Chrisaster is awesome@@@@@@@@ - Help

Hey im having an issue, my server got hacked somehow no idea how its like the COUGH exsploit. What happens it Console: Chrisaster IS AWESOME@@@@@@@@@@ Console: Chrisaster IS AWESOME@@@@@@@@@@ Console: Chrisaster IS AWESOME@@@@@@@@@@ Thats litrally what it says when a player is banned or joins. It says this as soon as the server starts up

Search all of your files on your server for that text.

[QUOTE=Robotboy655;45105444]Search all of your files on your server for that text.[/QUOTE] How do i search all files its on my GMOD server not my gmod computer files

I suggest Notepad++: [img]http://i.imgur.com/uUIcfZS.png[/img]

[QUOTE=Robotboy655;45105565]I suggest Notepad++: [img]http://i.imgur.com/uUIcfZS.png[/img][/QUOTE] Sorry im not sure u quite understand sorry, Erm im using a server hosting company so everything is hosted via a Game Panel

[QUOTE=terry tibs;45105429]Hey im having an issue, my server got hacked somehow no idea how its like the COUGH exsploit. What happens it Console: Chrisaster IS AWESOME@@@@@@@@@@ Console: Chrisaster IS AWESOME@@@@@@@@@@ Console: Chrisaster IS AWESOME@@@@@@@@@@ Thats litrally what it says when a player is banned or joins. It says this as soon as the server starts up[/QUOTE] Disabling rcon_password, disabling sv_allowdownload/sv_allowupload and restarting it might be a good start, what you by the way should already know if you want to be a good server hoster.

[QUOTE=terry tibs;45105592]Sorry im not sure u quite understand sorry, Erm im using a server hosting company so everything is hosted via a Game Panel[/QUOTE] Download all the files onto your PC and search.

[QUOTE=Robotboy655;45105609]Download all the files onto your PC and search.[/QUOTE] It could be srcd based u never know downloading all that for nothing not good

[QUOTE=terry tibs;45105632]It could be srcd based u never know downloading all that for nothing not good[/QUOTE] If you do not want to use the help we provide why ask for it?

[QUOTE=Robotboy655;45105656]If you do not want to use the help we provide why ask for it?[/QUOTE] Because i know what its based around i just dont know how to fix, Robot its not as simple as your making it. Im sure you remember the COUGH COUGH exploit well this is a new one of them but clients dont pass it on and client does not get infected

[QUOTE=terry tibs;45105706]Because i know what its based around i just dont know how to fix, Robot its not as simple as your making it. Im sure you remember the COUGH COUGH exploit well this is a new one of them but clients dont pass it on and client does not get infected[/QUOTE] Yeah, tell me all about it. I am trying to eliminate all causes of the problem. The most likely cause of the problem is one of your addons having a backdoor. Also, this: [QUOTE=Leystryku;45105608]Disabling rcon_password, disabling sv_allowdownload/sv_allowupload and restarting it might be a good start, what you by the way should already know if you want to be a good server hoster.[/QUOTE]

Currently checked DERMA and Autorun folders nothing found.

I'll be nice, check your configs out from your cfg/ folder.

[QUOTE=Handsome Matt;45105866]why don't you just search for chrisaster[/QUOTE] i heard notepad++ can do this

[QUOTE=Gran PC;45105880]i heard notepad++ can do this[/QUOTE] I am litrally checking files and well CHRISASTER is a known hacker, who sells his scripts i think hes on here. Um im just checking LUA folder then move on to the CFG

Search for that text only in lua and gamemodes folder, that's the only place it may be coming from ( unless it's a hacker who is constantly manually typing it, which is very unlikely. )

Nope it litrally says it 3 times as soon as the server starts

[QUOTE=terry tibs;45106005]Nope it litrally says it 3 times as soon as the server starts[/QUOTE] it literally says it? damn, computers have gotten advanced.

[QUOTE=Handsome Matt;45106034]you're really not helping; the issue is in the cfg folder.[/QUOTE] The issue is not in the CFG foler 100% [editline]15th June 2014[/editline] ISSUE WILL BE RESOLVED BY A SERVER REINSTALL, This problem is a SCRD problem so yh

[QUOTE=Handsome Matt;45106425]did you look[/QUOTE] Of course i did :P, The community is big i know how to work things, sorry if im being stubborn im just annoyed at the fact some FGT did it. Issue is being fixed and should be gone soon.

[QUOTE=terry tibs;45106904]Of course i did :P, The community is big i know how to work things, sorry if im being stubborn im just annoyed at the fact some FGT did it. Issue is being fixed and should be gone soon.[/QUOTE] But if you don't know how it got there in the first place then how do you know it's fixed?

[QUOTE=terry tibs;45106201]The issue is not in the CFG foler 100% [editline]15th June 2014[/editline] ISSUE WILL BE RESOLVED BY A SERVER REINSTALL, This problem is a SCRD problem so yh[/QUOTE] I'm unable to tell if you're just trolling or ( Excuse me miss ) really stupid. A reinstall won't delete the file. Delete cfg/joystick.cfg and it's gone - fact. Not that hard, was it?

Download your entire addons/custom content folder (w/e) via ftp search for .lua and then well. Notepad++ [url]http://5crat.ch/a/cymk[/url]

[QUOTE=Scratch.;45108627]Download your entire addons/custom content folder (w/e) via ftp search for .lua and then well. Notepad++ [url]http://5crat.ch/a/cymk[/url][/QUOTE] Yh well i did a simple test of renaming my addons folder so my server created a newone and it still had the problem so its none of my addons [editline]15th June 2014[/editline] [QUOTE=Leystryku;45107032]I'm unable to tell if you're just trolling or ( Excuse me miss ) really stupid. A reinstall won't delete the file. Delete cfg/joystick.cfg and it's gone - fact. Not that hard, was it?[/QUOTE] Ly im not stupid XD. Ive tried all the basic things

Could it be i.e. a base64 string that is decoded? Or a really crappy table containing parts of the string, then composing the string by adding table[2] etc? edit: I don't really see why this is worth a dumb, considering people who make scripts like this might aswell try to hide it rather than just having the string somewhere in that exact form. Some people do think before they do their shit.

[QUOTE=terry tibs;45109578]Yh well i did a simple test of renaming my addons folder so my server created a newone and it still had the problem so its none of my addons [/QUOTE] Check everything else then. Also your workshop gma collection if you use any of that

[QUOTE=Handsome Matt;45110135]holy shit Scratch. shut up, it's not in the fucking addons, it's in cfg/joystick.cfg, op is very very stupid and you're just providing fuel for it.[/QUOTE] Well i have no joystick.cfg so its not that, im doing some checks now 64% uploading if problem still persist i know where its located.

terry tibs, can you list everything you've done so far

[QUOTE=Scratch.;45109859]Check everything else then. Also your workshop gma collection if you use any of that[/QUOTE] Can not be my gma as i said i renamed the addons folder made sure no addons were made through workshop and problem still persisted. [editline]15th June 2014[/editline] Okay heres what ive done Checked lua folder, data, addons, cfg for words like AWESOME CHRISASTER so on. Nothing was found Currently in progress: Fresh server reinstall with copy of my addons, data, gamemode and 2 lua files [editline]15th June 2014[/editline] We also did a check on the whole ulx as when we tried to kick or ban someone it would do the normal ban message and not ban them but then do CONSOLE: CHRISASTER IS AWESOME@@@@@@@@@

Just do a fresh install