Question about acct being hacked.

[Richakin]

Wednesday between 7am and 3pm my acct was hacked.

They only got to my 65 priest, 61 hunter and 47 rogue...they are all naked except any pvp rewards, bags are empty some even vendored.

If i play the toons, and blizz manages to restore the gear...does anything i accumulated disappear? or would i keep anything i had gained after the hacker vendored it all?

[mesonm]

probably the latter.....

[DraedynLei]

ouch. good luck man.

[Altaris]

Yeah, my sympathies. I suggest you start working on a new alt for a time while they investigate. They may decide not to restore anything at all if you have already gotten requiped with newer, maybe better gear.

[Richakin]

yeah worst part is they are all on the same server =( but i still got my 48 lock 35 mage and 32 warrior to play while i wait for any word back.

only thing i could think of is a keylogger, i recently downloaded bartender3 from curse-gaming and cartographer and necrosis(dont remember if i got those 2 from curse or here). so my guess is it was somewhere in those. =(

[Richakin]

well good news. my 3 toons havhe already been restored and nothing is missing(that im aware of)

Kudos to blizz!

[Gekothan]

yeah worst part is they are all on the same server =( but i still got my 48 lock 35 mage and 32 warrior to play while i wait for any word back.

only thing i could think of is a keylogger, i recently downloaded bartender3 from curse-gaming and cartographer and necrosis(dont remember if i got those 2 from curse or here). so my guess is it was somewhere in those. =(

There is no reason ANY of those mods would contain an executable that'd launch a keylogger, and keyloggers cannot be coded in LUA themselves, at least ones that'd be able to steal passwords, since the mods are loaded AFTER logging on. Even if a keylogger was included WITH the mod, I don't think mods are able to call external executables. More likely you got hit by the trojan that hit the front page here recently (which I think has been fixed now). I'd run a virus scan straight away if I were you. Try out NOD32 and Kapersky.

Nice going getting your stuff restored! :)

[Richakin]

most said it was a key logger so i assumed so since the 2 antivirus programs i 'had' didn't find anything.

havent tried NOD32 or Kapersky yet.

ive used AVG Antispyware, Superantispyware, Adware, Trend Micro Antivirus...

AVG says i have a Trojan.small.fb and i click on it hit 'remove' and it says "actiosn completed" and i run it again and it shows up again...so ill ahve to try those 2 to see what happens.

[Miramis]

Found this article for you:
http://forums.techguy.org/security/490773-solved-trojan-small-fb.html

You'll need the program "hijackthis" found here:
http://www.majorgeeks.com/download3155.html

Good luck to you! :)

[ahhdamm]

maybe start a new forum where people can state how to protect your account. you could post your hijackthis list, and people could tall you what to delete. programs that work in detecting and removing threats, and whatnots.
it would be good for people who don't know this could happen and what to do if it does happen. and we could stay ontop of anything new that comes along:idea:

[Your Average WoW Player]

Maybe we should just sticky a thread in the community forum here with various safety tips and such.
IE:
--Anti-virus, Anti-spyware programs
--Safe site do download addons from
--Unsafe sites do download addons from.
--Etc.

[JaedxRapture]

Maybe we should just sticky a thread in the community forum here with various safety tips and such.
IE:
--Anti-virus, Anti-spyware programs
--Safe site do download addons from
--Unsafe sites do download addons from.
--Etc.

/Sign. There should be something like that, including a list of tools and such to help protect your PC and tools to get your PC back to normal after a hack, as well as info on who to contact and how if you're hacked.

[Altaris]

/sign
We could also include a post on mod's known/believed to have bad juju in them.