Okay, so I have this issue of a player joining the server and restarting the server. He joined before having Bluebot, mApex, I have !cac so I saw those were the only files he loaded. He joins and then restarts the server willingly. I can't join FacePunch without a referrer and I don't know what else to do so I'm turning here for help. I don't think it's a backdoor'd addon but then again every time this has happened he was just instantly banned so I didn't have a chance to remove addons and see if he can still do it. ULX logs this as a "New map" and I was thinking maybe it's something with ULX since I'm using the version from GitHub. If there's anything you guys know of that I can use to look if an addon is backdoor'd, please tell me. So far I've scanned all my files (Extracted using GMAD) using notepadd++ and I haven't found any suspicious looking RunConsoleCommand or ConCommands. I don't know what to do. This has happened a few times on 3 separate occasions, he just makes new accounts and rejoins. Please help me...
EDIT: I just noticed that the log has different times so I assume ULX started logging as soon as the server came back up and the New map is just stating that there's a new map loaded. I doubt he's forcing the map change but man I'm at a loss.
[16:23:04] Client "bzap111" spawned in server <STEAM_0:1:110868192> (took 29 seconds).
^Moment he connected
[16:34:04] bzap111: This is Arabu aka Gustav Melo 8, I'm crashing your server again. <3
[16:34:05] bzap111: This is Arabu aka Gustav Melo 8, I'm crashing your server again. <3
[16:34:06] bzap111: This is Arabu aka Gustav Melo 8, I'm crashing your server again. <3
-this is the end of this part of the log, this gap appears and then it starts again at New map-
[16:34:36] New map: ttt_minecraft_b5
[16:34:36] Client "[NeXuS] Madgamesbro" connected. <--- This guy was on during all the attacks.
[16:34:40] Client "[NeXuS] Madgamesbro" spawned in server <STEAM_0:1:85995295> (took 4 seconds).
