I think that happens in most hacking cases, because your characters, and the characters they added were probably used to transfer funds and spam chat. Which is probably how they detected the hacking in the first place.

 

-----signature-----

Got a mail today a real one for once from blizzard. My account has been banned "Exploitative Activity Found?". I havent been logged into the account for 3-4 months. Pretty impressive tho, how they even got that password to begin with. Honestly i cant really say that i care that much. Here i thought i was "safe" and all that, using sandboxes, firewalls and what not. There was a thing a couple of weeks ago, my mail showed some "errors" that someone had been trying to log in a lot. Didnt really think that much of it. Even with access to the mail they wouldnt even have got the password in the first place due to the "secret" word.

 

-----signature-----

I don't know, I still can't figure out how they got the password.

I use abstract password, I've run every virus scan, key log tool,autoruns,

everything that anyone has told me to do i've done. I've never given out

my account info so I'm going to do a fresh install and move on.

Beats me too. I am in the same boat. Havent logged on to the account since 17/08/10. However it showed recent activity about 10 hours ago. The usual routine striping the characters and running them to a major city from what i can see. In the end 3 level 1 characters was made and i can only guess what they were used for . Im guessing they somehow hijacked my browser(since i dont really clear the sandbox that often) when i visisted wow site i probably got redirected to their crap. If i were "them" id make sure that all the "evidence" got removed after a successful login/password retrieval. So it would be close to impossible to even find out how they did it.

 

-----signature-----