I REVERSE ENGINEERED LUA TOOLS to CHECK IF IT'S A VIRUS!

Summary

The video investigates five allegations about Lua Tools: that it is malware, a GPU cryptocurrency miner, a Trojan, a credential stealer, or impossible to uninstall. The creator combines file inspection and brief live observations with AI-assisted analysis, then discusses what the results do—and do not—establish.

Tests and findings

• Virus or malware: The analysis classifies Lua Tools as riskware with privacy and system-integrity risks, rather than confirming it as malware or declaring it clean. The tool modifies Steam-related files to provide its advertised functionality, and the creator notes that it is neither verified nor digitally signed. That does not prove malicious intent, but it means users must trust the software and its developers.
• GPU mining: No affirmative evidence of GPU or CPU cryptocurrency mining appeared during the observed run. The creator describes this as a limited negative finding, not proof that mining could never occur.
• Credential theft and network activity: The tests found no evidence that saved passwords, Discord or Instagram credentials, or session cookies were stolen. Observed network activity included the optional sharing of game decryption keys. The creator cautions that the developers could potentially change the software through updates and recommends disabling auto-updates if users are concerned.
• Trojan: The creator argues that the evidence did not establish Lua Tools as a Trojan. He distinguishes software that openly identifies itself from malware that disguises itself as a trusted, unrelated program.
• Uninstallation: Removing Lua Tools left behind Steam-related plugin files and game manifests. The creator says these could be removed separately; after deleting them, Steam returned to its normal state. He compares these remnants to exported files or other leftover data that may remain after uninstalling software.

Method and limitations

The video uses static inspection of the installer and installed files, along with live checks of system activity, GPU usage, network traffic, and file behavior. It also demonstrates checking for remaining files after uninstalling.

The creator acknowledges that this is not equivalent to professional malware reverse engineering with specialist tools and says testing ideally should be performed in a virtual machine. The on-screen tests were run on a real computer because of budget constraints. Detailed reports are said to be available for viewers to review.

Broader discussion

The creator says the video is partly a response to commenters’ technical accusations and partly intended to explain how viewers can assess software risks. He rejects unsupported claims of hardware damage and mining, while still describing Lua Tools as a risky, trust-dependent application.

On piracy, he presents a qualified view: he considers it ethically grey and says people who can afford games should pay developers. He also argues that piracy helped introduce gaming to some Indian players when official games and services were difficult to access, and may lead some players to become paying customers later. He says his videos focus primarily on the technology, not on endorsing piracy.

Guides and demonstrations

The video includes:

• A demonstration of using AI-assisted computer access to inspect an application’s files and activity.
• Checks for GPU usage, network connections, and possible credential-related activity.
• A walkthrough of uninstalling the application and manually removing leftover Steam-related files.
• References to detailed test reports for further verification.

Main speakers and sources

• OneShed — presenter and narrator.
• Budkix (also referred to as Bud Kicks) — invited to assist with the testing.
• AI analysis tool (“GPT Astra,” as named in the subtitles) — used to assist with file and behavior analysis; its output is presented as evidence to assess, not as a professional security verdict.
• Lua Tools community moderators and commenters — referenced as sources of claims and explanations, rather than as on-screen technical analysts.