It happened to a game I am developing too. This plugin helped me to find all affected scripts and another (probably older) virus.
Also, the module script which the virus wanted to insert was uploaded by a bot account, I saw a very similar named account in another post. It’s sad how complex these hidden viruses are made today…
1 Like
My suspicion is this plugin: GameGuard Anti Virus V2.5 [ALPHA] - Roblox
It seems legit, but when I ran RoDefender, it removed the gui used in this plugin, and the line of code stopped adding itself back.
The script used in that plugin is huge and I cant seem to find anything suspicious, so Im not sure
It may still be a plugin, but is it your’s or your friend’s? I would think it to also be maybe one of your friend’s (If he has any plugin).
I tried this plugin first to remove the virus, the plugin just listed every script with a require() or similar. Also the devforum profile of the creator looks pretty legit. The other antivirus plugin which I used was actually able to identify the affected scripts.
In my case it looks like this plugin added the virus. I only saw the big number of sales but if you look closer, it was released only one month ago and it has only one like.
Could you maybe send me a link to RoDefender? It seems like I can’t find it.
I have the legit roundify plugin (Roundify - Roblox), I always keep a look out on all plugins with the (NEW) or (UPDATED) tag since its most likely a scam.
As for RoDefender, its definitley legit, I used it for months with no issues. Link: Ro-Defender™ Plugin v8.7 - Roblox
1 Like
Recently found out that “Load Character Lite (Updated) - (Created by PluginMakers)” has a backdoor which is causing that exact problem and code so make sure to get rid of it you’re using it
Link of the backdoor plugin (Do not install)
https://www.roblox.com/library/5754612786/Load-Character-Lite-Updated
5 Likes
Literally the whole front page of plugins is backdoors, just dont use them in gereral
Also watch out for plugins with (NEW) or (UPDATED) in their name
Is it possible that this code can steal your game?
I wouldnt say so, it most likely gives server-side access to your game, it really depends what functions the backdoor has.
For instance you could kick players, destroy parts of the game, change walkspeed, etc ALL server-side
I Found a Rain plugin by Creator studio and I am unsure if it is safe or not, my roblox server defender tells me that this is a Virus and other plugins aren’t
Sorry for bumping this, but, Sniffer is now available here. Please keep in mind it still has a few issues here and there. But it’s a lot better than it was
11 Likes
I tried clearing out all scripts, have no team create and no plug ins. Not sure why this is happening constantly scripts all keep getting updated… huge game I have been working on. would take weeks to transfer all the stuff into new game properly… ideas?
The reason is probably that the scripts from the plugin is still running even tho the player left already. or removed plugins i have the same problems though i have no ideas how to end the task
Unfortunately, I think you might have to look thru all scripts to find “RoSync”, then delete it. You can use the find tool to look through all the scripts. The worst I’ve done, which was for one of my clients, has been ~110 scripts I had to delete from.
1 Like
The “RoSync” part of your script is a trick backdoorer’s use to hide code. How they do this is they put a character that can’t be read by studio in-between the comment block.
I believe a waterfall generator plugin is doing this, [ Content Deleted ] - Roblox . Not 100% sure if this is the cause but whenever I have it enabled I get the RoSync virus in my game.
1 Like
My friend had this in one of his games; it was teleporting all the players (in all servers!) to random games, such as Crossroads, but also bad free model tycoons. When I turned off HTTPService it stopped working, so my guess is that whoever controls this has it hooked up to some Discord webhook, where he can execute all code he wants in all the live game servers simultaneously.
Rosync is a backdoor virus that comes from a plugin. If you are in team create with friends and when they make a script and Rosync appears, that means one of them has a fake plugin or a plugin that has a backdoor. If you want to get rid of it, all you have to do is tell your friends to send the link to each plugin they have and make sure it is the official owner and not made by a group. My friend is a scripter and that kept on appearing on every single one of his scripts and I got rid of it by making him get rid of plugins that were not made by the owner. I hope this helps 
4 Likes
If the creator of the plugin is something like “PluginCreator”, or “RobloxPluginMaker”, and whatnot, it’s most likely a backdoor.
I am also having this issue, I am apart of a development team for a up and coming Navy group and we have no idea what is causing this to appear on our game… Any feedback on how we can Identify it?