So, let's try to explain this as clearly as possible. I have three gmail accounts, A B and C. A and B share a long, random and secure password, never used anywhere else. Account C has a relatively weak password. Account C is not used for any relevant stuff. Account A appears as a mailto link in my personal website, constructed using javascript, but a bot with a javascript engine can acces it easily get it.
And that's what I thought happened, when three days ago email account A started being spammed with registrations to many websites and mailing lists around the world. I thought some bot grabbed my address so I created gmail account D and proceeded changing my most important accounts to use account D, and warning people and contacts to send me mail to D instead of A.
But today, a few hours ago, I received a push notification on my android phone saying 'Somebody has your password', with a supposed login from my country, but hundreds of km from my location. This happened to accounts B and C, but NOT to A and D. Now is when I start being worried.
Turns out, my computer started lagging randomly when playing some games a while ago, as if the hard drive was malfunctioning. I have two drives in RAID 1, and both pass SMART tests as healthy.
My paypal and bank accounts are fine. No harm has been aparently done, but I am worried my personal computer (running windows 10) got compromised and somebody is 'preparing the terrain' to finally strike. I enabled two factor authentication on my google accounts and changed the password for websites where i have card information stored.
So what should I do to be sure my accounts are not compromised? What are your thoughts on the matter? I am really busy right now and completely reinstalling the operating system on my computer right now would imply a hugue loss of time and lots of stress. I do not know much about personal security and hacking despite being a developer.
UPDATE: Thank you for the answers. The hacker finally striked. It turns out they hacked some personal account with my credit card stored in it which I forgotten I had, and charged a ~1500 euro bill. Fortunately I catched it in time, since I was checking all the mails in my account being spammed in case it was due to something like this. To be sure, I cancelled and reissued all my credit cards and asked/warned my bank. No money was ever charged because I cancelled everything in time.
I ran a benchmark in my computer and indeed there is a faulty drive, also ran a scan with my antivirus software and everything seems ok.
Turns out account A was also accessed from that IP, so that would be all three accounts accounts I have on my phone, while my phone was using 3G, so maybe my carrier assigned my phone a far away IP? I don't know if that's possible, but I have enabled 2 factor in all my gmail accounts, so I think I should be safe without erasing my hard drive. Other people sharing my wireless haven't had any problems for now. I know fully erasing my computer is the safest option, and also not using backups to restore, but that would mean hell for me during at least a couple of weeks.
