Possible plugin virus

hello devs so i have ran into something that happens when i run my games
or the games i am add on
problem: https://gyazo.com/e011c26dfe576342d6ae67583f34ad66

i dont know if roblox adds those stuff or is it just a virus
if it is a virus then can someone help me fix it?

Edit:btw the objects are the script and the remote event
edit2:script

local clickEvent = script:WaitForChild('RemoteValue').Value

local player = game.Players.LocalPlayer
local mouse = player:GetMouse()
local camera = game.Workspace.CurrentCamera
local equippedConnection
local unequippedConnection
local equipped = false

mouse.Button1Down:connect(function()
	local target = mouse.Target
	if not equipped and target then 
		local toTarget = target.Position - camera.CFrame.p
		clickEvent:FireServer(target, toTarget.magnitude) 
	end
end)

local function onCharacterAdded(character)
	equippedConnection = character.DescendantAdded:connect(function(descendant)
		if descendant:IsA('Tool') then
			equipped = true
		end
	end)
	unequippedConnection = character.DescendantRemoving:connect(function(descendant)
		if descendant:IsA('Tool') then
			equipped = false
		end
	end)
end

local function onCharacterRemoving(character)
	equippedConnection:disconnect()
	unequippedConnection:disconnect()
end

local function onClickEvent(module, ...)
	require(module):Initialize(clickEvent, ...)
end
clickEvent.OnClientEvent:connect(onClickEvent)

if player.Character then
	onCharacterAdded(player.Character)
end
player.CharacterAdded:connect(onCharacterAdded)
player.CharacterRemoving:connect(onCharacterRemoving)

i think it wont do anything but i am posting just to make sure

If you’re not adding those things to your game, it’s most likely a backdoor. Check all of your plugins to ensure they are the real ones, and stay away from shady ones. You should also stay away from free models, unless you know how to properly clean them.

Could you please show me what is inside of the script?

1 Like

This is not Roblox adding it. Roblox never adds obfuscated instances into your game.

1 Like

What part of the photo are you talking about?

1 Like

Are there any scripts using the remove event?

1 Like

Roblox is definitely not adding this.
From what it looks like, it seems harmless, but you can’t be 100% sure - it could still be a virus. This seems like it’s a script that does something with your camera when you equip/unequip.
Have you inserted any models in your game lately? It could be from that.
By the way, like I said, you should still be very careful, as it could still be a virus, just because it doesn’t look like one, doesn’t mean that it isn’t one.

It seems to be a backdoor because it is requiring some module sent by the remote event arguments. Delete it.

5 Likes

Looks like a backdoor remote event added by a free model script or malicious plugin.

Notice how it says “BAC”, which sounds like “Back” in “Backdoor”.
So I’m sure this could fire an event that allows exploiters trash your game.

yea i will try to find the plugin that is causing this if i dont find it
i will just make a script that deletes the local script and the event

What this script seems to do:

  • Ensure that whenever you click anything while any tool is active, clickEvent is fired from client to server with the part you clicked on and the distance between the camera and the point on the clicked part
  • Whenever clickEvent is fired from server to client, assume it was fired with a ModuleScript or an ID for one, and require it, and Initialize it with the same RemoteEvent that was fired (and used elsewhere in the script)

require is dangerous in its own right and if you see any script you didn’t add that requires anything, you should be very careful. But this script seems benign to me. It’s also a local script, which makes highly unlikely to be an actual backdoor.

I’d imagine that, whenever a player is added, a RemoteEvent (named RemoteValue) is pinged by some server script (which you probably also didn’t add?) with a modulescript, in order to activate the functionality of this script and start listening for clicks on objects.

That’s hogwash. The name of the event at the top of the script is a GUID, which is basically a 64-bit random number, put in a specific format. Finding “BAC” in the name and assuming it’s a “BACkdoor” is like finding “sW4g” in a YouTube video ID and assuming the video has to be really, really swag.

4 Likes

I didn’t think about randomly generated strings, sorry about that lol

1 Like