Hey guys, I'm new to this forum, so i'm not really sure where to post this. But anyway, here goes. Today I had a player on my rMod server walking around with a weapon that is disabled on my server. I asked him where he got from it and he told me he got it from a dead player which he couldn't remember the name of. He volunteered to drop it in the ocean, so I was fine with the course of action and didn't think anything of it. Later when checking my remoteexec.log i find the following lines, from the player that had the weapon. remoteexec log: 10.01.2013 23:49:49: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #0 "[this] spawn BIS_Effects_AirDestruction" 10.01.2013 23:49:49: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #38 "[this] spawn BIS_Effects_AirDestruction" 10.01.2013 23:49:49: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #53 "[this] spawn BIS_Effects_AirDestruction" 10.01.2013 23:49:53: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #0 "[this, 8.47936, 7775.94]spawn BIS_Effects_AirDestructionStage2" 10.01.2013 23:49:53: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #38 "[this, 8.47936, 7775.94]spawn BIS_Effects_AirDestructionStage2" 10.01.2013 23:49:53: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #53 "[this, 8.47936, 7775.94]spawn BIS_Effects_AirDestructionStage2" 10.01.2013 23:49:55: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #0 "[this, 8.47936, 7775.94,false,true]spawn BIS_Effects_Burn" 10.01.2013 23:49:55: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #38 "[this, 8.47936, 7775.94,false,true]spawn BIS_Effects_Burn" 10.01.2013 23:49:55: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #53 "[this, 8.47936, 7775.94,false,true]spawn BIS_Effects_Burn" Later today I found a maphacker and banned him. When i check the remoteexec log, he had exactly the same kind of log as the guy above. And the funny thing is that those are the only 2 players I have found behaving suspicious and THOSE are the only 2 people showing in my remoteexec.log for this day. I'll post his remoteexec.log as well. 11.01.2013 06:20:41: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #0 "[this] spawn BIS_Effects_AirDestruction" 11.01.2013 06:20:41: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #38 "[this] spawn BIS_Effects_AirDestruction" 11.01.2013 06:20:41: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #53 "[this] spawn BIS_Effects_AirDestruction" 11.01.2013 06:20:43: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #0 "[this, 8.04328, 1133.81]spawn BIS_Effects_AirDestructionStage2" 11.01.2013 06:20:43: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #38 "[this, 8.04328, 1133.81]spawn BIS_Effects_AirDestructionStage2" 11.01.2013 06:20:43: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #53 "[this, 8.04328, 1133.81]spawn BIS_Effects_AirDestructionStage2" 11.01.2013 06:20:47: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #0 "[this, 8.04328, 1133.81,false,true]spawn BIS_Effects_Burn" 11.01.2013 06:20:47: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #38 "[this, 8.04328, 1133.81,false,true]spawn BIS_Effects_Burn" 11.01.2013 06:20:47: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #53 "[this, 8.04328, 1133.81,false,true]spawn BIS_Effects_Burn" So, my question is if anyone knows how I can tell if someone has been hacking on my server, and what to look for in the logs? Thanks in advance. /Uthari