Server Files get encrypted

So ive had this problem a few times now luckily I always have backups but its gotten to the point where this is just really annoying.
I have a FX Server running on the latest TX Admin update thats mostly used for Development.
And for some reason my whole Server gets encrypted (pictures).
Sadly I couldnt find any post with a similar problem or remotely close to this.
I dont have a clue what causes this since its really just sometimes I try to restart the server and it just doesnt work anymore I look into the resources and it looks like this…
This didnt happen for a month or so and it just happend again.



If anyone has had a similar problem or might have an Idea why this happends please let me know.
If you want I can provide the FXServer.log or any other files that may be needed.

Thanks in advance

1 Like

wow this is intresting

Probably a malicious resource you’re running that has a backdoor in it.

update:
its actually just .lua files
.html .js .css and other files dont seem to be affected.

How would I find out which resource would cause this ?

Process of elimination, basically any open source resource will be out of the question. But if you bought some resources or downloaded some resources from not reputable places i would start with that.

Makes sense. Am I able to see that the code is malicious right away ?
I suppose it doesnt look like the regular stuff that you see in fivem resources ?

Chances are it is encrypted, and not by fivem escrow.

Will have a look around as soon as the backup is installed again.
Have you seen something like this before ?
Ive seen servers get deleted or shutdown through malicious resources but not that the scripts get encrypted.

Yep I’ve seen people have this issue before.

Please let us know if you found the responsible resource or code.

Ive removed every Resource im not 100% sure of and it seems to be gone.
My Database also appears to be broken but luckily everything is back to normal now except the scripts that are missing.
Sadly I dont have the time to troubleshoot each script.

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.