I would recommend verifying you have the latest version of those two plugins and replacing the data/vscripts_override.cfg with the latest. I notice the cvars are being overwritten still. In the vscript_replacer cfg you can block changing all cvars:
PHP Code:
// Block all attempts to set cvars.
// The above critical cvars will still be blocked
// You can remove // before the next line if you want to block all other cvar changes.
// "Convars.SetValue" "// Convars.SetValues
// eg:
"Convars.SetValue" "// Convars.SetValue"
Your before and after cvars comparison is great, I've updated the Vscripts Replacer config to prevent critical cvars being changed.
Anyway I agree there doesn't seem to be anything changing the hostname. Does this only happen with Helms Deep installed? Does it happen only when changing to that map?
Seriously why hasn't Valve banned serious_samurai and his malicious stolen map already. Absolutely disgusting.
Edit: Updated the patch with latest attempt to override files.
__________________