I know most posts here are complaints, often valid. But in this case, I'd like to thank and commend the the Blizz folks for a job well done in the recovery of my account and characters: from the account/billing rep (Andrew) that I spoke with on the phone to the Admins who quickly verified that I was hacked to the GM's who quickly and completely restored my characters and all their items (as well as the items in the banks of the two guilds of which I was a member). From the time my account was compromised to the time I was fully restored was a little over 24 hours. This certainly exceeded my expectations, and I can't tell you how thrilled I was to be able to play again last night. My only difficulty was my inability to get through to anyone on the phone after my initial contact with Andrew in billing; I couldn't even get into the queue. I guess they need a few more billing agents (or at least more room in the phone bank). But overall, I could not have been happier with the response to what was a very frustrating and distressing time for me. Thansk again.

I'm very happy to hear that we were able to assist you with your recovery, Skansk—and so expediently, too! I know how troubling account compromise can be, so it's great when we're able to assist quickly and completely. Thank you for sharing your success story!

If you would like to thank or formally provide feedback for the representatives with whom you interacted, you'll find all the contact information you need right here: Important Contact Information

Blizzard Entertainment likes you, too, Aristeaus.

---

Q u o t e:
then how about a response on my hacked account thats been gear-less with no response for over a week?

---

I just provided a response to you here, Aristeaus: http://forums.worldofwarcraft.com/thread.html?topicId=24702012094&sid=1&pageNo=1#8

With that said, the first petition we received from you about your compromise was late in the evening on 05/03. Right now, the more intense investigations and restorations are requiring about 5 to 6 days to complete, so hopefully should you be hearing back from us soon.

In meantime, really use this time to focus on securing your account:

Account and Computer Security
http://us.blizzard.com/support/article/30794

What I said:

---

Q u o t e:
You petition has actually already been reviewed and escalated to our investigation queue. It remains in queue at this time and will be investigated (and then restored as thoroughly as possible) just as soon as it reaches the front. We've representatives working around the clock, so hopefully it won't be too long now.

Sometimes we're able to provide restorations right the off bat—I noted that you posted in another thread where I was speaking to someone who only had to wait 24 hours—and sometimes a more thorough investigation is necessary. Your particular case falls into the latter category. This doesn't mean we're resting on our laurels, just that we want to recoup as many losses as possible and, to do that, we need to dig a little deeper.

---

Your response:

---

Q u o t e:
lol so what your saying is that being that my account was hacked...got banned for spamming, (assuming it was some gold seller site) and had a random authenticator thrown on it...my account is in question?

---

That's not what I said at all. Your account isn't in question; we simply need to investigate further to not only help identify the source of your compromise, but to ensure that your restoration is as complete as possible. We want to get you back on your feet and recoup as much as we can. In this situation, that's going to require a bit more investigation on our part.

You've my sincere apologies for any wait in the meantime, though.

Whether or not you cancel is your decision, Aristeaus. You're acting as though we have no interest in assisting you, though, when the complete opposite is true.

In-Game Support will do all that they can to help recoup items, characters, and currency lost as the result of compromise. All that we ask in return is for an account owner to recognize that compromises occur client-side and then spend some time thoroughly reviewing his/her system security. This is not us placing blame, but really trying to ensure that a repeat compromise doesn't happen.

Now, while your computer may indeed be clean of malware, malware isn't the only means by which an account may be compromised. Here's just a few questions I'd encourage you to ask yourself (if you're willing):

• Do you ever access (or have you ever accessed) your account from a different computer? If so, could that computer perhaps be at risk? Remember that you will need to examine all computers from which you've logged into the game client, the World of Warcraft forums, and/or Battle.net Account Management. All three of these locations require an account name and password.
  
  
• Do your use your account name and/or password as your login credentials for any other website? Perhaps a networking site like Facebook or Twitter or MySpace? Or a guild website? If so, this could have lead to your compromise.
  
  
• On a similar note, is your registered email address publicly available? A quick way to check is to plug your address into any online search engine. If the search returns results, then it's probably a good idea for you to update that piece of your contact information. Instead of simply using a different email address, though, my advice would be to set up a completely new address. When creating this new address, make sure that the username and password are unique. Don't use a username (e.g. character name, IM screen name, profile tag) or password that you already use online.
  

All in all, I know this has been frustrating, and for that you've my sincere apologies. We're working to improve the service we provide every day, so if you have any suggestions or feedback for how we may do so, please let us know (http://forums.worldofwarcraft.com/board.html?sid=1&forumId=11122).

Can you provide me the name and realm of a character on the currently-locked account, Lazbirtrtyrt?

---

Q u o t e:
Fluffymage on Kil'Jaeden is one of my characters, and i hate to post a rant like response like i did, which i try to normally not to, but when the accountadmin responded but still said nothing about the lock on the account it just pissed me off, so sorry for that.

---

I understand and hopefully, as a result, I'll be able to provide some clarity. :)

---

Q u o t e:
Did you try running a malware scanner with the login window up and gibberish typed into the information fields? Often times your conventional virus scanners don't pick keyloggers up. They are notoriously good at hiding.

---

This is also excellent advice. Thank you, Maxine!

Be sure that your scanners are up-to-date, too. Unfortunately, un-updated scanners can sometimes miss newer threats. =/

---

Q u o t e:
Got anything yet??

---

Still looking!


Aristeaus, I'm really glad you're taking some extra steps to really secure your account. I know it's not the most enjoyable thing to do—at any point, really—and I can imagine it's even more frustrating right now because of the compromise. This should help greatly, though, and maybe even prevent you from having to go through this again. Another thing you might consider, but that is certainly not necessary, is picking up an Authenticator for yourself. We sell a keyfob on our Blizzard Store, and many mobile devices support our Mobile Authenticator application (sometimes even for free). If you're curious about learning more, let me know, and I can hook you up with any information you need. :)



Edit:

---

Q u o t e:
Scan type: Full scan (C:\|D:\|)
Objects scanned: 198191
Time elapsed: 21 minute(s), 2 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

---

Just to confirm, Malwarebytes was totally updated prior to scanning, correct? I suspect it was, but it certainly can't hurt to ask.

Also, several players have noted success finding malware that other scanners didn't pick up by using Combofix. Downloading this program may be something to consider doing tonight, and then starting a full scan right before you go to bed.

---

Q u o t e:
and whats this mobile authenticator u speak of?

---

Link spam, inc! :D

Here's the Mobile Authenticator FAQ: http://us.blizzard.com/support/article/26109

And here's where you can check to see if your mobile device supports the application: http://mobile.blizzard.com/

(Just click on the center link that says "FEATURED MOBILE APPLICATIONS" and it'll bring you to a page where you can select from a few drop-down options.)

---

Q u o t e:
ok so combofix isnt compatible with win7?

---

Is it? That's unfortunate. =/

You wouldn't happen to be running and/or Super AntiSpyware or Spybot – Search & Destroy? If not, one of these two programs is something to look into, too.

---

Q u o t e:
and mobile authenticator is a no go =( only goes up to a 747 i got a 797

---

Curse your technology!

Got a birthday, anniversary, or...well, you know, an unbirthday coming up? Or does anyone owe you a favor (maybe even a dinner)? If so, an Authenticator could be a great, but simple gift. :)

---

Q u o t e:
If there is anyway you can get my account unlocked in the next 4hours i would love you...please..80 hours of no one unlocking account....can't...go...on...much....longer....

---

Small update, Lazbirtrtyrt: We're looking into this further and should be able to assist. I'll provide you another update when I receive one myself. :)

---

Q u o t e:
my only concern...after reading all these posts...is that seems theres ALOT of problems with authenticators and people seem to be hacked while using them..so for me to spend even MORE money on wow...it doesnt seem to be a viable solution

---

I think most of the posts you're seeing are from players who were compromised and then had an Authenticator attached during that compromise. It's unfortunately a fairly common technique by malicious parties.

On the contrary, those that do use Authenticators are rarely compromised. And I'm talking super rare. While the Authenticator isn't a "silver bullet"—nothing is 100% infallible—it does provide a very real, very strong level of additional security. If you decide to get one (which is totally up to you), you'll just want to keep an eye out for Man-in-the-Middle Trojans, like the one described here: Security Awareness: New Trojan

---

Q u o t e:
Syndri if you get any updates i have this page up so remember to lemme know

---

Will do. :)

---

Q u o t e:
Can't you do something?????? I made only ONE mistake in the form and now i have to wait 4 more days just to get a response!?

---

If you can resubmit the form with the correct information provided in all fields (double-check your submission before sending), we should be able to help you out quickly—no need to re-wait all that time. We just need to verify that you can confirm the first and last name registered to the account.

Actually, it looks like we found another submission you made, and so far all the information looks good. Belay my last order and hang tight. :)

Alright, Lazbirtrtyrt. Looks like you're good to go. You should be receiving a follow up email shortly. :)