Dire Aquatic Form

No, not the spec. Sharon's got her stuff back. It started with a panicky, terrified call to me on my way into work this morning, saying they'd been back in her account and she caught them in the act and all her stuff had been moved around and what should she do(punctuation removed to simulate being on my end of the conversation). I told her to run to my computer and change and her password, and she goes "...wait." Well, as it turns out, it was Blizzard restoring her stuff. They moved her to the bank, loaded up her bank, and then just mailed her the rest of the stuff.

And, not just that, it appears they felt she was entitled to everything her character was used to farm, because she got all kinds of gems and adamantite ore that the hacker had been farming. Seems a little odd, but I'm not going to complain.

So, with that out of the way, I'm hoping we can get back to our regularly scheduled addiction. We still have yet to run any Outlands instances with our little levelling group, and the only Outlands instance me and Sharon have run is Ramparts. I want more blue lootz, damnit!

Nope, not me. Sharon. The person who's only been playing the game for a couple months now. We slept in saturday morning, enjoyed a glorious morning of dozing and not having to climb out of bed. We go to log on to check mail and such, and her password isn't working. Odd, I think, maybe the authentication server is borked. Nope, I got in just fine. So I race over, reset her password, and log in to see what the damage is.

The majority of her stuff is gone. All of her alts have been deleted. She was left in the drain going to Coilfang Reservoir to drown when we logged in. Apparently, according to friends who saw her popping on and off all night, the person that hacked her were in and out of slave pens. My guess is they were farming ore out of there. They'd bought 89 flash powders, and there were 10 adamantite ore sitting in her bags.

There has been some amusing tidbits from this, while we wait on getting her stuff restored and her alts undeleted. They got her mining up to 375, upgraded two of her rings(or maybe sidegraded) and got her somewhere in the neighborhood of 100k xp. Rat bastards got her ahead of me! I call shenanigans!

So, right now we're playing the waiting game, and I know stuff like this has been going around lately. I was wondering if any of my faithful readers out there have any tips for cleaning up the problem locally? I installed and ran kaspersky, found no traces of anything. Installed zonealarm, nothing suspicious outbound that I can see(although anything that I'm not 100% positive of is getting locked down). She's running vista, and aside from a keylogger, I'm really not sure how they could have gotten her password. Brute force, I suppose, but that doesn't seem likely. Any thoughts?