Keylogger possible.

Ok, like hundreds of others my World of Warcraft account was hacked. I know this because i was away for the weekend and i had a friend check my status, which someone had logged in yesterday while i was out of town. I tried to log in to WoW, someone had added an authenticator, instead of just changing the pw. Somehow i was able to log into WoW's forums, notify them, and they disabled the authenticator and reset the pw. Sooooooo, now comes finding how the hell i got hacked. I dont share accounts, i dont hand out pw's to anyone(including my wife), i didnt fall for a phish and i havent talked to someone impersonating a blizzard employee, which i would never give them my pw as i listen to warnings....... duh. lol

I was able to run everything asked to run in "read and run me first" EXCEPT mgtools as i cannot download it. It shows up as "not a valid win.32 program" and is 0kb when i try to dl it.

Here are the logs for Mbam, combofix and root repeal. As an aside, AVG and superantispyware also came up with nada.

Now that i think about it, ill attach those as well (in next post)

 

Well hell, was going to post my AVG report but it seems that it was overwritten by the one i stopped when it tried to restart. why it didnt save the old one is beyond me. Either way, it didnt find squat and heres my superantispyware log.

As an aside, i did find Viewpoint Media Player(and deleted it per instructions). I cant see any other suspicious things in my files or folders when i look myself either.

 

Well, so far no luck, it shows up on both the other pc's but i cant transfer it to the usb key. Says you need to be an administrator to perform this action, both pc's are win 7 and both logins WERE admin logins as they were my mother in laws pc and my wifes, both with only 1 damn login, and admins.

I hate pc's somedays and when youve been up all night screwing with them it gets reaal old fast.

:cry

 

My pc im trying to fix, and right the others will not let me xfer to flash drive. I shut off her UAC from win 7 after trying a few other ways to dl it and NOW this pc is only downloading it as a 0kb file. (i tried deleting it off the pc and now this)

i knew i should have just left it, now this pc wont dl it.

 

ok i have it on the pc again, used firefox, but still thinks im not an admin

 

Maybe this will help, was able to download the actual Hijackthis program. The Mgtools.exe is on my hardrive now, used firefox to dl it but it still will not run. get the following message:

Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access file.

That message shows up on ALL the pc's in my house for mgtools.exe.

Here is the HiJackThis log. I only had it scan and create a log so far.

 

ok, i think uninstalling AVG did the trick as disabling it did not. I was able to download it from the site and run it normally by totally removing AVG.

Heres the log from MGtools.

Another update: Just before uninstalling AVG, i tried opening a new tab in chrome and the pc shut down on me, deleting all my icons on the desktop that were not put there today. Not sure why.

 

Im not sure if that was for Dell Remote Access, which i havent gotten around to uninstalling, or if its used by Pando Media Booster, which i believe was installed by one of my games and wasnt sure if it could be deleted without messing up any games.

So i guess the right answer is no, i personally do not use that RA Media Server and was wondering about it myself. (just noticed it today with all the stuff ive been doing as well)

 

Yeah, i can agree with you there. Thanks to you both for the help, ive been worried to death all night about how this could have happened, still pretty pissed especially if its not on my pc and was done from inside WoW.

I find it funny that in over 5 years ive never been hijacked before, but now that blizzard sells random password generators that give you a secondary, randomly generated password to use along with your own password every time you log in now(they call it an authenticator i think and it was how i was locked out of my account) it seems that its more prevalent for people to have been hacked, rather than not.

Might just give up the game.

Thanks again, hopefully we are right and i'm safe for now.

 

Im not sure if im ready to call it yet. Definetly no spyware, malware or viruses, but i just got an email from blizzard requesting a pw change after logging into wow and the wow forums to start the reclamation process of my WoW gear. (hours after i logged in, this email came) so i made my way to a different PC and changed passwords again and got a new email address associated with it.

So far its only affecting anything to do with WoW, nothing to do with personal Info or banking, so its either a VERY specific keylogger to WoW, Or an email crossed paths while i was doing all this crap. Changed emails just in case they had access to my yahoo account, but i have some other info there they could easily have messed with but didnt. Hell, they didnt even strip all my gold from lower toons.

But anyway, what it boils down to is im not convinced this Ahole is done with me yet. I did order my own Authenticator so once that comes i think ill rest easier.

Im still not conviced that Blizzard isnt doing this on purpose to sell authenticators, who could prove otherwise?

 

Just updating.

Pretty sure, as sure as can be anyhow, that i'm clean. I want to thank all involved, esp Tim and Kestrel, at their patience, understanding and helpfulness.
:cool

Finished up all the steps, should be good to go.

One thing though, i found some folders that were disabled access to "everyone" yet it said admins and my account should have had access, but i didnt. I figured out how to restore access for myself. Just wondering if that may have happened durign the cleaning process, or when i downloaded Zone Alarm(didnt have a software firewall, and hate windows firewall) or if it could be a residual from having my WoW account hacked?

Thanks again people.