Gmail compromized?

[Hercules]

I was looking into a resting account. I opened up my gmail with a one letter missing mistake and I find this bogus gmail with 30 emails in it referring to mostly small buys from me and PP/ebay notices and questions. I checked the real PP and it was fine. The emails inside had my ebay user name minus one letter just like the gmail email address. I opened it up again so I didn't dream it. What happened?!! Should I change all my passwords on everything?!!!

[Hercules]

I can't understand this. My password works to get in the email. So if someone is using my info for there own account I know what could happen next. I care but theres no money in the paypal to speak of and it's all stealth. How did they get my password?

[Hercules]

It spooks me when no one answers. It usually mens I'm holding the bag and it's about to explode.

[pod]

are there actually transactions on your ebay and paypal that are not yours? Or just emails?

Spoof emails are nothing. spam, ignore - DO NOT EVER click on email links and enter password. EVER. go to main site, whatever it is and log in there.

But if someone is buying and selling with your ebay and paypal account you have been hijacked. you gave your password away some how.

Originally Posted by Hercules

Should I change all my passwords

Whenever you have a security concern, yes! It takes seconds so why wait around. just change to be safe.

.

[Hercules]

I feel it is a spoof email account like you said, but what I can't understand is how they got my password for the f@ke gmail account to match the real one? I changed all passwords including the spoof email to see a reaction. I only opened a few emails but they had little info. P.S. there are no transactions on my PP or ebay. If someone wanted to copy my seller account (almost) I don't see how that could effect me. I googled this for phishing but nothing like this around.

[pod]

Originally Posted by Hercules

I changed all passwords including the spoof email

You have access to the ⊗⊗⊗⊗ email account? They used the same password?

Then no doubt you gave up your account info somewhere. The odds of them getting the same password at random are zip. Whatever info was in that account is now in their hands.

I'm not sure if I understand completely... Are there REAL auctions and paypal payments using the gmail account that you did not setup? A real ebay seller account and a real paypal account? With your info?

If there are actual ebay sales and paypal payments using the same info on your account you are in trouble. If any of this info is real, or financial you need to run clean up, now. you may need to close everything up.

Check the auction numbers, search them on ebay and see if they are real acutions. Dont click links! Just copy the numbers

[Hercules]

I looked closer and it's all buying no selling. The emails look ⊗⊗⊗⊗ but really good. There are non payment notices and returns on Nikon batteries. The gmail name is the same too so someone got in but they never got my passwords on PP or ebay.I do have a bug that Kaspersky can't clean out and it's called mediplex. It blocks me from entering sites sometimes. Maybe it's a hint on what they may be really up to.

[Hercules]

I never really buy from ebay so I can't tell if they are real. But one was wrong because there was an inquiry of some sort. It has a " click hear to see item" instead of the auction listing description. What happens when you click inside suspicious emails? I never open anything without prior knowledge.

[pod]

Originally Posted by Hercules

What happens when you click inside suspicious emails?

It will take you to a page that looks exactly like the ebay, paypal, or whatever sign in page. Exactly. Sometimes they can look very good. Then you enter login and password, nothing happens, but they now have your login and password.

Even when I'm 100% sure its a real Paypal or whatever email, I never click on a link. Just by habit. I just go to main site and login.

If the guy is buying with your info that's not a good thing, at all. If its real info, then its really bad! You should contact ebay and say your info is being used fraudulently and have them shut down. When they get banned, it may come back to you and kill your account.

[Hercules]

I want to close my PP cause I want to use paymate on that one but that won't work either cause they all stay linked forever. Even if I call ebay it still won't work cause any suspension activity warrants a 'suspension first talk latter' mentality anyway. Anyone can come up with a story about a fraudster, but will ebay believe me? I think not.

[Hercules]

On the positive side, if it's a phishing trick it didn't work. The email dates are from 12/9 to 5/10 so they've been trying for a long time. They can't go in anymore cause I changed the password. All I can do is go about my business. The password is what's killing me. How could they possibly get that?

Could have got your password via keylogger. I'm paranoid about a keylogger hitting any of my ecommerce PCs. So I make damn sure I never use those PCs to browse other sites. I keep one PC in the DMZ and if it gets nailed, I just wipe it and restore last week's backup.

One PC to do everything EXCEPT ecommerce. Bunch of PCs that ONLY do ecommerce.

Never put your email or website address in your 'about me page'. Never include it in your listings (not even embedded in an image), unless you absolutely MUST in order to get paid via alternate means. If you do infact put the info in your aboutme or your listing, change those passwords frequently.

[Hercules]

'I just wipe it and restore last week's backup.' How do you do that.

[Hercules]

Oh and I have never had an 'about me' page or anything like that. This girl once called me, she was a seller too. Somehow she got my PH#. She was one of the largest pains I ever ran into.

When I first installed Windows and all the drivers plus browser (add-ons too) plus other softwares like paint shop and whatnot... I then made a full backup of that machine.

Then I just use it for all normal things like flash games, wikipedia, google searches, and visiting any site that is not ebay, PP, or directly part of business stuff.

At the end of the week, basically about 2:00am Monday, I make an incremental backup and burn it to a DVD.

If later in the week, I end up clicking a link that gives me some kind of e-blicki, I just restore the full original backup and the incremental backups.

For ease of use, you could just rely on the original installation full backup and skip the incremental stuff (you lose bookmarks, scripts, screen captures and other recent files and changes).

Making a backup the first time on a full windows install with extra drivers and additional programs will take however much time is involved with installation PLUS maybe an hour to make the backup. Burn time will depend on how many DVDs it takes and what speed you burn at.

My uncompressed base system is about 40 gigs. I back it up using Acronis and I choose the option to split the file into DVD size chunks (you can use Nero or whatever) in about 40 minutes. It takes 3 DVDs.

Instead of trashing an infected system and then digging up all my drivers and software keys which takes a long time, I just wipe the infected drive (don't format, it doesn't work and only wears out the drive) and then restore the discs in about 90 minutes.

Originally Posted by Hercules

'I just wipe it and restore last week's backup.' How do you do that.

You answer your phone for callers you don't recognize? Dang. Even if I recognize a number, it they didn't warn me by email, I don't answer.

Originally Posted by Hercules

Oh and I have never had an 'about me' page or anything like that. This girl once called me, she was a seller too. Somehow she got my PH#. She was one of the largest pains I ever ran into.

[Hercules]

It was on my very first account. Ha! Ha! everything was real and I still banged PP large without knowing a thing about my azz or my elbow!! Pure instinct and greed!

[Hercules]

By the way is there something a little less professional like you describe VIC to rid this PC of the phisher or is that the the way to go? If I change all passwords and serf on another PC could that be ok?

If you aren't going to wipe this particular PC, you should continue using this one for the open web stuff and move your ebay and PP stuff to a known clean computer. Then after those are on a new PC, change those passwords. If you change them before putting them on new PC, the potential keylogger would have the new passwords.

I have found that with the current rapid rate of keylogger evolution, none of the antivirus or antimalware programs can be relied on for anything. The best you can hope for is about 80% chance of avoiding infection. After an infection, you have nearly ZERO chance of getting stuff clean without it respawning within a day anyhow.

The best way to clean out infections is to use an application that wipes data and wipes freespace. Then restore a known clean setup. Wipe everything. Free drive space and even factory diagnostic data tracks can be used to hide a respawning infection.

Format does not format. Back in the days of MFM/RLL/ESDI drive types (back in the late 80's) drives did actually get formatted). IDE, EIDE, ATA, PATA, and SATA drives do not get formatted even when you give the command to format. The drive firmware translates the format instructions into something else. Those instructions will remove the first letter of the file name in the first FAT or analog. The second FAT or analog can be used to fully restore all data you thought you formatted. Changing all those file names will shred the heads in your HD and the magnetic signals will overheat the voicecoil used to move the head so rapidly for extended periods.

The reason there is still a format command is because so many people got used to it way back when. It isn't the same thing today as it used to be back then. A similar example would be the Chrysler 300. Back in the day, it was a whole different animal.

[Hercules]

When I backup my PC with my' HP simple save' does all that the stuff stored in it have the infection too?

If it was infected when you made the backup, it will be infected when you restore. If you made the backup when everything was clean, it will be clean if you restore to a fully wiped system.

Earlier post says you had the problem in 12/2009 which means you'd have to restore a backup from before that time.

[Hercules]

Thanks! I'm ordering on my new laptop from my suspended Amazon acc right now. Last time they sent me a book instead of a laptop, I sent it back and they reimbursed me.