Security guide

==Introduction==
Whilst the WoW game itself is relatively safe, there are several things you can do to protect your account, and information you have on your PC, from people who want to steal it. WoW accounts sell for a considerable sum on the black market.'Vuln left me naked and penniless' - http://www.theregister.co.uk/2007/04/10/wow_hijackings/ - The Register, April 2007 Thieves do not care that you spent five years getting a full set of top-tier gear on every character"Guild Member Hacked and Banned" - http://forums.wow-europe.com/thread.html?topicId=9036454824&sid=1, WoW Europe Forums, May 2009 - they will sell it for the few pieces of gold they can get and transfer the money to gold farmers to make real-world money."Cursor hackers target WoW players" - http://news.bbc.co.uk/1/hi/technology/6526851.stm BBC News, April 2007
Some of the things you can do to protect yourself are:
*Keep your Computer safe
**Keep your computer updated with the latest security patches from your operating system provider (typically Microsoft or Apple)
**Install good security software including anti-virus, firewall and spy-ware checkers
***Set it to run a daily virus scan 
***Run a virus check on ANY file you download from the internet / friend's / USB stick or similar etc
***Run a spyware scan at least once a week
**Turn off auto-play for plug-in devices such as CD drives so you can scan them first
**Secure your router so that neighbors can't steal your bandwidth... or worse
**Create and use a low-privilege account to reduce the risk of downloading malware
*Run WoW safely
**Run WoW using the launcher
**Install Blizzard Updates via the Launcher or from a machine you know has been scanned by a reliable virus checker
**Use a Strong password
**Use a separate email address for BattleNet and only for BattleNet
**Use Real ID sparingly - ONLY for people you know in the real world (and trust) as it is ALSO your account ID
**Buy a Blizzard Authenticator (US/EU).
**Take up the offer to use Dial in AuthenticationBattle.net Dial-in Authenticator Now Available, Blizzard Entertainment, November 2010, 
**Never, ever, share your account details outside your immediate family. This could result in a permanent ban
**If your account IS hacked, report it immediately (US EU)
*Surf the web safely: 
**Check web page links before you click on them
**Check the link matches that listed
**Use anti-phishing addons
**Use NoScript"NoScript" - http://browsers.about.com/od/48/gr/noscript.htm - About.com, October 2009 for FireFox
**Don't use Peer-to-Peer"Security Best Practice" - https://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/ - BleepingComputer, 18 February 2018
If this seems like a lot of effort, remember how long it took you to get all the gear you now have. Note also that it can take up to three weeks to get an account banned for botting and spamming (by the hacker) back. Some of your gear may never be retrieved completely. If the worst happens, then Contact Blizzard as soon as you can.
Keyloggers will also have been after your log-in details to payment sites (such as PayPal), shopping sites (such as Amazon) and your bank and credit card details, so you may lose money in real life too.
The information on this page will never mean that your are 100% safe, as criminals are always coming up with new ways to "beat the system". However, like the camper who stopped to put on running shoes when his friend was already running from the bear, if you follow at least some of this advice, you will have a better chance.
==Keep your computer safe==
===Keep your computer updated===
Computer programs are complex things, written by fallible human beings. As such they may contain unintended flaws. One of the most frequently used ways of getting malware onto a computer is to exploit one of these flaws.
As a consequence, the companies, or, in the case of Unix and Linux, the communities, who offer these operating systems (literally the programs that operate your PC), have to issue updates (patches) to fix them. These may address urgent security flaws, that could allow a criminal to craft a web page that could install malware (malicious softwareMalware - http://en.wiktionary.org/wiki/malware - Wiktionary, March 2009) on your PC. Or they may be fixes to things like drivers (pieces of code that drive a piece of hardware to do something) for your peripherals (such as your monitor or printer) or internal hardware (such as your graphics card or hard disk) that make your game go wrong. Every couple of years, the company may bring out a major new version, such as Windows 7, or Vista from XP. Typically they will have better security, but, may also introduce new faults too. Good advice is "never install version x.0 of anything". For Windows, when Service Pack 2 is issued, most of the major holes will have been addressed.
Malware used to be typically written to show off a cracker's skills, or cause damage by corrupting or deleting a user's files.Malware - http://en.wikipedia.org/wiki/Malware - Wikipedia, 2009 However, as broadband access became widespread, criminals realized that it was much easier to spy on a person's computer as they typed passwords into their banking website than to rob a physical bank.Virtual Criminology Report - http://www.mcafee.com/us/local_content/misc/mcafee_na_virtual_criminology_report.pdf - McAffee, July 2005
Though it is often claimed in forums that Apple and Linux users are "safe", this is increasingly being challenged as criminals realize that these users have grown accustomed to being lax about security.World's first Mac botnet - http://www.guardian.co.uk/technology/blog/2009/apr/16/apple-macoxs-botnet - Guardian newspaper, April 2009 Vista's claim to be "more secure than previous versions" has also come into dispute in a recent survey of malware infestations."Vista security credentials tarnished in malware survey" - http://www.theregister.co.uk/2008/05/09/win_malware_survey/ - John Leyden, The Register, May 2008
Consider using software such as the free Secunia Personal Software Inspector to check all your other software is up to date. A full scan from a security suite such as Kaspersky Internet Security will also advise you of software with known vulnerabilities.
====Windows Updates====
Microsoft tend to issues weekly on "Patch Tuesday" but may release urgent fixes to address serious flaws at any point. If you trust Microsoft to get fixes right most of the time, or cannot be bothered with security stuff, then set Windows to automatically update with the latest patches as follows:
*Log on to the account with administrator privilege
*Click on Start (the windows button in the bottom left of your screen)
*Windows Update (if it is not here, try Control Panel > Windows Update)
*Click on Change settings
*Select Install Updates Automatically, Every Day and choose a time when your computer will be logged on, but it will not affect game-play (such as 7 in the morning if you power up your computer then to check e-mail)
*Check the boxes to "Include recommended updates" and "Use Microsoft Update"
If you are less trusting of Microsoft's ability to generate fixes that work and do not break something else"Problem with KB951748 XP Update in Windows Update" - http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?dg=microsoft.public.windowsupdate&tid=75c56160-fcbc-4a2e-a28b-ed738c12bc76&cat=en_US_56d1dd45-de9e-4fc5-9bc1-2d1d0de6daee&lang=en&cr=US&sloc=&p=1 - Windows Community Forum, July 2008, then you can choose a different setting.
====Mac OS-X Updates====
Mac OS X has a software update tool:
*Click on the apple logo in the top left-hand corner of the screen
*Click on Software Update
For help on updating your Apple Mac, including how to set it to run automatically, see the Apple website "Mac OS X 10.5 Help".
====Linux====
If you are running WoW on Linux, you are probably technical enough to know how and why to update it. Otherwise, contact your Linux provider for information on how to download and install updates.
====Other software to update====
If you do not have version checker software, then check regularly for updates to:
*Security software (preferably set to update daily)
*Browser software such as IE, FireFox, Chrome and Safari
*Portable document format readers such as Adobe or Foxit
*Web content add-ons such as Adobe FlashTo update Adobe Flash go to: http://www.adobe.com/go/getflash, ShockwaveTo update Adobe Shockwave go to: http://get.adobe.com/shockwave/, Real Player, NoScriptTo get or update NoScript go to: https://addons.mozilla.org/en-US/firefox/addon/722/ and Silverlight
*Office software such as Word, Excel, Lotus or Open Office
*any other software installed on your computer such as games
*Voice chat such as Ventrilo or TeamspeakTeamSpeak Client Voice Packet Processing Vulnerability, Securelist, November 2010, [http://www.securelist.com/en/advisories/42014]
Typically the software will have an option under Help to "Check for updates".
===Install good security software===
There is absolutely no need to purchase anti-virus software. There are some free alternatives out there that are excellent choices and will do a very good job of protecting your system. Just because you paid money for it doesn't mean it's good. Remember, a good anti-virus program is but one tool in your arsenal to keep your computer bug free. 
====Necessary software====
As a minimum you will need:
*Anti-virus - this checks files on your computer or media like USB sticks for software that should not be there and will cause your computer harm. The better programs will also scan files as you download them from the Internet. However, most anti-virus programs aren't very good in picking up keyloggers. 
*Firewall - this sits between your Internet connection and your computer and checks that the request to access your computer is legitimate
Ideally you should also have something to check for spyware, which, though it may not harm your computer, tends to send more personal information than you have authorized back to the company that created it. In the worst-case scenario, it may cause system instability "Spyware Effects and Behaviours - http://en.wikipedia.org/wiki/Spyware#Effects_and_behaviors - Wikipedia, May 2009, steal your email address resulting in spam"Anti-spam bots - http://www.auditmypc.com/freescan/antispam.html - Audit My PC, May 2009, or result in Identity Theft"Spyware Identity Theft and Fraud - http://en.wikipedia.org/wiki/Spyware#Identity_theft_and_fraud - Wikipedia, May 2009 (where someone pretends to be you and opens bank accounts in your name, or even redirects your post). Anti-spyware will also check for ad-ware which slows your computer down and intrudes by popping up windows to their adverts. Typically these anti-spyware softwares are free, but they do require you to run and update them manually unless you buy a paid-for version.
If you think your computer is secure, and you do not need the hassle, try these tests:
*Audit My PC Firewall Test
*Steve Gibson's PC Shield Test
*Confiker Eye Chart
*Browser security test
*PC Security Test
*User Security Test
====Antivirus====
As the best software changes annually, see Anti-virus for an up-to-date list and reviews.
You may want to look for anti-virus software with a games mode, such as BitDefender GameSafe."BitDefender - GameSafe Antivirus Defence review" - http://www.itreviews.co.uk/software/s680.htm - IT Reviews, November 2008 Whilst these will not afford as much protection as a full anti-virus suite, they are designed to minimize the impact on game play. For example, when gamer mode is switched on, pop-ups will be disabled, and the update to virus signatures will be postponed.
====Firewalls====
As the best software changes annually, see Wikipedia - Firewall for an up-to-date list and reviews.
====Anti-Spyware====
Two of the best programsSpyware - Remedies and Prevention - http://en.wikipedia.org/wiki/Spyware#Remedies_and_prevention - Wikipedia, May 2009 are also free:
* Spybot - Search & Destroy - all features free for non-commercial use
* Ad-Aware SE - free scans for non-commercial users, but must pay for other features
===Secure your router===
If you have wireless enabled, a default on most routers (the box that sits between your computer and the telephone line), then you need to ensure that it is less likely to be hacked either by your weirdo neighbor (search for what happened to Matt Kostolnik in the USA...) or by a drive-by hacker. This will also ensure no-one else is stealing your bandwidth for a faster gaming experience!
This requires administrator access to your computer.
*Right-click on the Network icon in the bottom right corner of your screen
*Select the option to Open Network and Sharing Center
The following is for Windows 8. Other versions and operating systems you will need to read the manual or search the internet for how to configure your router.
====Change the default password and security level====
*Go back up a level on the Control Panel to "Network and Internet" (on the address bar at the top of the box)
*View network computers and devices
*Wait for the list of devices to be updated
*Under "other devices" find your router e.g. BT Home Hub
*Right click and select View device web page
*If you are using Firefox with NoScript add-on, then allow your router scripts to run
*Settings
*If you have set an admin password, then enter the password
*See or Change your wireless network key
*Select WPA2 (WEP is crackable in under an hour and WPA has been superseded by WPA2)
*Change the wireless key and write it down (the only one I do suggest you write down as you will need to use it on ALL devices you want to connect to the internet, including when family/friends visit)
*Click Apply
====Update the driver====
From the Network and Sharing Center
*Change adapter settings
*Right click on Ethernet > Properties
*Configure
*Driver tab > Update Driver
*Search automatically
For further steps you can take to secure your router, see How to secure your Wi-Fi Network Against Intrusion - http://www.howtogeek.com/68403/how-to-secure-your-wi-fi-network-against-intrusion - How-To Geek, June 2015
===Create a low-privilege account===
Windows allows you to create multiple accounts on a device. It is good practice to keep a separate account that has the highest privileges (an Administrator account) and use a low-privilege one for daily use on the internet. This will reduce the ability of malware to install bad software on your device. 
Make sure this Administrator account has a strong password (at least 12 characters using a combination of lower case, upper case, numbers and characters e.g. Th1$1$a$tr0ngPw0rd).
Use the administrator account to update or install new software and run a weekly full virus scan. Use the low privilege account for everything else.
If you do not know how, for Windows 10, search for WindowsCentral "How to use Windows10 non-admin and why".
===Turn Off Auto-Play===
Whilst convenient for music and videos, it also allows bad actors to install malware via pirated or fake or (rarely) manufactured software/music discs or copied from a friend's PC. Malware can also be installed simply by plugging in a USB stick used elsewhere on an infected PC.
For Windows 10:
*Click on the Windows icon in the bottom left of your screen
*Type "Autoplay"
*Toggle "AutoPlay For All Media And Devices" to Off
*Switch AutoPlay defaults for removable drives and memory cards to "Take No Action"
You can also use the Administrator account to set this up as a group policy. Search for "TechRepublic How to disable AutoPlay and AutoRun in Windows 10" for details.
==Use WoW safely==
===Run WoW using the launcher===
Use launcher.exe rather than wow.exe to run World of Warcraft. 
The launcher that can catch some viruses/trojans that you may not know that you have on your computer. One primary example is trojan-downloader.win32.agent that was found on many computers using the Launcher.exe . 
===Use a strong password for your account===
Think of the password as the key to unlock your account. If it is too simple, it is easy to pick the lock. Words from a dictionary, pets names, birthdays and "password123456789" are all easily guessable, or, with software, can be fired at a website by a botnet (massive networks of malware-infested PCs, thousands of them) until the password is cracked. A strong password, like a strong lock, means the thieves are more likely to be detected trying to break in, so will move on to easier pickings.
A strong password"Guidelines for strong passwords" - http://en.wikipedia.org/wiki/Password_strength#Guidelines_for_strong_passwords - WikiPedia, October 2009 is:
*At least 8 characters long, preferably 12 to 14
*Contains alphabetic, numeric and punctuation characters (e.g. my#2nake1s!0n_aplane)
*Note however that passwords are case-insensitive! Don't rely on CaMeLcAsInG.
*If written down it is encrypted in some way (e.g. if you write it in your diary, don't write down that it is a password; create a long list of fake passwords)
*Can easily be remembered by you, and you alone (e.g. is a phrase from a book, and only you know which page and paragraph; initial letters of the fourth line of your favorite song)
*Is never stored on your PC (any file could be stolen)
*Is only used for BattleNet and is different to your email password
*Changed regularly, at least every quarter
Remember:
*Never, ever, share it with anyone (e.g. someone telephoning or eMailing you or contacting you in-game "from Blizzard" saying there is a problem with your account)
*If you do ever share it, (e.g. to allow your roommate to log on and tell your guildmates you are stuck in traffic), then change it as soon as you get home
*Never let your younger brother know your password, or shoulder-surf while you are typing it in. Get him a trial account instead
===Use a Blizzard Authenticator===
An authenticator is a small key-fob device that gives you a One Time Password (OTP) to enter in addition to your normal password, thus ensuring the user has something as well as knows something. These are cheaply available from the Blizzard store. Note that they are not infallible - you still need to keep your PC free of key-logging malware. These trojans, such as emcor.dll"Hacked with Authenticator - Blizzard EU Forums, 27 Feb 2010 - http://forums.wow-europe.com/thread.html?topicId=12730404058&sid=1&pageNo=1, can intercept the code you type in, tell you that you have "entered an invalid code" and send the real code, along with your user name and password, to a thief working in real-time. This is called a "man in the middle" attack.
===Use a separate email address for Blizzard===
With the merger of accounts into BattleNet, you will now have to use an email address to log into WoW. It is highly recommended that you set up a separate email address to use for, and only for, logging into WoW and getting eMails from Blizzard.
*For your paid for service, create a separate alternative e-Mail with a nonsensical extension such as JSmith_altmail_dffduh@virgin.net
*For free mail services such as GMail, CryptoMail (secure), HushMail (secure), MSN Hotmail, S-Mail (secure, but Windows/Linux only), or Yahoo, create a unique but nonsensical address such as Bubba196Huggle@yahoo.com or This1IsNin@live.co.uk
*Set the Secret Question to a custom question (where possible) and treat this like you would a password
*Do not use an email service where you cannot choose a custom question (names are easily guessable)
*Un-check "Remember Me On This Computer" whenever you log in
*Set the Secondary Account field to another new email address that you do not use, ever, except when you have forgotten your password. If you have to use it to recover the password, then delete the account and create a new one
====Clear stored fields and files====
Be aware that this e-Mail address may be recorded if you use a public computer, so if you HAVE to use one to read Blizzard eMails or run WoW, (or you use a laptop that might be stolen) then:
*Turn off the browser Auto-Complete function"How to use the Auto-Complete feature in Internet Explorer 5 and 6" - Microsoft Knowledgebase - 24 January 2007, or remove the field from the list"HOWTO remove form field completion values in Firefox" - - Jason Clark - 25 June 2007:
**Navigate to the form containing the field that has a saved value that you want to delete
**Click on the field so that your cursor is in the text field
**Press the down arrow until the value is highlighted
**For Microsoft Internet Explorer - press Delete and the value will be removed from the saved form history
**For Mozilla FireFox - press Shift and Delete together
*When done:
**Remove any cookies on the PC"How to delete cookies..." - - Pinsent Majors - 22 October 2009
**Clear down any Temporary Internet files 
***On IE, Tools > Internet Options > Advanced > Security > Check "Empty Temporary Internet Files folder when browser is closed""How and Why to Clear Your Cache" - - Microsoft - 30 June 2006
***On Firefox, Tools > Options >Privacy > check Always Clear My Private Data"Set Firefox To Clear Temp Files, History etc. On Shut Down" - - MakeUseOf.com - Mark O'Neill - 14 December 2008
====Use Real ID sparingly====
The only exception to the "never tell anyone your e-Mail address for log-in" is that Blizzard have decided this is what you have to share to use the Real ID feature. This removes one level of security for your account log-in so ONLY share it with people you know in the real world (and trust) as it is ALSO your account ID.
===Install Blizzard Updates via the Launcher===
Blizzard have supplied a launcher which should automatically download and install updates for you. This is particularly useful when there is a large patch as they typically make it available in sections which can be downloaded over several days, thus reducing the impact on your PC and their server. More information is at the Blizzard Background Downloader FAQ and Blizzard Downloader FAQ.
However, there are times when the background downloader does not work. This seems to be an issue with Windows Vista users who allowed Blizzard to automatically create the Public > Games > World of Warcraft directory, though it also occurs with Windows XP users. Blizzard believe it could be conflicting background applications"Does your Blizzard Downloader fail to launch?" - http://us.blizzard.com/support/article.xml?articleId=21624&searchQuery=background%20downloader&pageNumber=1 - World of Warcraft Technical Support, May 2009, though its advice on closing background services requires more technical knowledge of Windows XP"Turn Off Unnecessary Windows XP Services" - http://www.jasonn.com/turning_off_unnecessary_services_on_windows_xp - Jason A. Nunnelley, April 2005 or Vista "Tweak Windows Vista services the right way" - http://blogs.techrepublic.com.com/window-on-windows/?p=720 - Greg Shultz, June 2008 to carry out safely than most non-expert PC people have. The advice on updating Windows is relatively sound. Or it could be a problem with security software conflicts, or the downloader itself."Download todays patch over and over" - http://forums.worldofwarcraft.com/thread.html?topicId=16473141623&sid=1&pageNo=1 - Neerdia of Rising Storm, April 2009 One option to try is to backup the entire directory to a removable hard drive, delete the original and create a new c:\users\public\games\World of Warcraft directory from the administrator account. There are other issues and solutions scattered through the US and EU support pages and EU Technical Support Forum.
If you find you are still unable to download the patches, having followed all the forum advice, then the best option is to copy the WoW-n.n.n.nnnn-to-m.m.n.mmmm-enGB-downloader.exe file from a computer or user you trust to have a "clean" PC. Run your own virus checking software on the download media or email before your copy it across. Running this should download the patch direct. There are many mirror sites listed (including those on Wowpedia) but these have frequently been attacked by crackers, with the purpose of installing malware to capture account information. Use these only as a last resort, and check any listed URL by copying it and running a Who-Is query at a reputable site, such as Network Tools.com. Note that you may have to remove the "http://" part if the site requires it and leave just the first main part (up to and including, for example .com or .org or .co.uk). The second complication is obfuscated URLs.How to Obscure Any URL - http://www.pc-help.org/obscure.htm - PC Help, January 2002 If the URL contains the "@" character or "%40" then it will redirect you to the site after those characters. In short, if you are not sure it is safe, do not use it and contact Blizzard Technical Support for help.
===Never share your account===
Blizzard is very strict on thisWORLD OF WARCRAFT®
TERMS OF USE AGREEMENT, Section 11 - WoW US, 29 July 2008 - http://www.worldofwarcraft.com/legal/termsofuse.html:
"Blizzard does not recognize the transfer of WoW Accounts or Blizzard Accounts (each an "Account"). You may not purchase, sell, gift or trade any Account, or offer to purchase, sell, gift or trade any Account, and any such attempt shall be null and void." and
"You are responsible for maintaining the confidentiality of the Login Information, and you will be responsible for all uses of the Login Information, whether or not authorized by you."
This includes the use of "power leveling" services, sharing with a friend or spouse, etc due to the risk of the account being compromised, the contents sold and emptied (either to earn real-life money or for revenge). This costs Blizzard time and money to resolve and takes away time from legitimate users of the game who have to wait longer for legitimate issues to be resolved. The consequence of Blizzard finding you responsible for account sharing ranges from a temporary ban through to deletion and permanent closure of the account with no restitution. Gold buying may also result in account compromise, banning when discovered, or, worse, misuse of your credit card, or even identity theft.
====Exception for minors====
The ONLY exception allowed is if you are an adult, you are allowed to open account on behalf of a minor child (in the UK this is below age 18, may vary by country).WORLD OF WARCRAFT® TERMS OF USE AGREEMENT, Section 3 - WoW US, 29 July 2008 - http://www.worldofwarcraft.com/legal/termsofuse.html
"You agree to these Terms of Use on behalf of yourself and, at your discretion, for one (1) minor child for whom you are a parent or guardian and whom you have authorized to use the account you create on the Service."
===Be wary of in-game whispers from Blizzard etc===
Scammers will try and direct you to sites with malware on them by promising free mounts or cheap gold or telling you your account will be banned.
"I was just contacted in-game by a Game Master for my password!" Games Master whispers ALWAYS appear in a separate chat window, and you will see the Chat Request flashing in the top right of your screen. 
If anyone whispers you more than once claiming to be a GM, or offering paid-for services, right click on their name and report them for spam. 
Also be wary of:
*"girls" chatting you up and sending you links to sites that LOOK like a Facebook page
*characters bragging about their achievements, or whispering to join your pug, and posting links to fake armory profiles 
*links to jokes and downloads in Trade chat - if you "must check it out" then install McAffee site adviser and search for the site first
*Fixed searches in google ad-words to send you to wwww.bl1zzard.net or www.curses.com if you try googling the site instead of blindly copying the link
They often copy the site, such as the battlenet login page, to make it look like one, then exploit any vulnerabilities in your browser to download malware, so ALWAYS check the site name carefully. If you "must check it out" then install McAffee site advisor and search for the site first.
==Surf the web safely==
The internet has been likened to the Wild West"Internet is becoming as lawless as the Wild West, report peers" - http://technology.timesonline.co.uk/tol/news/tech_and_web/the_web/article2231564.ece - Times Online, August 2007, travel at your own risk. So how do you protect yourself better?
===Look where you are going===
Not all web page links point to where you think they are heading. Take for example Thís Link to a joke.
Hands up if you clicked on it?
Always:
*check in the status bar, or when you hover over it that the link matches the site it says it lists
*watch out for unusual characters like í instead of i
*check the file extension on the link, for example, be careful or, or avoid, any file format that does not end in .htm or .html unless you are actually planning to download a file. 
====File extensions====
Information is held on computers in files. Under Windows, each of these will have three or more letters at the end after a dot such as file.htm or file.html. This file extension is used to tell the computer what to do with the file, and which program to use to open it. By default, Microsoft hides file extensions on files, but this can be easily changed. This default is dangerous, because if someone sends you a file called IKilledYou.jpg, you may think it is a picture, but if file extensions are hidden, and it is really IkilledYou.jpg.exe, it may contain malware which will be automatically run as soon as you open it.
In particular be careful of files sent to you, or links with, the following extensions:
*Executables (.exe) such as http://download.microsoft.com/download/C/C/0/CC0BD555-33DD-411E-936B-73AC6F95AE11/IE8-WindowsXP-x86-ENU.exe
*Compressed files such as .cab, .arj, .zip, or .dmg
*Scripts such as Visual Basic (.vbs) or Javascript (.js)
*Installation packages such as .msi or .msu
===Get a Look-Out===
Consider installing anti-phishing software
"Netcraft Toolbar" - http://reviews.cnet.com/internet-security-and-firewall/netcraft-toolbar/4505-3667_7-32329363.html - CNet Reviews, Feb 2007 that warns you if a link may lead to a known "dodgy" page. Examples include:
*IE or FireFox: Netcraft toolbar (free)
*McAfee SiteAdvisor (free) or SiteAdvisor Plus (paid for)
*FireFox: NoScript add-on to prevent cross-site scripting
===Beef up your browser===
Consider changing to another web-browser that has a better record of preventing and fixing issues than Internet Explorer, the default browser supplied with your PC. Examples are Mozilla FireFox for Windows and Linux and Camino for Mac.
For e-Mail and newsgroups, you may want to look at Mozilla Thunderbird, or SeaMonkey which will also integrate your instant messaging.
====Internet Explorer====
If you must use IE, make the following changes to IE to improve on the default security"How did I get infected" - http://www.geekstogo.com/forum/index.php?autocom=custom&page=How_did_I - Geeks to Go, May 2009:
*Open IE 
*Go to Internet Options > Security > Internet, then press "Default Level", then OK. 
*Press "Custom Level." In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
From now on, you will be asked whether you want ActiveX objects to be executed and whether you want software to be installed.
Sites that you are sure are safe can be moved to the Trusted Zone in Internet Option > Security. Though as servers can be hacked and defaced, it is better NOT to add any sites to this zone, but always prompt.
===Is that e-Mail REALLY from Blizz?===
"You have been reported for spamming and your account is now on a three day ban. Please click on this link if you wish to dispute this decision"
Now the message "from" says it comes from noreply@blizzard.com but the "from" can VERY easily be spoofed so how can you tell if the message is genuine ... or not?
There are several technical ways of doing it, but firstly, simply try logging in to your account. No ban? The message was not genuine. If you have been banned, then ignore the e-Mail and go DIRECTLY to the Blizzard Account Support pages . If you really must follow the link, then right click on it and COPY the link and paste it into your address bar. Does the link have funny characters or extra ones? Does it have a Tiny URL - in which case copy it and use the preview facility: instead of going to http://fat.ly/jdmf32 go to http://preview.fat.ly/jdmf32 for example. However, opinion is divided on the security and privacy of these shortened links http://www.internoetics.com/2010/01/13/my-take-on-short-url-services-protect-your-brand/, so use with care.
If the link is malware, and you want to take a step further report the spammer, then consider joining SpamCop .
Hackers use clever "social engineering" techniques to make you feel worried ("account banned") or clever ("get ahead with this hack") and do things in a panic that you would otherwise stop and think about. Other types of e-Mails (or in-game whispers) you may receive include:
*Buy gold, no more grinding, get ahead
*Clever flying hack
*Automate your fishing/mining/other boring repetitive stuff
ALL of these (even if not infested with malware) would break Blizzard's terms and conditions of fair play. They could (and have for other players) resulted in bans or out-right account termination (no more World of Warcraft, bye-bye Level 80 characters...).
Also be wary of "girls" who woo you in-game, or characters who brag about their achievements, and send you a link to their armory profile, only it isn't the armory, even if the site looks like it.
====Make your e-Mail client safer====
If you use Outlook, then turn off Mail Preview for your Inbox folder and right-click on genuine messages to set up Rules to automatically move them to Folders and on the address to add it to your address book. Treat all other e-Mails with caution.
Consider using a different e-Mail client to Microsoft's.
Turn off HTML viewing. This will depend on your e-Mail client. Read the Help file.
===Check that Instant Message===
Apply the same caution when using instant messaging. 
How do you know it is your friend on the other end, and not his spiteful kid brother who is using his logged in account whilst he is out, or your worst enemy who has found out the password, or even a hacker from Russia or China? One of the most successful social engineering hacks is being carried out by a "Rasputin bot" or "SlutBot", that pretends to be a lovelorn human male or female."Beware the CyberLover that Steals Personal Data" - http://www.pcworld.com/article/140507/beware_the_cyberlover_that_steals_personal_data.html - Sandra Rossi, Computerworld Australia, 2007
When using Instant Messaging software (IM, Yahoo! Messenger, IRC, mIRC, ICQ, AIM, WLM etc):
*Configure it using Tools > Options (or similar) to require contacts to be approved
*Share the minimum of personal data (especially your birthdate) with "everyone"
*Set it to prompt you to check links, approve video requests etc
*If you use IM on any other computer, change your password when you return "Password Stealers Sit on Popular Download Sites" - http://www.pcworld.com/article/163033/password_stealers_sit_on_popular_download_sites.html - Erik Larkin, PCWorld, as you don't know that your friend, or neighborhood internet cafe, has not unknowingly installed a keylogger. (This is also good advice if you play WoW at a friend's house, change the password when you get home).
You may prefer to switch to a different multiple-access IM (readers are strongly advised to check for security issues and reviews before installation!) and change all your passwords regularly. These include:
*Miranda-IM
*Windows: Pidgin (formerly gaim), Trillian, Instan-t, or Kopete
*Macintosh: Adium or Proteus
===Safer websites===
Note that some of these websites have also been known to have been hacked"ImageShack hacked in oddball security protest" - http://www.theregister.co.uk/2009/07/13/imageshack_hack/ - The Register, 13 July 2009, and no website can ever be considered truly safe. However when they are, due to their popularity, news of the hack gets out sooner. This list should help you identify real versus spoof sites (check the history page to ensure this page has not been edited!):
*Blizzard US: www.blizzard.com/us, www.worldofwarcraft.com
*Blizzard Europe: eu.blizzard.com, www.wow-europe.com, eu.wowarmory.com
*Add-ons: www.curse.com, www.wowinterface.com
*pictures: Imageshack.us, www.photobooth.net, photobucket.com
*Movies: Youtube.com, video.Google.com, Warcraftmovies.com
*Quest and item information: Allakhazam.com, Thottbot.com, www.wowhead.com, Wow.Stratics.com, WoWHead.com, WoWvault.IGN.com, wow.Warcry.com, www.guildox.com/wr.asp
*News: www.mmo-champion.com, www.wowjuju.com, www.wow.com
*Tactics: www.bosskillers.com
*Character improvement: be.imba.hu, wow-heroes.com, elitistjerks.com
*Raid voice chat: www.ventrilo.com, www.teamspeak.com
**Druids: thedailydruid.com
**Druids, Balance: www.themoonkinrepository.com
**Mages: l2dps.com
**Paladins, Holy: www.bananashoulders.com
**Paladins, Retribution: www.retpaladin.com
*Combat log parsers: www.gurre.eu/wowlogparser/forum/, code.google.com/p/stasiscl/
==Contacting Blizzard==
===In-Game Game Master Department===
If you suspect your account has had a security breach, and are still able to log in, or suspect someone you know has been, then try contacting the in-game GM by using the red "?" icon at the bottom of your screen to create a Ticket. This is usually the fastest way to get an account investigated and locked outside of normal working hours.
If you are unable to log into your account, for example the hacker has added an authenticator, then you can contact them via the methods listed on the Game Master support pages or the Customer Service Forum.
*Blizzard Support US EU
*Customer Support Forum US EU
*Account and Payment Support US EU
*For all other regions, please check your regional support pages:
**China http://www.warcraftchina.com
**Korea http://www.worldofwarcraft.co.kr
**Taiwan http://www.wowtaiwan.com.tw
For all other customer or technical support issues, see the appropriate battle.net forum.
==Further reading==
For more information see:
*Blizzard Computer Security Information 
*Securing Wireless Routers
*PC World guide to How to buy home networking
*Managing Processes on Vista
*Guide to Processes running (or should not be running) on your PC
*Latest Virus alerts
*PC Infection detection
*Identifying E-Mails from dirt bags out to steal your account info 
*How to remove Windows Messenger from Windows XP or Stopping Windows Messenger in XP
*Belarc Advisor to review for security issues or Download from CNet
===Blizzard forum links===
*Free security software
*Guide: Virusses & Keyloggers - It stops here
*World of Warcraft Forum sticky on Trojans
*How to recover a compromised account
*Guide: How to make a ticket
*Guide: How to CLEAN your PC from Keyloggers
*Guide: How to CLEAN your MAC from Keyloggers
*Guide: How to REALLY avoid getting hacked
*Guide: How to spot real Blizzard emails
*Guide: How to call Blizzard
*WoW Europe Scam Policy
==References==
Category:Technical support