Malicious script help

GreatLatte · April 23, 2020, 8:53am

Hello, I am Latte. I have this issue in my game where everytime you try to load in you go here: [ Content Deleted ] - Roblox first. I am not sure if this is normal or an actual virus script. But if it is and anyone knows the name of the script please do tell me. Thank you!

HmmBilly · April 23, 2020, 8:58am

Search for any script that uses TeleportService

DrKittyWaffles · April 23, 2020, 9:02am

Its likely embedded deeply in a script where you can’t see the location of the script or it is in an obnoxious place offsetted by lots of whitespace.

Try running this in command bar and see what it outputs:

local coreGui = game:GetService("CoreGui")

local descendants = game:GetDescendants()
local isA = game.IsA

local function couldBeMalicious(descendant)
    local success, isScript = pcall(isA, descendant, "LuaSourceContainer")

    if ((success and isScript) and (not descendant:IsDescendantOf(coreGui))) then
        local source = descendant.Source:lower()

        if (source:match("require") or source:match("getfenv")) then
            return true
        end
    end
end

for i, descendant in pairs(descendants) do
    if couldBeMalicious(descendant) then
        warn(descendant:GetFullName())
    end
end

Any scripts matching “getfenv” or “require” should get outputted to console.

GreatLatte · April 23, 2020, 9:03am

EpicMetatableMoment:

local coreGui = game:GetService("CoreGui")

local descendants = game:GetDescendants()
local isA = game.IsA

local function couldBeMalicious(descendant)
    if (not descendant:IsA("LuaSourceContainer")) then
        return false
    end

    if (descendant:IsDescendantOf(coreGui)) then
        return false
    end

    if (descendant.Source:lower():match("getfenv")) then
        return true
    end

    if (descendant.Source:lower():match("require")) then
        return true
    end

    return false
end

for i, descendant in pairs(descendants) do
    if couldBeMalicious(descendant) then
        warn(descendant:GetFullName())
    end
end

I type this in server side console?

GreatLatte · April 23, 2020, 9:08am

Looked through all my scripts and none had “TeleportService”

DrKittyWaffles · April 23, 2020, 9:10am

I made an error in my code. I have edited my post.

Also you are supposed to run the code in Command Bar. You can toggle the command bar in the View tab.

At the bottom of your screen you should see this

Paste the code in and press enter then check your output panel. If you don’t have an output panel then turn your output panel on too.

Here is an example:

This is showing two scripts in orange which might be malicious but not 100% sure. Shows the location too.