Virus in my game, I don't use free models, I work by myself and I have no plugins

[RecanValor (recanman)]

@railworks2

This thread is going way off track and I want to fix this.

Main thing to disclose, I currently have a diploma in cybersecurity and currently doing my undergraduate degree in cybersecurity. I am a security and privacy advocate. On top of this, an example of my work is from A Noob’s Guide to (Online) Security in which I peer reviewed. I intend to talk from a position of knowledge.

I have not read every single reply. Apologies for any repetition if so.

FIrstly, that script in the original post provided should be removed. Validate that the script does not return after saving and playing the game as normal.

After checking everything, you may begin to slowly return back to normal. Check each plugin directly to validate the content of each plugin, ensure you use only the official plugin and check what each plugin is doing.

Check the content of each and every script to validate similar behaviour as above. Getfenv, HTTPService and require (require does not always use an ID) may highlight scripts and behaviours which you do not intent.

You may find it helpful to ensure you have enabled antimalware software on your device, you could scan the device to make sure (even if it’s a new device)

@recanman

I change my password every week since 2016, I just changed it yesterday.

While this is a good idea in concept and does limit some specific issues to one week, depending on the nature of how your security model you may be actively harming your security based on NIST guidelines on this topic. You should be using passphrases (such as diceware passwords) or long complex passwords (from a password manager)

I’ve tried everything in this with no success.

[RecanValor (recanman)]

It happens in game too

30 charssssssss

[railworks2]

Just to make sure, that you have done…

• You have validated every single Roblox plugin on your Mac [including full source code review and validation of correct ownership]
• You have validated every single script (local, server or modular) for abnormal code action.
• You have deleted the script you provided from the game.
• You have active anti-malware technology running
• You have checked every single service in the game (including normally hidden ones)

Is this true?

---

That is these settings in Roblox Studio settings, which show this in the explorer

[Scepter_ofDarkness]

Could this work: Make a script inside studio (or a command) which deletes all the virus scripts at once (or as close as you can get to that) and see if it comes back

[RecanValor (recanman)]

1. I have uninstalled all my plugins and I deleted all sources of code with malicious things in them (the original script), but it keeps replicating.

2. I have 4 scripts, 2 modules, 1 localscript, 1 script
   They are validated and I have checked for whitespace and hidden places where code can be inserted

3. I have deleted it, but it keeps replicating itself in a matter of less than a second.

4. I have malwarebytes, an anti-malware technology running. I did a deep scan a few minutes ago, and it has found 0 threats/viruses.

5. Yes. Looked up script in explorer with hidden services on, found nothing except 1 script I mentioned in serverscriptservice.

[RecanValor (recanman)]

Those are on

30 charsssssssssss

[railworks2]

Does this issues exist only in that game or in other games? Does this issue exist in previous versions of the game? (Refer to any backups you have)

[Ryanthemudkip (Mudkip)]

I suggest going in place history, in place settings to restore to a previous version.

[railworks2]

User is using a local file and not cloud.

@recanman

this game is a local file

[PhoenixRessusection (PhoenixCausesOof)]

Virus in my game, I don't use free models, I work by myself and I have no plugins

So like I said, when I make a new game it copies itself.

[RecanValor (recanman)]

Yep it does, I have tried going back to a different version with no success.

[railworks2]

If you remove everything from the game, does this issue continue?

You may wish to consider seeking more official support for this issue.

[RecanValor (recanman)]

Yeah still continues. I will contact official support, thanks for all the help.

[MrOofBoyPlayz (Barnibus)]

But you need to delete them or it won’t remove the stuff it put in ur game

[MrOofBoyPlayz (Barnibus)]

Well we didn’t know that this was wrong.

[Ryfiles]

Well, here are the following things that I think that might help

• Check for your Plugins
  Mostly, the plugins can be malicious.
• Check for Any Scripts
  Mostly, malicious scripts have the following code in it.
  loadstring
0 or 1
/ or \

Mostly these types of scripts that have back doors are:

Anti Exploit Scripts
Examples:
Anti SaveInstance, and bigger exploit problems.