how to remove an auto forward rule sending all emails to hntechh.

Question

My email account was hacked, had password and have set up auto forwarding to hntechh where all emails in my account are forwarded, tried to remove the rule but it keeps repopulating.

Answer 1

Do you use email apps on any device? If so please go through all. In each app remove your account.

then do the followings.

,

Make sure you do this on a computer, not on smartphone or tablet. Go to https://www.outlook.com and log in, click on the gear icon on the top right to launch the settings.

Then, on the Mail tab, go to Rules. Are there any rules set up here? If yes, delete them all.

Then check the conditional format, again, if it's there, delete it.

Then, check Forwarding and IMAP, If any items are present, delete them as well.

===========

If you can't find anything, go to https://account.live.com > Your info > Sign in Preferences. Make sure to check all the aliases here. If you don't recognize any there, delete it.

Then go to Security > Manage How I sign in, make sure all contact info is yours. Then scroll down on the same page, look under App Password, click on remove existing app passwords as well.

Please make sure you change your password and enable two-step verficiation.

Go to your account online, go to Devices, remove any devices you don't recognize.

Then go to Security, click on Sign out everywhere. This is meant to kill any session that's still connected. Unfortunately, this one will take 24 hours to take effect.

Then, take one step further - Go to your Microsoft account online https://account.live.com> Sign in > Your info > Sign in preference. Add an alias - You have two options here:

Create new: this will allow you to use the native domain outlook.com to create a new alias.

Add existing: this will allow you to add a 3rd party email address, such as yahoo, gmail, as long as they are not already associated with another Microsoft account.

Once added, make this new alias your primary alias, do NOT delete the old alias. Then at the bottom, click on "Change sign in preference". On the next page, uncheck the box for the old alias. This means, from now one, the old alias cannot be used to sign into your Microsoft account, but it can be still used to receive emails, etc.

Answer 2

To remove an auto-forward rule that keeps repopulating after being deleted, you will need to take several steps to secure your account and eliminate the rule effectively:

1. Check Inbox Rules: Sign in to Outlook Web and navigate to Settings → Mail → Rules. Look for any suspicious rules that automatically forward emails and delete them.
2. Review Forwarding Settings: Go to Mail → Forwarding and ensure there are no unknown forwarding addresses set up.
3. Sign Out Everywhere: Visit Microsoft Account Security and use the option to sign out everywhere. This will terminate all active sessions that might be maintaining the forwarding rule.
4. Manage App Permissions: Check Manage App Permissions and revoke access to any apps you don’t recognize, as hackers often use these to maintain access.
5. Use PowerShell Commands: If you have Microsoft 365 admin access, you can use PowerShell commands like Get-InboxRule -Mailbox youraddress@example.com to find and remove hidden rules that may not be visible in the Outlook interface.
6. Reset Your Password: Change your password again and ensure that multi-factor authentication (MFA) is enabled to enhance security.
7. Monitor Activity: Keep an eye on sign-in logs for any suspicious activity that may indicate further compromise.

By following these steps, you should be able to stop the auto-forwarding rule from reappearing and secure your account against further unauthorized access.

---

References:

• Respond to a compromised cloud email account
• Control automatic external email forwarding from cloud mailboxes