I have a friend who has a game
He told me that sometimes hackers appear with the ability to kick players (with custom message included)
I joined the project and I saw that no script/localscript/module uses “:kick” and LoadStringEnabled property is disabled
help. I do not understand how this is possible
Check for any scripts loading in something using “require()”. Then check the source code of those modules or remove the loader entirely. This should be a server only thing so feel free to just check server scripts or both.
That plugin is still useful but it’s database may be limited so it would still be best to look it over manually unless the game is full of scripts that make reviewing it very difficult.
it will be difficult. roblox studio found 170 lines with “require” 
Not really. If you found all of those, just search those for common id’s. From there, you can find which ones are harmful and which ones aren’t.
Could you check exploitlogs? Or Client logs?
I found this and I don’t know what it does
“require(306895131)” from Kohl´s Admin Infinite
That’s a fake admin script, it should be removed.
It links back to here: https://www.roblox.com/library/306895131/MainModule
I doubt that’s an issue but Kohl’s Admin Infinite has been known to have… issues. So I suggest switching to Adonis for your sake.
EDIT: Fake admin script so yes, there’s your issue.
Yeah, was about to say it seems suspicious. Creator has no places, no favorite places, and no groups.
Use a new admin for his game? Instead that is more trusted?
The real admin may be fine, but that’s a fake version, most likely with a backdoor scripted in.
The creator has content deleted models, little to no friends, and seems suspicious in general.
Would he better of use this Kohl admin? https://www.roblox.com/library/172732271/Kohls-Admin-Infinite?
Its Kohl’s Admin Infinite
By Scripth
Yes, that’s official. I think there are better admin scripts out there, but Kohl’s is fine if he wants it.
That is the real Kohls Admin Infinite, so that should work.
By the way, if you don’t know, backdoors allow exploiters to run server-side code, including kicking players.
Try double checking your require() functions again and see if you can find another id outside of Kohl’s admin. If you can’t, it’s safe to say Kohl’s admin is the culprit.
Again I’ve heard Kohl’s is suspicious so I recommend Adonis
If any of our replies solved your issue, it would be nice if you marked it as the solution.
He could find his ingame admins that he prefers here, I would recommenced he gets one that has a green tick of approval though!