Remoteexec.log help.

[Uthari 0]

Hey guys,

I'm new to this forum, so i'm not really sure where to post this. But anyway, here goes.

Today I had a player on my rMod server walking around with a weapon that is disabled on my server. I asked him where he got from it and he told me he got it from a dead player which he couldn't remember the name of. He volunteered to drop it in the ocean, so I was fine with the course of action and didn't think anything of it. Later when checking my remoteexec.log i find the following lines, from the player that had the weapon.

remoteexec log:

10.01.2013 23:49:49: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #0 "[this] spawn BIS_Effects_AirDestruction"

10.01.2013 23:49:49: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #38 "[this] spawn BIS_Effects_AirDestruction"

10.01.2013 23:49:49: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #53 "[this] spawn BIS_Effects_AirDestruction"

10.01.2013 23:49:53: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #0 "[this, 8.47936, 7775.94]spawn BIS_Effects_AirDestructionStage2"

10.01.2013 23:49:53: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #38 "[this, 8.47936, 7775.94]spawn BIS_Effects_AirDestructionStage2"

10.01.2013 23:49:53: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #53 "[this, 8.47936, 7775.94]spawn BIS_Effects_AirDestructionStage2"

10.01.2013 23:49:55: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #0 "[this, 8.47936, 7775.94,false,true]spawn BIS_Effects_Burn"

10.01.2013 23:49:55: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #38 "[this, 8.47936, 7775.94,false,true]spawn BIS_Effects_Burn"

10.01.2013 23:49:55: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #53 "[this, 8.47936, 7775.94,false,true]spawn BIS_Effects_Burn"

Later today I found a maphacker and banned him. When i check the remoteexec log, he had exactly the same kind of log as the guy above. And the funny thing is that those are the only 2 players I have found behaving suspicious and THOSE are the only 2 people showing in my remoteexec.log for this day. I'll post his remoteexec.log as well.

11.01.2013 06:20:41: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #0 "[this] spawn BIS_Effects_AirDestruction"

11.01.2013 06:20:41: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #38 "[this] spawn BIS_Effects_AirDestruction"

11.01.2013 06:20:41: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #53 "[this] spawn BIS_Effects_AirDestruction"

11.01.2013 06:20:43: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #0 "[this, 8.04328, 1133.81]spawn BIS_Effects_AirDestructionStage2"

11.01.2013 06:20:43: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #38 "[this, 8.04328, 1133.81]spawn BIS_Effects_AirDestructionStage2"

11.01.2013 06:20:43: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #53 "[this, 8.04328, 1133.81]spawn BIS_Effects_AirDestructionStage2"

11.01.2013 06:20:47: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #0 "[this, 8.04328, 1133.81,false,true]spawn BIS_Effects_Burn"

11.01.2013 06:20:47: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #38 "[this, 8.04328, 1133.81,false,true]spawn BIS_Effects_Burn"

11.01.2013 06:20:47: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #53 "[this, 8.04328, 1133.81,false,true]spawn BIS_Effects_Burn"

So, my question is if anyone knows how I can tell if someone has been hacking on my server, and what to look for in the logs?

Thanks in advance.

/Uthari

[AmberHelios 2071]

hi mate

they usually show up when someone crashes a helicopter and are normal

[Uthari 0]

Well, that's kinda strange. Since the 2nd player that used a maphack teleported first. That's around the time the entry was made. Which is also the time I started spectating him. And he was just on foot, constantly checking his map, and I could see that he went straight for another player. It's really a pain in the ass that we barely have any tools to get these hackers, and I have no idea how to check my logs for hackers.

[AmberHelios 2071]

it is really hard to search the logs for hackers but i do know that what you posted is a heli crash i use gotcha anti hacks atm i have to sometimes unban people for throwing chem lights some sort of bug at the moment i believe the best thing is to search google for the hacks to see what they show up in the logs and keep an eye out for them i do recommend gotcha just set it ignore the chemlight bug that is something like setpos log # 0 shot **** and it can steam the logs as they happen