I have multiple Gmail accounts. There's this particular Gmail account which I have not signed into for a pretty long time. The forwarding address for this Gmail account is set to my MAIN Gmail account, which I use on a daily basis.

Suddenly today I got a message that a suspicious sign in was prevented for this account. This was extremely weird as I had not signed into that account for quite some time.

I checked the IP address from which the sign-in was made, and surprisingly, the IP address was in the same range as the one I currently had (it's a dynamic IP from my ISP). The sign in had most probably occurred from my own computer, as I'm pretty sure there are no hackers around here where I live!

This led me to conclude that my computer was infected with malware. But it's still pretty baffling why that PARTICULAR Gmail account got signed in, as there were no cookies in my computer for signing into that account, and the password was simply stored in one password manager.

Did someone deliberately get that account details from my password manager (Keepass) and try to sign into that particular account?

Seems pretty scary! For that to happen, someone had to know that I managed my passwords using this particular password manager and that the file was stored in this particular place on my computer. Someone had to be watching my activities.

I did a quick scan with Malwarebytes a removed a supposed Trojan (precomp042.exe) and two other files from azlyrics.com. Don't know if these were the issue.

Maybe the whole thing was an error from Google's side, or maybe someone is watching me type this?!

Can anyone please provide some light on my situation?!

  • Password managers are a juicy target and have been known to be targets from recent malware. This is far from a complete response, but an important consideration.
    – blaughw
    Jan 29 '15 at 15:52
  • Its very unlikely Google is warning you in error. The history of addresses which have accessed your account can quickly be replaced by normal traffic. You should take this warning seriously.
    – Ramhound
    Jan 29 '15 at 15:53
  • "Can quickly be replaced by normal traffic" - Can you explain what this means?
    – Vikram
    Jan 29 '15 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.