Virus in my game, I don't use free models, I work by myself and I have no plugins

[RecanValor (recanman)]

I do have a few plugins I installed a lot of years ago, but none of them are enabled or even installed. They are owned.

[blokav]

How old is the file? Is it a current project, or something you made a long time ago and opened recently?
If you’re telling the truth about the plugins, then it had to have come from the toolbox. There is really no other place it could have come from.

[RecanValor (recanman)]

This project was started ~a week ago.

I did not get anything from the toolbox, I swear on my life.

[RecanValor (recanman)]

I’ve tried all those solutions, but with no success

[Scepter_ofDarkness]

tell me what happened when you playtested a blank file with a single part in it

[Sub_zeeroz (Subzeero)]

@Scepter_ofDarkness

I get that you aren’t using any plugins. Are you sure they are uninstalled? They have to be uninstalled, NOT just turned off, otherwise, they could be inserting the script into your game once you playtest

This is incorrect, please don’t spread misinformation.

@Seranok

Enabling or disabling a plugin now takes effect immediately. Previously it would require closing and reopening the place.

[Scepter_ofDarkness]

Thanks for the information, I will delete that

[blokav]

I’m sorry that this is so frustrating. I still find viruses on place files that I made 10 years ago and even back then I thought I was being vigilant.

Is this the only game where you’re seeing it?

[RecanValor (recanman)]

No, It started happening today and in every place file i go into.
I didn’t even wake up until a bit ago, I logged on and saw this.

[Scepter_ofDarkness]

Then it’s external. Not a script inside your game

[RecanValor (recanman)]

Is it related to when roblox went down?

[Sub_zeeroz (Subzeero)]

@madattak

If a script is copying itself inside studio but outside of run/play solo without team create, then your only possibilities are a plugin (You can also manually add local plugins into studio that will not appear inside the plugin manager), someone in your account, or some other external modification to the studio software.

@Crazycat4360

If it’s occurring randomly during your Studio session, the only possible cause would be a plugin. I’m aware that you’ve stated that you aren’t using any, but it’s the only possible situation.

[Scepter_ofDarkness]

I get this is a bit redundant, but check your plugins. Follow these steps:
Go to the Plugins tab, on the left you will see a Manage Plugins button. Click that.
The folder that pops up should be blank (or a “you don’t have any plugins message,” I’m not sure) if you have no plugins

EDIT: really redundant

[RecanValor (recanman)]

Correct. Blank
(30 charssssssss)

[Sub_zeeroz (Subzeero)]

Have you checked the system’s local plugin directory?

The Plugins Folder button should take you to it.

[RecanValor (recanman)]

Yep, tried it. No success.

30charssssss

[railworks2]

This thread is going way off track and I want to fix this.

---

Main thing to disclose, I currently have a diploma in cybersecurity and currently doing my undergraduate degree in cybersecurity. I am a security and privacy advocate. On top of this, an example of my work is from A Noob's Guide to (Online) Security in which I peer reviewed. I intend to talk from a position of knowledge.

I have not read every single reply. Apologies for any repetition if so.

---

FIrstly, that script in the original post provided should be removed. Validate that the script does not return after saving and playing the game as normal.

After checking everything, you may begin to slowly return back to normal. Check each plugin directly to validate the content of each plugin, ensure you use only the official plugin and check what each plugin is doing.

---

Check the content of each and every script to validate similar behaviour as above. Getfenv, HTTPService and require (require does not always use an ID) may highlight scripts and behaviours which you do not intent.

---

You may find it helpful to ensure you have enabled antimalware software on your device, you could scan the device to make sure (even if it’s a new device)

---

@recanman

I change my password every week since 2016, I just changed it yesterday.

While this is a good idea in concept and does limit some specific issues to one week, depending on the nature of how your security model you may be actively harming your security based on NIST guidelines on this topic. You should be using passphrases (such as diceware passwords) or long complex passwords (from a password manager)

---

Oh and talking about security, take a peak at A Noob's Guide to (Online) Security

[PhoenixRessusection (PhoenixCausesOof)]

I can only think of one thing here, which is the plugins.

I didn’t see if this has been said earlier, but what i think what has happened is that one of the plugins, if not most of them, had their owner “hacked”, and could possibly have changed those, and inserted something malicious.

Though as you said, you turned off all of them, leading at least me, to have no other actual ideas on this case.

Also, just a question, what is the maximum amount of characters that you can put in “your”/a roblox password?

[railworks2]

Always got to keep on top. Great to see you’ve gone to that level but good to make sure you are compliant and on top of the modern standard.

---

@PhoenixRessusection

Also, just a question, what is the maximum amount of characters that you can put in “your”/a roblox password?

I don’t know what the max is but I have been able to use 2048 length password before.

[PhoenixRessusection (PhoenixCausesOof)]

I actually have a 64 digits password, should i use a 2048 digits one?

And sorry for being off-topic.