Account Hacked, what software and cleanup did you use?

[crowdx]

So one last issue I have, blizzard said they have sent a password reset email for the affected accounts. In my gmail the emails have all hit the spam filter, is there a way to go directly to the password reset page without using the link in the email or must I follow that link?
Thanks for the help

[Arneas]

Of course, as I'm reading this thread, I get a sinking feeling and check my email. BAM! Three hour account suspension for spamming. Only thing is, I haven't logged in for four days. Tried to access battle.net. My password doesn't work anymore. Bah!

Reset the password to the accounts, so at least they can't do anything else. But, since I'm at work, I need to wait until I get home to see what damage was done (as well as for the three hour ban to expire).

Bah!

[Tonuss]

My friend got hacked Sunday morning. Readin the Blizz forums it sounds like another waves of attacks have started. Who knows how long they've been collecting & storing PWs, just to use them now in an all-in-one burst. I got the keychain coder but anyone who doesn't may consider changing PWs asap to be safe. Could have visited a page 6 months ago that got you're info & is using it now.

Geez, I have to admit that I had not even thought of that. It can make it really difficult to figure out when your account got compromised if they decide to work that way.

[crowdx]

Well I went home at lunch and so far the virus scanners have not picked up anything as yet.
A question for those that have been through the hacked trauma, the care package that blizz offers, what does this include? Do they restore the gear and x gold or is no gear restored? What does the restore package cover?
I prefer a full restore but I really do not care about mats on the accounts, I more care about gold (about 32k across the 5 accounts) and the gear for the toons.

[crowdx]

Just got a few emails supposedly from Blizzard informing me of unsuccessful paid character transfers on my accounts. Wondering now has the account been newly compromised or is this a delay from this morning. I added an authenticator straight away at the time I found the account hacked and so wondering what is happening

[mikekim]

if you are looking to clean the machine of trojans/ keyloggers use both malwarebytes and ccleaner

[coglistings]

we use roboforms at work and if you don't encrypt / password the keycard, the file is basically a text file on the file system. the wow account name is passed along in the tcp stream as plain text and the characters you see when you get into your main character selection screen as also passed along to your computer in plain text. not that the hackers had a tip on your network on anything, but alot of information can be datamined by someone who knows what they are looking for. I can say that the packets passed along to the server after your username appear to be encrypted...

beware authentacators is all I have to say on that matter....

if you are looking to clean the machine of trojans/ keyloggers use both malwarebytes and ccleaner

unless you can verify that you don't see any strange packets out of your computer by monitoring an entire conversation from a network port mirror or a tip linked to an unknow monitoring device you can't assume you got it. av software is just meant to make you feel good about browsing the network and it may not catch what actually infected the system even if they catch other things, svper has really the best advice. blast from afar and reinstall straight from your dvd's or from web downloader.

So one last issue I have, blizzard said they have sent a password reset email for the affected accounts. In my gmail the emails have all hit the spam filter, is there a way to go directly to the password reset page without using the link in the email or must I follow that link?
Thanks for the help

well, you call always hover over the link in the e-mail to see where it goes. if it goes to a straight up bliz page, then you are good.. the reset page is on the same server your battle.net accounts goto so if the first portion of the URL is off even by just a letter, chances it a phinse. you really can't go around it cause there are security tokens in the e-mail link that bliz is expecting for like a 24 hour period before they expire. chances are that if the message came in after a few minuets from being on the phone or from requesting it, its leggit.

bliz is really good about restoring ppl cause they want to keep you and also they want to keep you from saying how you quit the game after you got hacked. I wouldn't expect a hacked account that was able to be recovered to contineu to pay their membership subscription.

remember, by not keeping you account safe, you are admitting to a TOS violation which under current case law is a copyright infrindgment. so never approach bliz with a large stick on this one. their stick is larger.....

[Svpernova09]

Well I went home at lunch and so far the virus scanners have not picked up anything as yet.
A question for those that have been through the hacked trauma, the care package that blizz offers, what does this include? Do they restore the gear and x gold or is no gear restored? What does the restore package cover?
I prefer a full restore but I really do not care about mats on the accounts, I more care about gold (about 32k across the 5 accounts) and the gear for the toons.

Don't ever take the package, request a full restore. The package is frost badges and 2k or 3k gold.

[Dramoth]

One of my guildies second account (with all his bank toons on it, not his playing toons) got hacked yesterday.

As soon as they hit it, the hackers put an authenticator on it and changed the password.

I think that him and his brother are going to be investing in authenticators for their accounts. At least I am going to tell them to do it

[crowdx]

So as an update, I nuked all my machine's OS's and did clean installs from a format ( I have the OS on a seperate partition). I then used multiple pieces of software to scan the existing drives for any keyloggers or trojans and so far I seem to be clean.
I also setup a new email address and moved my battlenet account onto it and as some have said on the forum before, I will keep this email address solely for WoW. I then did another update on my password and then logged back into the game. What seems to have happened is that they did not delete any of my toons, instead they transferred 3 of them to other realms, when I am restored, will blizz automatically move these toons back or do I have to add this to my ticket?
I did question the failed paid transfers with a GM and he said it happened after I submitted my ticket, what I am wondering here was, were they logged into my bnet account when I logged in and so it allowed them to do the transfers while I was logged on, not sure. Anyhow, all the above steps to clean my machines were taken later in the day and so I am hoping I am clear of the mess.

So now I think I am into the waiting game to have the accounts restored, luckily I have one account untouched which is the account that I have my tanks on and was using to powerlevel some alts and so the wait for restore will not affect my gaming at all.

Overall, a pain to have to do fresh installs etc but I am glad that I got hacked on my WoW account and not some other real world bank accounts or some such which I have also now changed all the passwords for.

Still no idea where the compromise came from but I think one of the posters here may have been correct in stating that the hack may have been a few months ago and the hackers are just doing mass onslaught on people's accounts, I suppose the logic might be to overwhelm blizzards support and so inexperienced users may be left vunerable longer due to trying to call blizzard etc instead of taking immediate action.