1

So, let's try to explain this as clearly as possible. I have three gmail accounts, A B and C. A and B share a long, random and secure password, never used anywhere else. Account C has a relatively weak password. Account C is not used for any relevant stuff. Account A appears as a mailto link in my personal website, constructed using javascript, but a bot with a javascript engine can acces it easily get it.

And that's what I thought happened, when three days ago email account A started being spammed with registrations to many websites and mailing lists around the world. I thought some bot grabbed my address so I created gmail account D and proceeded changing my most important accounts to use account D, and warning people and contacts to send me mail to D instead of A.

But today, a few hours ago, I received a push notification on my android phone saying 'Somebody has your password', with a supposed login from my country, but hundreds of km from my location. This happened to accounts B and C, but NOT to A and D. Now is when I start being worried.

Turns out, my computer started lagging randomly when playing some games a while ago, as if the hard drive was malfunctioning. I have two drives in RAID 1, and both pass SMART tests as healthy.

My paypal and bank accounts are fine. No harm has been aparently done, but I am worried my personal computer (running windows 10) got compromised and somebody is 'preparing the terrain' to finally strike. I enabled two factor authentication on my google accounts and changed the password for websites where i have card information stored.

So what should I do to be sure my accounts are not compromised? What are your thoughts on the matter? I am really busy right now and completely reinstalling the operating system on my computer right now would imply a hugue loss of time and lots of stress. I do not know much about personal security and hacking despite being a developer.

UPDATE: Thank you for the answers. The hacker finally striked. It turns out they hacked some personal account with my credit card stored in it which I forgotten I had, and charged a ~1500 euro bill. Fortunately I catched it in time, since I was checking all the mails in my account being spammed in case it was due to something like this. To be sure, I cancelled and reissued all my credit cards and asked/warned my bank. No money was ever charged because I cancelled everything in time.

I ran a benchmark in my computer and indeed there is a faulty drive, also ran a scan with my antivirus software and everything seems ok.

Turns out account A was also accessed from that IP, so that would be all three accounts accounts I have on my phone, while my phone was using 3G, so maybe my carrier assigned my phone a far away IP? I don't know if that's possible, but I have enabled 2 factor in all my gmail accounts, so I think I should be safe without erasing my hard drive. Other people sharing my wireless haven't had any problems for now. I know fully erasing my computer is the safest option, and also not using backups to restore, but that would mean hell for me during at least a couple of weeks.

  • Enable 2-step verification on your gmail accounts ASAP. Bad guy will not be 'preparing the terrain' before the final strike, they will exploit your e-mail with as little observable interference as possible, until you lock them out. – Dmitry Grigoryev Jan 16 '17 at 11:19
  • Are you sure it is your PC that got hacked? If only the accounts you have on your phone got compromised, it would be safer to assume that its the phone. – Daniel M. Jan 17 '17 at 13:27
  • I doubt it, if any attacker had access to my phone they could have done so much. What's more, if they had access to my gmail account they would not had the need to spam-bomb my email address to try to steal from me. Since I have 2-step auth and nothing has happened since the attack I am closing the question. Thank you everybody for your help! – arkhell Jan 17 '17 at 22:03
1

Personally, these are the steps I would take if I thought my personal computer had been compromised enough that the traffic was being captured. The following assume you have a friend with non-compromised media.

  1. Go to a friends house and use their computer to login to all accounts and set them to new, secure, unique passwords. If 2 Factor Authentication is available do it. Bank accounts, phone bills, etc. etc. All of them changed.

  2. Wipe the personal computer with Darik's Boot And Nuke (DBAN) on a bootable flash drive created at your friend's with your friend's flash media

  3. Reinstall Windows from a fresh media created using friend's flash drive and computer.

  4. If you can be sure your backups haven't been compromised, restore from backup.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.