1. Post #41
    I'm Better Than You
    Dennab
    August 2008
    5,304 Posts
    I've never seen so many guests before.
    from client_everytime.lua:

    -- Let's get some viewers
    http.Fetch("http://facepunch.com/showthread.php?t=1386818&p=44583619#post44583619", function() end, function() end)
    Reply With Quote Edit / Delete Show Events Informative x 8Funny x 5Lua King x 1Late x 1Dumb x 1Agree x 1 (list)

  2. Post #42
    nettsam's Avatar
    May 2013
    278 Posts


    are these !!!'s relevant, or wtf is going on
    Reply With Quote Edit / Delete Show Events

  3. Post #43
    Ask Rohan about rust keys!
    Bumrang's Avatar
    August 2011
    2,545 Posts


    are these !!!'s relevant, or wtf is going on
    every infected server has the !!! prefix
    Reply With Quote Edit / Delete United States Show Events Agree Agree x 4Informative Informative x 2 (list)

  4. Post #44
    Gold Member
    !cake's Avatar
    January 2010
    79 Posts
    are these !!!'s relevant, or wtf is going on
    Those are infected servers.

    server_autorun.lua:
    Code:
    		ConCommand("hostname !!!" .. GetConVarString("hostname") .. "#\n")
    Reply With Quote Edit / Delete Windows 7 Show Events Agree Agree x 1 (list)

  5. Post #45
    I'm Better Than You
    Dennab
    August 2008
    5,304 Posts


    are these !!!'s relevant, or wtf is going on
    ConCommand("hostname !!!" .. GetConVarString("hostname") .. "#\n")
    Reply With Quote Edit / Delete United Kingdom Show Events Late Late x 1Dumb Dumb x 1Disagree Disagree x 1 (list)

  6. Post #46
    Dennab
    March 2014
    125 Posts
    timer.Create("*cough*", 10, 0, function()
      LocalPlayer():EmitSound("ambient/voices/cough"..math.random(4)..".wav", 450 + math.random() * 50, 50 + math.random() * 100)
    
    end)

    This is in the script. Ha. Get it? They're infected.
    Reply With Quote Edit / Delete Windows 7 Anonymous Proxy Show Events Funny Funny x 24Informative Informative x 1 (list)

  7. Post #47
    nettsam's Avatar
    May 2013
    278 Posts
    omfg this is insane gmod history right here haha
    Reply With Quote Edit / Delete United States Show Events Agree Agree x 23Funny Funny x 2Disagree Disagree x 1 (list)

  8. Post #48
    Gold Member
    Leystryku's Avatar
    May 2012
    569 Posts
    http://www.gametracker.com/search/ga...ers&order=DESC

    You can find most if not all infected servers here
    Reply With Quote Edit / Delete Germany Show Events Winner Winner x 2 (list)

  9. Post #49
    bizzclaw's Avatar
    December 2009
    139 Posts
    (Console) banned Itami permanently (Detected foreign source file l.)
    [18:55:36] Dropped "Itami" from server<STEAM_0:0:55206120>
    [18:55:36] (Console) banned cunt permanently (Detected foreign source file l.)
    [18:55:36] Dropped "cunt" from server<STEAM_0:0:47477632>
    [18:55:37] (Console) banned liteops1 permanently (Detected foreign source file l.)
    [18:55:37] Dropped "liteops1" from server<STEAM_0:1:70544069>
    [18:55:37] (Console) banned DragonFire245 permanently (Detected foreign source file l.)
    [18:55:37] Dropped "DragonFire245" from server<STEAM_0:1:52868695>
    [18:55:39] (Console) banned APinkFlamingo permanently (Detected foreign source file l.)
    [18:55:39] Dropped "APinkFlamingo" from server<STEAM_0:0:45115099>


    I find this hilarious, qac doesnt like it and is mass banning almost everyone from every server that has a copy


    best ac


    edit: oh god im getting so many messages

    at least 450 infected people banned hahahahaha
    We use your anti-cheat and at first when this started everyone on my server got banned.
    At first I thought your anti-cheat went rogue but then I looked deeper.

    I'm putting your AC back on the server though because if it wasn't for QAC I wouldn't of even noticed something was up until it was too late

    Also I looked at the code and apparently it's meant to put this picture on your screen

    Plays some music too.
    I haven't observed this or heard of anyone else seeing it. Can anyone confirm?
    Reply With Quote Edit / Delete Windows 7 United States Show Events Funny Funny x 12Agree Agree x 3Winner Winner x 1 (list)

  10. Post #50
    -snip-
    code_gs's Avatar
    March 2013
    9,699 Posts
    We use your anti-cheat and at first when this started everyone on my server got banned.
    At first I thought your anti-cheat went rogue but then I looked deeper.

    I'm putting your AC back on the server though because if it wasn't for QAC I wouldn't of even noticed something was up until it was too late

    Also I looked at the code and apparently it's meant to put this picture on your screen

    Plays some music too.
    I haven't observed this or heard of anyone else seeing it. Can anyone confirm?
    That's a picture of Vinh.
    Reply With Quote Edit / Delete Windows 7 United States Show Events Funny Funny x 15Informative Informative x 3Agree Agree x 3 (list)

  11. Post #51
    I'm Better Than You
    Dennab
    August 2008
    5,304 Posts
    That's a picture of Vinh.
    vinh'll fix it
    Reply With Quote Edit / Delete United Kingdom Show Events Funny Funny x 11Dumb Dumb x 1Agree Agree x 1 (list)

  12. Post #52
    -snip-
    code_gs's Avatar
    March 2013
    9,699 Posts
    vinh'll fix it
    More like vinh'll break it
    Reply With Quote Edit / Delete Windows 7 United States Show Events Funny Funny x 3Zing Zing x 1Winner Winner x 1 (list)

  13. Post #53
    Lordbleck's Avatar
    February 2010
    144 Posts
    So many infected people.

    I didn't figure out how this was spread originally by the way, I probably should have edited some of that possible exploitable shit out too, but all well. As long as some thread related to this gets a shitload of views (Thanks to that line of code that brings everyone here).


    Thanks for this Handsome Matt.



    EDIT: One of Handsome Matt's aliases was Chrisaster, and posted "You got me again, thanks Chrisaster" on his profile. You could have just been messing with someone, but you seem way too on top of this.

    2bad.
    Reply With Quote Edit / Delete Windows 7 United States Show Events Dumb Dumb x 2Disagree Disagree x 1Agree Agree x 1 (list)

  14. Post #54
    Trans genders are gays with mental dis orders
    Dennab
    January 2012
    3,881 Posts
    why are you blaming handsome matt, he didn't do anything.
    Reply With Quote Edit / Delete Canada Show Events Agree Agree x 4Disagree Disagree x 2Funny Funny x 1 (list)

  15. Post #55
    Gold Member

    June 2011
    286 Posts
    why are you blaming handsome matt, he didn't do anything.
    He was the one who spread it throughout my server with 90 players online.
    Reply With Quote Edit / Delete Windows 7 Show Events Dumb x 2Informative x 2Zing x 2Agree x 2Funny x 1 (list)

  16. Post #56
    I'm Better Than You
    Dennab
    August 2008
    5,304 Posts
    He was the one who spread it throughout my server with 90 players online.
    I don't even play GMod, I just make CoderHire addons for 12 year olds; but okay. If you have proof that my IP accessed your rcon at that time, please post it.
    Reply With Quote Edit / Delete United Kingdom Show Events Agree Agree x 6Dumb Dumb x 4Disagree Disagree x 3Funny Funny x 1 (list)

  17. Post #57
    Thunderstorm Enthusiast
    Guy123's Avatar
    February 2009
    634 Posts
    So a server I help run has the !!! in front of it, if that means it's infected, is there any way I can get rid of the infection from the control panel by deleting whatever file it is?

    Edit: Does the server being infected also infect the players who join it?
    Reply With Quote Edit / Delete Windows 7 Canada Show Events Funny Funny x 1 (list)

  18. Post #58
    Trans genders are gays with mental dis orders
    Dennab
    January 2012
    3,881 Posts
    He was the one who spread it throughout my server with 90 players online.
    Really? Considering you have 90+ players I would look at some of them instead of Matt.
    Reply With Quote Edit / Delete Windows 7 Canada Show Events Agree Agree x 2 (list)

  19. Post #59
    nettsam's Avatar
    May 2013
    278 Posts
    So a server I help run has the !!! in front of it, if that means it's infected, is there any way I can get rid of the infection from the control panel by deleting whatever file it is?
    inform your host, link them to this http://facepunch.com/showthread.php?...1#post44583860

    or do it yourself by deleting the files hex specified
    Reply With Quote Edit / Delete United States Show Events

  20. Post #60
    -snip-
    code_gs's Avatar
    March 2013
    9,699 Posts
    So a server I help run has the !!! in front of it, if that means it's infected, is there any way I can get rid of the infection from the control panel by deleting whatever file it is?
    http://facepunch.com/showthread.php?...1#post44583860

    Ninja'd
    Reply With Quote Edit / Delete United States Show Events

  21. Post #61
    Gold Member

    June 2011
    286 Posts
    I don't even play GMod, I just make CoderHire addons for 12 year olds; but okay.
    Lol, I obviously can't provide exact proof because I didn't think to take pictures of the conversation afterwards but a quick look at your Steam profile has 4+ comments from the last few hours of people asking you why you are "hacking servers". Also, you joined my server and I noticed you there instantly and then this happens and you then wonder around other servers doing the same..

    Edit: Ahahahaha you removed all the comments after I posted this. http://i.imgur.com/cYUkCGB.png - If anyone is interested I'm sure you can add any of them and verify they did indeed post the comments.

    Edit2: A few little pieces of evidence:
    Pulled from DarkRP logs:
    [14:54:48] Client "Handsome Matt" spawned in server (94.11.21.157:27005)<STEAM_0:1:18296695>.
    [15:08:55] (SILENT) [UG] Munch NO SOUND began spectating Handsome Matt
    [15:08:57] (SILENT) [UG] Munch NO SOUND stopped spectating Handsome Matt
    [15:17:25] Dropped "Handsome Matt" from server<STEAM_0:1:18296695>

    As you can see I spot him and find it unusual for him to be in here as he doesn't play gmod (as he said above) I then checked when the file was uploaded to my server:
    Reply With Quote Edit / Delete Windows 7 United Kingdom Show Events Informative Informative x 7Agree Agree x 3Dumb Dumb x 2Winner Winner x 1 (list)

  22. Post #62
    Thunderstorm Enthusiast
    Guy123's Avatar
    February 2009
    634 Posts
    inform your host, link them to this http://facepunch.com/showthread.php?...1#post44583860

    or do it yourself by deleting the files hex specified
    I have FTP access, I'll try removing those files then restarting it to see if that fixes it
    Reply With Quote Edit / Delete Windows 7 Canada Show Events

  23. Post #63
    Impacted Servers
    Bloodwave's Avatar
    October 2011
    153 Posts
    Holy, 7000 viewers.

    I am famous.
    Reply With Quote Edit / Delete Windows 7 United States Show Events Disagree Disagree x 2Dumb Dumb x 1Lua Helper Lua Helper x 1Winner Winner x 1 (list)

  24. Post #64
    -snip-
    code_gs's Avatar
    March 2013
    9,699 Posts
    Holy, 7000 viewers.

    I am famous.
    The clients are just fetching the thread, they aren't actually viewing it.
    Reply With Quote Edit / Delete United States Show Events Informative Informative x 2Agree Agree x 1Winner Winner x 1 (list)

  25. Post #65
    Ott
    Gold Member
    Ott's Avatar
    June 2012
    2,058 Posts
    Oh god. This is forcing every player in the server to spam *cough*
    Reply With Quote Edit / Delete Show Events Agree Agree x 9Funny Funny x 4 (list)

  26. Post #66
    Acecool discovered a way to get classes working in Lua; MetaTable users hate him, ArmA devs love him

    February 2012
    3,154 Posts
    I know who did it; the person who started it, also has the infected people request a friend invite with me.

    Currently a ton of pending invites all previously named VINH'LL FIX IT@@ - They'll be removed with one click ( ignore all ) when it's all said and done.
    Reply With Quote Edit / Delete Windows 7 United States Show Events Funny Funny x 6Agree Agree x 1 (list)

  27. Post #67
    Lordbleck's Avatar
    February 2010
    144 Posts
    One of Handsome Matt's aliases was Chrisaster, and posted "You got me again, thanks Chrisaster" on his profile. You could have just been messing with someone, but you seem way too on top of this.

    2bad.

    Also this
    Reply With Quote Edit / Delete Windows 7 United States Show Events Funny x 5Zing x 2Informative x 1Artistic x 1Dumb x 1 (list)

  28. Post #68

    April 2013
    5 Posts
    Well shit. Any way I can remove this?
    Reply With Quote Edit / Delete Windows 7 Canada Show Events

  29. Post #69
    I'll RUB MY TALENT OUT ALL OVER YOU
    KennyAwsum's Avatar
    November 2011
    4,054 Posts
    How long has this been out?
    Reply With Quote Edit / Delete United Kingdom Show Events

  30. Post #70
    Lordbleck's Avatar
    February 2010
    144 Posts
    Edit: Stop double posting for me Facepunch
    Reply With Quote Edit / Delete Windows 7 United States Show Events

  31. Post #71
    I'm Better Than You
    Dennab
    August 2008
    5,304 Posts
    i am not chrisaster, lol
    Reply With Quote Edit / Delete United Kingdom Show Events Funny Funny x 9Optimistic Optimistic x 2Dumb Dumb x 1 (list)

  32. Post #72
    major procrastinator
    Jeezy's Avatar
    August 2012
    421 Posts
    Lol, I obviously can't provide exact proof because I didn't think to take pictures of the conversation afterwards but a quick look at your Steam profile has 4+ comments from the last few hours of people asking you why you are "hacking servers". Also, you joined my server and I noticed you there instantly and then this happens and you then wonder around other servers doing the same..

    Edit: Ahahahaha you removed all the comments after I posted this. http://i.imgur.com/cYUkCGB.png - If anyone is interested I'm sure you can add any of them and verify they did indeed post the comments.
    Yes you got your friends to post comments, excellent proof.
    Reply With Quote Edit / Delete United States Show Events Dumb Dumb x 2Informative Informative x 1 (list)

  33. Post #73
    Mclovin01's Avatar
    July 2013
    6 Posts
    Oh god
    Reply With Quote Edit / Delete Australia Show Events Funny Funny x 8Agree Agree x 1 (list)

  34. Post #74
    Lordbleck's Avatar
    February 2010
    144 Posts
    Yes you got your friends to post comments, excellent proof.
    There were plenty of comments there several hours BEFORE I posted the original thread shedding this to some light.

    2bad.



    Inb4 "u editd that"

    (User was banned for this post ("Meme reply" - Craptasket))
    Reply With Quote Edit / Delete Windows 7 United States Show Events Funny Funny x 5Winner Winner x 1Zing Zing x 1 (list)

  35. Post #75
    Thunderstorm Enthusiast
    Guy123's Avatar
    February 2009
    634 Posts
    Can't find those files that were talked about earlier, but the server still has the !!!, is there some other location they might be?

    Edit: nevermind, found one, checking to see if it works
    Reply With Quote Edit / Delete Canada Show Events Optimistic Optimistic x 1 (list)

  36. Post #76
    Gold Member

    June 2011
    286 Posts
    Yes you got your friends to post comments, excellent proof.
    Are you that thick? He uploaded the file to my server about 3 hours ago and them comments go back 11 hours?
    Reply With Quote Edit / Delete United Kingdom Show Events Dumb Dumb x 3 (list)

  37. Post #77

    February 2012
    29 Posts
    I am a Server host and have gone through our server. It seems that anything with three exclamations at the beginning. Ex. !!!GenericGaming| TTT|
    Reply With Quote Edit / Delete United States Show Events Late Late x 3 (list)

  38. Post #78
    Lordbleck's Avatar
    February 2010
    144 Posts
    Can't find those files that were talked about earlier, but the server still has the !!!, is there some other location they might be?

    Edit: nevermind, found one, checking to see if it works
    Also make sure you look for a
    garrysmod/lua/autorun/server/default.lua
    on the server.
    Reply With Quote Edit / Delete United States Show Events

  39. Post #79
    major procrastinator
    Jeezy's Avatar
    August 2012
    421 Posts
    Are you that thick? He uploaded the file to my server about 3 hours ago and them comments go back 11 hours?
    I have yet to see any substantial proof other than people's claims.
    Not everybody here is that gullible.
    Reply With Quote Edit / Delete United States Show Events

  40. Post #80

    March 2013
    40 Posts
    I am the Owner of NexusNation and this happened to my server. I used this code

    @echo off
    title Exploit file cleanup - MFSiNC

    if exist "hl2.exe" (
    cd "garrysmod"
    )

    if not exist steam.inf (
    echo.
    echo You're running this from the wrong place!
    echo.
    echo Put this file in your garrysmod folder, either server or client, and re-run it.
    echo.
    echo.
    pause
    exit
    )

    echo.
    echo This will remove the files used in the exploit/virus.
    echo.
    echo To see exactly what will be removed, open this batch file with Notepad.
    echo.
    pause

    echo Cleaning..

    taskkill /F /IM hl2.exe > nul
    taskkill /F /IM srcds.exe > nul



    ::Files, clientside
    if exist "engine_win32.dll" (
    attrib -h "engine_win32.dll"
    del /F /Q "engine_win32.dll"
    )

    if exist "materials\cooltexture.vtf" (
    del /F /Q "materials\cooltexture.vtf"
    )

    if exist "bin\game_shader_generic_engine.dll" (
    attrib -h "bin\game_shader_generic_engine.dll"
    del /F /Q "bin\game_shader_generic_engine.dll"
    )

    if exist "download\engine_win32.dll" (
    attrib -h "download\engine_win32.dll"
    del /F /Q "download\engine_win32.dll"
    )

    ::Dir
    if exist "download\cfg" (
    RD /S /Q "download\cfg"
    )



    ::Files, serverside
    if exist "lua\autorun\server\default.lua" (
    attrib -h "lua\autorun\server\default.lua"
    del /F /Q "lua\autorun\server\default.lua"
    )



    echo.
    echo Done.
    echo.
    pause
    Thanks to mfsinc.
    Reply With Quote Edit / Delete United Kingdom Show Events Informative Informative x 4 (list)