I may have a backdoor can someone help?

Help and Feedback Code Review
#1

In the command bar of my game, this showed

local button = plugin:CreateToolbar(“oreoollie”):CreateButton(“rm rosync”, “Removes RoSync virus.”, “rbxassetid://4826065214”)

button.Click:Connect(function()
game:GetService(“ChangeHistoryService”):SetWaypoint(“remove RoSync”)
button:SetActive(false)

local totalFixed = 0
for _, v in ipairs(game:GetDescendants()) do
	local s, e = pcall(game.IsA, v, "BaseScript")
	if not (s and e) then continue end

	local occurrences		
	v.Source, occurrences = string.gsub(v.Source, "%s%-%-%[%[ Last synced.+", "")
	totalFixed += math.clamp(occurrences, 0, 1)
end

warn("Fixed", totalFixed, "RoSync infected scripts")

end)

I did not do this, me and a scripter were together. I know the scripter for awhile he has been helping me with the game for a few months. Why is this here?

Also I dont have any virus plugin as I only use moon editor and that is for animation editing.

Please help me, and tell me if this is a backdoor or not

#2

Didn’t you already make a thread about this?

2 Likes
#3

This is a pretty known backdoor that has been talked about A LOT. It comes from malicious plugins made by users/groups called something along the lines of “PluginCreator”. Most likely, your friend had a malicious plugin that infected your scripts. I had to go through all my scripts on by one, searching for “Rosync”, and all my plugins, searching for suspicious creators to get the backdoors out. Good luck!

#4

This is quite a well-known virus known as “RoSync”. It is usually from malicious plugins. I had no idea that this was in my game until my developer @DecodedMint informed me about it. She said that apparently, it can reverse the letters, R, E, Q, U, I, R, and E using string.fev. Guess what that spells? Require. If HTTP Requests are turned on, the virus can be implemented into your game.

1 Like
#5
#6