This man has made over 200k+ Robux by making this malicious script that inserts a (fake?) 50R$ admin command into infected games

Help and Feedback Scripting Support
#36

All I’m seeing is this e.e

image
image1920×1080 414 KB

#37

It has something to do with ThirdPartySales but the thing is I have it turned off so how is that even possible that they have a Marketplace product in my game?

1 Like
#38

A method I use is by searching Welding, Fix, Weld or Debounce into explorer and delete any script with those names, they normally will appear “empty” or saying something about “this script is from ROBLOX” (which is not true) also any unnamed scripts could be the backdoor.

#39

Can’t confirm.

image
image1003×443 16.3 KB

The module seems to have been obfuscated with Luraph.
I am not sure of how to dump Luraph’s constants but what I could find is that it also requires this module

1 Like
#40

I found Debounce, but the script is blank, nothing inside the script. What do I do with it?

#41

Are you absolutely sure?

Because a lot of these scripts just indent soooo much that the script has a horizontal scrollbar.

1 Like
#42

Just delete the entire script.

#43

Yes I’m absolutely sure because the script has no scroll bars it’s literally a blank script named Debounce inside a part that I have no idea how it got there. Also I can’t revert to an old version because I have no clue how long it’s been like this until I finally tested the game for a while, this is what my version history looks like:

image
image1062×639 32.5 KB

1 Like
#44

Did you find anything? I tried to search what you wrote and it showed nothing for me…

#45

No its not a product Id, it a module script Id, why not just delete that script.

#46

How do I find that module script id though?

#47

@sjr04 linked it in his post above.

#48

I got the model, it looks like this

image
image1641×193 7.5 KB

How do I decompile that

1 Like
#49

Also I did delete the script and nothing happened, the marketplace admin pop up still comes

#50

Did you delete the other one?The search results that you posted found two.

#51

Yes that was the same script with the one I deleted

#52

I would try to print what it says in there.

#53

This may be an off-topic question but is this allowed or not on Roblox? Are they allowed to insert a script like this into an infected asset.

EDIT: It’s not like I want to do it myself, just curious.

#54

It shouldn’t be, I still can’t get rid of it. I researched and saw that ThirdPartySales is a broken feature…

1 Like
#55

it might be bytecoded? like

\13\123\123\123\123\13

try searching