Help Server been hacked

[Brian Do]

SystemLog.rar

Hi, i just make a fun server without any donate ,.. just for fun that all
i using Ep3.3 Server file share by WarOnline.
But server have been hack. i was try all what i know to track him but i cant,

After this error. all player online is banned

06-14 22:39:18|  SendErrorMsg to ClientIndex[142] 205.185.126.202(38794) ==> ERR_PROTOCOL_INVALID_SEQUENCE_NUMBER(0x2408) AT T_PRE_IOCP Param1(0) Param2(0) Msg((null))
06-14 22:39:18|Socket Closed  SocketIndex[142] SocketType[9] PeerIP[205.185.126.202] Port[38794] MaxWriteBufCounts[   1] ==> reason 69632[0X011000]
06-14 22:39:18|[Error] CIOCPSocket::OnReceive Error! Closing Connection!, SocketIndex[142]
06-14 22:39:20|Socket Connect SocketIndex[143] PeerIP[205.185.126.202] Port[38836]
06-14 22:39:22|[Notify] Account Block: AdminIP(205.185.126.202) AdminAccountName(                    ), BlockedUserAccName(               admin) Period(2004-01-22 01:06:01 ~ 2021-01-26 16:12:35)
06-14 22:39:22|  SendErrorMsg to ClientIndex[  1]  77.102.173.240(57488) ==> ERR_PROTOCOL_ACCOUNT_BLOCKED(0x2415) AT T_PA_ADMIN_DISCONNECT_USER Param1(175) Param2(0) Msg(admin)
06-14 22:39:22|Socket Closed  SocketIndex[143] SocketType[9] PeerIP[205.185.126.202] Port[38836] MaxWriteBufCounts[   0] ==> reason 6[0X000006]
06-14 22:39:22|Socket Connect SocketIndex[144] PeerIP[205.185.126.202] Port[38861]
06-14 22:39:23|[Notify] Account Block: AdminIP(205.185.126.202) AdminAccountName(                    ), BlockedUserAccName(             akosss2) Period(2007-03-08 08:56:38 ~ 2021-05-10 11:37:22)

and the adminaccountname show at database just like "sdhdfafasdagsdf" and all random AdminAccountName . and All attack ip come from proxy server.
i was stop http service. but it wasnt help at all.
i was change all command in all the file on Bin folder .but it wasnt help at all.

Any 1 help me plz. log file attachment bellow, plz help me stop this happen.


Thanks

[jison]

[Alucard95]

you are not the only one to had this problem

[addy2291]

SystemLog.rar

Hi, i just make a fun server without any donate ,.. just for fun that all
i using Ep3.3 Server file share by WarOnline.
But server have been hack. i was try all what i know to track him but i cant,

After this error. all player online is banned

06-14 22:39:18|  SendErrorMsg to ClientIndex[142] 205.185.126.202(38794) ==> ERR_PROTOCOL_INVALID_SEQUENCE_NUMBER(0x2408) AT T_PRE_IOCP Param1(0) Param2(0) Msg((null))
06-14 22:39:18|Socket Closed  SocketIndex[142] SocketType[9] PeerIP[205.185.126.202] Port[38794] MaxWriteBufCounts[   1] ==> reason 69632[0X011000]
06-14 22:39:18|[Error] CIOCPSocket::OnReceive Error! Closing Connection!, SocketIndex[142]
06-14 22:39:20|Socket Connect SocketIndex[143] PeerIP[205.185.126.202] Port[38836]
06-14 22:39:22|[Notify] Account Block: AdminIP(205.185.126.202) AdminAccountName(                    ), BlockedUserAccName(               admin) Period(2004-01-22 01:06:01 ~ 2021-01-26 16:12:35)
06-14 22:39:22|  SendErrorMsg to ClientIndex[  1]  77.102.173.240(57488) ==> ERR_PROTOCOL_ACCOUNT_BLOCKED(0x2415) AT T_PA_ADMIN_DISCONNECT_USER Param1(175) Param2(0) Msg(admin)
06-14 22:39:22|Socket Closed  SocketIndex[143] SocketType[9] PeerIP[205.185.126.202] Port[38836] MaxWriteBufCounts[   0] ==> reason 6[0X000006]
06-14 22:39:22|Socket Connect SocketIndex[144] PeerIP[205.185.126.202] Port[38861]
06-14 22:39:23|[Notify] Account Block: AdminIP(205.185.126.202) AdminAccountName(                    ), BlockedUserAccName(             akosss2) Period(2007-03-08 08:56:38 ~ 2021-05-10 11:37:22)

and the adminaccountname show at database just like "sdhdfafasdagsdf" and all random AdminAccountName . and All attack ip come from proxy server.
i was stop http service. but it wasnt help at all.
i was change all command in all the file on Bin folder .but it wasnt help at all.

Any 1 help me plz. log file attachment bellow, plz help me stop this happen.


Thanks

All server have this problem. And anyone know how to fix it. It somthing in preserver

[DragonLord]

As I was saying a lot of times, I have the solution, all I ask for is a small fee for the program I wrote.

[Alucard95]

maybe you need to take another server to solve, not that one of darkmandos (nothing against him) or eliminate the ban function from the server, it eliminates the problem drastically.
Edit: I wrote this post without reading the post of DragonLord, what do you need to solve the problem?

[addy2291]

maybe you need to take another server to solve, not that one of darkmandos (nothing against him) or eliminate the ban function from the server, it eliminates the problem drastically.
Edit: I wrote this post without reading the post of DragonLord, what do you need to solve the problem?

And file i can take? i find good only this...

As I was saying a lot of times, I have the solution, all I ask for is a small fee for the program I wrote.

yeah and what solution you have?

[DragonLord]

A program I wrote that filters out all the bad stuff.
Feel free to pm me for more details.

[Grott]

Not to get hacked, change your password SA. With this address, there are constant attacks on the server. Better yet, put the database on a computer on the LAN. In the extreme case you can install a virtual machine with the database. Then just hack the server can not be. At least through the database.

[sitherogame]

After the same hacker attack on the server where i am GM, all the strategic points become with the date 2013

For example, here's what happened yesterday

On the tool and db : SP Spawn = 2012-06-18 23:35:00.000

after h23:35:00
On the tool and db : SP Spawn = 2013-06-18 23:35:00.000


O.O ... if i initialize it by tool, i don't solve anything..

(sorry for my horrible pseudo-english)

Edit: i've try to restore the databases on the tester (VM), the problem persists there too .. the SP don't spawn..

[sami37]

As I was saying a lot of times, I have the solution, all I ask for is a small fee for the program I wrote.

A small fee? 600€ is small fee for you? lol :)

And yes Brian Do you are not alone :)
You can start to block ALL the thor IP TorStatus - Tor Network Status
That will not stop all your hack but the hacker use thor proxy....

[TheNox]

You can start to block ALL the thor IP TorStatus - Tor Network Status
That will not stop all your hack but the hacker use thor proxy....

give u only a little bit more time...

[Brian Do]

i was trying all what i know to stop him but i cant,
Sorry guys, im move back to Ep2. server just for play with my friend that all.

[sami37]

give u only a little bit more time...

I know, that what i said...
There is not a deffinitly solution but that help a little bit.

[DragonLord]

500€ actually, and it works perfectly.