LOG of crash while being hacked

#0 - Feb. 23, 2010, 7:27 a.m.

Not sure if this will help or not but i got hacked again while logged in on my authenticator. Called blizz and they said its possibly a live keylogger. They sent me to microsoft and i ran there virus scan and it didn't find anything at all. Everything is updated and it still is happening. Somehow they lock me out with my own authenticator and they can use my account at will. So here is the log any help much appreciated.

==============================================================================
World of WarCraft (build 11403)

Exe: C:\Program Files\World of Warcraft\WoW.exe
Time: Feb 22, 2010 5:47:13.687 PM
User:
Computer:
------------------------------------------------------------------------------

This application has encountered a critical error:

ERROR #132 (0x85100084) Fatal Exception
Program: C:\Program Files\World of Warcraft\WoW.exe
Exception: 0xC0000005 (ACCESS_VIOLATION) at 001B:01311660

The instruction at "0x01311660" referenced memory at "0x00000000".
The memory could not be "written".

WoWBuild: 11403
Settings:
SET locale "enUS"
SET realmList "us.logon.worldofwarcraft.com"
SET patchlist "us.version.worldofwarcraft.com"
SET coresDetected "2"
SET hwDetect "0"
SET gxRefresh "60"
SET gxMultisampleQuality "0.000000"
SET gxFixLag "0"
SET videoOptionsVersion "3"
SET movie "0"
SET Gamma "1.000000"
SET readTOS "1"
SET readEULA "1"
SET showToolsUI "1"
SET Sound_OutputDriverName "System Default"
SET Sound_MusicVolume "0.40000000596046"
SET Sound_AmbienceVolume "0.60000002384186"
SET farclip "507"
SET specular "1"
SET groundEffectDensity "24"
SET projectedTextures "1"
SET mouseSpeed "1"
SET accounttype "LK"
SET VoiceActivationSensitivity "0.39999997615814"
SET ChatMusicVolume "0.29999998211861"
SET ChatSoundVolume "0.39999997615814"
SET ChatAmbienceVolume "0.29999998211861"
SET realmName "Durotan"
SET gameTip "124"
SET Sound_MasterVolume "0.20000000298023"
SET Sound_VoiceChatInputDriverName "System Default"
SET Sound_VoiceChatOutputDriverName "System Default"
SET readScanning "-1"
SET readContest "-1"
SET readTerminationWithoutNotice "-1"
SET installType "Retail"
SET particleDensity "0.80000001192093"
SET weatherDensity "1"
SET checkAddonVersion "0"
SET gxWindow "1"

----------------------------------------
GxInfo
----------------------------------------
GxApi: D3D9
Adapter Count: 1

Adapter 0 (primary):
Driver: ati2dvag.dll
Version: 6.14.0010.6925
Description: Radeon X1300/X1550 Series
DeviceName: \\.\DISPLAY1

------------------------------------------------------------------------------

----------------------------------------
x86 Registers
----------------------------------------

EAX=00000001 EBX=00000053 ECX=101DF7BC EDX=7C90E514 ESI=00002778
EDI=101DFAA4 EBP=0000000B ESP=101DF7DC EIP=01311660 FLG=00010202
CS =001B DS =0023 ES =0023 SS =0023 FS =003B GS =0000

----------------------------------------
Stack Trace (Manual)
----------------------------------------

Address Frame Logical addr Module

Showing 25/25 threads...

--- Thread ID: 3056 ---
7C802455 0019FD40 0001:00001455 C:\WINDOWS\system32\kernel32.dll
0084443D 0019FD4C 0001:0044343D C:\Program Files\World of Warcraft\WoW.exe
00618762 0019FD94 0001:00217762 C:\Program Files\World of Warcraft\WoW.exe
00617A6F 0019FDA8 0001:00216A6F C:\Program Files\World of Warcraft\WoW.exe
0044F7F5 0019FE60 0001:0004E7F5 C:\Program Files\World of Warcraft\WoW.exe
00427A39 0019FE90 0001:00026A39 C:\Program Files\World of Warcraft\WoW.exe
00424AE9 0019FEB8 0001:00023AE9 C:\Program Files\World of Warcraft\WoW.exe
0042614A 0019FF0C 0001:0002514A C:\Program Files\World of Warcraft\WoW.exe
00426191 0019FF24 0001:00025191 C:\Program Files\World of Warcraft\WoW.exe
00406D8D 0019FFC0 0001:00005D8D C:\Program Files\World of Warcraft\WoW.exe
7C817077 0019FFF0 0001:00016077 C:\WINDOWS\system32\kernel32.dll

--- Thread ID: 4488 ---
77DF8631 01BBFFB4 0001:00027631 C:\WINDOWS\system32\ADVAPI32.dll
7C80B729 01BBFFEC 0001:0000A729 C:\WINDOWS\system32\kernel32.dll

--- Thread ID: 1504 ---
7C802455 01DCFF40 0001:00001455 C:\WINDOWS\system32\kernel32.dll
0072C635 01DCFF60 0001:0032B635 C:\Program Files\World of Warcraft\WoW.exe
0074231A 01DCFF74 0001:0034131A C:\Program Files\World of Warcraft\WoW.exe
0086A0BF 01DCFFAC 0001:004690BF C:\Program Files\World of Warcraft\WoW.exe
0086A164 01DCFFEC 0001:00469164 C:\Program Files\World of Warcraft\WoW.exe

--- Thread ID: 5072 ---
7C802455 0272FB60 0001:00001455 C:\WINDOWS\system32\kernel32.dll
0084443D 0272FB6C 0001:0044343D C:\Program Files\World of Warcraft\WoW.exe
0046167D 0272FF8C 0001:0006067D C:\Program Files\World of Warcraft\WoW.exe
0070318B 0272FFB4 0001:0030218B C:\Program Files\World of Warcraft\WoW.exe
7C80B729 0272FFEC 0001:0000A729 C:\WINDOWS\system32\kernel32.dll

--- Thread ID: 3756 ---
7C802542 0294FF64 0001:00001542 C:\WINDOWS\system32\kernel32.dll
00707370 0294FF74 0001:00306370 C:\Program Files\World of Warcraft\WoW.exe
007F5422 0294FF8C 0001:003F4422 C:\Program Files\World of Warcraft\WoW.exe
0070318B 0294FFB4 0001:0030218B C:\Program Files\World of Warcraft\WoW.exe
7C80B729 0294FFEC 0001:0000A729 C:\WINDOWS\system32\kernel32.dll

--- Thread ID: 2700 ---
7C80A115 0657FF88 0001:00009115 C:\WINDOWS\system32\kernel32.dll
72D2312A 0657FFB4 0001:0000212A C:\WINDOWS\system32\wdmaud.drv
7C80B729 0657FFEC 0001:0000A729 C:\WINDOWS\system32\kernel32.dll

--- Thread ID: 1904 ---
7C80A115 066EFE40 0001:00009115 C:\WINDOWS\system32\kernel32.dll
73F114A2 066EFE58 0001:000004A2 C:\WINDOWS\system32\dsound.dll
73F12862 066EFF78 0001:00001862 C:\WINDOWS\system32\dsound.dll
73F198DF 066EFF98 0001:000088DF C:\WINDOWS\system32\dsound.dll
73F12896 066EFFB4 0001:00001896 C:\WINDOWS\system32\dsound.dll
7C80B729 066EFFEC 0001:0000A729 C:\WINDOWS\system32\kernel32.dll

--- Thread ID: 4392 ---
7C80A115 0685FE48 0001:00009115 C:\WINDOWS\system32\kernel32.dll
73F114A2 0685FE60 0001:000004A2 C:\WINDOWS\system32\dsound.dll
73F12862 0685FF80 0001:00001862 C:\WINDOWS\system32\dsound.dll
73F1292B 0685FFB4 0001:0000192B C:\WINDOWS\system32\dsound.dll
7C80B729 0685FFEC 0001:0000A729 C:\WINDOWS\system32\kernel32.dll

--- Thread ID: 5996 ---
7C802455 06ACFF94 0001:00001455 C:\WINDOWS\system32\kernel32.dll
008A0FED 06ACFFA0 0001:0049FFED C:\Program Files\World of Warcraft\WoW.exe
008A180C 06ACFFB4 0001:004A080C C:\Program Files\World of Warcraft\WoW.exe
7C80B729 06ACFFEC 0001:0000A729 C:\WINDOWS\system32\kernel32.dll

--- Thread ID: 5104 ---
7C802455 06C3FF94 0001:00001455 C:\WINDOWS\system32\kernel32.dll
008A0FED 06C3FFA0 0001:0049FFED C:\Program Files\World of Warcraft\WoW.exe
008A180C 06C3FFB4 0001:004A080C C:\Program Files\World of Warcraft\WoW.exe
7C80B729 06C3FFEC 0001:0000A729 C:\WINDOWS\system32\kernel32.dll

--- Thread ID: 2576 ---
7C802455 06DAFF94 0001:00001455 C:\WINDOWS\system32\kernel32.dll
008A0FED 06DAFFA0 0001:0049FFED C:\Program Files\World of Warcraft\WoW.exe
008A180C 06DAFFB4 0001:004A080C C:\Program Files\World of Warcraft\WoW.exe
7C80B729 06DAFFEC 0001:0000A729 C:\WINDOWS\system32\kernel32.dll

--- Thread ID: 1912 ---
7C802455 06F1FF94 0001:00001455 C:\WINDOWS\system32\kernel32.dll
008A0FED 06F1FFA0 0001:0049FFED C:\Program Files\World of Warcraft\WoW.exe
008A180C 06F1FFB4 0001:004A080C C:\Program Files\World of Warcraft\WoW.exe
7C80B729 06F1FFEC 0001:0000A729 C:\WINDOWS\system32\kernel32.dll

--- Thread ID: 2532 ---
7C802542 0708FF68 0001:00001542 C:\WINDOWS\system32\kernel32.dll
00707370 0708FF78 0001:00306370 C:\Program Files\World of Warcraft\WoW.exe
00497379 0708FFB4 0001:00096379 C:\Program Files\World of Warcraft\WoW.exe
7C80B729 0708FFEC 0001:0000A729 C:\WINDOWS\system32\kernel32.dll

--- Thread ID: 832 ---
7C802542 071FFF58 0001:00001542 C:\WINDOWS\system32\kernel32.dll
00707370 071FFF68 0001:00306370 C:\Program Files\World of Warcraft\WoW.exe
00421425 071FFF80 0001:00020425 C:\Program Files\World of Warcraft\WoW.exe
00421591 071FFF8C 0001:00020591 C:\Program Files\World of Warcraft\WoW.exe
0070318B 071FFFB4 0001:0030218B C:\Program Files\World of Warcraft\WoW.exe
7C80B729 071FFFEC 0001:0000A729 C:\WINDOWS\system32\kernel32.dll

--- Thread ID: 2424 ---
7C80A115 0736FD28 0001:00009115 C:\WINDOWS\system32\kernel32.dll
00421C3B 0736FF80 0001:00020C3B C:\Program Files\World of Warcraft\WoW.exe
004213CE 0736FF8C 0001:000203CE C:\Program Files\World of Warcraft\WoW.exe
0070318B 0736FFB4 0001:0030218B C:\Program Files\World of Warcraft\WoW.exe
7C80B729 0736FFEC 0001:0000A729 C:\WINDOWS\system32\kernel32.dll

--- Thread ID: 5520 ---
7E4195F9 0A51FF18 0001:000085F9 C:\WINDOWS\system32\USER32.dll
7E4196A8 0A51FF34 0001:000086A8 C:\WINDOWS\system32\USER32.dll
007413A6 0A51FF60 0001:003403A6 C:\Program Files\World of Warcraft\WoW.exe
0074231A 0A51FF74 0001:0034131A C:\Program Files\World of Warcraft\WoW.exe
0086A0BF 0A51FFAC 0001:004690BF C:\Program Files\World of Warcraft\WoW.exe
0086A164 0A51FFEC 0001:00469164 C:\Program Files\World of Warcraft\WoW.exe

--- Thread ID: 816 ---
71A55FA7 0B2BFC04 0001:00004FA7 C:\WINDOWS\system32\mswsock.dll
71AB314F 0B2BFC54 0001:0000214F C:\WINDOWS\system32\WS2_32.dll
3D93E9A9 0B2BFFAC 0001:0000D9A9 C:\WINDOWS\system32\WININET.dll
3D95DEAB 0B2BFFB4 0001:0002CEAB C:\WINDOWS\system32\WININET.dll
7C80B729 0B2BFFEC 0001:0000A729 C:\WINDOWS\system32\kernel32.dll

--- Thread ID: 3416 ---
7C80B729 0B42FFEC 0001:0000A729 C:\WINDOWS\system32\kernel32.dll

--- Thread ID: 1204 ---
7C802542 0B70FF74 0001:00001542 C:\WINDOWS\system32\kernel32.dll
008E1D35 0B70FF90 0001:004E0D35 C:\Program Files\World of Warcraft\WoW.exe
008A1189 0B70FFA0 0001:004A0189 C:\Program Files\World of Warcraft\WoW.exe
008A17D0 0B70FFB4 0001:004A07D0 C:\Program Files\World of Warcraft\WoW.exe
7C80B729 0B70FFEC 0001:0000A729 C

Orlyia

#8 - Feb. 23, 2010, 7:57 a.m.

Iron,

Under the account you are posting under here - the Battle.net account, I see no current authenticator.

I see where one was put on and taken off on 2/21 from a malicious source, but none at the moment, and not seeing one taken off previously.

When did you add it - this is the account in question?

Orlyia

#19 - Feb. 23, 2010, 8:33 p.m.

Q u o t e:
Of course i had a authenticator or i wouldn't be posting for help with this problem. I changed my email at work today when i got my account back. So the only time this comp seen it was when i logged into wow.

I see none on the Battle.net account attached to the account you are posting under right now, Iron.

I see a malicious one that was put on and taken off on 2/21. I see an authenticator ordered on 2/22/2010.

If you had one previously, can you tell me what type it was and about when you think you attached it?

Orlyia

#26 - Feb. 23, 2010, 8:47 p.m.

Well, it's helpful to be able to look at the correct account.

Orlyia

#28 - Feb. 23, 2010, 8:54 p.m.

Looks like you did call with an authenticator issue on 2/19 and we tried a reset - then removed this at your request.

I don't see another added to this account until 2/22. The other account you are posting under does not have one at present.