"I sent you an email from your account" removal guide
What is "I sent you an email from your account"?
"I sent you an email from your account" is a spam email campaign (scam) used by cyber criminals who threaten to proliferate compromising/humiliating videos of recipients if their ransom demands are not met. This is a common scam, and one of many similar versions. If you receive this email, simply ignore it and do not believe any of the statements within the message. The email is proliferated via an "email spoofing" method used to falsify the sender's email address. In this way, scammers behind this email make it seem as if the recipient of the email is also the sender.
Cyber criminals claim that they have gained full access to the recipient's email account and obtained the password. It is also stated that the computer is infected with a trojan that allows them to change the password at any time (even if the user creates a new one). According to these scammers, this trojan was installed when the recipient visited an adult website. Furthermore, they state that they are capable of controlling the recipient's computer remotely, monitor activities in real time, turn the camera and microphone on, etc. People behind the "I sent you an email from your account" scam claim that they have, at some point, recorded a compromising video that will be sent to all of the recipient's contacts, unless $780 in Bitcoins is transferred to a provided Bitcoin Wallet within 48 hours. Furthermore, they also threaten to proliferate the video if the ransom email is shared with any other party. All statements regarding recorded videos, trojan infections, stolen data, etc. are false. Scammers send these emails to thousands of people hoping that some will fall for it. Never trust this or other similar scams.
|Name||I Sent You An Email From Your Account Email Scam|
|Threat Type||Phishing, Scam, Social Engineering, Fraud|
|Fake Claim||Scammer claims that he has infected victim's computer with a trojan and used it to record a compromising video. He also claims to have access to various recipient's accounts (including email).|
|Cyber Criminal Cryptowallet Address (Bitcoin)
||19Q3HZtnznuB5cuWng8cacwqZV13gNpZaN, 1J9iAfnHhvhhMrP7c8n3bmvWh6CcjjynUt (cyber criminals change their cryptowallet addresses with each new spam campaign).|
|Symptoms||Received an email that threatens to send supposedly recorded video of user watching adult videos to family members and colleagues. Email(s) in the inbox state that ones passwords have been stolen.|
|Distribution methods||This scam is spread wide via spam email campaigns.|
|Damage||Monetary loss - completely unnecessary payments for fake claims about hacking and in reality non-existent video recordings.|
To eliminate possible malware infections our malware researchers recommend scanning your computer with Spyhunter.
Examples of other similar spam campaigns include Looked At You For Several Months, I Am A Spyware Software Developer, and So I'm The Hacker Who Broke Your Email. Scammers who spread these emails simply attempt to trick people into paying ransoms so that they do not reveal various photos or videos (they actually do not exist). Another type of spam email campaign aims to infect recipients' computers with high-risk viruses such as TrickBot, Emotet, AZORult, Adwind, etc. These emails infect computers through attachments or links associated with Microsoft Office documents, PDF documents, archive files (ZIP, RAR, and so on), executable files, etc. Opening these attachments leads to installation of malicious programs that often spread other infections or steal personal data (banking details, various passwords, logins, and so on). Having these programs installed can lead to financial loss, privacy issues, problems with browsing safety, or computer infections with other viruses such as ransomware.
We receive a great deal of feedback from concerned users about this scam email. Here is the most popular question we receive:
Q: Hi pcrisk.com team, I received an email stating that my computer was hacked and they have a video of me. Now they are asking for a ransom in Bitcoins. I think this must be true because they listed my real name and password in the email. What should I do?
A: Do not worry about this email. Neither hackers nor cyber criminals have infiltrated/hacked your computer and there is no video of you watching pornography. Simply ignore the message and do not send any Bitcoins. Your email, name, and password was probably stolen from a compromised website such as Yahoo (these website breaches are common). If you are concerned, you can check if your accounts have been compromised by visiting haveibeenpwned website.
How do spam campaigns infect computers?
Spam email campaigns that contain malicious attachments can only affect systems when an infected attachment is opened (or executable file is executed). Therefore, these emails cannot proliferate malware without the manual intervention of the recipient. For example, if the attachment is a Microsoft Office document, it must be opened and permission to use macro commands given. Once this is done, malicious MS Office documents are able to download and install various computer infections. If the attachment is an archive file, it will probably contain an executable file that needs to be executed before it can do any harm.
How to avoid installation of malware?
If there is an email is received from an unknown/untrustworthy address or the email context seems irrelevant/does not concern you, do not open the presented link or attachment. Do not download software from dubious, unofficial websites (or other sources), using third party downloaders, peer-to-peer networks, and so on. Install/download software carefully: check all available settings or options (such as "Custom", "Manual") and deselect additionally-included apps that you do not want to download/install. Never use third party, unofficial (fake) software updaters, since these often install viruses rather than the updates. Use functions and tools provided by official software developers. Use Microsoft Office versions that are no older than 2010. Later versions have "Protected View" mode that can prevent malicious attachments from downloading various infections. If you have already opened malicious attachments, we recommend running a scan with Spyhunter for Windows to automatically eliminate infiltrated malware.
Text presented in the "I sent you an email from your account" email message:
Subject: You password must be need changed
As you may have noticed, I sent you an email from your account.
This means that I have full access to your account: On moment of hack your account has password: *********
You say: this is the old password!
Or: I will change my password at any time!
Yes! You're right!
But the fact is that when you change the password, my trojan always saves a new one!
I've been watching you for a few months now.
The fact is that you were infected with malware through an adult site that you visited.
If you are not familiar with this, I will explain.
Trojan Virus gives me full access and control over a computer or other device.
This means that I can see everything on your screen, turn on the camera and microphone, but you do not know about it.
I also have access to all your contacts and all your correspondence.
Why your antivirus did not detect malware?
Answer: My malware uses the driver, I update its signatures every 4 hours so that your antivirus is silent.
I made a video showing how you satisfy yourself in the left half of the screen, and in the right half you see the video that you watched.
With one click of the mouse, I can send this video to all your emails and contacts on social networks. I can also post access to all your e-mail correspondence and messengers that you use.
If you want to prevent this, transfer the amount of $780 to my bitcoin address (if you do not know how to do this, write to Google: Buy Bitcoin).
My bitcoin addresses (BTC Wallets) are: 19Q3HZtnznuB5cuWng8cacwqZV13gNpZaN, 1HPhZrmyevkNXKo1MYnZG1A65p2PtyEpqc, 18kXxMp9NuTMUFVAfXR4TFT4CrrHWVzwm4, 1PNpAXTo6jh4V9dhXRvimNYqPYjvZEnQiu, 16LBDius3vg6ufFvnc7PGXfiTZgphuZgr5, 18eBGkYam1wjz1S77jz3VmADuYYFzhA3vB, 1BPUUNghhuwQjDDvFd3TnJz2ato5dyDLr8, 1DrCbXWfTqJbaiak2wjGUQiEo1WBzCBnof, 1GEhuEajkFXVe7vhtZqy1hRLdCaguhWBC2, 19rvCcYfSwPUSvJJKNyTyRFi5vxt6zaqJC, 1KeCBKUgQDyyMpaXhfpRi2qUvyrjcsT44o, 1Jh1miFmhTmGQvn6Zejaqg85viD4k1vVjG, 142e8SgyTLnkvwkDkNNon9jMtKY4UDvQqr, 1GoWy5yMzh3XXBiYxLU9tKCBMgibpznGio, 1GdSHQ4aE7zUD8HDqVJDEwU9dxn3LfJLMK, 1N5PXJHzJFyFfyqd32Gn9FZsVzNz8hqjqs, 1JBFFHR8tGiMgYLpnZCVG8n4cSpm591urc, 14tfS3yWL2cABhXVJZ97XRhuDXC69aWH6Y, 1N6dubqFmnyQ2qDWvi32ppVbc3kKMTYcGW, 1DHymxN8JqSwECGLPVbRMVWXrod8vvii5A
After receiving the payment, I will delete the video and you will never hear me again.
I give you 48 hours to pay.
I have a notice reading this letter, and the timer will work when you see this letter.
Filing a complaint somewhere does not make sense because this email cannot be tracked like my bitcoin address.
I do not make any mistakes.
If I find that you have shared this message with someone else, the video will be immediately distributed.
Another variant of "I sent you an email from your account" email letter:
Text presented within this mail:
subject: Your account has been hacked! You need to unlock.
I know the ********, this is your password, and I sent you this message from your account.
If you have already changed your password, my malware will be intercepts it every time.
You may not know me, and you are most likely wondering why you are receiving this email, right?
In fact, I posted a malicious program on adults (pornography) of some websites, and you know that you visited these websites to enjoy
(you know what I mean).
While you were watching video clips,
my trojan started working as a RDP (remote desktop) with a keylogger that gave me access to your screen as well as a webcam.
Immediately after this, my program gathered all your contacts from messenger, social networks, and also by e-mail.
What I've done?
I made a double screen video.
The first part shows the video you watched (you have good taste, yes ... but strange for me and other normal people),
and the second part shows the recording of your webcam.
What should you do?
Well, I think $635 (USD dollars) is a fair price for our little secret.
You will make a bitcoin payment (if you don't know, look for "how to buy bitcoins" on Google).
BTC Address: 19rvCcYfSwPUSvJJKNyTyRFi5vxt6zaqJC, 1J36BsmxdqhuJhaSftiTc3MqEhmgdwcCNT, 1CZVUZa4sJrzQX5mBLucdgAMeVvkaj2dmv, 1MrUDSrZiqD3ijxsBUPt2SukoFy534orP2, 15G9wyGRDssFXsfwEm1ihdJs2xabVPDu68, 142e8SgyTLnkvwkDkNNon9jMtKY4UDvQqr, 1NL9MTdnTxsVxEg9nHeY5oiw5U9Mxzsh8v, 1DASN5fH1E1PCoxU9qMEF7QDjnXcA2b3Km, 1GoWy5yMzh3XXBiYxLU9tKCBMgibpznGio, 1B3Lx1t4CQSt3ck85bqzGHC9TeEQGANhUR, 19qqYeGgbzhT8Lic5WsbDZgJkzAy82R6fF, 1EHDCx1rXd7w6SguvcneeotsPhyDaetGKm, 14H8TULh8pw6RDB897Shtx88jobVu3RaVU
(This is CASE sensitive, please copy and paste it)
You have 2 days (48 hours) to pay. (I have a special code, and at the moment I know that you have read this email).
If I don't get bitcoins, I will send your video to all your contacts, including family members, colleagues, etc.
However, if I am paid, I will immediately destroy the video, and my trojan will be destruct someself.
If you want to get proof, answer "Yes!" and resend this letter to youself.
And I will definitely send your video to your any 19 contacts.
This is a non-negotiable offer, so please do not waste my personal and other people's time by replying to this email.
Yet another variant of this email spam campaign:
Text presented within this letter:
Subject: Alert! Your account was hacked!
As you may have realized, I mailed you this e mail from your own account.
This shows that I have complete access to your account and your device.
I've been observing you for several months now.
Reality is that your device was taken over with a malware via a site that you visited.
If you are not familiar with this, I will explain.
My Trojan Virus grants me full access and control over a pc or other system.
This means that I can see everything on your screen, turn on the cam and microphone, but you don't know about it.
I additionally have access to all your contacts and all your correspondence.
Why did your anti-virus did not detect it?
Answer: My virus uses a driver, I up-date its signatures every four hrs so that your antivirus is silent.
I made a clip revealing how you satisfy yourself in the left half of the screen, and in the right half you see the video that you watched.
With one click of the mouse, I can deliver this clip to all your emails and contacts on social networks.
I can also post access to all your e-mail correspondence and messengers that you use.
Picture how this will affect your social life and the relations with your family members!
If you want to avoid this, transfer the amount of $650 (USD) to my bitcoin address (if you do not know how to do this, use Google or bing: "Buy Bitcoin").
My bitcoin address (BTC Wallet) is: 1KuAR7Vh2kYPQENAG6JbrmnGYySmUcLtu4, 1K7nnDHosR5czKZtuKT928YSxXXNSaDK6H, 1C2EbKJCZKtHMJawxBqyzZ9SHQVwRyfist, 1C1ehibCgeuLwF4VbSAzoDapDLbKtjivbP, 18yTDtmrUeRAdjC2gNscnbV6Dfn6UUsaMk, 14bscQz6FSjUyUgEv5NxjeKUFtY3yR1cCu, 16htiAFUVMXCsUMfvpPJFUuGRyvtxw1To9, 1HouKKY29benTnpiP2vVdLcKamN4NJrksk, 1NiXnj8DcDTnawYqz57GeVRMxw6WDTy3ba, 15bbfkGkNMjz857G5ya4RNRo5dWb1dRsxR
After receiving the payment, I will erase the video and you will never hear me again.
I give you 24 hours to pay.
When you opened this message a timer activated and is now counting on my server.
Filing a complaint anywhere does not make sense simply because this email can't be tracked like my bitcoin address.
I do not make any errors.
If I discover that you have revealed this message with someone else, the video will be immediately delivered.
A new variant of this email scam - trying to evade email spam filters by separating Bitcoin address into two separate lines:
Text presented in this variant:
Subject: Your device is hacked!
Did you notice i've sent you this email using your own private e-mail address? This means i posses FULL access to your device! I will tell you just how i did all this. A bit of time in the past you paid a visit to various xxx internet sites, one of these websites was injected with a backdoor i developed. This backdoor installed itself upon your platform and provides me full access to every one of your accounts, e-mails, data, contacts and so on.
Do not be concerned, further in this email i will inform you about what action you have to take.
While you checked out these adult websites i initiated your webcam and taped some video clips and took a number of screenshots of you while you "pleased yourself".... if you know what i mean.
So here it is, i have accessibility to your mail addresses, to your system, i have some quite compromising images and clips of you and i posses every one of your email and social media contacts. It doesn't matter how many times you change your password, my backdoor will invariably allow me full access to your system.
Now you can perform 2 things.
It's possible to disregard this e-mail, sent from your own account. In this situation i will present all the images and clips i own of you "satisfying yourself" to all your contacts, imagine the impact this is going to have on your social life! Furthermore your device will lock-up in a particular amount of time and can never be utilized again.
I am certain you don't want that so here is option number two.
I reside in a country where it is very hard to find any job or support my loved ones, that's why I really do this, that's precisely why i am a hacker. You are not targeted, you just went to the wrong web site at the wrong time. So for my secrecy you will need to do something for me.
You'll need to transfer $650 (USD) in bitcoins to my address:
IMPORTANT: You MUST copy/paste the 2 lines together or it will NOT work so the bitcoin address looks like this:
15U89Ea5Q61VQnzyB8YAmoLNfT7UL1JCzc, 1LRuigr82sxPmQt5XDQ7PprJu9qX1rJFMN, 13nsNBfoVwXDHY4puRD1AHjARbomKhsxEL
I can imagine you have no clue about how to use bitcoins nevertheless that is not a challenge, browse Google, lots of sites sell bitcoins making use of a debit or credit card and the procedure is really fast.
Consider this as being a contribution.
From the moment you opened this email you triggered a timer. My setup will now observe this particular bitcoin address for any inbound financial transactions. You have 12 hrs (just 12!) to make the transfer. In case you do not make the transfer within this timeframe your system will lock up, even if you detach from the web or alter all your passwords. Furthermore all your friends will obtain all the unpleasant pictures and video clips i own of you, this will certainly have a big affect in your social life.
If the transaction does come in before its due my setup will automatically shut down the backdoor on your platform and delete all the information, pictures and videos i have of you and you will never ever hear from me again then you can go on to live your life as if this never happened.
I do not want to do damage nevertheless i will do no matter what it takes to feed my spouse and children.
Since you have only 12 hrs you better start the transaction right now!
All the best!
Cyber criminals have translated this email scam and are now targeting computer users in various countries, here's an example of this scam email targeting Chinese users:
Chinese text presented in this email scam:
Subject: 安全通知。 有人可以访问您的文件。
一键！ 您在电子邮件和社交网络中的所有联系人都将收到此视频！ 你的生活将永远改变！
Instant automatic removal of possible malware infections:
Manual threat removal might be a lengthy and complicated process that requires advanced computer skills. Spyhunter is a professional automatic malware removal tool that is recommended to get rid of possible malware infections. Download it by clicking the button below:
- What is "I sent you an email from your account"?
- STEP 1. Manual removal of possible malware infections.
- STEP 2. Check if your computer is clean.
How to remove malware manually?
Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Spyhunter for Windows. If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:
If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:
Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:
Restart your computer into Safe Mode:
Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.
Video showing how to start Windows 7 in "Safe Mode with Networking":
Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup. Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings". Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.
Video showing how to start Windows 8 in "Safe Mode with Networking":
Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options". In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.
Video showing how to start Windows 10 in "Safe Mode with Networking":
Extract the downloaded archive and run the Autoruns.exe file.
In the Autoruns application, click "Options" at the top and uncheck the "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.
Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.
You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".
After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.
Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs. These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software.
To be sure your computer is free of malware infections, we recommend scanning it with Spyhunter for Windows.