I usually play this game single player, single deck. The two cards in combination are of course doom, doom, doom and the Balrog which read;

"Cannot be optionally engaged. The Balrog and shadow cards dealt to The Balrog are immune to player card effects. While in the staging area, The Balrog is considered to be engaged with the first player and only the first player can declare attackers against The Balrog."

And

"Forced: At the end of the quest phase, remove 1 damage token from Doom, Doom, Doom. Then, if there are no damage tokens here, add The Balrog to the staging area.

Forced: At the end of the quest phase, The Balrog makes an attack if it is in play. "

I have been playing this as at the end of the quest phase, Balrog makes an attack against the first player. Then during the combat step Balrog makes an attack against the first player. Is this correct?

In one player it's just two attacks against you, in a multiplayer games it's two attacks for whomever has the first player token correct?

Yes, that is correct.

Do remember, though, that the Balrog attacks two times every round, including the one it enters play (as clarified here ).

That is good to know, all the more reason to leg it through moria. Oh how I wish attack negation worked on him!

Or at least on Shadow cards on him. These extra attacks are... not cool.