Sister got hacked then banned! Help!

#0 - July 9, 2010, 2:26 a.m.

My sister was playing earlier when suddenly she kept getting booted over and over. She was on the phone with a friend who told her she may have been hacked. She gave her gold to her trusted friend she was questing with and then logged over to her other toons one by one and sent their gold to me. On the final one, she got booted just after sending the mail and tried to get back in to send a ticket only to find that her password was no longer working. She came to the site and found instructions on what to do and followed step one which was change your password. She did and is now able to log on to the site, but not the game because she got banned for 3 hours for buying/selling gold!!! She is anxious to get back in game and check what was taken if anything, and if her toons are safe. But she can't. Is there anyway to fix this asap?

Orlyia

#3 - July 9, 2010, 2:44 a.m.

Well, without a character name and realm, there is very little I can do to look this up - but the above scenario isn't likely to have produced that.

Now, if she's been compromised and didn't know it - it's extremely likely something was done with the account without her knowledge and the penalty just processed through.

She can email wowaccountadmin@blizzard.com if she'd like to pursue that - but I'd recommend she do full security sweeps of her system and make sure her email is also secure.

This sticky may be useful.
Account Hacked? Security Issue? Look Here!
http://forums.worldofwarcraft.com/thread.html?topicId=24702231244

You may also want to look into getting an authenticator for your account. It's no substitute for good security habits, but it will help keep them out of your WoW account.

Blizzard Store
http://us.blizzard.com/store/browse.xml?f=c:6

Mobile Authenticator
http://us.blizzard.com/support/article.xml?locale=en_US&articleId=26109

Orlyia

#5 - July 9, 2010, 3:03 a.m.

Q u o t e:
We will look into the other stuff. Her toon name is Whysper and her realm is Eitrigg, if that helps.

Well, at the very least, someone has been using this to advertise. I'd be looking for malware or a compromised email. Possibly responded to a phish, those are very popular at the moment.

Orlyia

#7 - July 9, 2010, 3:43 a.m.

Q u o t e:
Scanned her computer using Trend Micro and just found a few cookies which we deleted. Is that enough. When you say someone has been using it to advertise, what does that mean? And respond to a phish in game? Because I asked her and she said she hasn't logged into any supposed website that belongs to Blizzard. Is there anyway to lift the ban before the time?

Those typically expire fairly fast. You could appeal to Account Administration, but it will likely end naturally long before they can respond. You are still free to do that if you like.

And cookies won't do this. I recommend going over that link I posted above very carefully. There are scanners aimed at trojans/viruses and ones aimed at adware/spyware. One of each - ran independently would be my minimum recommendation with the launcher up and a bit of gibberish in the text boxes.