Two accounts hacked in one week. Now I'm totally paranoid

[Tequila]

I've gone years without incident and now in one week *boom* my WoW account was hacked then one of my email accounts(not the same one as I use for WoW)

Here's what scares me: I take good preventive care to not get hacked. I do the following:
I always keep Windows7 up to date
I use Avira AntiVir permium, one of the top rated antivirus regarding detection rates
I don't share my passwords with anyone
My passwords are very secure and I never write them down.
I'm behind a router using NAT
With WoW, I keep "Remember Account Name" checked so I don't have to type it when logging in.
I use a USB wired keyboard.

So with all that I got hacked anyway. No virus found by Antivir at all. Ok WoW who cares, it's just a game. But the only way I can think I was hacked was a keylogger and that scares me. What if my bank account or investment account was the target?

For WoW I'm going to order the authenticator device. But now I'm so paranoid about all my other accounts especially bank and investment. I'm thinking about writing to those institutions and suggesting an authenticator to them.

The one other thing I did was download the Kaspersky trial and they have this cool virtual keyboard to supposedly fool keyloggers. We'll see, because I'm using that religously now but after 30 days I'll have to buy it and then I'll have 2 anti virus software lol.

Anybody else paranoid? Any suggestions for me? What else have I overlooked?

Thanks

 

[stlcardinals]

Blizzard Authenticator is a must.

Change your passwords often.

Make up bogus information for security questions.

For your web site needs, you might look at LastPass.

 

[MrColin]

Your email authentication may have been compromised through a stolen cookie, or sniffed off of a public or cracked wifi. You could have a rootkit or trojan that has never been identified by any antivirus vendor before. Your email provider might be compromised internally.
Both services I believe are subject to brute force attacks. Does anyone have physical access to your computer?

There are free on screen keyboards out there, I think windows has one built in doesn't it?

You sound paranoid, but definitely they are after you also.

I really like the commodo firewall freeware. Not so much for the firewall but for the monitoring and control of stuff that is being executed in real time. It nags you a lot at first but once you have all of the rules saved it gets less intrusive. It doesn't let anything phone home or write to the registry or execute another binary until you say it can. I use that in combination with NOD32. Disable javascript in your browser(s). Chrome is great but I don't use it since it has nothing like the no-script plugin for FF, cuz lets face it you sometimes want to run javascript. I also have a hosts file with 14000 ad server, and malware server domains all pointing to 0.0.0.0 . I got that from here:http://www.mvps.org/winhelp2002/hosts.htm You can avoid some other bs by using OpenDNS. Use a VPN or something similar on public wifi networks.

For auditing your system you should run a packet sniffer on your lan to see what is being broadcast from your machine. For better detection of rootkits use a live CD based scanning tool. By definition, your OS can't see rootkits, so neither can your AV.