has my account been hacked?

Scram

I got an email this morning saying that my password had been changed which of course i didnt do. Now the wierd thing is that my account sub is up i havnt played since september when it ran out and i dont play anymore.

the email looks real too as i checked out the headers in the email;

Delivered-To: irishbloke@gmail.com
Received: by 10.100.122.8 with SMTP id u8cs9976anc;
Mon, 9 Nov 2009 22:33:51 -0800 (PST)
Received: by 10.150.166.4 with SMTP id o4mr15257348ybe.53.1257834831501;
Mon, 09 Nov 2009 22:33:51 -0800 (PST)
Received-SPF: softfail (google.com: best guess record for domain of transitioning noreply@battle.net does not designate 80.239.186.56 as permitted sender) client-ip=80.239.186.56;
Received: by 10.192.8.27 with POP3 id 27mf72192ywh.40;
Mon, 09 Nov 2009 22:33:51 -0800 (PST)
X-Gmail-Fetch-Info: 1 mail.eircom.net 110
Return-Path: <noreply@battle.net>
Delivered-To: eircom.net
Received: (vpopmail 19023 invoked by uid 16); 10 Nov 2009 06:24:40 +0000
Received: (qmail 19020 messnum 13084055 invoked from network[80.239.186.56/smtp06.eu.worldofwarcraft.com]); 10 Nov 2009 06:24:40 -0000
Received: from smtp06.eu.worldofwarcraft.com (80.239.186.56)
by mail02.svc.cra.dublin.eircom.net (qp 19020) with SMTP; 10 Nov 2009 06:24:40 -0000
Received: from ew1-web-10-blade02.wowadmin.net (ew1-web-10-blade02.wowadmin.net [10.50.53.42])
by smtp06.eu.worldofwarcraft.com (8.13.8/8.13.8) with ESMTP id nAA6Odc5027774
for <@eircom.net>; Tue, 10 Nov 2009 06:24:40 GMT
Date: Tue, 10 Nov 2009 06:24:39 GMT
Message-ID: <29437094.1257834279963.JavaMail.tomcat@ew1-admin-smtp-vip.wowadmin.net>
From: Blizzard Entertainment <noreply@blizzard.com>
To: "@eircom.net" <@eircom.net>
Subject: =?utf-8?Q?Battle.net_Account_=E2=80=93_Password_Change_Notice?=
MIME-Version: 1.0
Status: U
X-UIDL: 1257834280.19023.mail02.svc.cra.dublin.eircom.net,S=2163
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Hello xxx,

This is an automated notification regarding the recent change(s) made to your Battle.net account: EMAILADDRESS@EMAIL.COM

Your password has recently been modified through the Account Management website.

*** If you made this password change, please disregard this notification.

However, if you did NOT make any changes to your password, we recommend you contact Blizzard Billing & Account Services for assistance keeping your account as secure as possible.

For more information, click here for answers to Frequently Asked Questions or to contact the Blizzard Billing & Account Services team.

Account security is solely the responsibility of the accountholder. Please be advised that in the event of a compromised account, Blizzard representatives typically must lock the account. In these cases the Account Administration team will require faxed receipt of ID materials before releasing the account for play.

Sincerely,
The Battle.net Account Team
Online Privacy Policy

i cant login now and i cant change my password...my account was merged with battle.net months ago and it was fine until now...

Nehaxak

Actually, this looks like a dupe. Wowadmin.net is not a Blizzard site, far as I'm aware.

Psycopat

Ouch, if this is an official e-mail and they've already merged your account with their e-mail its gona be damn hard to get your account back. Ring the blizz helpline asap but get the number off their official site just in case. Dont click on anything in the e-mail as it may be a key logger.

2 Espressi

no, but eu.worldofwarcraft.com is.

webform:

https://eu.blizzard.com/support/webform.xml?locale=en_IE

Phone Numbers:
(use UK)

http://eu.blizzard.com/support/article.xml?locale=en_GB&articleId=22330

nix

I still find it funny that we have to call a UK number to get through to their offices in cork :rolleyes:

Scram

2 Espressi wrote: »

no, but eu.worldofwarcraft.com is.

webform:

https://eu.blizzard.com/support/webform.xml?locale=en_IE

Phone Numbers:
(use UK)

http://eu.blizzard.com/support/article.xml?locale=en_GB&articleId=22330

will i be able to ring the uk number? from ireland

i contacted billing support and they sent me this, basically saying that my credit card expired? which it did is that the problem?
This is crazy i dont even play the game anymore....

Hello,

Thank you for your interest in World of Warcraft. We regret to inform you that we have encountered a problem when trying to process your most recent payment attempt. In order to assist us with resolving this problem, we respectfully request that you provide the following information:

Please confirm how many accounts you are paying for, and if more than one, please supply the name of all the accounts and the reason that you are paying for them.

Could you please provide a list of all accounts, if any, which currently have character transfers being processed using the same card?

Was payment attempted with only one credit card? If more than one credit card was used, please confirm how many credit cards were used, and explain why multiple cards were used.

Please confirm whether the bank that issued your card is based in a different country from the contact address listed on your World of Warcraft account, and if it is, please explain the reason for this as well as stating in which country the credit card was issued.

Please check that the correct details are registered on the account management page.

Did you change the expiry date of the credit card used on any of the attempts to enter your credit card information, and if so, please explain why and confirm the actual expiry date that appears on your credit card?

Please note that the sooner as we receive your answers, the sooner we will be able to help you resolve this issue. Also please note that in order for us to help you we need you to answer all our questions fully. If you do not know the answers to all of these questions, please ask the credit card holder to help you answer our email fully.

Thank you for your cooperation.


Regards,

Aechlyria
Blizzard Europe Entertainment
Payment Support
http://eu.blizzard.com/support

Scram

nix wrote: »

I still find it funny that we have to call a UK number to get through to their offices in cork :rolleyes:

yeah thats kinda ****ed up, will i be able to get though to that number?

Scram

and yes ive been hacked....**** me jesus, i thought i had good antivirus and firewall software. **** jesus if i didnt play anymore id probably have a heart attack.

What the hell am i suppose to do now? Appeal this? Ring them up?...oh god im shocked lol

Greetings,

We are writing to inform you that we have, unfortunately, had to cancel your World of Warcraft account:

Account Name: ********
Type of Violation: Involvement in online trading activities
Investigation Concluded: 10/11/2009
Consequences for Account: Account Cancellation

It is with regret that we take this type of action, however, it is in the best interest of the World of Warcraft community as a whole, and for the integrity of the game, that your access to the World of Warcraft servers be cancelled.

Online trading refers to the exchange of in-game content for real world money, and includes, but is not limited to, the sale or purchase of gold, the sale or purchase of experience in the form of powerlevelling, and the sale or purchase of honor points, reputation or items.

Account access is the responsibility of the account owner and account sharing is against our Terms of Use (http://www.wow-europe.com/en/legal/termsofuse.html). Therefore, should you believe someone other than yourself (the account owner) has committed this violation of the Terms of Use with your account, these sanctions would still apply, as our action is taken against the account, not the individual.

If you wish to review our current Rules and Polices, they can be found at:
http://www.wow-europe.com/en/policy/

Regards,

Account Administration Team
Blizzard Entertainment Europe

Jumpy

2 Espressi wrote: »

no, but eu.worldofwarcraft.com is.

webform:

https://eu.blizzard.com/support/webform.xml?locale=en_IE

Phone Numbers:
(use UK)

http://eu.blizzard.com/support/article.xml?locale=en_GB&articleId=22330

Thats only the delivery server!

It can be faked if they have an open relay.

The sender was wowadmin. Look at that, not the delivery server.

Nehaxak

You didn't perchance happen to access that wowadmin site at all did you ?
Even after you got the initial email, did you maybe access that wowadmin site to check your account ?
Can you post the headers of the email also that said your account is now banned ?

viconia

This happened to me last night except I was online and the person kicked me off. I got the same email as you, and followed the person on my otehr account as they emptied and vendored all my items & guild banks.

I put a password change through and got my account back and opened a ticket. Evertyhign was gone from it unfortunately. Now the account has been temporarily banned.

I put through a WoW account hack form online now. It is normal for them to temporarily suspend your account and you will get most of your items back too. I'm still so damn pissed off over this.

I'll let you know how mine goes. Mine happened around 3am this morning.

Nehaxak

...wait wait wait, wowadmin.net is apparently a legit Blizzard site.

So, I'm guessing they've hacked your email account and used it to request password changes without you knowing, clicking the link blizz sends when you request a password change.

So, before you do anything else, scan your computer for viruses/malware and hope to remove any keyloggers that might be there - then change your email password.

KilOit

Get a blizzard authenticator

viconia

Yeah, I got the authenticator.

I got my account back with all my stuff on it. The hacker disbanded a bank-alt guild of mine so I need to talk to a GM to get that stuff back. a GM hasn't spoken to me yet but they said they will in the next 4-5 days.

Once they do, they'll see if they can get me stuff but generally, any DE'd stuff won't get returned so no gear

Scram

you got your stuff back? did you ring them up? that was quick

I submitted a compromised account request and filled all the details out yesterday evening and im waiting...i might go and ring them up if i can get through..

viconia

Scram wrote: »

you got your stuff back? did you ring them up? that was quick

I submitted a compromised account request and filled all the details out yesterday evening and im waiting...i might go and ring them up if i can get through..

I put the form through, but I also talked to a GM on another account I have, and he told me it was with their investigator already. He said they temporarily ban you until they see whats the problem. You get your account back but it'll take up to 7 days for a GM to talk to you on your account because they're trying to see what you lost. That way you can ask them for certain things that you don't have.

Make sure you make a list of whatever you have. Especially stuff that can be DE'd.

Scram

Jumpy wrote: »

Thats only the delivery server!

It can be faked if they have an open relay.

The sender was wowadmin. Look at that, not the delivery server.

how do i get through to that uk number?

United Kingdom 0901 815 0810 £0.25 per minute

0044901 815 0810 ?

Ivan

viconia wrote: »

Yeah, I got the authenticator.

I got my account back with all my stuff on it. The hacker disbanded a bank-alt guild of mine so I need to talk to a GM to get that stuff back. a GM hasn't spoken to me yet but they said they will in the next 4-5 days.

Once they do, they'll see if they can get me stuff but generally, any DE'd stuff won't get returned so no gear

That isnt true anymore. If they can verify that someone else did it, which they usually can by tracing the IP address and then show that the items were transferred to another account after being de'd then they can usually get it back and you should get your items back, most of which with the gems/enchants they had.

Scram

Ivan wrote: »

That isnt true anymore. If they can verify that someone else did it, which they usually can by tracing the IP address and then show that the items were transferred to another account after being de'd then they can usually get it back and you should get your items back, most of which with the gems/enchants they had.

Im still waiting on a reply from blizzard. i expect it will take quite a while, i would like to know how they got my password, i can only guess because i used it onther wesbite somewhere or my PC is riddled with viruses.

I tried to get though to the Uk number but it didnt seem to get through which sucks big time really and there have offices in cork i mean what the ****.
Ill have to format this Windows im runninng at the moment to be safe i think?

A Full AVast anti-virus said it was clean
Windows Defender said it was clean
Spybot S&D the same
then i tried LavaSoft's Adaware and got like 20 different things but it wont show me where these viruses where.

Goes to show you cant trust your Anti-Virus.

What should i do now?
Reformat? or change all passwords? or do both?

what anti-virus would you folks recommend as Avast has failed big time.

Nehaxak

Scram wrote: »

what anti-virus would you folks recommend as Avast has failed big time.

NOD32 or Avira (premium) and also use OpenDNS.org for your DNS settings, setup an account on it (free) for yourself and go through the easy to use list to ban crap sites or adverts on sites that might be harmful.

viconia

Oh, I got my account back and everthing. They actually gave me more stuff back so I profited about 4000 gold

Scram

Anyone know how i get throught to blizzard by phone?
i havnt been able to get though with the uk number it rings like the number isnt there, is it possable to get through to the uk with a 0901 number?

Anyone know? i wanna speak to to somebody about it rather than sit and wait if possable?

Do i need to ring paris or something? or if i ring up the operator can they put me through?

Ivan

Unless they changed the number, you should be able to get through no problems first thing in the morning, when the lines just open. If you leave it too late then it's usually swamped again and you are stuck in a huge queue...

Of course, the thing is their lines have very particular opening and closing times
10:30 am to 08:00 pm (Paris time), on Monday and Tuesday.
11:30 am to 08:00 pm (Paris time), on Wednesday.
10:30 am to 08:00 pm (Paris time), on Thursday.
10:30 am to 07:00 pm (Paris time), on Friday.

Come to think of it... where'd you get an 0901 number from? The billing number on their site is United Kingdom: 0800 931 0800 (free). It's not free, since it's from Ireland to Uk but it's really quick if you can get through...

Scram

Ivan wrote: »

Unless they changed the number, you should be able to get through no problems first thing in the morning, when the lines just open. If you leave it too late then it's usually swamped again and you are stuck in a huge queue...

Of course, the thing is their lines have very particular opening and closing times
10:30 am to 08:00 pm (Paris time), on Monday and Tuesday.
11:30 am to 08:00 pm (Paris time), on Wednesday.
10:30 am to 08:00 pm (Paris time), on Thursday.
10:30 am to 07:00 pm (Paris time), on Friday.

Come to think of it... where'd you get an 0901 number from? The billing number on their site is United Kingdom: 0800 931 0800 (free). It's not free, since it's from Ireland to Uk but it's really quick if you can get through...

thanks ill try that number when i get home from college.

Psycopat

You should fully re-instal windows to make sure you get rid of any keylogger. Also, I got my account hacked about 6 months ago when i was in a net cafe. All my gear was gone but i got it all back with the same enchants and gems.

Magaa

I GOT THIS EMAIL DO NOT CLICK ON THE LINK IT BRINGS YOU TO ANOTHER WEBSITE!