====== I received an email notification about my user’s account being compromised. What should I do? ======

=== Question: ===
I received an email notification about my user’s account being compromised, such as below.\\
   We have noticed that one of your account xxx@domain.com has been sending hundreds of illegal
   spam email starting at [date].
   We believed that the user computer has been compromised (infected with spyware or virus).
   We have changed the user's password to prevent the account being used for illegal activities, 
   and you may need to cleanup/reinstall the system as soon.
   DO NOT use the previous password as it has already been exposed.

What should I do?\\

=== Answer: ===
When your VO user is compromised, the system will reset the user's account password to prevent the account to be further used for illegal activities such as email spamming.\\
To enable the user to access his/her account again, you as the Administrator may:
  * Advice the user to **run a virus scan** on his/her computer to cleanup any spyware or threats.
  * **Reset the user account password** via Avomaster/voadmin account ([[https://afteroffice.com/support/doku.php?id=faq:administrator:how_to_reset_user_password|learn how]]).

Please do not use the previous password as it has already been compromised.