Random shirts being prompted - is my game infected?

Help and Feedback Scripting Support
#1

I was about to test my game and when I joined, appeared a buying screen that I didn’t add. This screen was requesting 100 R$ for a random T-Shirt and it was spamming and I don’t know what is happening and I don’t know how to remove it. Is that a type of virus?
Also, can a virus be found in Free Models? The image of proof and the game

4 Likes
#2

What plugins do you have? Usually some plugins make this problem occur, I remember it caused some problem with another person I helped fix with.

4 Likes
#3

Free models, sometimes contain backdoor scripts which do things like prompting shirt purchases. Use ctrl + f to filter through your scripts to see if there is a backdoor. Also, like @Hello42bacon said, plugins can make backdoors appear in your game. This happened to me a few times. Double check all your current scripts and plugins.

2 Likes
#4

Are you using toolbox models? They usually come with ‘infected’ scripts.

#5

Try searching all scripts for IsStudio. I’ve seen a similar virus affect a few people in the past, and searching that has usually helped them locate the backdoor.

You can find a similar thread about this issue where found out about this specific backdoor here.

If this doesn’t return any results, some other things you could search for are require and getfenv. If none of these help, also make sure to check your plugins.

2 Likes
#6

Hit Ctrl + Shift + F in studio and search for keywords such as MarketplaceService, Purchase, getfenv, loadstring, require and review the scripts you find.

Also make sure to check all plugins you have installed.

12 Likes
#7

It’s probably those models with those scripts that makes something pop up like a model or a purchase,Just search “scripts” in workspace and all the scripts should pop up,Including the pop up script.

#8

Yeah you got a infection here are some steps you might be able to do to find it and get ride of it…

  • Go though your scripts to see if you find an asset ID.
  • Go to the game test then buy the item it shouldn’t really charge you then look in the script outputs to see what the asset ID is
  • You could Reverse image search it less likely but still might work
#9

This question has been asked several times in the past before. Please make sure you perform searches first to see if your question has been asked before.

2 Likes
#10

Thank you, but the post is now a couple months old.

#11

(Sorry for adding onto this necro bumped thread but I did not see an answer that was accepted)

Saw something that did exactly this on the developer catalog. Roblox

Remove any free models you’ve inserted as they likely have some malicious code in one. One such example of a model that is on the front page that prompts you to buy their clothing is this Christmas tree model: Christmas tree - Roblox

image
image1343×268 17 KB

If you do not care about the code in your game you can easily remove all scripts at once by running some code in the command bar that removes all lua source containers.

for i, v in pairs(game:GetDescendants()) do
    local success, isScript = pcall(game.IsA, v, "LuaSourceContainer")
    
    if success and isScript then
        v:Destroy()
    end
end

This will iterate over all the descendants of Game and then attempt to call IsA on them and check if they are a LuaSourceContainer which is a super class for Script, LocalScript, and any other script container. The pcall is there because some instances are RobloxLocked and cannot be indexed.

1 Like
#12

sorry for necrobumping but normally the scripts that cause this have the code of:

require(596049032)

this is so that when you press f9 in game the script source comes up as unknown! You can fix this by manually finding fishy scripts, if FE is disabled then you should enable it!