got hacked, how to verify a clean/secure PC?

[olsondw]

I got hacked last night, when I logged in this morning I noticed my bank alt had been moved and my guild bank cleaned out. I went to reset my battlenet password and noticed my authenticator had been removed from my account. Since then Blizzard has cancelled my 5 accounts due to abusing the economy. I have a ticket open to get the accounts restored.

Trying to figure out how it was hacked and how were they able to remove my authenticator. I'm running full scans on my PC with Norton and spy hunter? Any other suggestions to verify I have a clean PC?

Thanks

[Ualaa]

Unfortunately, your only sure fire method is going to be a format and a reinstall.
Whatever hacked you, or acquired your login/password, defeated your current/previous security measures.

You can run an assortment of anti-virus or scans.
But you're not going to be sure, without a format/clean start.

[MiRai]

You have to nuke it from orbit... it's the only way to be sure.

[Palee]

You have to nuke it from orbit... it's the only way to be sure.

ROFL, you're so funny MiRai.

[zenga]

I got hacked last night, when I logged in this morning I noticed my bank alt had been moved and my guild bank cleaned out. I went to reset my battlenet password and noticed my authenticator had been removed from my account. Since then Blizzard has cancelled my 5 accounts due to abusing the economy. I have a ticket open to get the accounts restored.

Trying to figure out how it was hacked and how were they able to remove my authenticator. I'm running full scans on my PC with Norton and spy hunter? Any other suggestions to verify I have a clean PC?

Thanks

how did they manage to remove your authenticator in the first place?

[MiRai]

how did they manage to remove your authenticator in the first place?

I thought the same thing as well since it takes two consecutive codes from the attached authenticator to remove it (or verification over the phone with the need to possibly fax in information to prove your identity), but... There is that mobile armory hack that's going around which is bypassing authenticators and maybe the hackers have gotten better at what they do. /shrug

[Sam DeathWalker]

I put the OS on drive C on its own hard disk, and everything else on other hard drives. I use Easeus to CLONE the whole C drive every few weeks. Disconnect the power cable from the back up drive when done with back up. If you have a problem take out the infected C drive and put in the back up drive and you are up and running in a few minutes.

[olsondw]

Looking thru the Blizzard support forums, there seems to have been an issue with the remote AH, which I do use daily. Which might be why it was taken down over the weekend:

https://us.battle.net/support/en/blo...ouse-6_22_2013

Plus, there are a few threads on accounts getting hacked recently with the authenticator on them. Still looking thru the threads, but haven't seen any comments from Blizzard on the issues yet.

[Sservis]

Your safest bet is to start over and treat everything in and on that computer as suspect if you think it's compromised. There are intermediary steps that are less drastic. Things like pulling the HD, mounting it on a known safe PC, and running a scan on the drive from that PC (don't run anything from the HD). Or burning a bootable DVD to check the computer (do this from a known safe computer)

Blizzard may be able to provide information as to how things happened that will help you understand the likelihood of your computer being compromised. I'd ask if they can tell you anything about how the authenticator was removed, dates, times, methods that they see from their end.

You can also always run a scan from the questionable PC with the questionable OS running. You'll have to decide if you trust the results or not. The usual advice about changing your passwords, at least battle.net/email attached to battle.net/any others that match applies.

[EaTCarbS]

If you don't feel like nuking it from orbit, there are an assortment of programs you can use to attempt to remove a keylogger

MalwareBytes
Spybot - S&D
Security Task Manager
HijackThis