I have found a Hidden Virus script in my game that hides itself in other scripts

Help and Feedback Scripting Support
,
#1

I have been dealing with viruses in my game for a while, normally id be able to use the lookup tool, search Getfenv and find the virus script in the explorer but that no longer seems to work, instead the find results tool tells me the virus script is located in the same location as other script, under the same name, for example:
If i have a script called script inside of a part called part in workspace, the lookup tool will tell me the virus script is in Workspace.part.script, if i open this script, it will show me the normal script with nothing weird in it. What is even weirder is that whenever i open the virus script from the lookup thing, it opens the virus, but as soon as i click something inside of it, it refreshes to the regular script. I have tried multiple anti-backdoor plugins but none detect these scripts, and i dont know what to do.

Ill also attach a screenshot of what shows up when i look up Getfenv, what i get after i select the first result and what it turns into when i try to select anything in it.

Virus script
Virus script600×760 41.1 KB

4 Likes
#2

Do you have any suspicious plugins?
This seems to be a plugin injecting its virus payload
You mentioned that you tried to get rid of it, and i think it just reinstalls itself.
Go through all your pluging and find anything suspicious delete it then maybe reinstall.
after that check if its still there

4 Likes
#3

There are some plugins that help to remove these.

The one I personally use:
https://www.roblox.com/library/2817475151/Virus-Remover

3 Likes
#4

Can you link the ones you tried? When did this start happening? What free models do you remember inserting?

1 Like
#5

I use this one, Hidden/Infection Script Detector - Roblox

1 Like
#6

i have tried the following
https://www.roblox.com/library/3550088966/Backdoor-Scanner
https://www.roblox.com/library/2670956620/Hidden-Infection-Script-Detector
https://www.roblox.com/library/4216304328/Venom-Intercept-Malicious-Scripts

2 Likes
#7

that didnt detect anything, the only one that detected something was backdoor scanner, but it only detected like 7 scripts out of like 80 or 90

2 Likes
#8

also this has been going on for a couple of months, its coming from a plugin but im afraid i cant tell you which, i got multiple devs working on this game and they all have different plugins. what i can tell you is that most of them have deleted all of their plugins a couple of times and this keeps showing up

1 Like
#9

one of you has a backdoor plugin. You will have to try and find it
just get everyone in a call and go through all of your plugins one by one

2 Likes
#10

well yeah, but how do i get rid of these?, is there a command i can use to remove a specific line of code from a bunch of scripts?

1 Like
#11

You should try to track down the plugin first. You could also have one of your scripters write a plugin to do that for you as there is no command that can do that.
also remove any free models you got

1 Like
#12

Try to revert the studio workplace to a much older version. Yes ik you will sadly lose progress but i think it maybe will remove the virus you have currently in the game.

Second option is wait for the Anti Virus Plugins to be updated i guess or maybe you have some outdated

And like SlinkyShelf said remove Free models if you have any

2 Likes
#13

as this is a question that is asked way to amny times on this forum i made a tutorial

How to remove the remenants of a virus (for beginners)

1 Like
#15

Fun fact, those funny looking numbers with the backslashes are ASCII codes, which I translated it and it says require.

#17

that encoded string is just ‘require’ with ‘\114’ is key ‘r’

#18

to stay safe just remove scripts from places that don’t need scripts using the explorer