More information from ppl who didn't get banned

So maybe, it seems malwarebytes could be helpful in some way.... Anyone who is using malwarebytes has been banned?

 

Any correlation for content botted? Everyone I've seen who has been banned was botting WoD content, and I haven't heard of anyone who only botted pre-WoD being banned. But then, I'm not 100% sure.

 

Here are some facts for me:
I hand leveled 10 toons from 85-100 on alliance side.
I used hb for my lowbie horde toons including level 1's, combined with manual playing and dungeons.
My highest horde toon is 70.
I only botted a few hours a day and only while I was at the computer to monitor is. Quickly shutting down if the area was too populated or there was a path problem.
1 account banned, 2 other account are fine, no botting.
I sold a few wow tokens on banned account, never bought any from the ah.
I never did any grinding only used Kick's 1-100 questing profile.
The account in question was from wow release, then inactive for about 6 or 7 years until I came back in jan/feb.

 

So, you didn't use HB for WoD-tier raids, PvP, garrisons, etc? I'm pretty sure that subscription counts have been debunked. I'm wondering if they just used some kind of pattern-recognition algorithm for current content. I mean, it'd be a pain to process that for the entire game, but would probably be a lot more manageable in chunks.

 

No only for leveling the lowbie characters. Everything else I did by hand, including dungeons. I don't pvp.

 

Well, I suppose that kills my theory. It's kind of disturbing to think that Blizzard might be performing process scanning and the like.

 

I don't really know what to think at this point. It's my first ever ban/suspension for 6months. I don't even sell or buy gold.
I would guess my HB usage was minimal maybe 8 hours or so total for 7 days and only for leveling.

 

I botted on the reg through that time period, but i only use enyo for cr automation. I dont do any automated tasks, no garrison bot, dungeon buddy or any of that crap. My account didn't get banned so idk, im thinking it was people that just let their bot go and go afk. I lost one account like that to a perma ban that i had been playing since bc, i won't make that mistake again.

 

Here are some facts from my circumstances, take them as you will.

TL : DR I think it is very likely detection was made using a method that no weird stuff would prevent like has been suggested on these forums. Short of directly countering the method of detection preemptive, I think HB was screwed on this one.

1. I ran a private 32 bit bot on (made up number, for reasons) 10 accounts. It was a sloppily updated bot from a friends bot he wrote a while ago. It was pretty simple of a bot - it ran 3 separate bot task. Most of it was hard-coded as it was designed very specifically for those task for the 5 users or less who used it. The bot had a few different versions that I ran that hooked different ways over the past three weeks leading up to the ban, mostly due to me trying to mess with the code on my own. One of the hooks was _lua_load from endscene, the other hook was also on endscene, and the other hook was done in a way that I'm pretty sure got 5 accounts I used it on banned.. they got banned before the wave, actually..

2. I also ran another numbers of bots(lets say 10) running a very simple version in 64 bit of the bot. This had very limited, hard-coded task in it as I am clueless when it comes to RE work and I know it is a pain in the ass to RE stuff to 64 bit. However, a friend did enough of the RE work I needed to convert one of the bots task to a pure 64-bit bot, which I did for learning and fun. This bot also hooked multiple ways over the three weeks for the same reasons as above.

The results were 10/10 of the 32 bit bots running were banned, which is a good sign that the detection code/method used by who ever is working right now on Blizzard's anti-detection stuff only applied it to 32-bit. This makes sense, as HB was the clear intended target here. There are a couple of possible reasons for this result in my eyes.

A) I some how accidentally shared what ever code managed to get HB detected. No one knows for sure yet exactly what got them detected that I know, but I have a fairly good idea from talking to the person who did the RE work for the 64 bit functions for me for a week or so now, as he knows the entire code and how it works in the bot I was using and has looked into it a little. He has a good guess.

B) The '10' accounts banned were shared in the sense the gold-buyers who took the gold off of it earned every week then sent me money for what ever gold made could have possibly been using some kind of honorbuddy script to auto collect and mule the gold - causing them to be banned. The other 10 accounts not banned were my own personal new bot accounts that month with no one set up to collect like that, yet. I think it is unlikely as I've dealt with this buyer and done it this way for over 3 years now, with out any issues and we've exchanged 10's of thousands of dollars with out even sweating it. He swears he did not use an HB script or any at all and did it by hand. It's possible, but I find it doubtful.

Now, I actually personally talked to a member of the HB team who I will not name for privacy reasons on skype about this. I wanted to share the code of the 32 bit bot and all versions I ran of it over the past three weeks to perhaps help them narrow down the reason for detection if it was option A). Long story short, my friend who wrote most of the code has a personal dislike for him and asked me not to share any of his own code he provided me with him. I did not feel safe editing it down my self and not giving anything away as I am very noob at this stuff. I also felt like he was some what rude, arrogant, and made some pretty interesting post on these forums. As a result this exchange never occurred.


With all that said - should some one on the HB team wish to contact me via PM here that thinks they can benefit from the above information and would be fine agreeing to keeping everything private I share via a faxed, signed, legal document I provide I will do my best to strip down the code to what I can provide you which would include any code I suspect might have flagged the accounts and send it to your email of choice. It's totally over-kill and stupid, but it is the only way I feel comfortable doing so in my current situation - the friend of mine could face legal issues for even being involved in blizzard games.. and he would not be doing so with out my begging for it.

 

I had 5 bots running random heroics all together. Only one got the ban!

 

Trial account - leveled 1-20 using questing profile - no ban
Re-sub account - less than 1 hour - BOOM banned while gathering.