Remove a virus in less than a few minutes


  • I was working on a script today when suddenly in Script Analysis I spotted this 0_1551192789265_bandicam 2019-02-26 06-51-14-064.png
    So I opened that Script and noticed it was a whole virus in the place I've been working on for a long time :cry:
    The first thing I did was delete all of my plugins
    I then loaded up this script
    0_1551193041551_bandicam 2019-02-26 06-57-08-689.png
    And played it.
    In output I got
    0_1551193179398_bandicam 2019-02-26 06-59-24-261.png
    A bunch of viruses
    But luckily since I don't keep a lot of things in Workspace it was much quicker to remove.
    Then I brought my Ro-Defender Plugin back and scanned it to remove anything else that can give birth to more viruses.
    Since I noticed that all these viruses had numbers in them I went in explorer and typed each number 0-9 one at a time and removed any nasty script I seen
    0_1551194963573_bandicam 2019-02-26 07-06-24-497.png
    Once I removed Everything I rechecked output to find that those viruses were gone.
    Now I open up that "Debris.?" then right click on its name
    0_1551194355170_bandicam 2019-02-26 07-18-59-995.png
    Then click show in explorer.
    They made the parent Debris so that we can't find it but we got past that.
    0_1551194437869_bandicam 2019-02-26 07-17-38-498.png
    I just click on Debris and then change it's parent to new empty part I made in my Workspace so that we can find this script
    0_1551194492258_bandicam 2019-02-26 07-17-46-512.png
    There it is
    0_1551194484320_bandicam 2019-02-26 07-18-04-659.png
    Then we delete it
    Then we save the game :clap_tone1:

    Tell me if your some sort of virus finding professional or something and I missed something crucial.

    I made this to help out anybody who has this issue.



  • Everytime you put a "scriptless" free model into studio, make sure that you run a simple script (that works i guess lol)

    for i, v in pairs(INSERTED_MODEL:GetDescendants()) do
       if (v:IsA('Script')) then
          v:Destroy();
       end
    end
    

    Kills virsus. ggez no re l0l

    also, if you're really paranoid, then go ahead and check all scripts and eliminate all malicious code. works wonders. ttyl

    also make sure that the model isn't heckin huge.
    if it is, put a wait in the loops xd


  • @Fifkee If you get a free model in your game with malware, and you just noticed that it was acting up after getting model (like you just got model few minutes ago) then revert the version of your game. SImple!


  • @DominusInfinitus

    No. People tend to insert a model without checking it (especially new developers), and proceed to keep building. Reverting the version will severely hinder the development process if someone is oblivious to the virus. That's why I recommend running a script on the command line. If you think Motor6D Viruses are a threat (which I don't think they are), then you may change the IsA to "Motor6D." (without the period & quotes.)


  • @Fifkee Yeah I've been making animations in the same place for years from back when I just started so I'm pretty sure I might have done something like that ages ago.

Log in to reply
 

Looks like your connection to Scripting Helpers was lost, please wait while we try to reconnect.