Server hacked

[flakenstine]

So the server that I'm a developer on got hacked today. And it's the same hack that happens everytime. Here's what happens: They keep using stupid lua scripts that cause players to not be able to move props the admins keep getting this script where we are stuck in a fixed view. And our permissions get taken away on restart.

I need to know if anyone can offer assistance besides suggesting to wipe the server. Because at this point I don't really know what or how to fix the issue.

[soja]

sv_allowupload 0

Look for LUA scripts recently uploaded(check last modified date).

[flakenstine]

That's just it. I don't know where to look. I've looked just about everywhere and can't find anything.

[soja]

Enable -condebug and check the output when you restart the server. It will be contained in console.log in your garrysmod folder.

[flakenstine]

Okay this happened shortly after the server restarted:
L 03/14/2014 - 23:56:01: server_cvar: "sv_allowcslua" "1"
L 03/14/2014 - 23:56:01: server_cvar: "sv_airaccelerate" "100"

Note: That was not us. That happened as I said after the server restarted.

[soja]

A lot of stuff is enabled when the server boots up.

sv_airaccelerate is harmless, I don't know what sv_allowcslua means.

[flakenstine]

CSlua means custom lua scripts.

[flakenstine]

The one thing that is pissing us off the most is the fact that players can't move props. I really don't know what to do at this point.

[soja]

Try restoring from a backup?

[flakenstine]

Tried that. The script is still here. Or something is disabled. But I don't know what is wrong, because props are basically frozen to the world like they're welded.

[Fixer243]

I have a few questions after reading, Is it a Darkrp server or something close to it?
Is Ulx installed?
If it is DarkRP, what version are you on?
Have you looked into a anticheat addon?
Is there anyway i can get your server ip to assist you?
BlaBlaBla. But really, Contact me on steam: Fixer243