Post by Kuracynn on May 24, 2008 4:06:31 GMT -5
As you may or may not know, we had several items stolen from our guild bank. This thread is an FYI for the guild. Please feel free to reply if you have any questions
History:
On 5/22 at about 11PM server time, it was brought to my attention that a character named "Leblon" had withdrawn a large quantity of items from the guild bank. At that time I checked to see who "Leblon" was and fond it to be an Alt of another character who was in RoA for a time called "hartmut"
I messaged Hartmut immediately and did not receive any reply. It was also noted that he was in Ironforge, I sent Bloor to find him while I looked on the auction house for items that may have been ours.
Hartmut was found in the bank area, but despite repeated attempts he did not answer whispers.
He then logged out and logged back into Leblon. He immediately went to the Ironforge bank and started removing items from the guild bank. At this point I looked up Hartmut on the armory and discoved that his character was naked except for a few items that would not be vendored. This is a tell tale sign that a persons account has been compromised.
After seeing the naked character in the armory and the behavior of Leblon, I instructed Alwiz to remove Leblon from the guild. I was on Cynnical at the time and did not have removal powers.
I then looked up Hartmut current guild and contacted one of their officers. I explained the situation to them and warned them to keep an eye on their guild bank.
After this I got some help looking at the logs and made a mental list of what was taken.
- A large quantity of void crystals
- Several darkmoon cards
- About 6 class ability training books (arcane brilliance, Gift of the wild, etc.)
- Some random herbs
- Pre-BC raid raid materials (primal tiger skin, etc)
- Some BoE items
I then contacted a GM about the issue. Unfortunately, I took 5 minutes to change characters and do a transmute for someone and a GM contacted Cynnical while I was offline. The generated an in-game mail that was useless and am email what was slightly less useless.
The solution to our problem is to get Hartmut to report the theft. I then used these boards to find Hartmuts email address. I sent him an email on 3/24 explaining the situation. Sadly this may have little effect.
I found this to be in no way satisfactory, so I again contacted a GM and managed to pin one down long enough to talk to them about the situation. Unfortunately, his hands were tied as it was not my account that was compromised. Any restoration needs to be done on the offending account. So, this is starting to turn into a clusterfuck.
Current activities:
Right now we have very few options to get our items recovered. It all comes down to Hartmut logging in and reporting the theft. So, I am looking at ways to speed this process up.
I have talked to Hartmut's other guild before and I will likely contact them again. I suspect the email address I used is a bit outdated and they will have a better way to contact him.
I will keep you guys posted if there is anything new.
-Kura
Update 1:
It appears that one of the updates for omen at Curse Gaming had an embedded worm in it. If you use Curse to update Omen you should get a Virus Scan done ASAP.
Update 2:
ZG mats, spell books and BoE items have been returned. Working with Hart to get the rest.
Update 3:
The rest of the stuff was returned. Many thanks to Hartmut/Leblon for his assistance.
History:
On 5/22 at about 11PM server time, it was brought to my attention that a character named "Leblon" had withdrawn a large quantity of items from the guild bank. At that time I checked to see who "Leblon" was and fond it to be an Alt of another character who was in RoA for a time called "hartmut"
I messaged Hartmut immediately and did not receive any reply. It was also noted that he was in Ironforge, I sent Bloor to find him while I looked on the auction house for items that may have been ours.
Hartmut was found in the bank area, but despite repeated attempts he did not answer whispers.
He then logged out and logged back into Leblon. He immediately went to the Ironforge bank and started removing items from the guild bank. At this point I looked up Hartmut on the armory and discoved that his character was naked except for a few items that would not be vendored. This is a tell tale sign that a persons account has been compromised.
After seeing the naked character in the armory and the behavior of Leblon, I instructed Alwiz to remove Leblon from the guild. I was on Cynnical at the time and did not have removal powers.
I then looked up Hartmut current guild and contacted one of their officers. I explained the situation to them and warned them to keep an eye on their guild bank.
After this I got some help looking at the logs and made a mental list of what was taken.
- A large quantity of void crystals
- Several darkmoon cards
- About 6 class ability training books (arcane brilliance, Gift of the wild, etc.)
- Some random herbs
- Pre-BC raid raid materials (primal tiger skin, etc)
- Some BoE items
I then contacted a GM about the issue. Unfortunately, I took 5 minutes to change characters and do a transmute for someone and a GM contacted Cynnical while I was offline. The generated an in-game mail that was useless and am email what was slightly less useless.
The solution to our problem is to get Hartmut to report the theft. I then used these boards to find Hartmuts email address. I sent him an email on 3/24 explaining the situation. Sadly this may have little effect.
I found this to be in no way satisfactory, so I again contacted a GM and managed to pin one down long enough to talk to them about the situation. Unfortunately, his hands were tied as it was not my account that was compromised. Any restoration needs to be done on the offending account. So, this is starting to turn into a clusterfuck.
Current activities:
Right now we have very few options to get our items recovered. It all comes down to Hartmut logging in and reporting the theft. So, I am looking at ways to speed this process up.
I have talked to Hartmut's other guild before and I will likely contact them again. I suspect the email address I used is a bit outdated and they will have a better way to contact him.
I will keep you guys posted if there is anything new.
-Kura
Update 1:
It appears that one of the updates for omen at Curse Gaming had an embedded worm in it. If you use Curse to update Omen you should get a Virus Scan done ASAP.
Update 2:
ZG mats, spell books and BoE items have been returned. Working with Hart to get the rest.
Update 3:
The rest of the stuff was returned. Many thanks to Hartmut/Leblon for his assistance.