I think I've been hacked, please help!

For the past two days I've been getting banned for spamming gold selling, I know the emails I got are real because I had to enter the battle.net site and change my password two times.

Upon getting my account back, I found two characters I've never made on two different servers.

I have the updated full version of norton so I'm scanning for any virus at the moment.

I honestly don't know what to do and I'm really scared, please help.

*I've never been to those scammer sites that they spam in trade and whispers

Just to show that the email wasn't fake.

Account Name: **********

Account Action: 3 hour suspension and password reset
Reason for Action: In-Game Chat Policy Violation - Advertisement and Spamming

This suspension happened because one or more characters on the account were identified exchanging, or contributing to the exchange of, in-game property (items or gold) for ""real-world"" currency. This exchange process negatively impacts the World of Warcraft game environment by detracting from the value of the in-game economy.

To prevent further harm to the game and the account you use, the account has been suspended for 3 hours and the password was reset. You do not need to reply to this email, as the account will automatically become available again once the 3-hour suspension period has ended. It may take up to one hour for our system to generate and send the new password. If you have not received a password within one hour of this message's delivery, please check your Spam, Junk, or Suspect Mail folders. If you are still unable to locate the email containing your new password, please contact us using this form: http://us.blizzard.com/support/webform-us.xml or use the password recovery function on https://us.battle.net/account/support/login-support.xml.

Account compromises are usually the result of the registered player of the account sharing his or her login information or playing on a computer that has a virus.

Please remember that it is your responsibility to keep your login information confidential. Any account that is registered to your name may not be shared with anyone except for one minor, of whom you are acting as a parent or guardian. You are also responsible for every use of your login information, whether authorized or not.