Blizzard detected a virus, de-activated all my accounts.. how?

[Heavyd]

There was a story a couple of days ago about 44mm game accounts, including some number of warcraft accounts, that were found on a chinese server. Maybe it had something to do with that?

http://news.techworld.com/security/3...tolen/?olo=rss

If you don't want to click the link you can google 'stolen warcraft accounts' and it'll be the top couple of stories.

[Fat Tire]

This is unfortunate, however there is a silver(gold) lining.

I made out like a bandit when my accounts go hacked @6 months ago - pre authenicator. At the time I had about 160k gold and just a ton of other items, mostly enchanting,jewelcrafting mats on bank mules etc. These hackers pretty much cleaned me out and transfered alot of my characters to different servers.

I went thru the procedure and it took about 12 days to get my stuff back and when I got it all back I was blown away. I got around double my gold back and got about 3 times in mats back. My warrior had thunderfury from back in the day and when I logged him on he had his original equipped and another in his bags.

[jinkobi]

I seriously doubt that; I'm a security analyst by profession and have done phishing campaigns myself. I loaded the emails in a VM and inspected the headers and links which all pointed to the official Blizzard sites - they would've had to have spoofed the content client-side via a rootkit level proxy, DNS or some other method. The accounts were locked out before I even read the emails. If they managed to trick me, honestly, they deserve it.

Just saying it happens to the best of us man. Luckily hasn't happened to me -knock on wood-. Even MMO champion got hacked, Curse gaming, etc... People were getting things from those sites. You may have had something hiding for a while and they just now decided to take advantage of it.

Wishing you all the best!

[Multibocks]

Blizzard would not automatically apply an authenticator to your account. You somehow lost control of the accounts and the new owner has put an authenticator on them.

[emps]

it's bogus. i've gotten that kind of email in the past (if not exactly that) stating my account has been disabled as well (on top of getting password changes, violation of eula, blah blah blah). If i didn't filter my inbox, I would be getting at least 5 wow phishing emails a week. Never really clicked a single link on it (sometimes I'd inspect the headers and view the message as text to see the src links for kicks).. Oh well, with an authenticator thank Elune I haven't been compromised yet. If you're not so sure about your account status - you can always log into battlenet and check if they are truly disabled. Otherwise, 99% of these emails are scams.

Edit: I assume you don't have an authenticator?

[BrothelMeister]

Blizzard does scan your system while you are playing wow, and if they detect a virus, they have been known to shut down your account till you get it fixed if you do not have an authenticator. They do this because if your account becomes compromised, its more work for them to fix it.

However, if you clicked a link in an email from blizzard, (real blizzard emails wont have a link for you to follow in it), and now your account has an authenticator on it, you've been tricked.

To get an authenticator removed from your account, and get it restored, since its definitely been wiped clean by now by the botters, you have to call them direct. When I had to remove my mobile authenticator after my phone died, they simply asked for things like the product key on one or two of your wow accounts or upgrades.

After the authenticator is off tho, you'll still need them to do a restore on your account; before which they'll have to do a lot of research, x5 accounts, which means you might be out of wow for a week or two.

[Multibocks]

Here's a simple fucking rule for WoW: if an email tells you that your account is compromised/banned don't even fucking read it. Scan for a Trojan if you must, but I've ignored every email from blizzard and have not been "hacked."

[Starbuck_Jones]

Your accounts were prolly flagged by reports in game. People see you sharding and vendoring all your gear and stripping naked and large gold transfers.

[Souca]

Since no one has spelled it out, here is likely what happened:

1. Your accounts got hacked, your computer got hacked, or you password got guessed/stolen from another site.

2. Hacker adds authenticator to your account.

3. Hacker did something stupid, or got detected by IP range. Blizzard maintains IP ranges of common pirates and power-leveling service and will ban accounts if there is enough activity from these IPs.

4. Blizzard sends out a form email telling you that your account has been hacked and that you likely have a virus and that your account has been frozen.

While things might be different, this is a common pattern and the result is the same, you need to call up Billing, 800-592-5499 and politely explain the situation and provide the information they need to validate your account. Generally they will not do item/gold/character restoration until you have regained your account and had a chance to loot through things. Restoration is usually done in-game and via email with a group that handles that specifically. Do not accept the care package instead; wait for your stuff.

As another poster mentioned, you can stand to make some decent gold out of the whole thing. Just make sure to get an authenticator.

- Souca -

[heyaz]

Here's a simple fucking rule for WoW: if an email tells you that your account is compromised/banned don't even fucking read it. Scan for a Trojan if you must, but I've ignored every email from blizzard and have not been "hacked."

The accounts were compromised Before I read the email. If it was fake, I don't see the purpose of it considering it had no malicious links - it went directly to the Blizzard site.

I tend to agree with the logic posted by Souca - account was compromised beforehand by some means, blizzard sends out generic email saying I probably have a virus. I don't think the email itself compromised me.

I'm just happy that they didn't get anything else. I kind of doubt my actual machine is compromised, but I am very curious as to how accounts get stolen when: your machine isn't compromised, you don't use the same password/email on your bnet as you do anywhere else, your wireless is encrypted, etc. I almost wonder if they're able to sniff traffic at some core router on the Internet far outside of my control. I've known a few people who were totally secure on their end yet their accounts were compromised. It's a damn good technique, whatever they're using,.