Banned and Confused

Customer Support
Hi everyone,

My main's account was banned last week: Overcast@Hyjal. I'm posting this from my wife's account. According to the email from Blizzard, I was banned for Exploitative Activity: Unauthorized Cheat Programs ("Hacks"). I was totally shocked when I received this
notification. My wife and I each have our own accounts and have been playing WoW since
Burning Crusade. I have never used hacks or 3rd party programs. I would never dream of jeopardizing the years of effort I've put into my characters. I use an authenticator and my account has never been compromised to my knowledge.

I went through the appeals process and by the second ticket they told me that after further investigation the issue was considered closed and there would be no more replies. Interestingly though, they did actually name the addon that caused my account to be banned. From what I've read, Blizzard doesn't usually disclose this information so I was a bit surprised. I'm not going to provide the name of the addon because I don't want to risk having this thread deleted before a blue (hopefully) has a chance to look at this. The addon name is listed in the ticket history.

I took the name they gave me and googled the hell out of it. I didn't get any matches. Next, I scanned my entire machine several times over including the registry and still found nothing. So now I'm totally at a loss because I have never run any addons outside of the usual ones (i.e. recount, quartz, etc) and the ticket is closed which means I have no way of disputing it. Imagine for a moment that your account was suddenly banned and Blizzard marked your appeal ticket Resolved saying that you were running an addon called HappyMurloc. If you had multiple years invested in your account you would probably be going crazy like I am now.

I did some research and learned that bans can land several weeks or even months after
the violation. My computer was in fact infected with a Trojan back in September:

Date: 9/8/2012
Time: 1:21:59 AM
Description:
Microsoft Antimalware has deleted an item from quarantine.
For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Tracur.AZ&threatid=2147662159
Name: Trojan:Win32/Tracur.AZ
ID: 2147662159
Severity: Severe
Category: Trojan
Path: file:_C:\Documents and Settings\XXXXXX\Local Settings\Temp\mor.exe

More information: http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32/Tracur

The virus allows backdoor access and control, redirects web searches, etc. I noticed that two instances of iexplore.exe would be present in Task Manager even if I didn't have Internet Explorer open. This behavior is consistent with an infected machine. Seeing as how the WoW engine scans for active processes on your PC, it's possible that this virus would appear as a concurrent program running alongside WoW which in turn would trip the alarm. This is just a theory of course but it's the only thing I can come up with regarding unauthorized 3rd party programs. Thing is, Blizzard will usually suspend an account for 24hrs to give you time to clean your PC if a Trojan is detected. In my case they went straight to perma-ban. In the meantime, I have managed to remove the virus and have run several different scanning programs and they all come back clean.

I decided to come to the forums as a last resort to hopefully have a blue take another look. I realize that I'm out of options and am pretty much screwed here. The ticket system is dismissive at best and calling Blizzard doesn't help either. If the virus isn't to blame then I honestly don't know what else it could be. The addon Blizzard mentioned doesn't exist on my machine and I can't find any matches on Google. Short of driving down to Blizzard HQ with my computer in the trunk for further analysis I don't know what else to do. The kicker
here is that even if I was to consider opening a new account I would be paranoid about getting banned all over again. Whatever tripped the alarm could decide to phone home again randomly while grinding a poor Orc from level 1-90.

I've been a loyal customer for years and have spent hundreds on faction transfers, server transfers, etc. Getting banned for something you have no clue about one week after MoP launches is disheartening and cruel. I sincerely hope this never happens to any of you.

Overcast@Hyjal
This is my advise on how to appeal this ban. We sadly will not be able to go into details on why the account was banned however, the forums are not primarily purposed for that, only discussion. Anyway, here is what you do.

Go to the support site:

https://us.battle.net/support/en/ticket/submit

Click: Choose from a list of pre-defined topics

Then choose the I have an issue in-game, and my account is banned or suspended.
10/12/2012 11:50 AMPosted by Gypsymoon
I went through the appeals process and by the second ticket they told me that after further investigation the issue was considered closed and there would be no more replies. Interestingly though, they did actually name the addon that caused my account to be banned.


ok, caught this part on the reread, and it does look like the appeals process has run it's course. You can still attempt to resubmit your appeal though, not much can be done from here on the forums though, you do need to know this up front.
10/12/2012 11:50 AMPosted by Gypsymoon
I decided to come to the forums as a last resort to hopefully have a blue take another look.


The "blues" on this forum do not investigate such things. Your only recourse is through tickets.
I am passing this one along, it's not a run of the mill thing.

The main thing is that you make absolutely certain that your system and email account are secure.
I hope you get this problem solved, I'm glad you got orlyia doing some leg work for you :)
10/12/2012 12:32 PMPosted by Kalorea
Funny how blizzard bans people for having trojans on their computers or using add ons.

That's a pretty huge assumption. You have absolutely no idea why this person's account was actually banned. They mentioned an "add-on" but that doesn't mean that the OP was in control of the account at the time and that it had not been hacked.

Please do not jump to conclusions Kalorea.
Funny how blizzard bans people for having trojans on their computers or using add ons.

If I kicked every customer out of my store who made a mistake I would start to create a bad rep for myself. I see Blizzard doing this by giving heavy handed bans.


Incidents like this are very rare. And in fact, you have those in the other camp who says Blizzard is way too lenient on banning those who bot. Blizzard can't win - they are either mean and heavy handed or don't care...
Good luck Overcast :)
Orlyia, I can't express how happy I am that you came to my rescue. I'm eternally grateful. The ban has been reversed. Also, thanks to all those that took the time to add comments to this thread.

Seenah, I look forward to seeing you again in game.

Thanks :)

Overcast
Orlyia, I can't express how happy I am that you came to my rescue. I'm eternally grateful. The ban has been reversed. Also, thanks to all those that took the time to add comments to this thread.

Seenah, I look forward to seeing you again in game.

Thanks :)

Overcast


That is awesome to hear!!! Glad it worked out for you. Good luck!

:)
The exact same thing happened to me. It took a grand total of about 8 days and over 4 customer support reviews for my account to be finally be unbanned. I was also affected by that same malware in the past, I don't know if it had a connection but I'm really glad it's been resolved.
10/12/2012 02:58 PMPosted by Skjellyfetti
contrary to what other may have suggested.


Generally a Blue here can't.

10/12/2012 12:08 PMPosted by Orlyia
it's not a run of the mill thing.


This one was different.

Always best not to deal with absolutes.
10/12/2012 03:07 PMPosted by Skjellyfetti
Aboslutes like "the blues cannot help" is not really accurate.


But generallly.

Would you rather people flock here to have Blues address their issues?

Don't answer that. I already know you would.

That's not the purpose of this forum. The above was an exception. One you'd like to see made a rule. The information given, was perfectly valid
10/12/2012 12:32 PMPosted by Kalorea
Funny how blizzard bans people for having trojans on their computers or using add ons.

If that trojan is used to perform illicit activity, then yes, the process is to action first (to STOP the illicit activity). Why? Because the account action, the ban, is not "for having trojans". It is for accessing the game through the client while a 3rd party program was active. The trojan may have been the door through which it happened, but it DID happen - the ACCOUNT (not the player) DID engage in that particular violation.

It is an important distinction to remember. When it comes to the ACCOUNT action of a ban, Blizzard isn't checking to see whether the PLAYER did something wrong - they are checking to see whether something wrong was done on or with the ACCOUNT.

We are responsible for anything done on our account, even if we aren't the perpetrator. Because Blizzard understands that accounts can and do get compromised and accessed maliciously, there is an appeal process and Blizzard makes allowance for that - being willing to reverse those bans if they can verify the malicious access. But the criteria is pretty strong to verify that because the criminal minds behind hacking and exploiting are MORE willing to lie about their innocence and provide all sorts of plausible explanations.

(Also, we won't know about it, but it would be a VERY safe bet that more than a few people with banned accounts have seen the data in the OPs post and hurried off to make their own appeal with a similar claim, just in case maybe they can get away with their intentional violations by using the OPs legitimate situation. There's even sites and forums by the scum who produce the botting programs that want to help people cheat and think they can get away with it. Funny how that works.)
10/12/2012 11:54 AMPosted by Kozzae
This is my advise on how to appeal this ban. We sadly will not be able to go into details on why the account was banned however,


"We"? You sound as though you have any input or knowledge of anything at all. I think you mean they* won't go into details.

Join the Conversation

Return to Forum