What.idk what to say.
TF2 servers can display HTML pages that could have that JavaScript exploit on them (see "Infection").Either disable them in advanced multiplayer options or put cl_disablehtmlmotd 0 in your autoexec.cfg.
is pinion pot o gold attacking?
Trojan horse confirmed for tenth class