Can we mass delete scripts containing virus? Is there a plugin for it?

Help and Feedback Scripting Support
, ,
#1

Alright, so recently my friends army game had infected with viruses
I researched about the script and found out it was…
This is the game btw, 🏝️[BETA] AFP, Fort Magsaysay - Roblox
You can’t get in it because when it says joining it will freeze your screen.
RoSync which is a backdoor virus that comes from a plugin. Example; If you are in team create with friends and when they create a script and RoSync appears outta nowhere, that would mean that one of your devs has a fake/suspicious plugin or a plugin that has a backdoor. If you want to get rid of it, you would have to tell your friends to uninstall each plugin, and make sure it’s made by the original owner and not made by a new account/an alt.

You could either remove the virus or it’s hiding itself by deleting itself when RunService returns true from the function :IsStudio().

getfenv() returns a table of the functions and variables in the current environment. This can be used to easily attempt to hide a function.

In this case, it indexes string.reverse("\101\114\105\117\113\101\114"). If you see what this ascii code corresponds to “eriuqer”, which when put through the reverse function gives you “require”.

When the script uses getfenv() and escapes ascii code to hide the require index in that table that is returned. It calls the require function with the asset id. Upon further inspection this is a quote on quote “require chain”, which basically hooks up module scripts in a chain to require each other in an attempt to hide the final script in the chain.

The script uses require to get a chain of module scripts, which will eventually lead to a server-sided backdoor.

Now what I want in help is, Is there way I can delete this viruses becauses clicking it is and deleting will take a long time
Here is how it looks like

image
image766×594 156 KB

And yes getfenv is a backdoor script confirmed by an programmer
And let me tell you I am not a programmer or scripter.
image
image981×361 33.6 KB

I just want to see if there is a way I can mass delete this viruses it would mean a lot to me
Thank you for reading If I did any mistakes in my sentences I am sorry I was just fast typing…

#3

I think this plugin will help: Ro-Defender™ Plugin v8.7 - Roblox

#4

…Or you can use a loop through the workspace and delete all of the scripts.

#5

I dont think he want to delete all the scripts in Workspace. (why?)

#6

The thing is I only want to delete selected scripts which contain the word getfenv So when we do ctrl shift F we see all the scripts containing that word but can I delete all of those?
Just want to know if there a way to do that

#7

In the command bar, you can access the source and remove it if it contains certain word(s).

for i, v in ipairs(game:GetDescendants()) do
   if v:IsA('Script') and v.Source:find('getfenv') then
      v:Destroy()
   end
end
3 Likes
#8

Please can you show a video on how to do it?

#9

EDIT: The script also errors because some descendants of game cannot be accessed, so add a pcall like I did in the snippet below.

Whenever I share snippets to use in the command bar I always like to add undo waypoints just in case it messes up somehow:

ChangeHistoryService:SetWaypoint("Destroying scripts with 'getfenv'")
for i, v in ipairs(game:GetDescendants()) do
   pcall(function()
        if v:IsA('Script') and v.Source:find('getfenv') then
          v:Destroy()
       end
    end)
end
ChangeHistoryService:SetWaypoint("Destroyed scripts with 'getfenv'")

Especially useful because some legitimate scripts might use getfenv

#10

You have to turn on the command bar if you don’t have it visible.
https://gyazo.com/667a8cbdb78d7a4a906e31934887f4f3

View > Command Bar

1 Like
#11

It wouldn’t mess up in this case, but that’s probably helpful if you are worried.

1 Like
#12

Enable command bar (also enable Output):

image

Paste command to bar:

image
image932×43 3.31 KB

Press Enter to execute