Is this some virus?

[jzxssph (onlyjzxsh)]

I have tried playing my game and this came. I am not sure from where and I couldnt find anything about it

[Doxelix (Chara)]

Did you put any free models apparently?

I can see that it’s trying to get an object like maybe script or something and then parent it to game.ServerScriptService which is Server-Side. It might try to get an access or a backdoor to your game to have access. (That’s what I think)

[SMBri (SMBriTheNuke)]

Yeah that seems like a malicious model in your game, you gotta be careful when using the toolbox, can you check all scripts in your game for something that parents/creates a gui? Or it could be a plugin that inserts something

[JAcoboiskaka1121 (Skellyton)]

This is so blatant it’s hilarious.

If you used free models and such this may happen, so just don’t use free models with scripts you don’t understand.

[gameCoder1210]

YES. THIS IS A VIRUS! DO NOT FOLLOW THE INSTRUCTIONS, THEY INSERT A VIRUS INTO YOUR GAME

I’ll see what the virus does and report back.

[jzxssph (onlyjzxsh)]

But how do I track the virus down?

[jzxssph (onlyjzxsh)]

Yep but Im not sure which it was.

[gameCoder1210]

This is a link to the virus that the gui is trying to insert into your game.
https://create.roblox.com/store/asset/114706280708394/Roblox-Core-Meta-Module

Please report this model.

Speaking of, it’s hilarious how stupid this is. Most backdoors try to hide it. This one is almost as bad as Debounce.


I’ll update the search for what this malware does by editing this comment.

Sandbox evasion. This is 100% malicious.

It looks like this script is a cheap attempt at getting people to accidentally purchase a gamepass.

I’ll spam this api with nonsense requests.

Nothing interesting from beyond this point, just some “backdoor” from little Timmy.

[JAcoboiskaka1121 (Skellyton)]

I mean, check any free models you have used in your game, you can also try getting every Script instance and its subcategories(LocalScript, ModuleScript) and just go through each one and see the model it’s under.

[jzxssph (onlyjzxsh)]

Is there some filter that I can only select them?

[Doxelix (Chara)]

• Check if in Output appear something like an error or something.
• Check in Workspace if there aren’t any scripts or anything suspicious.
• Make sure to check if script doesn’t use require().
• Basically, do not use Toolbox next time.

[gameCoder1210]

Search up Script, ModuleScript, and LocalScript in the explorer.

[jzxssph (onlyjzxsh)]

Nope, its only showing the scripts we made. Are you sure its not some “ASDIGSHIGSBD” like a weird name script to prevent people to find it?

[jzxssph (onlyjzxsh)]

Thanks, Ill look into that. We wont use toolbox next time

[jzxssph (onlyjzxsh)]

Thanks! I checked in the output and It turns out they modified the real “weld” script thing with backdoors. We have deleted them

[gameCoder1210]

for i,v in game:GetDescendants() do
    if v:IsA("Script") then
        print(v)
   end
end

Since this is solved, this script is irrelevant, but i’ve kept it.

[Doxelix (Chara)]

Yeah, they always hide in any type of normal objects to make it look legit while in reality beneath it is a script (like a backdoor) with random letters like what you just said.

Be careful next time!

[JAcoboiskaka1121 (Skellyton)]

Nice, I have wrote a little script that finds every script inside the game and checks their ancestry, just if you need it, but glad you have it fixed:

local scripts = {}

for _, obj in game:GetDescendants() do
	if not (obj:IsA("Script") or obj:IsA("ModuleScript") or obj:IsA("LocalScript")) then continue end
	scripts[obj.Name] = obj:GetFullName()
end

print(scripts)