Dallas 69 Script logs of supposed hackers...

[achillius 40]

Guys im going to need someone to help me figure out some scripts, and tell me if these are hacks, or just normal scripts.

My Victims will keep being added...

Hacking or not?

23.07.2012 20:44:59: marki (24.34.160.39:48376) - - #36 icopter" || _v iskindof "plane")

then

{

_v setVehicleInit "[this] spawn BIS_Effects_AirDestruction";

23.07.2012 20:44:59: marki (24.34.160.39:48376) - - #55 his] spawn BIS_Effects_AirDestruction";

processInitCommands;

};

if (_v iskindof "tank")

then

{

_int

Edited July 28, 2012 by Achillius

[achillius 40]

Second...

_id = player spawn spawn

24.07.2012 06:58:12: N (211.30.124.109:2504) 5dc14e44dff07c9b7db4816ff29aa6bc - #11 hmove "ainjppnemstpsnonwrfldb_still";

_dragee attachto [_unit,[0.1, 1.01, 0]];

Edited July 28, 2012 by Achillius

[achillius 40]

Third guy

_id = player spawn spawn

24.07.2012 08:06:53: Tekk (98.240.246.196:2504) 7d402d223c222caf855b40256a5fe176 - #35 eelF", _endPos, [], 0, "CAN_COLLIDE"];

_bolt setPosATL _endPos;

_bolt setDir (getDir _unit);

_bolt s

24.07.2012 08:06:53: Tekk (98.240.246.196:2504) 7d402d223c222caf855b40256a5fe176 - #145 _endPos;

_bolt setDir (getDir _unit);

_bolt setVectorUp _vUp;

_hitArray = _unit getVariable["firedH

24.07.2012 08:07:02: Tekk (98.240.246.196:2504) 7d402d223c222caf855b40256a5fe176 - #35 eelF", _endPos, [], 0, "CAN_COLLIDE"];

_bolt setPosATL _endPos;

_bolt setDir (getDir _unit);

_bolt s

24.07.2012 08:07:02: Tekk (98.240.246.196:2504) 7d402d223c222caf855b40256a5fe176 - #145 _endPos;

_bolt setDir (getDir _unit);

_bolt setVectorUp _vUp;

Edited July 28, 2012 by Achillius

[achillius 40]

No. 4

_id = player spawn spawn

24.07.2012 08:42:29: Nekron (109.120.42.245:2304) d312dbabc68b8f72d0a0d16faf88561f - #36 icopter" || _v iskindof "plane")

then

{

_v setVehicleInit "[this] spawn BIS_Effects_AirDestruction";

24.07.2012 08:42:29: Nekron (109.120.42.245:2304) d312dbabc68b8f72d0a0d16faf88561f - #55 his] spawn BIS_Effects_AirDestruction";

processInitCommands;

};

if (_v iskindof "tank")

then

{

_int

Edited July 28, 2012 by Achillius

[achillius 40]

Numbers 5, and 6

_id = player spawn spawn

24.07.2012 09:02:33: PromodeR (62.181.50.145:60664) 9006b06905523f7fd71760a26c559774 - #35 eelF", _endPos, [], 0, "CAN_COLLIDE"];

_bolt setPosATL _endPos;

_bolt setDir (getDir _unit);

_bolt s

24.07.2012 09:02:33: PromodeR (62.181.50.145:60664) 9006b06905523f7fd71760a26c559774 - #145 _endPos;

_bolt setDir (getDir _unit);

_bolt setVectorUp _vUp;

_hitArray = _unit getVariable["firedH

24.07.2012 09:02:59: PromodeR (62.181.50.145:60664) 9006b06905523f7fd71760a26c559774 - #35 eelF", _endPos, [], 0, "CAN_COLLIDE"];

_bolt setPosATL _endPos;

_bolt setDir (getDir _unit);

_bolt s

24.07.2012 09:02:59: PromodeR (62.181.50.145:60664) 9006b06905523f7fd71760a26c559774 - #145 _endPos;

_bolt setDir (getDir _unit);

_bolt setVectorUp _vUp;

_hitArray = _unit getVariable["firedH

24.07.2012 09:03:06: PromodeR (62.181.50.145:60664) 9006b06905523f7fd71760a26c559774 - #35 eelF", _endPos, [], 0, "CAN_COLLIDE"];

_bolt setPosATL _endPos;

_bolt setDir (getDir _unit);

_bolt s

24.07.2012 09:03:06: PromodeR (62.181.50.145:60664) 9006b06905523f7fd71760a26c559774 - #145 _endPos;

_bolt setDir (getDir _unit);

_bolt setVectorUp _vUp;

_hitArray = _unit getVariable["firedH

24.07.2012 09:03:14: PromodeR (62.181.50.145:60664) 9006b06905523f7fd71760a26c559774 - #35 eelF", _endPos, [], 0, "CAN_COLLIDE"];

_bolt setPosATL _endPos;

_bolt setDir (getDir _unit);

_bolt s

24.07.2012 09:03:14: PromodeR (62.181.50.145:60664) 9006b06905523f7fd71760a26c559774 - #145 _endPos;

_bolt setDir (getDir _unit);

_bolt setVectorUp _vUp;

_hitArray = _unit getVariable["firedH

Edited July 28, 2012 by Achillius

[achillius 40]

No 7

I will stop here, but any help regarding which of these are just normal scripts, and which are not would be very helpful!

(group _x) addGroupIcon ["x_art"];

(group _x) setGroupIconParams [[

24.07.2012 09:14:08: Credon (70.178.195.87:2504) a2d7bb130dc65fcfa05aebe49f002464 - #35 eelF", _endPos, [], 0, "CAN_COLLIDE"];

_bolt setPosATL _endPos;

_bolt setDir (getDir _unit);

_bolt s

24.07.2012 09:14:08: Credon (70.178.195.87:2504) a2d7bb130dc65fcfa05aebe49f002464 - #145 _endPos;

_bolt setDir (getDir _unit);

_bolt setVectorUp _vUp;

_hitArray = _unit getVariable["firedH

24.07.2012 09:14:17: Credon (70.178.195.87:2504) a2d7bb130dc65fcfa05aebe49f002464 - #35 eelF", _endPos, [], 0, "CAN_COLLIDE"];

_bolt setPosATL _endPos;

_bolt setDir (getDir _unit);

_bolt s

24.07.2012 09:14:17: Credon (70.178.195.87:2504) a2d7bb130dc65fcfa05aebe49f002464 - #145 _endPos;

_bolt setDir (getDir _unit);

_bolt setVectorUp _vUp;

_hitArray = _unit getVariable["firedH

[achillius 40]

are any of these hackers? Or am I just hallucinating?

[Zerg00s 3]

_id = player spawn spawn

24.07.2012 06:58:12: N (211.30.124.109:2504) 5dc14e44dff07c9b7db4816ff29aa6bc - #11 hmove "ainjppnemstpsnonwrfldb_still";

_dragee attachto [_unit,[0.1, 1.01, 0]];

Answer: This script is harmless. This is happening when you are trying to drag a body. So do not ban people using it! I've checked it several times. My friend was dragging me about 60 mins ago and scripts.log shows the same script for my friend.

_bolt setPosATL _endPos;

_bolt setDir (getDir _unit);

_bolt s

Answer: We ban people who use setPosATL because this is a teleport script. And I advice you to do the same!

_id = player spawn spawn

24.07.2012 08:42:29: Nekron (109.120.42.245:2304) d312dbabc68b8f72d0a0d16faf88561f - #36 icopter" || _v iskindof "plane")

then

{

_v setVehicleInit "[this] spawn BIS_Effects_AirDestruction";

24.07.2012 08:42:29: Nekron (109.120.42.245:2304) d312dbabc68b8f72d0a0d16faf88561f - #55 his] spawn BIS_Effects_AirDestruction";

processInitCommands;

};

if (_v iskindof "tank")

then

{

_int

Answer: The problem with this script is that I've noticed my friend using it and I know for a fact he does not use any scripts. Otherwise I would ban the person using it. I've tried to understand where this script comes from. I think this script is happening when you are destroying a vehicle. We were driving an ATV then crashed it. It blew up a few seconds after it. This matches with the script time. So do not ban in this case!

[Zerg00s 3]

I've even written a small prog to help us to analyse the scripts.log. You can have a look at a screenshot here. The funny thing is that it's just caught my friend wrongly because he's destroyed the ATV and this prog alerts us when it spots using of setVehicleInit script.

[AADiC 182]

I've even written a small prog to help us to analyse the scripts.log. You can have a look at a screenshot here. The funny thing is that it's just caught my friend wrongly because he's destroyed the ATV and this prog alerts us when it spots using of setVehicleInit script.

Can others use this program?

[lookatmyprofile 0]

These logs are not that of a hacker.

[Zerg00s 3]

Can others use this program?

I haven't thought about it yet. It probably needs some kind of a manual. I can publish it some where with the source code.

The limitations are:

• it works only with FTP folders so far.
  
• it has no functionality to ban anyone (can be added in the future).
  
• I haven't tested it on big scripts.log files more than 200 KB. I would recommend you to delete scripts.log if it's more than 1 GB. it will be recreated later.
  
• You will still need to review the scripts.log carefully and do some investigations before you actually decide to ban someone.
  
• You might need to run it under Administrative privileges
  
• It was not tested on other machines yet.
  
• When processing large log file the interface might hang up for some time.
  

Features:

• it automatically downloads bans.txt file to see who's already banned
  
• it does not show people who were already banned using bans.txt file.
  
• It stores violators in the players.xml file which includes their nick, GUID, the first suspicious script their used and the time.
  
• It can run the check every several minutes according to the timer.
  

Update: I've uploaded the prog here.

Edited July 29, 2012 by Zerg00s