Haven bows out.
- Thread starter Haven
- Start date
Kasatka
Active Member
Might throw some light on your situation Haven. I just received the same e-mail. Now as many of you may know i dislike WoW, but did once have a trial account, so either my trial account got hacked, activated and then blocked, or it's a phishing scam... either way, watch out!
Quick update on this.
Blizzard have re-instated my account and partially refunded lost items.
Having done a full re-install of my OS I then copied a backup of my wow folder across and was surprised to be kicked out literally 5 seconds after logging in because my password was immediately compromised. What this tells me is that my WoW folder was compromised and not my OS. Anti-Virus and WoW file checker both showed the folder as clean. My personal suspicion is either wowmatrix (which I had installed into the wow folder) or an addon were directly reporting my passwords as I typed them into the game.
Fortunately I immediately re-set my password again to prevent any damage and then deleted the WoW folder.
Interesting lessons learnt from this experience
* obviously something in the wow folder was compromised and not detected by AV - can't tell if it was an addon or an addon updater - but it was one of the two.
* only characters in the last realm I was logged into were abused, the hack script was not able to swtich realms and affect characters on other realms.
* blizzard do not refund all items - hopefully they will eventually but at the moment I am without tanking and healing gear on two of my main characters.
Thats me for now anyway. Since re-installing wow from scratch all has been well (so far at least) so I'm confident it was wowmatrix or an addon that caused the hack.
Blizzard have re-instated my account and partially refunded lost items.
Having done a full re-install of my OS I then copied a backup of my wow folder across and was surprised to be kicked out literally 5 seconds after logging in because my password was immediately compromised. What this tells me is that my WoW folder was compromised and not my OS. Anti-Virus and WoW file checker both showed the folder as clean. My personal suspicion is either wowmatrix (which I had installed into the wow folder) or an addon were directly reporting my passwords as I typed them into the game.
Fortunately I immediately re-set my password again to prevent any damage and then deleted the WoW folder.
Interesting lessons learnt from this experience
* obviously something in the wow folder was compromised and not detected by AV - can't tell if it was an addon or an addon updater - but it was one of the two.
* only characters in the last realm I was logged into were abused, the hack script was not able to swtich realms and affect characters on other realms.
* blizzard do not refund all items - hopefully they will eventually but at the moment I am without tanking and healing gear on two of my main characters.
Thats me for now anyway. Since re-installing wow from scratch all has been well (so far at least) so I'm confident it was wowmatrix or an addon that caused the hack.
Windzarko
Well-Known Member
Did you download a new copy of Wowmatrix any time recently? Fake Wowmatrix stuff was one of the causes of the authenticator-bypass account thefts.
That's... odd. Stolen accounts should have absolutely everything reset to how it was, apart from little details like any quests you had, the arrangement of items in your bank, the state of your mail box (sometimes it'll get emptied, meh) and some other little mostly inconsequential things. If they've not given your gear back, harass them, they're supposed to restore it.
Got another batch of gear back but looks like they don't have to give it back if you read the text. At least I've got 12 more items of tanking gear back 
