3

I use Gmail for my office. My account was hacked. (Two days ago I received an email from an otherwise trusted source stating that he had files in Dropbox to share. I bit. No files. Dumbdedumbdumb.) Next day, the immediate world had received emails from me offering to share files in Dropbox. I changed my Gmail password a few times, and made sure no other user had access. I also ran my Norton 360 scan, which came up clean. All emails received since the hack have come into my Trash folder, not my inbox. I checked the filters -- nothing changed.

Any suggestions for how to resume receiving legit messages in the inbox?

4

Suggestions:

  • Go through all the Gmail settings, e.g. "Inbox type." Under "Accounts and Import", there are settings to grant others access to your account and mark conversations as read when opened by others.
  • Check "Forwarding", "POP Download" settings, and "IMAP access" settings, too.
  • Review all the filters again or delete & recreate them.
  • Disable all Labs. Remember which ones were turned on in case you want to restore them again after things are cleared up. Or try the Labs escape hatch URL which opens GMail with all Labs turned off.

I highly recommend using Google's 2-Step Verification to make your account more secure. It does make things more complicated.

2

If this Symantec blog post about a phishing scam targeting Dropbox users sounds like what happened to you, I'd recommend you do the following:

  1. If you entered your Dropbox and/or Gmail password to 'access the shared files', change both passwords immediately.

  2. If you re-use the affected password(s) on other websites, change those immediately as well.

  3. Ensure that your emails aren't being forwarded to unknown parties by looking under Forwarding and POP/IMAP tab in Gmail settings. If you don't use forwarding, disable it. Additionally, also disable POP and IMAP if you don't use them.

  4. Check the Accounts tab and look for any email accounts that you don't recognize as your own and delete them.

  5. Check the Filters tab and look for email filters that are forwarding incoming mail to unauthorized email accounts (press Ctrl+F and search the Filters page for Forward to to highlight such filters) and delete them.

  6. Look for filters that delete incoming mail by pressing Ctrl+F and searching for Delete it in the Filters page. Such filters may look like:

    Matches: from:(*)
    Do this: Delete it
    Delete those filters.

  7. Under the General tab in Gmail settings, check your signature and the Vacation Responder message just in case the crook may have turned it on and modified it to include a fake email address.

  8. Check for suspicious sessions in your Google account's Devices & activity page and end any unauthorized sessions.

  9. Check last account activity for your Gmail account by clicking on the Details link at the bottom of every Gmail page. Look for unauthorized logins here and if need be, click the Sign out of all other web sessions button.
    Account activity

  10. If you didn't previously have 2-step verification enabled, check that no unauthorized phone numbers were registered with your Google account here.

  11. Do the same with your Dropbox account. Review security settings and ensure that no unauthorized phone number is registered with your Dropbox account. Review the Sessions and Devices sections and remove unauthorized entries. Also revoke access for linked apps that you don't recognize in the Apps linked section. Lastly, check the Links and Sharing sections to see that unauthorized parties don't have access to your Dropbox files.

  12. Finally if you haven't done so already, consider enabling two factor authentication for both Dropbox and Google (and any other services you use that support it).

1

If you don't have any "bad" filters, the other thing I'd check is to see if there are any apps that have access to your Gmail account.

Go to https://myaccount.google.com/ and scroll down to "Connected apps and services". Click "View All". Make sure the apps and devices you're expecting are there, and that anything you're not expecting is immediately suspect. For safety, I suggest "revoking" anything you don't recognize. (In case it was something you wanted to have, you should be able to re-connect later.)

If that doesn't help, then I can only imagine that your account is munged/blacklisted. All you'll be able to do is keep restoring it to your inbox (and choosing "Not Spam" where appropriate).

0

Under setting chose Filters and Blocked Addresses. If a strange looking address is applied to all incoming mail, delete it. Change your passwords too.

-1

Check this page: Gmail > Settings > Filters. There, if you find anything even a (.)(,)(*) - delete it. I found my own email address there.

filters page

protected by Community Aug 15 '16 at 22:57

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.