Back to the list

If you play Garry's Mod, please read this.

OK. So, I've recently been "hacked" in Garry's Mod. 


Sometime between July 12 and July 17, I launched the game and loaded one of my saved games, as I usually would. When it finished loading, a chat box appeared in the bottom left corner of the screen. It showed my username (Vortexus98), and a series of messages appeared. This is what it read: 

"hello invitation to our discord already copied to your clipboard"

"10 | your gmod will be closed in 10 seconds" 

"9 | no need to debug my scripts anymore" 

"8" 

"7" 

"6 | also all the information about you has already been sent to us" 

"5" 

"4" 

"3" 

"2" 

"1 | see ya later" 

After this, it automatically closed GMod. I knew it was an addon that caused that, so I uninstalled & unsubscribed from all of my recent addons, and tried starting GMod again, but it didn't work. I then tried uninstalling the game, removing many of its files and folders, deleting all of the addons, and re-installing it, but that didn't work, either. I deleted the cache folder and disabled all of the addons, and started a new game, which took care of the issue. I have a video of this, below:



There was an archived page I found. In it, people mentioned that addon creators can add malicious code to their LUA files.


I enabled one or more addons at a time and tested them to see which ones were the culprit. There were about 119 pages of mods to browse, though, so this took a while. I've unsubscribed from & removed addons that had low or negative ratings, were updated recently, had negative comments, and were from authors/creators that had a low number of followers (and a bad track record). I think it took me days to do all of that.


I searched for anti-backdoor tools on Google, and discovered these:

-SNTE (Say No To Exploits)

-Backdoor Buster

-NomaLua Anti-Backdoor (Ingame AD Detector) - Steam - mTxServ


I subscribed to these addons, and launched GMod. I started a new game, and the problem seemed to be resolved. However, a new problem arose--GMod would freeze every 10 seconds. So, I inspected every addon, again, and removed ones that were possible culprits. While I was doing this, I inspected a mod called "Terry Crews Playermodel", and came across a user named "empathy" (now "xo"--this is their third and current name. The second and previous username they went by was "The Fool"). You can view their profile, here.


The addon had a few negative comments; some people accused empathy of stealing it, and another person pointed out that The Fool had multiple VAC bans on record, would hack servers by running a script that demotes staff members and crashes the servers, and has a lot of hate comments on their profile.


empathy admitted that all of that was true, and even said that they hacked the People Of Gaming group on Steam. Also, this person attacks people for no reason. Here's a screenshot of that argument:


And here are a few screenshots of the comments on empathy's profile:


It's safe to say that they have a bad reputation in the community, and shouldn't be trusted. Anyway, I unsubscribed from & uninstalled the "Terry Crews" addon.

Finally, after doing all of the above, the problem was taken care of! For real, this time. No more freezing or crashing!

Possibly malicious addons 

I've compiled a list of addons that might be causing the problem. These are the addons I removed:

  • https://steamcommunity.com/sharedfiles/filedetails/?id=150931409 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1136522607 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=264254834 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1113022065 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1612480439 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=582872726 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1696048467 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1713246866 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1183270758 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=939506947 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1422571973 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=300215933 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=680158152 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1525476002 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=532867045 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1641436287 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1981678974 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1780670555 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1468301449 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1444002820 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1588143044 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1295034547 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1364579794 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1966693278 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=919522045 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1422571973 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=939506947 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1183270758 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1136522607 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1113022065 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1612480439 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=582872726 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1499727706 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1696048467 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1713246866 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1674340751 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=492481673 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1924687045 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1380468790 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=121640637 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=812135775 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=796149775 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=743578457 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1324824216 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1332959445 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1788743463 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=561784997 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=205899664 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=150931409 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=256517431 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1082567905 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1893305952 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=351768384 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=971862631

These are the addons that were removed from the Workshop (these were uninstalled, as well):

  • https://steamcommunity.com/sharedfiles/filedetails/?id=1981556407 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1815276248 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=807679825 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=117827803 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1834155099 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1627016625 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1416824115 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1899997443 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1139812155 
  • https://steamcommunity.com/sharedfiles/filedetails/?id=1675388522

If you have any (or all) of these addons, then you should unsubscribe from them, and remove them from your addons folder. Alternatively, you can uninstall them in GMod--go to Addons, and search for the addons listed above. Click the "Uninstall" button. Wait for a moment--this may take a few minutes. Once it's uninstalled, the color of the border around the addon will change from green to white. You can also open the menu by pressing Escape (ESC).

If you see any "hidden" addons, uninstall them by clicking "Uninstall". This will remove them from your computer, and unsubscribe you from them.

Advice

  1. Don't install addons that have low or negative ratings. 
  2. Don't install brand new addons, unless it's from a creator you trust--it's best to wait for a few weeks or so. 
  3. Always check the date the addons were updated. 
  4. Don't install addons that have/had negative comments. 
  5. Avoid installing addons that are from authors/creators that have a low number of followers and/or a bad track record. If you still decide to do this, please use caution. 
  6. Only subscribe to & install one or more addons at a time. Do not install, say, 69 addons at the same time. Why? Because if you encounter a problem, you'll have a difficult time pinpointing the source of said issue, and might end up uninstalling or disabling all of them, anyway. 
  7. Only install addons from trusted websites, like the Steam Workshop, or GarrysMods.org. 

I hope this was helpful. I think people can narrow down the list even further, and find the offending addon(s). Whoever is behind this will get caught, eventually. Thanks for reading (and visiting).