Hacked..please help

#0 - Feb. 24, 2010, 3:16 p.m.
Blizzard Post
I woke up this morning to discover I have been hacked. I run Avast and its never alerted me to anything. I am following the stickies at the top of the page but I am scared to redo my e-mail and password because I havnt found the keylogger.
#26 - Feb. 24, 2010, 5:31 p.m.
Blizzard Post
Hey there, Möönlight. I'm very sorry to hear that your account has been compromised. I know you must be both frustrated and confused. =/

Hopefully, this guide will help you:



It will walk you through every element of account recovery: securing your computer, reclaiming your account, reporting losses, and the like. Go ahead and read through this guide now and if you have any questions after, please let me know. :)
#29 - Feb. 24, 2010, 5:37 p.m.
Blizzard Post
Q u o t e:
So after I run these, would it be safe to log on and try to begin the restoration process and just hope for the best? (While waiting for an authenticator in the mail)


Once you've completed both an antivirus and anti-spyware scan (you may even want to run more than one scan of each type, using different programs), I'd strongly recommend updating your registered email address.

The best course of action would be to create an entirely new address rather than using an address that already exists. Make sure that username and password are unique; don't use a username or password that you've used online before. Register this address, then update your password again.

Q u o t e:
I had another question..Are the GMs able to see what was deleted, or should I begin to make a list of what was deleted? (I only really care about the large sum of gold and raid gear/frost badges on my main)


We can see quite a bit, Möönlight. And what we can verify as being lost due to compromise, we will restore. There's no need to make any lists just yet. Once we contact you after restoration, then you can start noting what's still missing and let us know. :)
#31 - Feb. 24, 2010, 5:41 p.m.
Blizzard Post
Q u o t e:
I read through it, one question so far which I asked above. It says to have the launcher open while doing scans, which I am doing. Is it better to restart the scans with the full program running and gibberish typed into the e-mail/password section. Thank you so much for replying to me Syndri, and everyone else as well!


It certainly wouldn't hurt. If you are willing to restart the scan currently in progress or re-do any scans you've already completed, go ahead and do so. You might want to type some gibberish into the account name and password fields, as well.

I realize that full anti-malware scans can take some time, and that the wait can be positively excruciating. Just hang in there, though. Maybe grab a cup of tea or coffee. Find a cute animal to pet. Take a bubble bath. Most importantly, though, rest assured that our staff will do everything they can to get you back on your feet.
#33 - Feb. 24, 2010, 5:48 p.m.
Blizzard Post
Q u o t e:
Okay, I will calm down a bit. This is the first time I have ever been hacked, and have put so much time into my main. It was so heartbreaking to find him deleted and even more so to find my level 70 Warrior who JUST got to Northrend stripped, only wearing his BoA shoulders and chest. Me and my boyfriend have been leveling healer/tank combo nonstop using only the Dungeon finder (so fun!), and now we'll have to stop for a lil while :(


You've access to your account currently, correct? If so, once you've completed all the necessary security steps and reported any losses, you may want to consider leveling an alt character with your boyfriend. Maybe even make a contest out of it: Character at the highest level by the time your items are restored, wins! (Wins what, I don't know. Maybe a pony. Ponies are always good.)
#36 - Feb. 24, 2010, 6:03 p.m.
Blizzard Post
Q u o t e:
My warrior was in mostly blacksmith crafted cobalt tank pieces, so I am sure I could borrow some gold to remake those. Would it be safe to try and continue leveling my warrior, or would a level 1 reroll be better so nothing gets disrupted during the restoration process?


Were any of your characters transferred, renamed, re-customized, or had their race or faction changed without your permission? If so, it would be best not to play on those characters until we can correct the transaction and changes.

Characters that didn't take part in an unauthorized transaction, though, are free to play to your heart's content. :)
#38 - Feb. 24, 2010, 6:12 p.m.
Blizzard Post
It looks like Hexx was indeed transferred while your account was compromised. Because of that, just be sure to complete this form: http://us.blizzard.com/support/article.xml?locale=en_US&tag=transferform

The rest of your characters look good to play. :)
#43 - Feb. 24, 2010, 7:13 p.m.
Blizzard Post
Q u o t e:
I just now changed my e-mail and password for battle.net again. Will this affect how the Gm's contact me about my already open ticket?


Not at all. :)