[Taxacom] Deceit

[Karl Magnacca]

A useful feature that Gmail has for these unfortunate situations is
that on the bottom right of the inbox screen, it says "Last account
activity: X hours ago" and a link that says "Details".  If you click
on Details it will show you the IP address of anyone who has logged
into your account, when, and if they downloaded your messages using
POP3.

If this has happened again after changing your password to a secure
one, you should check your computer deeply for a keystroke logger,
using both an antivirus program and an anti-malware program like
Malware Bytes.

Karl

Dr Gurcharan Singh <singhg at sify.com> wrote:
> Dear Mikolas
> It seems the reply path of your gmail settings is set by hacker as
> dolomiticola at mail.com instead of dolomiticola at gmail.com
> So first thing you do is go to settings-->account and locate that
> below
> your gmail email ID there is reply mails to dolomiticola at mail.com so
> all
> replies to your mails are going to him. locate edit at right of
> entry,
> click edit and simply delete this fake reply email ID. Save, change
> your
> password, logout and login with new password. It is likely that
> hacker has
> deleted your addressbook (contacts). import them back if you have
> them
> ready on your computer. In future always keep backup of contacts as
> csv
> file on your computer for such occasions.
>
> Gurcharan Singh
>
>
> On Fri, Sep 20, 2013 at 8:27 AM, Dr Gurcharan Singh
> <singhg at sify.com> wrote:
>
>> Yes this has happened with many persons including me.
>>
>> The hacker is likely to do three things
>> 1. Send distress mail from your account.....(You can't do anything
>> about
>> it except warn your contacts, change your password, logout and
>> login with
>> new password)
>> 2. Change reply path to some fake email ID very similar to yours,
>> but @
>> mail.com or yahoo.com, so that all replies (who volunteer to help
>> the
>> person) go to that hacker. (Immediately go to
>> settings----->account, see
>> edit inf on right of your email id and delete that fake reply
>> path. Save
>> changes.
>> 3. He may delete your address book so that you can't warn your
>> contacts.
>> (always keep a csv file of your computer ready on your computer
>> (you may
>> export it from your contacts in gmail), and import it immediately
>> should
>> the situation arise.
>>
>> Please keep in mind the vague mails you receive. The likely
>> culprit is
>> mail from Google ++ (this only is google, if you just click the
>> reply
>> button to check reply path (and not reply) you will find a vague
>> email id
>> and a fishy website-your antivirus software may warn you) with
>> subject line
>> "Restore your messages". If you click the link restore messages,
>> you are
>> caught. The hacker gives the same address in Lisbon, Portugal, to
>> any one
>> who responds to help.
>>
>> Gurcharan Singh
>>
>> Gurcharan Singh"
>>
>>
>> On Thu, Sep 19, 2013 at 11:32 PM, Vlastimil Mikolas <
>> dolomiticola at gmail.com> wrote:
>>
>>> If some members of Taxacom got news from me I am in Lisboa in
>>> bot.confer.
>>> ... I neeed money.,. etc. It is deceit. Hacker already 2x
>>> penetrated to my
>>> box and send mails to hundreds of subjects ! Thanks
>>> Best regards,
>>> Vlastimil