generic image
Processing...
  • Games
  • Catalog
  • Develop
  • Robux
  • Search in Players
  • Search in Games
  • Search in Catalog
  • Search in Groups
  • Search in Library
  • Log In
  • Sign Up
  • Games
  • Catalog
  • Develop
  • Robux
   
ROBLOX Forum » Roblox » Help (Technical Support and Account Issues)
Home Search
 

Re: New virus found

Previous Thread :: Next Thread 
fireking100489 is not online. fireking100489
Joined: 10 Mar 2011
Total Posts: 5586
08 Mar 2016 09:35 PM
It's a ransomware that attacks private servers. You can obtain it by inserting a toolpack, which I forget the name of who uploaded it. Anyways, the thing that happens is it displays a message saying "Pay 500 ROBUX within 48 hours or your game will be deleted." There's also a button that says "Remind Me Later." I was able to locate where this virus was hiding in Workspace and added it to the list of viruses in my anti-virus program.

I advise any and everyone to update their anti-virus models to delete anything named "crptolcker" (without the quotes.)
Report Abuse
Nickoplier is not online. Nickoplier
Joined: 29 Apr 2009
Total Posts: 1337
08 Mar 2016 09:36 PM
Or just not use kits?

True builders don't use kits..

Tell us what kit you used.


Report Abuse
kingtookie is not online. kingtookie
Joined: 18 Jun 2007
Total Posts: 815
08 Mar 2016 09:37 PM
Thanks for your contribution to keeping ROBLOX secure. I will try my best to help spread this because this can be a costly scam to users who fall for it. This goes to show why you should always include some kind of antivirus or antiexploit in your creations!
Report Abuse
fireking100489 is not online. fireking100489
Joined: 10 Mar 2011
Total Posts: 5586
08 Mar 2016 09:39 PM
It was a random toolkit I inserted. Next thing I know about 15 seconds later, the message popped up. I instantly started snooping in Workspace and it was lurking in a car model. I checked the code and it was legitimately going to erase my game within 48 hours.

If I ever find the model, I'll post it here.
Report Abuse
kritiki is not online. kritiki
Joined: 12 Jul 2012
Total Posts: 12323
08 Mar 2016 09:40 PM
Can't you simply delete it?

Or change the script?

Make everything false or make the script in it say print ("taco")

if it's not a script just delete it
Report Abuse
fireking100489 is not online. fireking100489
Joined: 10 Mar 2011
Total Posts: 5586
08 Mar 2016 09:44 PM
You could, except it chooses a random location to be in. So, it could be in an inaccessible service like the CoreGui.
Report Abuse
Nickoplier is not online. Nickoplier
Joined: 29 Apr 2009
Total Posts: 1337
08 Mar 2016 09:45 PM
I don't believe anything can hide itself in CoreGui.

PS


function Recurse(p)
pcall(function()
if p.className=="Fire" then
p:Destroy()
end
end)
pcall(function()
local all=p:getChildren()
for a=1,#all do
Recurse(p)
end
end)
end
Recurse(game)


Fixed..


Report Abuse
kingtookie is not online. kingtookie
Joined: 18 Jun 2007
Total Posts: 815
08 Mar 2016 09:47 PM
I do believe the user is talking about this happening in PBS servers. So my only guess is that they are inserting the model with admin commands which it then injects itself and they have no access to delete it as they are not in studio. Which brings back my previous point of using a antiexploit and antivirus in games you use freemodels in or insert freemodels in.
Report Abuse
Nickoplier is not online. Nickoplier
Joined: 29 Apr 2009
Total Posts: 1337
08 Mar 2016 09:48 PM
I believe this can run in the so called F9 Server Logs command bar that can run scripts..

OR.

nBD admin commands feature an anti-virus scanner included.

:antivirus me


Report Abuse
fireking100489 is not online. fireking100489
Joined: 10 Mar 2011
Total Posts: 5586
08 Mar 2016 09:49 PM
This is completely brand new, however.
So all the current antiviruses wont detect it.
Report Abuse
kingtookie is not online. kingtookie
Joined: 18 Jun 2007
Total Posts: 815
08 Mar 2016 09:50 PM
Good point, none the less though this shows why you should not use freemodels and plugins that you are not familiar with.
Report Abuse
Nickoplier is not online. Nickoplier
Joined: 29 Apr 2009
Total Posts: 1337
08 Mar 2016 09:50 PM
A game simply can't remove parts from your game unless it was a plugin.

Besides, how does a game manage to run for 24 hours or how ever long you have said.


Report Abuse
kingtookie is not online. kingtookie
Joined: 18 Jun 2007
Total Posts: 815
08 Mar 2016 09:53 PM
Even though it is rare a game would run for 48 consecutive hours the game can not interact with anything outside its current instance (with a few exceptions) so the most it could do is delete the parts in that instance but a new server would have all the scripts and parts intact.
Report Abuse
fireking100489 is not online. fireking100489
Joined: 10 Mar 2011
Total Posts: 5586
08 Mar 2016 09:55 PM
So, scripts don't run in the background on a PBS server?
I thought since they were a build server, they always run and start up from where they left off.
Report Abuse
Nickoplier is not online. Nickoplier
Joined: 29 Apr 2009
Total Posts: 1337
08 Mar 2016 09:55 PM
No, scripts start from fresh anytime the server was to shutdown.


Report Abuse
kingtookie is not online. kingtookie
Joined: 18 Jun 2007
Total Posts: 815
08 Mar 2016 09:56 PM
I do believe the next time you launch the PBS the script starts over again from the beginning so the timer would be reset.
Report Abuse
kingtookie is not online. kingtookie
Joined: 18 Jun 2007
Total Posts: 815
08 Mar 2016 09:58 PM
Also even if it doesn't delete your place still try and get this information out there and the model containing it exposed before someone falls for it and pays the 500 ROBUX. If it is possible check to see if you can track the creator of it as there will be a t-shirt link or some way to pay that can be traced to the creator in the script.
Report Abuse
fireking100489 is not online. fireking100489
Joined: 10 Mar 2011
Total Posts: 5586
08 Mar 2016 09:58 PM
So as long as no one stays on there for 48 hours, the PBS in question will be perfectly okay?

I know in some PBS servers once you delete something in-game, it's permanent.
Report Abuse
Nickoplier is not online. Nickoplier
Joined: 29 Apr 2009
Total Posts: 1337
08 Mar 2016 09:59 PM
Well PBS games do save, so yes.

But by now, you would of shutdown the game or locked it up.

Everyone knows it bad to leave a personal server open overnight for hackers to possibly ruin.


Report Abuse
kingtookie is not online. kingtookie
Joined: 18 Jun 2007
Total Posts: 815
08 Mar 2016 10:01 PM
Now in the case of a PBS server it is a bit different then what I said here is how... When you delete a part from a PBS and rejoin making a new server you will see that part is deleted. However the scripts will start running again from the start of the code (effectively resetting all timers etc). If a script was to delete the part and you rejoined the part would indeed be gone unlike a regular place and the script would reset again. But the odds of a server being up for 48 hours is RARE because the second everyone leaves and no one is left it closes that instance.
Report Abuse
fireking100489 is not online. fireking100489
Joined: 10 Mar 2011
Total Posts: 5586
08 Mar 2016 10:05 PM
What if the timer was a value within the model? I found that deep in the code. Like, it wasn't in the code, but it was hidden one of the folders. It was named "CountdownToDeath" or something. Anyways, I'll send a link to the original creator if I find the toolset again.
Report Abuse
fireking100489 is not online. fireking100489
Joined: 10 Mar 2011
Total Posts: 5586
09 Mar 2016 02:12 PM
I would like to know so I can protect myself later on.

The virus also breaks itself up into several different parts, all going to different objects in the game. I obtained a copy of the ransomware, which I still have. Everything is stored within a Gui, and tiny scripts within the Gui is moved to a random service in the game.

Apologies for the late update. I dozed off last night.
Report Abuse
Previous Thread :: Next Thread 
Page 1 of 1
 
 
ROBLOX Forum » Roblox » Help (Technical Support and Account Issues)
   
 
   
  • About Us
  • Jobs
  • Blog
  • Parents
  • Help
  • Terms
  • Privacy

©2017 Roblox Corporation. Roblox, the Roblox logo, Robux, Bloxy, and Powering Imagination are among our registered and unregistered trademarks in the U.S. and other countries.



Progress
Starting Roblox...
Connecting to Players...
R R

Roblox is now loading. Get ready to play!

R R

You're moments away from getting into the game!

Click here for help

Check Remember my choice and click Launch Application in the dialog box above to join games faster in the future!

Gameplay sponsored by:
Loading 0% - Starting game...
Get more with Builders Club! Join Builders Club
Choose Your Avatar
I have an account
generic image