Random ban

[Devilsdog]

A friend of mine was leveling to 90, he went afk to make a sandwich and when he got back he was banned. Blizzard stated that he was using a third party program and it was the reason he was banned. Now no offence to him but he's too stupid to even know how to run an AV scan let alone use hacks or bots. He had recently only gotten access to his computer after a virus was asking for €100 in exchange for his files to be unlocked. I disabled this virus for him as AV's weren't picking it up. I'm wondering if this virus could have shown as a false positive on Blizzard's end, ie: showing as a hack. Although I did disable this virus it looked sophisticated enough to be hooking into external processes or making copies and running in the background. It felt too easy to disable (disabled it in the startup menu, wasn't even hidden). I'm thinking of sending the MD5 hash alongside startup batch files that I found running in a ticket to Blizzard to see what they say. Considering how many improper bans that I've seen happen and them being overturned I'm wondering how lenient Blizzard will be or what they'll say. Can anyone give me some advice?

[sed-]

A friend of mine was leveling to 90, he went afk to make a sandwich and when he got back he was banned. Blizzard stated that he was using a third party program and it was the reason he was banned. Now no offence to him but he's too stupid to even know how to run an AV scan let alone use hacks or bots. He had recently only gotten access to his computer after a virus was asking for €100 in exchange for his files to be unlocked. I disabled this virus for him as AV's weren't picking it up. I'm wondering if this virus could have shown as a false positive on Blizzard's end, ie: showing as a hack. Although I did disable this virus it looked sophisticated enough to be hooking into external processes or making copies and running in the background. It felt too easy to disable (disabled it in the startup menu, wasn't even hidden). I'm thinking of sending the MD5 hash alongside startup batch files that I found running in a ticket to Blizzard to see what they say. Considering how many improper bans that I've seen happen and them being overturned I'm wondering how lenient Blizzard will be or what they'll say. Can anyone give me some advice?

best is say you got hacked, they will look at the ip that norm logs on account with the recent new one and go from there.

[Devilsdog]

best is say you got hacked, they will look at the ip that norm logs on account with the recent new one and go from there.

The main thing that I'm worried about is what if he was hacked but it was done locally on his PC? I only know this to be possible because I've done this before. The virus that I mentioned could more than likely have a RAT attached to it, meaning whoever did it has local access to his PC. It would show as his IP connected even though he had no control over his PC.