Menoloopal - you know... ropable....fizzing...

Haven't had a steam-release for a while and most of you will by now have guessed that this one is triggered by this week's "skwirrill" attack - the email gremlin.

My public thanks to those who were sympathetic and supportive when the thing managed to burrow under my usually wide-eyed awareness of such things. Truly, as far as email stuff goes, till date, I have always spotted them and dealt with them accordingly. However, "skwirrills" are determined little rodents and those nuts are just too tempting.  They eventually do find a way to get to the stash.

This post is being put out for two reasons - one has just been served; majority folks seemed to pick there was something stinky and have evaded the nonsense and I am grateful for the handful who took time to 'talk' with me. It felt less lonely! The second reason is that some didn't pick it and what I would like to do here is highlight some stuff which I hope will be helpful in general. It is not to suggest that nobody knows how to handle these things, but for all my 'techy-nose' I came to realise through all the carry on yesterday that there is an enormous amount of stuff on Google of which the average user is probably unaware.

I am not going to produce a whole lecture about 'do this, do that'; rather, I am going to share my process, add in a few useful links, and hope that some of it may prove interesting.

...it was a dark and stormy night.... 

brawwahahaha, just kidding.  It got dark and stormy all around YAM though, when it dawned that there had been an unsolicited visitation.  All unsuspecting, an email arrived Tuesday, from an ex-colleague in Sydney. There was no 'Dear...', but this is not always used by some correspondents. What I will point out at this juncture, is that the language of the email was not so very out of the ordinary for the person it purported to be from, so nothing in that set off any signals in my head. Additionally, there was a level of interest, knowing her to be a photographer.

This was probably a bit of a fluke, but it is the reason I did not, for once, take precautions. On reflection there were two key pointers (other than the link out) to which I could have been paid more attention; the multiple names to whom the email had been sent included some which might have triggered concern (insurance company for example?!) and also that there was, I now realise, no sign-off at all.

Hindsight, eh?  Needless to say, I had clicked the link then had that moment of "oh no wait a minute"!!! Nothing happened. Or so I thought. I duly emailed, as many of you, my dear pals, did to me...  'Sorry link not working'.

That was late Tuesday. Wednesday morning the storm arrived. Not only had there not been any response from what was clearly now a bogus correspondent, but there were no emails at all. An empty inbox is unheard of at the YAMster's hutch. Immediate alarm. Checking the blogs easily revealed that comments had been left - but they had not arrived in email. This could not be so. Then two did arrive and it confirmed the already dreaded situation. Something interesting was on them though... they had already been 'labelled' as trash.  Not by me. The light went on... and sure enough when I looked at the trash label, all the emails I would normally see had been routed directly there. Only two correspondents got through to my inbox and it was on looking to send off an alert email that it was realised why.

The contacts box had been stripped of all but those two addresses!  Why they survived is a total mystery. One or two of the mis-placed emails were making their own suggestions as to actions - which of course were exactly what I knew to do, but nonetheless I am most grateful to the concerned.

A key one was, of course, to alert all who may have received something 'from YAM'. What was becoming clear was that the message was adapting somewhat and a couple of folk have said that they got secondary messages also and these were seeking passwords and such.  This didn't happen to me, so it is entirely possible that there was a second nasty piggy backing on the first, which didn't actually route through my email at all.

Okay. Damage done.  What to do?  Changing the password is the first and obvious - but take note, doing that first is not sufficient. Once all other remedies have been applied, the password must be changed one final time. What remedies?

As my contacts list was entirely wiped clean, I opted to put up the emergency post here and also an alert post for my circles in G+ pages. Not everyone would be receive these in timely fashion, but at least it was the best attempt in the circumstances. Each and everyone of us will have a set of procedures, I am sure, for dealing with such emergencies. Neither is everyone necessarily tied to Gmail. However, I found some fascinating things that would have remained hidden had I not followed my intense curiosity and I would like to share some now... even if you are not Google users, there will be similar stuff in the various other sources out there.

Let it be known that Google help pages actually do.  To be honest I have had frustrations with them on other matters. This time though, they came up trumps. Knowing what to ask for is sometimes the hurdle. I decided to focus on the loss of contacts first. Straight to it!

Turns out the giant has up to 30 days backup in place for these things so was instantly able to bring back all my contacts - 130+, so rather needful!  Fine.  What next? Well, using the search gmail help box which was now available I asked 'why are my messages going to trash instead of inbox?' and got this page. Some of you, I am sure, knew about filters but, I am betting, many don't! Apparently, there are folk out there who like to have gmail do their labelling as the messages come in. It never occurred to me. Those of you who use POP/IMAP to reroute from non-gmail servers may have filters in place. Read a bit more about filters here.

How to know if there is a filter? Click the 'cog' at top right of your gmail page and then select settings from the drop down list.  It will reveal this...

See those labels across the top in blue? Click the Filters tab and hey presto... What did YAM find? Something she knows she most definitely did not put there herself. At the end of a long list of alpha-numeric soup there was the word 'delete'  and somewhere amongst it was the 'if inbox then' kind of instruction which was enough for me to know it was up to mischief.  I did my own 'delete with prejudice' upon that line of rubbish.

Emails started appearing in their rightful place again! I then changed my photo and updated my 'signature' again. This was not enough for me though.  All those tabs up there got me wondering... lots of different reading was taken up then in the Google helps, but this ONE PAGE is extremely useful, because from it, one can find a good deal of worth and interest.  Clicking the Google Accounts Settings alone brings lots to light. Do yourselves a favour; have a read.

Some of you will be wondering 'did she scurry away and go wild changing all sorts of other passwords?'  No, actually.  The reason being that this was clearly, in my case at least, entirely email-based.  It was designed to create maximum mayhem yet with minimum damage. Nothing occurred at my side with regards to 'phishing' for details; though it is worth mentioning that there are other measures in place on all sensitive items anyway. Also, for those same sensitive items, regular changing takes place and there was nothing showing up as unusual activity there.

On the matter of activity - regarding gmail/google at least, on the bottom right corner of the gmail homepage you will see (in rather small lettering) "last account activity" and a figure of time (30 minutes for example). You can click here and see what you've been up to.  At the bottom of that listing the IP address your computer is using will be designated. Also which browser you are using. Most of us favour one or another. Mine is Chrome. Then you will notice immediately if another place is busting into your territory. I immediately discovered that there had been an entry via Firefox. A browser I have never used. However, it did appear to have done so via the same IP address.

In that ONE PAGE you will note there is also a 'Google Dashboard'.  This shows all the things where your presence is open online.  Page down this and you will see 'Contacts'. I don't know about you but this was a revelation!

All contacts from G+ and Gmail are collated here.  There was a function for merging like-addresses. This process revealed to me that there was a phantom address BUT IT WAS TITLED AS ONE OF MY SISTER'S!!!!  Needless to say merging did not take place.  The 'more' button at left was clicked to reveal 'send feedback' and used that to highlight the problem address and sent that off to Google. Now they are not likely to respond directly to me as an individual, but at least they are now aware of this - and if others among you followed through and found similar I would encourage you to, likewise, send the feedback.

After all this, I again changed my password before signing out for last night.

You see, then, that I had yet another lengthy time of i'net research engendered by naughty chappies having nothing better to do with themselves.

Rant over.  Thanks for 'listening'.  YAM xx