|
| 08 Mar 2016 09:35 PM |
It's a ransomware that attacks private servers. You can obtain it by inserting a toolpack, which I forget the name of who uploaded it. Anyways, the thing that happens is it displays a message saying "Pay 500 ROBUX within 48 hours or your game will be deleted." There's also a button that says "Remind Me Later." I was able to locate where this virus was hiding in Workspace and added it to the list of viruses in my anti-virus program.
I advise any and everyone to update their anti-virus models to delete anything named "crptolcker" (without the quotes.) |
|
|
| Report Abuse |
|
|
|
| 08 Mar 2016 09:36 PM |
Or just not use kits?
True builders don't use kits..
Tell us what kit you used.
|
|
|
| Report Abuse |
|
|
|
| 08 Mar 2016 09:37 PM |
Thanks for your contribution to keeping ROBLOX secure. I will try my best to help spread this because this can be a costly scam to users who fall for it. This goes to show why you should always include some kind of antivirus or antiexploit in your creations!
|
|
|
| Report Abuse |
|
|
|
| 08 Mar 2016 09:39 PM |
It was a random toolkit I inserted. Next thing I know about 15 seconds later, the message popped up. I instantly started snooping in Workspace and it was lurking in a car model. I checked the code and it was legitimately going to erase my game within 48 hours.
If I ever find the model, I'll post it here. |
|
|
| Report Abuse |
|
|
kritiki
|
  |
| Joined: 12 Jul 2012 |
| Total Posts: 12323 |
|
|
| 08 Mar 2016 09:40 PM |
Can't you simply delete it?
Or change the script?
Make everything false or make the script in it say print ("taco")
if it's not a script just delete it |
|
|
| Report Abuse |
|
|
|
| 08 Mar 2016 09:44 PM |
| You could, except it chooses a random location to be in. So, it could be in an inaccessible service like the CoreGui. |
|
|
| Report Abuse |
|
|
|
| 08 Mar 2016 09:45 PM |
I don't believe anything can hide itself in CoreGui.
PS
function Recurse(p) pcall(function() if p.className=="Fire" then p:Destroy() end end) pcall(function() local all=p:getChildren() for a=1,#all do Recurse(p) end end) end Recurse(game)
Fixed..
|
|
|
| Report Abuse |
|
|
|
| 08 Mar 2016 09:47 PM |
I do believe the user is talking about this happening in PBS servers. So my only guess is that they are inserting the model with admin commands which it then injects itself and they have no access to delete it as they are not in studio. Which brings back my previous point of using a antiexploit and antivirus in games you use freemodels in or insert freemodels in.
|
|
|
| Report Abuse |
|
|
|
| 08 Mar 2016 09:48 PM |
I believe this can run in the so called F9 Server Logs command bar that can run scripts..
OR.
nBD admin commands feature an anti-virus scanner included.
:antivirus me
|
|
|
| Report Abuse |
|
|
|
| 08 Mar 2016 09:49 PM |
This is completely brand new, however. So all the current antiviruses wont detect it. |
|
|
| Report Abuse |
|
|
|
| 08 Mar 2016 09:50 PM |
Good point, none the less though this shows why you should not use freemodels and plugins that you are not familiar with.
|
|
|
| Report Abuse |
|
|
|
| 08 Mar 2016 09:50 PM |
A game simply can't remove parts from your game unless it was a plugin.
Besides, how does a game manage to run for 24 hours or how ever long you have said.
|
|
|
| Report Abuse |
|
|
|
| 08 Mar 2016 09:53 PM |
Even though it is rare a game would run for 48 consecutive hours the game can not interact with anything outside its current instance (with a few exceptions) so the most it could do is delete the parts in that instance but a new server would have all the scripts and parts intact.
|
|
|
| Report Abuse |
|
|
|
| 08 Mar 2016 09:55 PM |
So, scripts don't run in the background on a PBS server? I thought since they were a build server, they always run and start up from where they left off. |
|
|
| Report Abuse |
|
|
|
| 08 Mar 2016 09:55 PM |
No, scripts start from fresh anytime the server was to shutdown.
|
|
|
| Report Abuse |
|
|
|
| 08 Mar 2016 09:56 PM |
I do believe the next time you launch the PBS the script starts over again from the beginning so the timer would be reset.
|
|
|
| Report Abuse |
|
|
|
| 08 Mar 2016 09:58 PM |
Also even if it doesn't delete your place still try and get this information out there and the model containing it exposed before someone falls for it and pays the 500 ROBUX. If it is possible check to see if you can track the creator of it as there will be a t-shirt link or some way to pay that can be traced to the creator in the script.
|
|
|
| Report Abuse |
|
|
|
| 08 Mar 2016 09:58 PM |
So as long as no one stays on there for 48 hours, the PBS in question will be perfectly okay?
I know in some PBS servers once you delete something in-game, it's permanent. |
|
|
| Report Abuse |
|
|
|
| 08 Mar 2016 09:59 PM |
Well PBS games do save, so yes.
But by now, you would of shutdown the game or locked it up.
Everyone knows it bad to leave a personal server open overnight for hackers to possibly ruin.
|
|
|
| Report Abuse |
|
|
|
| 08 Mar 2016 10:01 PM |
Now in the case of a PBS server it is a bit different then what I said here is how... When you delete a part from a PBS and rejoin making a new server you will see that part is deleted. However the scripts will start running again from the start of the code (effectively resetting all timers etc). If a script was to delete the part and you rejoined the part would indeed be gone unlike a regular place and the script would reset again. But the odds of a server being up for 48 hours is RARE because the second everyone leaves and no one is left it closes that instance.
|
|
|
| Report Abuse |
|
|
|
| 08 Mar 2016 10:05 PM |
| What if the timer was a value within the model? I found that deep in the code. Like, it wasn't in the code, but it was hidden one of the folders. It was named "CountdownToDeath" or something. Anyways, I'll send a link to the original creator if I find the toolset again. |
|
|
| Report Abuse |
|
|
|
| 09 Mar 2016 02:12 PM |
I would like to know so I can protect myself later on.
The virus also breaks itself up into several different parts, all going to different objects in the game. I obtained a copy of the ransomware, which I still have. Everything is stored within a Gui, and tiny scripts within the Gui is moved to a random service in the game.
Apologies for the late update. I dozed off last night. |
|
|
| Report Abuse |
|
|