Guild Wars 2

Hi there, today I got an email telling me someone from China has attempted to log in to my account and asked me if I wanted to authorize it. Here’s the mail I recieved:

A log-in attempt from the following location is currently awaiting your authorization.

Address: 122.143.128.74
City: Baicheng
Region: 05
Country: CN

This location is approximated based on information provided by your Internet Service Provider. If in doubt, deny the request and try again.

If you are certain this log-in attempt was not made by you, then someone else knows your log-in credentials and you should change your password immediately via Account Management.

For security purposes, we alert you each time your account is accessed from an unrecognized location. To authenticate this log-in attempt, please click the link below:

I just changed my password and logged in to see if anything was missing; luckily all of my belongings were still there. I wanted to know if there’s anything else I should do.

Virus scan your computer. You may have a key logger. MalwareBytes or AviraAntivir are good. Trend micro also has a great online scanner.

Hi everyone,

As stated by Sindarin, please perform a virus scan as soon as possible. After that, changing your password also helps, and of course keep the mail authentication enabled.

Thanks

Thanks for the replies Sindarin and Mr. Moderator. I did a scan of my PC and everything turned up A-Ok.

I have received the same message but every time I try to deny access, it gives me a failure. I haven’t had time to check my account but I’ll be changing passwords now. My PC does daily virus scans as well.

I received the same e-mail, my computer is clean. The data leak may be on your end, I suggest you investigate, I used to use my password for more than just the game.

IP address was:
Address: 42.48.59.151
City: Changsha
Region: 11
Country: CN

“I used to use my password for more than just the game” definitely sounds like it is on your end carnality. The reason I suggested the on-line scanner TrendMicro is that viruses can sometimes hi-jack your virus program and make themselves “invisible”. Go do an on-line scan and then report back.

would start off with using norton power erase first

It could also stem from incidents that happened a long time ago. Back in 2010, my GW1 account was once hacked because GuildWarsGuru got hacked. The hackers obtained a huge list of e-mails from the user database and proceeded to test all of those e-mails for valid accounts. Now, I’m no Internet neophyte; the GWGuru password was different to the one I use for my Guild Wars password, but what I had forgotten was that I also had an NCSoft account (something which I think I created once in the early days of GW1 just to submit a bot report, then forgot all about it). The hackers went to the NCSoft account, which I stupidly used the same password for as the GWGuru password, and they reset my password there. I’ll spare you the agonizing details of what happened next.

But to come back to the current issue, if you happened to have a GWGuru account dating back years into the past, it’s not impossible the hackers may obtain a list of these compromised e-mails/passwords and attempt to use them again in hacking GW2.

Yea I just got the same kind of Email and I’d tried to change my password but the account management is not working!!!!

I just got an attempt too:
Address: 118.120.39.135
City: Chengdu
Region: 32
Country: CN

Changed my password but it was unique to GW2 and my PC is clean…

Sindarin.1095:

“I used to use my password for more than just the game” definitely sounds like it is on your end carnality. The reason I suggested the on-line scanner TrendMicro is that viruses can sometimes hi-jack your virus program and make themselves “invisible”. Go do an on-line scan and then report back.

Like I said, computer is clean, I just did another check with Trend Micro, this problem is obviously not unique to just me.

I had six login attempts from various places in China over the past 12 hours. Discovered them when I woke up this morning. the bulk of the verification messages went to my email spam folder, which is why I assume they had to try so many times before they realized that’s what was happening. The good news though is that when I logged on, it seems nothing is out of place or missing. I changed my password to something stupidly hard. I would also like to change my email address as well, but I can’t seem to find a place to do that. Can I do that?

I am going to assume for now that this was partially my fault, seeing as most account compromises spring from poorly guarded information, though I am usually very careful with my own.

I still have no idea where I could have misused it though, since this site and the game login are the only places I used this email or password.

I would also like to see an authentication option other than the app, since I don’t have a smartphone.

Edit: here is the complete list of the I.P.s that tried to access my account, starting at 3:56 am US mountain time:

Address: 119.36.59.2
City:
Region:
Country: CN

Address: 111.174.243.180
City: Wuhan
Region: 12
Country: CN

at 3:58 am…

Address: 58.212.152.50
City: Nanjing
Region: 04
Country: CN

At 4:01 am…

Address: 222.241.120.3
City: Yiyang
Region: 11
Country: CN

Address: 111.166.161.144
City: Tianjin
Region: 28
Country: CN

And December 12 at 6:12 am

Address: 112.247.58.242
City: Jinan
Region: 25
Country: CN

I have already sent a copy of this to support.

Edit again:

I should probably also mention that after running MalwareBytes and Symantec I still have not detected a virus or keylogger. I’ll check a few more times with other programs.

Symantec is a joke, if power erase doesn’t find something, its time to hit it with ikarus