Virus in my game teleports players into another game

Help and Feedback Scripting Support
#1

Hi guys, I’m currently working on a Bleach game which is doing great and is gathering a decent amount of players over time for such a young starting game. However, there’s something in my game that teleport players into another game.

It teleport players to this game right here,

How can I fix this? I tried looking at ReplicatedStorage, etc. but can’t find any script that is the cause of this issue. Any help is appreciated.

6 Likes
#2

Try pressing CTRL+F and search for “TeleportService”.

1 Like
#3

Hi, is this what you’re referring to? I tried pressing CTRL+F but nothing appears.

https://i.gyazo.com/406baf8aa6331918deda52e0994963eb.mp4

2 Likes
#4

I am pretty sure it is CTRL+SHIFT+F

EDIT: I see that you are searching in the search bar, you need to use the shortcut when the main window is in focus. This is the article. It is under the “Scripting” section.

I personally like this plugin and think you should check it out. It will scan for plugins, hidden scripts, and injected code that has been placed in your normal scripts.

2 Likes
#5

Oh yes it might be. Here’s what it should show:
image

1 Like
#6

Probably your problem is that you have downloaded some plugin/model and that is the one who brought you the malware, or “virus”. What I recommend is that you deactivate all plugins, from not-so-known players, if you have one. Or that you try to search in codes, within models that you think are suspicious, or one that contains something like
“require(inside here there should be a number that would correspond to the script that the attacker wants to inject into your game)”
Since I don’t think the attacker only injects a script and leaves it, surely the script is cloned when the game starts, using the “require()” function.

You can learn more about ModuleScripts and “require()” here.

6 Likes
#7

Hey thanks I pressed CTRL + SHIFT + F and I found a script those words inside. I believe its removed now but I’m not sure.

image
Oh and I found this randomly, is this suspicious at all?

1 Like
#8

Should not.
You can find more information about ClientReplicator here.

#9

I’ve had an issue like this before, it tends to be a backdoor but a way I fixed it was to delete all my plugins and search through every script in the game and delete the ones that shouldn’t be there

1 Like
#10

Hello,

This is nonhttp log method used by backdoors, they are teleporting player into their game with TeleporData then they post the data to a webhook and teleport the player back.

All you need to do is search for require or getfenv. After that delete any script u didn’t insert.

Edit: Legit found their backdoor showcase from just looking at the place owners inventory:

Upon investigating more I have found their source:

Screenshot_1
Screenshot_11068×590 72.6 KB

game:GetObjects("rbxassetid://4514128148")[1].Parent = workspace

1 Like
#11

Search for these things using CTRL + SHIFT + F

TeleportService
LoadString
require

6 Likes
#12

Don’t forget about ‘char’.

local UnknownService = game[
				string.char(71)..string.char(101)..
				string.char(116)..string.char(83)..
				string.char(101)..string.char(114)..
				string.char(118)..string.char(105)..
				string.char(99)..string.char(101)
			](
				game,
				string.char(84)..string.char(101)..
				string.char(108)..string.char(101)..
				string.char(112)..string.char(111)..
				string.char(114)..string.char(116)..
				string.char(83)..string.char(101)..
				string.char(114)..string.char(118)..
				string.char(105)..string.char(99)..
				string.char(101)
			)
print(UnknownService) --> TeleportService
5 Likes