[Attilla the Bun]

Hi,
A couple of days ago, people started getting spam emails alleging to be from my primary email address. I access the internet via BT, (which uses BT Yahoo for email) and I use Thunderbird from my PC, but more often access my email via BT webmail from my netbook.

I spotted it before people started telling me, as I got two to my work email, which I occasionally send documents to from home, and also to my one of my two secondary email addresses, which I had occasionally emailed from the primary one as a test. The emails I got had been addressed to three or four other email addresses alphabetically adjacent to mine, and included people I haven't emailed for many years and in one case, an incorrect email address that I had attempted to email but had bounced back. Some of the addresses were people I hadn't emailed for 6 or 7 years, and had cleared out my 'Sent' and 'Deleted' boxes since then, but Thunderbird must have the emails saved somewhere, because when I tried searching for one of them in my sent folder, several emails I had sent to him popped up even thought they weren't apparently deleted - this is disturbing, does it mean it someone has got into some stored Thunderbird folder on my PC?

The emails were sent out at a time when I probably had one or the other switched on, but I can't remember which; I have Malwarebytes and Superantispyware, which I've updated and run complete scans on both computers, and also Avira, and all three found nothing. The spam messages weren't in the 'sent' folders of either Thunderbird or my webmail; if I copy and paste the email address, it is mine, but I clicked on 'viewed source' and the isp they were sent from obviously wasn't mine. I copied all that information into a word document and saved it.

I've changed the password on my primary account but I don't know what to do next; there don't appear to have been any further emails after the original ones (so far) but I don't know how it happened, and I'm not convinced that there isn't something lurking on my computer.

Please can you help?

[Advertisements]

My account was compromised again today, it is apparently part of a big attack on Yahoo email, which BT uses.
I still can't find any virus or malware on my computer, but it must be there somewhere

[Attilla the Bun]

My account was compromised again today, it is apparently part of a big attack on Yahoo email, which BT uses.
I still can't find any virus or malware on my computer, but it must be there somewhere

[CompCav]

Actually changing your password will usually solve this problem if you change it to a longer harder to guess password. We are seeing a lot of this with yahoo. Apparently it is very easy to use a password guesser program on yahoo so any password with fewer than 7 letters is easily guessed. They have now started offering a two stage logon which might help.

I went through several systems which had yahoo mail spam and couldn't find any malware on the system. It was only after we changed the password to have 8 letters or more that the spam stopped.

[Attilla the Bun]

Thank you very much, that is a great relief!

I actually had an eight-letter password originally, and a ten-letter password the second time, both times a combination of letter and numbers. Since I have added the second stage to my password, I seem to be ok (so far).
Although I have two subsidiary accounts (which had the same original password as my primary account apart from the numbers), they were not attacked, for some reason. Have changed those as well!

Hugely unimpressed with BT over this - the problem has apparently been going on for a couple of months at least, and at no stage were their customers warned of the risk, or given any advice; when I phoned them for help, I was told that they were 'actively working with Yahoo on the problem' but not to apply the second stage to my password.

Thanks again for your help, CompCav, I can always rely on Geeks to Go!

[CompCav]

[Attilla the Bun]

Hi, Sorry to come back and pester you, but had a thought.
One thing is still worrying me re whether there is a virus on my computer: how did the hacker get hold of the email address that was incorrect (the email had never been sent) and the ones that I haven't email for 8 or 9 years, if not from finding them stored in my computer?
Did you mean that someone had got into my computer, taken the details of everyone I had ever emailed since I first started using Thunderbird and gone away without leaving anything behind?

[CompCav]

Did you mean that someone had got into my computer, taken the details of everyone I had ever emailed since I first started using Thunderbird and gone away without leaving anything behind?

They got stuff that was available at Yahoo once they broke your password. As long as the address was in your address book it was online for your account. Unless you are having other issues it is highly unlikely they got anything directly off your computer.