Is this a virus?

It looks suspicious and is really just poorly attempted obfuscation (is this even obfuscation or just some unnecessary string.reverse command?) of the require command in a getfenv() :neutral_face:

Usually getfenv() is involved with “virus” scripts or backdoors as a tip so just avoid using this. (not always of course but USUALLY)

Not the function itself, just the name usually is. (By that I mean, the name in explorer.)

As a last security check, check all of your important places for any viruses in them. Welcome, if you still have the virus, either reply or DM me for further help.

There is a lot of plugins, at least one of them will have a virus in them. Please read them carefully! Make sure the creators of the plugins are well trusted. Check the users, like ratio, and user’s creations. They might contain some bootleg items.

3 Likes

This is not a Roblox feature. Somehow virus developers are able to hide code behind that comment that actually works. There was a post on it, but I can’t find it right now.

2 Likes

No it isnt. You have obviously used a malicious plugin and probably somewhere in that script there is a backdoor. Please show us all your plugins if you don’t want your game to be plagued by exploiters. Make sure if your game is Team create, show us your dev’s plugins as well

2 Likes

If the script was randomly inserted into a part, or randomly appeared in your workspace then you do in fact have a virus.

I strongly encourage you to be more cautious with plugins or models you may use for your games.

This is not a ROBLOX feature it’s the plugins causing this. It has inserted a backdoor in the game. To find the backdoors, test the game and click alt+shift F. Then a window will open. Search things like teleportservice, get fenv, require. Check the scripts, if you see a script that is unfamiliar then DESTROY IT!

This is not a feature. I was working in team create when I noticed this comment, turns out one of my member had a infected plugin. If you scroll horizontally to the extreme right you will see some virus obfuscated code

I remember helping a user that had this same problem a couple of days ago.

This virus comes to your game by either using a fake plugin called “RoSync”, or through a free model.

What we did, is that we scanned the whole entire game. Then we deleted the malicious scripts and scanned again. And then, it was gone.

I do not know if it still works, as the virus came back the day after. -_-

1 Like

I play tested the game, there is nothing malicious when I searched gen fenv, require etc.

This is very obviously a backdoor.
If you want to know how I can easily figure this out: here’s what I did.

getfenv() returns a table of the functions and variables in the current environment. This can be used to easily attempt to hide a function.

In this case, it indexes string.reverse(“\101\114\105\117\113\101\114”). If you see what this ascii code corresponds to “eriuqer”, which when put through the reverse function gives you “require”.

So, the script uses getfenv() and escapes ascii code to hide the require index in that table that is returned.

It then calls the require function with the asset id “5723263360”. Upon further inspection this is a quote on quote “require chain”, which basically hooks up module scripts in a chain to require each-other in an attempt to hide the final script in the chain.
I’ve reached a script in the chain that’s obfuscated, I don’t have the tools to get through it so :confused:

TL;DR: The script uses require to get a chain of module scripts, which eventually leads to a server-sided backdoor.

17 Likes

You either removed the virus, or it’s hiding itself by deleting itself when RunService returns true from the function :IsStudio().

2 Likes

The virus doesn’t pop up anymore even when I spam letters. I guess the insert catalog item plugin infected my place. I uninstalled it

If your problem is solved, make sure to add a Solution to the person that got you an answer.
This is so we can know what solved your problem.

As an alternative to the plug-in, you can insert items from the catalog using the Command Bar.
Copy & Paste this line, and replace AssetID with the ID of the item.

game:GetService("InsertService"):LoadAsset(AssetID).Parent=game.Workspace

3 Likes

RoSync has gotten pretty “popular” now it seems.
One of my games got infected with it too

even if you uninstall the plugin there still may be a backdoor, for example
I had I virus in my game that I couldn’t see but other players could, which is why I was never suspicious of anything until I was notified by a friend that he was getting pop-ups on his screen telling him that if he bought it, he would get admin in the game.
I went to see for myself and was confused because I never got any pop-ups , so I joined an alt and sure enough there it was.
I couldn’t see it on my own account that I had made the game on.
I tried everything to get rid of it, even without the plugin i still had it.
i had a small game so there were really any parts in there that it could of hid inside of either.

You may just want to double check just to be on safe side. :heart:

1 Like

Yea I did double check, luckily it was my building place. I never used the plugin in my actual games.

1 Like

my friend is a great programmer and he told me this Capture

1 Like