Infected CS 1.6 servers!

[Tilestra]

Just warn - most of the Community Servers are infected with Win32.Belonard.A/Win32.Belonard.C/Win32.Belonard.1/Win32.Belonard.5
After connecting to server it will upload to your PC infected virus body.
This problem appeared since march 2019, but last weekend it rised up with more nightmare virus modifications. The currently as i know only Kaspersky/Dr. Web and ESET Nod can detect and remove it from the system correctly.

[Tilestra]

It opens on your PC many proxy connections (for what purposes i dunno, but also it replaces the master-server)

[.0]

It opens proxy connections to add more fake servers to the list.

[BigD1ckJesus]

it's gay. My AV f-secure did also find it. I got the virus for just starting the game, it sends me into a server which appears to be dust2 for a moment, then kicks me out to the menu. Why is no one looking in to this.

[Tilestra]

Originally posted by Christian Soldier:

it's gay. My AV f-secure did also find it. I got the virus for just starting the game, it sends me into a server which appears to be dust2 for a moment, then kicks me out to the menu. Why is no one looking in to this.

I sended tickets to Valve, but got only that:

Hi there!

Unfortunately, we're not able to provide direct support for dedicated servers.

Because dedicated servers are independently operated, we can't provide support for issues you may be experiencing when playing on or running them. If you're playing on a dedicated server and having issues, please contact the server operator for help.

If you're running a dedicated server and having issues, you may be able to find helpful information in the Dedicated Server forums.

I'm sorry we can't be of more help with this.

Best Regards,
Sofi

[Aleksander]

Make sure you never join fake servers, infected servers, join now gametracker.rs all real and quality servers without changing game menu, viruses, fake servers. Enjoy.

[Tilestra]

Originally posted by ^Kafein^Bağımlısı^ESL^:

Make sure you never join fake servers, infected servers, join now gametracker.rs all real and quality servers without changing game menu, viruses, fake servers. Enjoy.

And how we can detect - infected it or not?

[Aleksander]

There are no fake servers on gt.rs

[X_TheRealGamerShady_X420]

do u know where fake servers are sending the virus? like disc C or something?

[Tilestra]

Originally posted by Merix:

do u know where fake servers are sending the virus? like disc C or something?

Yes.

Windows/system32

wmcodecs.dll, ssdp32.dll, davapi.dll
This is infected virus files.

[X_TheRealGamerShady_X420]

Originally posted by nasty:

Originally posted by Merix:

do u know where fake servers are sending the virus? like disc C or something?

Yes.

Windows/system32

wmcodecs.dll, ssdp32.dll, davapi.dll
This is infected virus files.

I saw lots of server like VIP free with always 30/32 Players but if i try to connect then either it says that there's something wrong with my maps or it loada but im in some kind of small dust 2 map with boxes where everyone is spectator. Are those infected servers?

[Tilestra]

Originally posted by Merix:

Originally posted by nasty:

Yes.

Windows/system32

wmcodecs.dll, ssdp32.dll, davapi.dll
This is infected virus files.

I saw lots of server like VIP free with always 30/32 Players but if i try to connect then either it says that there's something wrong with my maps or it loada but im in some kind of small dust 2 map with boxes where everyone is spectator. Are those infected servers?

Yes, those are infected servers.

[Tilestra]

Also after connecting to server, the de_dust2 map will appear for 1-2 seconds and after this it will throw u into main menu.

[X_TheRealGamerShady_X420]

Originally posted by nasty:

Originally posted by Merix:

I saw lots of server like VIP free with always 30/32 Players but if i try to connect then either it says that there's something wrong with my maps or it loada but im in some kind of small dust 2 map with boxes where everyone is spectator. Are those infected servers?

Yes, those are infected servers.

Well then i need to scan my pc. Thanks

[X_TheRealGamerShady_X420]

Originally posted by Merix:

Originally posted by nasty:

Yes, those are infected servers.

Well then i need to scan my pc. Thanks

Luckily i don't have it or malwarebytes just didn't found it.

[gearashi]

Just block this port in your inbound and outbound firewall connections: 144.126.147.143. You will see that NAS is the only active server after that.