Fearless Forums
How to delete the Garry's Mod virus - Printable Version

+- Fearless Forums (https://fearlessrp.net)
+-- Forum: Community & Server Information (https://fearlessrp.net/forumdisplay.php?fid=1)
+--- Forum: Help & Support (https://fearlessrp.net/forumdisplay.php?fid=3)
+---- Forum: Support Archive (https://fearlessrp.net/forumdisplay.php?fid=158)
+---- Thread: How to delete the Garry's Mod virus (/showthread.php?tid=45485)

Pages: 1 2


How to delete the Garry's Mod virus - bismo - 04-19-2014

Attention!
Well, some of you may be infected with the garry's mod virus, and I found some useful code to delete all of the files that you may be infected with. Even if you don't think you have it, you might as well try it, just in case.

Information about the virus
The "cough" virus has been spreading through Garry's Mod servers, and all people that are infected with the virus who join the server infect others, so chances are that you have the virus. The virus spams your friends list with messages, makes you say *cough* (that's how it got its name) and there are rumors that you may get VAC banned for having this, but that is just a rumor, so I am not completely positive. If you want to see really quick if you have the virus, go in your GarrysMod/garrysmod/downloads folder and check for this .dll file. "engine_win32.dll" if you see this, then you are infected and need to either delete all of the files manually, or follow these instructions to fix it. Here are all the files that you need to delete: "engine_win32.dll", "materials\cooltexture.vtf", "bin\game_shader_generic_engine.dll", "lua\autorun\server\default.lua"

Instructions:
1. Go in notepad, and type in this code.


Spoiler :
Echo off
title Exploit file cleanup - MFSiNC

if exist "hl2.exe" (
cd "garrysmod"
)

if not exist steam.inf (
echo.
echo You're running this from the wrong place!
echo.
echo Put this file in your garrysmod folder, either server or client, and re-run it.
echo.
echo.
pause
exit
)

echo.
echo This will remove the files used in the exploit/virus.
echo.
echo To see exactly what will be removed, open this batch file with Notepad.
echo.
pause

echo Cleaning..

taskkill /F /IM hl2.exe > nul
taskkill /F /IM srcds.exe > nul



::Files, clientside
if exist "engine_win32.dll" (
attrib -h "engine_win32.dll"
del /F /Q "engine_win32.dll"
)

if exist "materials\cooltexture.vtf" (
del /F /Q "materials\cooltexture.vtf"
)

if exist "bin\game_shader_generic_engine.dll" (
attrib -h "bin\game_shader_generic_engine.dll"
del /F /Q "bin\game_shader_generic_engine.dll"
)

if exist "download\engine_win32.dll" (
attrib -h "download\engine_win32.dll"
del /F /Q "download\engine_win32.dll"
)

:Cheeseir
if exist "download\cfg" (
RD /S /Q "download\cfg"
)



::Files, serverside
if exist "lua\autorun\server\default.lua" (
attrib -h "lua\autorun\server\default.lua"
del /F /Q "lua\autorun\server\default.lua"
)



echo.
echo Done.
echo.
pause


2. After you paste that in, click "save as..." click save as type "all files"
3. Name it anything, as long as it ends in .bat Ex: "cleanup.bat"
4. Drag the .bat file into your GarrysMod/garrysmod folder.
5. Double-click the file, and let it run.
6. Delete the .bat file if you like, and you should be completely uninfected!

Note: I did not make this code, I found it on the Facepunch website. It worked for me, so I thought I would share it with the community.


RE: How to delete the Garry's Mod virus - yarrrs - 04-19-2014

Mind explaining what this "virus" is to all of us who are unaware?


RE: How to delete the Garry's Mod virus - bismo - 04-19-2014

(04-19-2014, 06:12 AM)Jarz Wrote: Mind explaining what this "virus" is to all of us who are unaware?

Yes, I'll add it right now! Cheese


RE: How to delete the Garry's Mod virus - Jan - 04-19-2014

Not sure if trolling or serious.


RE: How to delete the Garry's Mod virus - bismo - 04-19-2014

(04-19-2014, 06:35 AM)Jan Wrote: Not sure if trolling or serious.

Not trolling, this is just some information I found on Facepunch, mind sharing why you think I'm "trolling?"


RE: How to delete the Garry's Mod virus - Falcon - 04-19-2014

Yes, there is a LUA exploit that is going around. People are getting your passwords, going into your Steam folders, and placing corrupt files in there.


RE: How to delete the Garry's Mod virus - Adamantite - 04-19-2014

Staying away from GMod to Garry updates it and removes this.

Anyways, Theomoz (Thinks that's his name) got infected, spammed me on steam, etc etc, I check his former names, and one of his names was "FL infected." Don't know if that's true or not... Can a admin/dev confirm?

(04-19-2014, 06:35 AM)Jan Wrote: Not sure if trolling or serious.

And yes, hes serious.

(04-19-2014, 06:12 AM)Jarz Wrote: Mind explaining what this "virus" is to all of us who are unaware?

https://www.youtube.com/watch?v=l0JC4AZqqY0

That should help you.


RE: How to delete the Garry's Mod virus - Falcon - 04-19-2014

(04-19-2014, 07:06 AM)Adam James Wrote: Staying away from GMod to Garry updates it and removes this.

Anyways, Theomoz (Thinks that's his name) got infected, spammed me on steam, etc etc, I check his former names, and one of his names was "FL infected." Don't know if that's true or not... Can a admin/dev confirm?


(04-19-2014, 06:35 AM)Jan Wrote: Not sure if trolling or serious.

And yes, hes serious.

(04-19-2014, 06:12 AM)Jarz Wrote: Mind explaining what this "virus" is to all of us who are unaware?

https://www.youtube.com/watch?v=l0JC4AZqqY0

That should help you.

Alright, I believe the servers are infected, as Theomenz logged into them, after the crash, and was immediately infected. This happened with many others as well. There is now a patch for Gmod that I believe fixes it, just restart your Gmod, and it should prompt you for a download.

BEWARE: As of now, after you download the patch, you will not be able to play on the FL servers until they are updated.


RE: How to delete the Garry's Mod virus - yarrrs - 04-19-2014

Interesting. Thank you for the heads up. I seem to be virus free, however it's a shame Theomenz was on the unfortunately side.


RE: How to delete the Garry's Mod virus - Demonic - 04-19-2014

Or http://store.steampowered.com/news/externalpost/steam_community_announcements/919041785791057342