I joined a Fake Server and nearly got a Virus.

[クロソ]

a

[Automatic]

It looks like you've come across a malicious server that attempted to exploit your machine through a series of scripts. The script you posted is indeed malicious in intent.

It first kills any running instances of hl.exe or cstrike.exe. These are the main executable files for Half-Life and Counter-Strike respectively.

It then removes certain types of files (*.asi and *.bat), which could potentially be related to legitimate game modification files or other scripts.

A VBScript file (trash.vbs) is then created, which seems to be designed to download a file (ST*G_**_DE.exe) from a remote server and execute it on your machine.

The fact that you found a path to a PDB file (Program Database) in the binary suggests that the creator didn't bother to clean up after compiling the code, as these files are typically used for debugging and aren't needed in a final, released version of software. The username "emoto" might be related to the person who created this file, but it could also be a false flag or irrelevant.

In this case, you did the right thing by investigating the files and not running anything suspicious. It's very important to stay vigilant when gaming online, especially when joining servers or downloading mods from sources that aren't officially endorsed or otherwise trusted by the gaming community.

Here are a few additional steps you can take to protect yourself:

Scan your system for malware: Use an antivirus software to scan your computer for any malicious programs or files that may have been downloaded.

Change your passwords: If there's a chance that your information has been compromised, it's a good idea to change your passwords. This is especially true for any accounts that you logged into while you were potentially infected.

Update your software: Make sure all of your software, including your operating system, is up to date. Many updates include security fixes that can protect you from known vulnerabilities.

Enable a firewall: If you haven't already, enable a firewall on your computer. This can help protect your system by controlling incoming and outgoing network traffic based on predetermined security rules.

Be cautious: Be careful when joining unofficial servers or downloading mods. Always use trusted sources and verify the integrity of files where possible.

Remember, it's always better to err on the side of caution when it comes to online security.

[Prime Rib]

For any newcomers, don't use a website to find servers and make sure every server has real Steam accounts in them. If you're having a hard time finding a server you want to play then don't go down the rabbit hole of looking for IPs it's just not worth it. The only thing that happened to me once is that my Player name was changed after joining a server but nothing like stopping the client happened so it was relatively harmless. Valve should really clean up this game a bit more because it's weird for a big company to have a game with this many security holes in it.

[심장을 파고들어 넌]

Can confirm this is real.
They uploading rat to client with precache_generic.
Be careful.

[Dark]

Imagine trying to hack players in a nostalgia game.

[Dark]

If you want to protect yourself from unwanted commands install Xguard from UnknownCheats. it is just a .dll file that you'll copy in your game folder

[クロソ]

Originally posted by item bank 14:

Can confirm this is real.
They uploading rat to client with precache_generic.
Be careful.

Ah, snap. The server was VAC secured, so I didn't think twice before joining; now I wonder if they managed to execute that FreeVIP.cmd script using the client...
I will probably wipe my OS... schizo is kicking in.

Also, I checked that script kiddie site; he keeps a public log of baited users. Server boosting?

[심장을 파고들어 넌]

Originally posted by クロソ:

Ah, snap. The server was VAC secured, so I didn't think twice before joining; now I wonder if they managed to execute that FreeVIP.cmd script using the client...
I will probably wipe my OS... schizo is kicking in.

Also, I checked that script kiddie site; he keeps a public log of baited users. Server boosting? :mkcat:

Who knows, but that thing opens remote access to PC.

[Henry is a sore loser]

i joined an ip from a website because i figured it'd be fine because its a server in an official valve game. but the server did not have real people in it, and im concerned that i could have been infected by something? how can i be sure that I am okay?