Clients email password keeps getting changed

[drjones]

I have a client that uses a small email provider for basic POP access.

They have around 10 users.

One in particular will randomly lose access to his email; I called the email provider the first time it happened & they said this users' password was changed to some random, long string of numbers & letters, probably maliciously. The provider is able to see each users' password, while I in the admin control panel, cannot.

Anyway, this has been happening more & more frequently to this user & I keep having to reset his password to what it was before. He uses Outlook on his work PC, and an iPhone

Just happened again today, and also to another user who only uses webmail.

This clients' network was hit with a pretty bad worm virus back in Dec. 2012 or so....I guess there is a slight chance of some remnants on these two computers.

What do you think is the source/cause? A virus still on the machines, or is it the provider getting hacked?

Thanks

 

[mraikes]

... snipped... I keep having to reset his password to what it was before. He uses Outlook on his work PC, and an iPhone ...snipped...

Does it still happen if you change his password to a new one, rather than what it was before?

 

[drjones]

Does it still happen if you change his password to a new one, rather than what it was before?

Good question, I don't know. Next time it happens I will try that. Though I will still recommend a replace or upgrade to 7, as both computers in question are still on XP.

 

[brandonkick]

I would be inclined to think that it's due to an infection.

What type of antivirus protections do they have?

Web players up to date?

Microsoft Updates current?

Good browsing / usage habits (nothing like torrents... ect..?)

Browsers up to date?

Do they have a UTM device?

It probably is a good idea for him to go to a new and secure password. A good mix of letters, numbers and symbols should be fine. Throw in some upper and some lower case letters.

 

[nlinecomputers]

Does it still happen if you change his password to a new one, rather than what it was before?

Bingo. The hacker knows the old password. NEVER use an old password if you've had any kind of breach. That's ought to be common sense.

And I'd do change of ALL the email passwords on the system not just the effected user. Assume the worst that the whole place was compromised.