Files Somehow Getting Deleted

culexor · **Author**

I run several game servers (TF2, HL2DM, CSS) on a server running Windows 2008 R2 and as of a couple of days ago, my files have been randomly getting deleted. Somehow all of the folders with all of the game server files in them are getting deleted while the servers are running. I suspect someone has somehow gained access to my server and is trying to compromise it. I've looked through my FTP logs and nothing is out of the ordinary. RDP logs all check out (I'm the only one that has successfully logged in).

I've followed this guide however it hasn't solved my problem. I've also enabled auditing so it logs whenever files are deleted, however those audits don't seem to give me enough information as to who/what is deleting the files.

Any ideas as to what I can do to track this down and/or prevent it from happening again?

Fearts · 07-13-2012 , 11:48 Re: Files Somehow Getting Deleted

http://forums.alliedmods.net/showthread.php?t=142249

culexor · 07-13-2012 , 19:12 Re: Files Somehow Getting Deleted

I installed that the other day and it doesn't seem to have solved my problem unfortunately.

culexor · *Last edited by culexor; 07-20-2012 at 10:08.*

Okay, well it happened again and ProcMon caught it. Here's the procmon output for one of the files that got deleted:

(Process)

Code:

Description:	
Company:	
Name:	srcds.exe
Version:	
Path:	D:\srcds\hl2dm-roleplay\orangebox\srcds.exe
Command Line:	"D:\srcds\hl2dm-roleplay\orangebox\srcds.exe" -game hl2mp -ip 72.9.147.131 -port 27100 +maxplayers 24 -debug -console -nocrashdialog -norestart +host_timer_spin_ms 0 +map rp_bangclaw_hl2_b
PID:	8088
Parent PID:	1404
Session ID:	0
User:	NT AUTHORITY\SYSTEM
Auth ID:	00000000:000003e7
Architecture:	32-bit
Virtualized:	False
Integrity:	System
Started:	7/19/2012 2:33:59 PM
Ended:	(Running)
Modules:
server.dll	0x170000	0x1b000	d:\srcds\hl2dm-roleplay\orangebox\hl2mp\addons\metamod\bin\server.dll		1.8.7
dosattackfix.dll	0x3c0000	0x31000	d:\srcds\hl2dm-roleplay\orangebox\hl2mp\addons\daf\bin\dosattackfix.dll		
metamod.2.ep2v.dll	0x440000	0x36000	d:\srcds\hl2dm-roleplay\orangebox\hl2mp\addons\metamod\bin\metamod.2.ep2v.dll		1.8.7
D-FENS_OB.dll	0x490000	0x1d000	D:\srcds\hl2dm-roleplay\orangebox\hl2mp\addons\D-FENS_OB.dll		
serversecure_files.ext.2.ep2v.dll	0xb60000	0x1a000	D:\srcds\hl2dm-roleplay\orangebox\hl2mp\addons\sourcemod\extensions\serversecure_files.ext.2.ep2v.dll		
plr.dll	0xc10000	0x75000	d:\srcds\hl2dm-roleplay\orangebox\hl2mp\addons\plr.dll	AdminOP, SourceOP	1.2.2
crashhandler.dll	0x12a0000	0xaf000	D:\srcds\hl2dm-roleplay\orangebox\bin\crashhandler.dll	Valve Corporation	00.96.95.26
srcds.exe	0x1350000	0x22000	D:\srcds\hl2dm-roleplay\orangebox\srcds.exe		
steamtools.ext.dll	0xe310000	0x27000	D:\srcds\hl2dm-roleplay\orangebox\hl2mp\addons\sourcemod\extensions\steamtools.ext.dll		
steam.dll	0x30000000	0x2d8000	D:\srcds\hl2dm-roleplay\orangebox\bin\steam.dll	Valve Corporation	2.0.1343.135
steamclient.dll	0x38000000	0x692000	D:\srcds\hl2dm-roleplay\orangebox\bin\steamclient.dll	Valve Corporation	01.38.96.20
server.dll	0x54f40000	0x7a9000	d:\srcds\hl2dm-roleplay\orangebox\hl2mp\bin\server.dll		
sdkhooks.ext.2.ep2v.dll	0x60700000	0x23c000	D:\srcds\hl2dm-roleplay\orangebox\hl2mp\addons\sourcemod\extensions\sdkhooks.ext.2.ep2v.dll		144:f283b1c23d74
dbi.mysql.ext.dll	0x61de0000	0x17d000	D:\srcds\hl2dm-roleplay\orangebox\hl2mp\addons\sourcemod\extensions\dbi.mysql.ext.dll		1.4.4-dev
socket.ext.dll	0x64390000	0x63000	D:\srcds\hl2dm-roleplay\orangebox\hl2mp\addons\sourcemod\extensions\socket.ext.dll		
dbi.sqlite.ext.dll	0x64510000	0x61000	D:\srcds\hl2dm-roleplay\orangebox\hl2mp\addons\sourcemod\extensions\dbi.sqlite.ext.dll		1.4.4-dev
sdktools.ext.2.ep2v.dll	0x64580000	0x57000	D:\srcds\hl2dm-roleplay\orangebox\hl2mp\addons\sourcemod\extensions\sdktools.ext.2.ep2v.dll		1.4.4-dev
clientprefs.ext.dll	0x691b0000	0x1b000	D:\srcds\hl2dm-roleplay\orangebox\hl2mp\addons\sourcemod\extensions\clientprefs.ext.dll		1.4.4-dev
bintools.ext.dll	0x691d0000	0x17000	D:\srcds\hl2dm-roleplay\orangebox\hl2mp\addons\sourcemod\extensions\bintools.ext.dll		1.4.4-dev
topmenus.ext.dll	0x691f0000	0x18000	D:\srcds\hl2dm-roleplay\orangebox\hl2mp\addons\sourcemod\extensions\topmenus.ext.dll		1.4.4-dev
webternet.ext.dll	0x6a200000	0x42000	D:\srcds\hl2dm-roleplay\orangebox\hl2mp\addons\sourcemod\extensions\webternet.ext.dll		1.4.4-dev
updater.ext.dll	0x6a5a0000	0x19000	D:\srcds\hl2dm-roleplay\orangebox\hl2mp\addons\sourcemod\extensions\updater.ext.dll		
sourcepawn.jit.x86.dll	0x6ac70000	0x32000	D:\srcds\hl2dm-roleplay\orangebox\hl2mp\addons\sourcemod\bin\sourcepawn.jit.x86.dll		1.4.4-dev
sourcemod.logic.dll	0x6acb0000	0x4d000	D:\srcds\hl2dm-roleplay\orangebox\hl2mp\addons\sourcemod\bin\sourcemod.logic.dll		1.4.4-dev
sourcemod.2.ep2v.dll	0x6ad00000	0xa8000	D:\srcds\hl2dm-roleplay\orangebox\hl2mp\addons\sourcemod\bin\sourcemod.2.ep2v.dll		1.4.4-dev
sourcemod_mm.dll	0x6adb0000	0x11000	D:\srcds\hl2dm-roleplay\orangebox\hl2mp\addons\sourcemod\bin\sourcemod_mm.dll		1.4.4-dev
tier0_s.dll	0x6add0000	0xa7000	D:\srcds\hl2dm-roleplay\orangebox\bin\tier0_s.dll	Valve Corporation	01.38.96.20
stdshader_dx9.dll	0x6ae80000	0x9b000	d:\srcds\hl2dm-roleplay\orangebox\bin\stdshader_dx9.dll		
studiorender.dll	0x6af20000	0x401000	d:\srcds\hl2dm-roleplay\orangebox\bin\studiorender.dll		
dhcpcsvc.DLL	0x703f0000	0x12000	C:\Windows\SysWOW64\dhcpcsvc.DLL	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
VERSION.dll	0x71ef0000	0x9000	C:\Windows\SysWOW64\VERSION.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
HID.DLL	0x728e0000	0x9000	C:\Windows\SysWOW64\HID.DLL	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
DINPUT.DLL	0x728f0000	0x25000	C:\Windows\SysWOW64\DINPUT.DLL	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
WSOCK32.dll	0x73750000	0x7000	C:\Windows\SysWOW64\WSOCK32.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
fwpuclnt.dll	0x73880000	0x38000	C:\Windows\SysWOW64\fwpuclnt.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
rasadhlp.dll	0x738c0000	0x6000	C:\Windows\SysWOW64\rasadhlp.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
WINNSI.DLL	0x738d0000	0x7000	C:\Windows\SysWOW64\WINNSI.DLL	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
IPHLPAPI.DLL	0x738e0000	0x1c000	C:\Windows\SysWOW64\IPHLPAPI.DLL	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
vstdlib_s.dll	0x73a90000	0x44000	D:\srcds\hl2dm-roleplay\orangebox\bin\vstdlib_s.dll	Valve Corporation	01.38.96.20
engine.dll	0x73ae0000	0x641000	d:\srcds\hl2dm-roleplay\orangebox\bin\engine.dll		
winrnr.dll	0x74130000	0x8000	C:\Windows\SysWOW64\winrnr.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
NLAapi.dll	0x74150000	0x10000	C:\Windows\SysWOW64\NLAapi.dll	Microsoft Corporation	6.1.7601.17514 (win7sp1_rtm.101119-1850)
rsaenh.dll	0x74250000	0x3b000	C:\Windows\SysWOW64\rsaenh.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
CRYPTSP.dll	0x74290000	0x16000	C:\Windows\SysWOW64\CRYPTSP.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
wship6.dll	0x742b0000	0x6000	C:\Windows\SysWOW64\wship6.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
wshtcpip.dll	0x742c0000	0x5000	C:\Windows\SysWOW64\wshtcpip.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
DNSAPI.dll	0x743f0000	0x44000	C:\Windows\SysWOW64\DNSAPI.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
soundemittersystem.dll	0x74470000	0x23000	D:\srcds\hl2dm-roleplay\orangebox\bin\soundemittersystem.dll		
stdshader_dx8.dll	0x744a0000	0x68000	d:\srcds\hl2dm-roleplay\orangebox\bin\stdshader_dx8.dll		
scenefilecache.dll	0x74530000	0x17000	D:\srcds\hl2dm-roleplay\orangebox\bin\scenefilecache.dll		
Secur32.dll	0x74550000	0x8000	C:\Windows\SysWOW64\Secur32.dll	Microsoft Corporation	6.1.7601.17856 (win7sp1_gdr.120601-1505)
WINMM.dll	0x74560000	0x32000	C:\Windows\SysWOW64\WINMM.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
stdshader_dx7.dll	0x745a0000	0x37000	d:\srcds\hl2dm-roleplay\orangebox\bin\stdshader_dx7.dll		
stdshader_dx6.dll	0x745e0000	0x48000	d:\srcds\hl2dm-roleplay\orangebox\bin\stdshader_dx6.dll		
stdshader_dbg.dll	0x74630000	0x33000	d:\srcds\hl2dm-roleplay\orangebox\bin\stdshader_dbg.dll		
shaderapiempty.dll	0x74670000	0x18000	D:\srcds\hl2dm-roleplay\orangebox\bin\shaderapiempty.dll		
vgui2.dll	0x74690000	0x5a000	d:\srcds\hl2dm-roleplay\orangebox\bin\vgui2.dll		
datacache.dll	0x746f0000	0x3e000	d:\srcds\hl2dm-roleplay\orangebox\bin\datacache.dll		
vphysics.dll	0x74730000	0xed000	d:\srcds\hl2dm-roleplay\orangebox\bin\vphysics.dll		
materialsystem.dll	0x74820000	0x123000	d:\srcds\hl2dm-roleplay\orangebox\bin\materialsystem.dll		
dedicated.dll	0x74950000	0xff000	D:\srcds\hl2dm-roleplay\orangebox\bin\dedicated.dll		
vstdlib.dll	0x74a80000	0x5c000	D:\srcds\hl2dm-roleplay\orangebox\bin\vstdlib.dll		
tier0.dll	0x74ae0000	0x44000	D:\srcds\hl2dm-roleplay\orangebox\bin\tier0.dll		
steam_api.dll	0x74b30000	0x1e000	D:\srcds\hl2dm-roleplay\orangebox\bin\steam_api.dll	Valve Corporation	01.39.29.64
mswsock.dll	0x74b50000	0x3c000	C:\Windows\SysWOW64\mswsock.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
wow64cpu.dll	0x74b90000	0x8000	C:\Windows\SYSTEM32\wow64cpu.dll	Microsoft Corporation	6.1.7601.17651 (win7sp1_gdr.110715-1504)
wow64win.dll	0x74ba0000	0x5c000	C:\Windows\SYSTEM32\wow64win.dll	Microsoft Corporation	6.1.7601.17651 (win7sp1_gdr.110715-1504)
wow64.dll	0x74c00000	0x3f000	C:\Windows\SYSTEM32\wow64.dll	Microsoft Corporation	6.1.7601.17651 (win7sp1_gdr.110715-1504)
CRYPTBASE.dll	0x74c50000	0xc000	C:\Windows\syswow64\CRYPTBASE.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
ADVAPI32.dll	0x74cc0000	0xa0000	C:\Windows\syswow64\ADVAPI32.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
MSASN1.dll	0x74e70000	0xc000	C:\Windows\syswow64\MSASN1.dll	Microsoft Corporation	6.1.7601.17514 (win7sp1_rtm.101119-1850)
iertutil.dll	0x74e80000	0x1b8000	C:\Windows\syswow64\iertutil.dll	Microsoft Corporation	9.00.8112.16447 (WIN7_IE9_GDR.120602-0000)
CRYPT32.dll	0x75040000	0x11e000	C:\Windows\syswow64\CRYPT32.dll	Microsoft Corporation	6.1.7601.17827 (win7sp1_gdr.120423-1504)
imagehlp.dll	0x75160000	0x2a000	C:\Windows\syswow64\imagehlp.dll	Microsoft Corporation	6.1.7601.17787 (win7sp1_gdr.120229-1502)
MSCTF.dll	0x75190000	0xcc000	C:\Windows\syswow64\MSCTF.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
PSAPI.DLL	0x75260000	0x5000	C:\Windows\syswow64\PSAPI.DLL	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
msvcrt.dll	0x75270000	0xac000	C:\Windows\syswow64\msvcrt.dll	Microsoft Corporation	7.0.7601.17744 (win7sp1_gdr.111215-1535)
KERNELBASE.dll	0x75320000	0x46000	C:\Windows\syswow64\KERNELBASE.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
ole32.dll	0x75370000	0x15c000	C:\Windows\syswow64\ole32.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
WINTRUST.dll	0x754d0000	0x2d000	C:\Windows\syswow64\WINTRUST.dll	Microsoft Corporation	6.1.7601.17787 (win7sp1_gdr.120229-1502)
OLEAUT32.dll	0x75500000	0x8f000	C:\Windows\syswow64\OLEAUT32.dll	Microsoft Corporation	6.1.7601.17676
WS2_32.dll	0x755e0000	0x35000	C:\Windows\syswow64\WS2_32.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
urlmon.dll	0x75620000	0x111000	C:\Windows\syswow64\urlmon.dll	Microsoft Corporation	9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
SHLWAPI.dll	0x75740000	0x57000	C:\Windows\syswow64\SHLWAPI.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
CFGMGR32.dll	0x758a0000	0x27000	C:\Windows\syswow64\CFGMGR32.dll	Microsoft Corporation	6.1.7601.17621 (win7sp1_gdr.110523-2108)
USP10.dll	0x75930000	0x9d000	C:\Windows\syswow64\USP10.dll	Microsoft Corporation	1.0626.7601.17514 (win7sp1_rtm.101119-1850)
SHELL32.dll	0x75a30000	0xc4a000	C:\Windows\syswow64\SHELL32.dll	Microsoft Corporation	6.1.7601.17514 (win7sp1_rtm.101119-1850)
NSI.dll	0x76680000	0x6000	C:\Windows\syswow64\NSI.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
WININET.dll	0x76690000	0x11b000	C:\Windows\syswow64\WININET.dll	Microsoft Corporation	9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
Normaliz.dll	0x767b0000	0x3000	C:\Windows\syswow64\Normaliz.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
sechost.dll	0x76840000	0x19000	C:\Windows\SysWOW64\sechost.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
DEVOBJ.dll	0x76860000	0x12000	C:\Windows\syswow64\DEVOBJ.dll	Microsoft Corporation	6.1.7601.17621 (win7sp1_gdr.110523-2108)
SETUPAPI.DLL	0x76970000	0x19d000	C:\Windows\syswow64\SETUPAPI.DLL	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
GDI32.dll	0x76b10000	0x90000	C:\Windows\syswow64\GDI32.dll	Microsoft Corporation	6.1.7601.17514 (win7sp1_rtm.101119-1850)
ntdll.dll	0x773a0000	0x1a9000	C:\Windows\SYSTEM32\ntdll.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
LPK.dll	0x77550000	0xa000	C:\Windows\syswow64\LPK.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)
ntdll.dll	0x77580000	0x180000	C:\Windows\SysWOW64\ntdll.dll	Microsoft Corporation	6.1.7600.16385 (win7_rtm.090713-1255)

(stack)

Code:

"Frame","Module","Location","Address","Path"
"0","fltmgr.sys","FltAcquirePushLockShared + 0x907","0xfffff88000db1067","C:\Windows\system32\drivers\fltmgr.sys"
"1","fltmgr.sys","FltIsCallbackDataDirty + 0xa39","0xfffff88000db2329","C:\Windows\system32\drivers\fltmgr.sys"
"2","fltmgr.sys","fltmgr.sys + 0x16c7","0xfffff88000db06c7","C:\Windows\system32\drivers\fltmgr.sys"
"3","ntoskrnl.exe","NtSetInformationFile + 0x81c","0xfffff800019a3b4c","C:\Windows\system32\ntoskrnl.exe"
"4","ntoskrnl.exe","KeSynchronizeExecution + 0x3a23","0xfffff800016c8453","C:\Windows\system32\ntoskrnl.exe"
"5","ntdll.dll","ZwSetInformationFile + 0xa","0x773f158a","C:\Windows\SYSTEM32\ntdll.dll"
"6","wow64.dll","Wow64EmulateAtlThunk + 0x7ab1","0x74c15411","C:\Windows\SYSTEM32\wow64.dll"
"7","wow64.dll","Wow64SystemServiceEx + 0xd7","0x74c0cf87","C:\Windows\SYSTEM32\wow64.dll"
"8","wow64cpu.dll","TurboDispatchJumpAddressEnd + 0x2d","0x74b92776","C:\Windows\SYSTEM32\wow64cpu.dll"
"9","wow64.dll","Wow64SystemServiceEx + 0x1ce","0x74c0d07e","C:\Windows\SYSTEM32\wow64.dll"
"10","wow64.dll","Wow64LdrpInitialize + 0x429","0x74c0c549","C:\Windows\SYSTEM32\wow64.dll"
"11","ntdll.dll","RtlUniform + 0x6e6","0x773e4956","C:\Windows\SYSTEM32\ntdll.dll"
"12","ntdll.dll","RtlCreateTagHeap + 0xa7","0x773e1a17","C:\Windows\SYSTEM32\ntdll.dll"
"13","ntdll.dll","LdrInitializeThunk + 0xe","0x773cc32e","C:\Windows\SYSTEM32\ntdll.dll"
"14","ntdll.dll","NtSetInformationFile + 0x12","0x7759fc2a","C:\Windows\SysWOW64\ntdll.dll"
"15","KERNELBASE.dll","DeleteFileW + 0x277","0x753394b6","C:\Windows\syswow64\KERNELBASE.dll"
"16","KERNELBASE.dll","DeleteFileA + 0x20","0x753395ac","C:\Windows\syswow64\KERNELBASE.dll"
"17","sourcemod.2.ep2v.dll","CreateInterface + 0x53acc","0x6ad687bc","D:\srcds\hl2dm-roleplay\orangebox\hl2mp\addons\sourcemod\bin\sourcemod.2.ep2v.dll"

So from what I get out of this, I may be running a sourcemod plugin or extension that is allowing someeone to hijack my server. I'll continue to investigate.

Here's a list of plugins running on the server

Code:

admin_logging.smx
admin-flatfile.smx
adminhelp.smx
AdminList.smx
adminmenu.smx
antiflood.smx
basechat.smx
basecomm.smx
basecommands.smx
basetriggers.smx
basevotes.smx
clientprefs.smx
disabled
extendedcomm.smx
firewallradio_v1.02.smx
forlix_floodcheck.smx
funcommands.smx
funvotes.smx
glow.smx
hlstatsx.smx
infinite_aux_power.smx
kigen-ac-pub.smx
list.txt
mapchooser.smx
nextmap.smx
nominations.smx
playercommands.smx
playersvotes.smx
randomcycle.smx
rcon_lock.smx
reloadmaponserverstart.smx
reservedslots.smx
rockthevote.smx
serverhop.smx
sm_downloader.smx
sm_skinchooser_hl2dm.smx
smac.smx
sounds.smx
sourcebans.smx
spraytrace.smx
st_gamedesc_override.smx
superlogs-hl2mp.smx
votemute_p.smx
webshortcuts.smx

Nolongerinthegame · 07-20-2012 , 14:15 Re: Files Somehow Getting Deleted

What is list.smx?

Zephyrus · 07-20-2012 , 16:49 Re: Files Somehow Getting Deleted

Quote:

Originally Posted by nelioneil

What is list.smx?

thats a txt

checkster · 07-20-2012 , 17:10 Re: Files Somehow Getting Deleted

1. are you the sole admin ?
If yes have you been compromised ?
2. have you installed this http://forums.alliedmods.net/showthread.php?t=142249 ?

Nolongerinthegame · 07-20-2012 , 18:16 Re: Files Somehow Getting Deleted

Quote:

Originally Posted by Zephyrus

thats a txt

DOH!

Visual77 · *Last edited by Visual77; 07-20-2012 at 18:45.*

Quote:

Originally Posted by checkster

2. have you installed this http://forums.alliedmods.net/showthread.php?t=142249 ?

Read post #3 again.

Running any custom/private plugins or anything like that no? Why have you listed a .txt file as a plugin?

culexor · 07-20-2012 , 20:07 Re: Files Somehow Getting Deleted

Quote:

Originally Posted by checkster

1. are you the sole admin ?
If yes have you been compromised ?
2. have you installed this http://forums.alliedmods.net/showthread.php?t=142249 ?

1. yes

1a. i'm 95% sure i'm not (you can never be 100% sure about that)

2. yes

As I said in my previous post, it appears that srcds and/or sourcemod is being triggered to delete the files internally, as opposed to someone deleting them through ftp or remote desktop.