weird error in autocad 2009

[3dsmaxed]

hi everyone

i am facing some weird problem in my autocad 2009
i think because of opening some file i have started getting this error whenever i try to open autocad or any file inside autocad.

http://img198.imageshack.us/img198/4461/erroru.th.jpg (http://img198.imageshack.us/my.php?image=erroru.jpg)

my move command behaves like copy command and copies the object while using move command.

ihave tried reinstall but that problem and error message still appearing.

i tried to install autocad 2007. but i face same problem in that also

how can i correct it?

thanks

[Cad64]

You do not need 10 posts in order to attach images. You can easily include images by following these instructions: http://www.cadtutor.net/forum/showthread.php?t=8863.

I have deleted your other posts. Please do not spam the forum.

[Cad64]

When did this problem start?
What operating system are you running?
Have you installed any new software, or add-ons, that may be conflicting with Autocad?
Did you perform a complete uninstall, removing all remnants of Autocad, before reinstalling?
I have seen you post this message on other forums, but have you tried contacting Autodesk regarding this issue?

[3dsmaxed]

this started happening when i opened some drawing which asked me to install the "korean" language pack.

i am using windows XP 64 bit.

my major concern right now is that my move command is copyinh the onject while moving

if i can get rid of that i am okay with that error because otherwise my cad is working fine

thanks

[3dsmaxed]

You do not need 10 posts in order to attach images. You can easily include images by following these instructions: http://www.cadtutor.net/forum/showthread.php?t=8863.

I have deleted your other posts. Please do not spam the forum.

i am really sorry about that

i was so desparate to get the problem solved

thanks

[ReMark]

How are you invoking the move command? Via the command line using a command alias?

[Car5858]

Un-install the "korean" language pack with add/remove programs and reset your language preferances.

[3dsmaxed]

Un-install the "korean" language pack with add/remove programs and reset your language preferances.

i dont see any korean language pack installed in my add/remove programs

thanks

[3dsmaxed]

How are you invoking the move command? Via the command line using a command alias?

i am typing m in the command box

[lordjkpff]

Did this ever get resolved! We have started to get the same error on certain files which now seem to be spreading LIKE WILD FIRE! Other commands affected are explode and I have had reports that the send to back command doesn't work anymore. We are told that it is a old AutoCAD virus (see thread link at bottom of post), but Symantec, which has been through our files and machines, can find no infected files and tell us we are fine.


The facts are these:


1. After getting the language pack error and answering the question with the "OPEN" button or the "X" activates something to that affects the CUI, acad & express menu files.


2. Commands start to act weird like explode, send to back, copy.. etc.


3. When you just OPEN the infected files you get a:


ERROR: Could not instantiate AecDict!
ERROR: Could not instantiate AecDict!
ERROR: Could not instantiate AecDict!
ERROR: Could not instantiate AecDict!
AutoCAD Express Tools Copyright © 2002-2004 Autodesk, Inc.


Other files seem to be unaffected! It spreads randomly!


4. –purge, Reggapps does not clean the “Language Pack Error” out of the file.


5. To get around the problem files, we use the recover command, it seems to suppress whatever macro or hidden element (virus) is now infecting the drawing.


6. Copy and pasting the linework into a blank new dwt seems to take this “Language pack Error”/virus with it. (and NO I did not slelect ALL, just the linework)


7. Exporting to a DXF R12 then opening the DXF file does NOT remove the MACRO/Launguage Pack Error.


8. Disconnecting the computer from the network doesn’t stop it either; it seems to be a file issue.


9. Removing and Reinstalling doesn’t work either.


IS THERE ANYWAY TO PURGE OUT THE HIDDEN MACRO THAT IS TRYING TO INITIATE THE LANGUAGE PACK???


Here is a thread of the virus everyone has suggested we have:
http://discussion.autodesk.com/forums/thread.jspa?threadID=733104
“Important: not all virus detection picks up
these files. The signatures can change, since they are just text files,
but when AutoCAD launches, the text of course gets read and executes doing it's
malicious work. We do a lot of international work, and this particular
virus hailing from China, often comes innocently enough in file transmittals of
CAD files sent to us by clients and consultants... they probably don't realize
they're infected.”

[3dsmaxed]

Did this ever get resolved! We have started to get the same error on certain files which now seem to be spreading LIKE WILD FIRE! Other commands affected are explode and I have had reports that the send to back command doesn't work anymore. We are told that it is a old AutoCAD virus (see thread link at bottom of post), but Symantec, which has been through our files and machines, can find no infected files and tell us we are fine.


The facts are these:


1. After getting the language pack error and answering the question with the "OPEN" button or the "X" activates something to that affects the CUI, acad & express menu files.


2. Commands start to act weird like explode, send to back, copy.. etc.


3. When you just OPEN the infected files you get a:


ERROR: Could not instantiate AecDict!
ERROR: Could not instantiate AecDict!
ERROR: Could not instantiate AecDict!
ERROR: Could not instantiate AecDict!
AutoCAD Express Tools Copyright © 2002-2004 Autodesk, Inc.


Other files seem to be unaffected! It spreads randomly!


4. –purge, Reggapps does not clean the “Language Pack Error” out of the file.


5. To get around the problem files, we use the recover command, it seems to suppress whatever macro or hidden element (virus) is now infecting the drawing.


6. Copy and pasting the linework into a blank new dwt seems to take this “Language pack Error”/virus with it. (and NO I did not slelect ALL, just the linework)


7. Exporting to a DXF R12 then opening the DXF file does NOT remove the MACRO/Launguage Pack Error.


8. Disconnecting the computer from the network doesn’t stop it either; it seems to be a file issue.


9. Removing and Reinstalling doesn’t work either.


IS THERE ANYWAY TO PURGE OUT THE HIDDEN MACRO THAT IS TRYING TO INITIATE THE LANGUAGE PACK???


Here is a thread of the virus everyone has suggested we have:
http://discussion.autodesk.com/forums/thread.jspa?threadID=733104
“Important: not all virus detection picks up
these files. The signatures can change, since they are just text files,
but when AutoCAD launches, the text of course gets read and executes doing it's
malicious work. We do a lot of international work, and this particular
virus hailing from China, often comes innocently enough in file transmittals of
CAD files sent to us by clients and consultants... they probably don't realize
they're infected.”

cudnt find any solution to this yet
and living with the problem for now

[ReMark]

AutoCAD and viruses as posted at AutoDesk:

http://usa.autodesk.com/adsk/servlet/ps/item?siteID=123112&id=12903754&linkID=9240617

[lordjkpff]

Well then, I guess it is not a Macro, my "Enable macro virus protection " was checked and is on..

BUT would a launguage pack error be considered a Macro?

Anyother suggestions?

[Car5858]

I have Had this issue also.

I removed the lagunage pack with the add remove programs. Then checked to make sure the program was removed. There were some unidentified files left over that I manualy deleated.

I then did a repair of the installlation. So far I have not had the reaccure. I also will not reinstall the Koren Language pack. This one seemed to be the cause in my situation.

[lordjkpff]

Except for the fact that I have never loaded a language pack and this seems to spread to every drawing you save on the infected computer.

So far Autodesk & Symantec have been extremely helpful. An Autodesk Tech states:

'I was able to do some research on those error messages. The language pack box will appear when there are objects in the file that were created with a different language. It is notifying you that you should install the pack so that all objects will appear correctly. However, I did see a few instances where the language pack box appears when it should not. In those cases, you can click the 'suppress' button on that box and the message will no longer appear. However, if there actually is information from a different language, they should take the time to install the appropriate pack. Then run recoverall."

BUT like I said earlier we never installed a language pack nor have the need to do so. There should be no other languages than English in these files.

If you hit the ‘suppress’ button, then the drawing does not open! Recover will open the drawing but once open and then save it you are now infected. Even if you open a brand new, fresh out of the box, unaffected dwt, then save it, close it, and reopen it, now that file is infected!

[chelsea1307]

when you removed before you reinstalled did you delete all autocad related folders on your computer/server before reinstalling?

[lordjkpff]

Yes, after unistalling i removed the folder in C_rogram and C_Documents and Settings_user_Application Data_Autodesk folder for a completely fresh install.

[ReMark]

I wonder if there is a Registry setting that was missed. That would explain the reappearance of the bug after a fresh install.

Jeez, that's all the CAD community needs now, a macro virus or a rogue LISP routine that installs language packs without our knowledge. I can see all progress on drawings come to a grinding halt as users waste precious time trying to sort things out.

[lordjkpff]

We have determined that it is a session based transfer. Meaning if you recover an infected file, do your work, then save it and close, now open a new from dwt, save it, close it, and then reopen it. The new file is now infected with the language pack error. Which is strange because we didn't do anything to the new file beside create it and then save it!

We also noticed that if you close that infected session of AutoCAD or Civil 3D, then start a new session, open a new drawing from a DWT, save it, close it, and then reopen it. It is fine!

We think the virus may be hiding in the .dwl & dwl2. file because sometime the original infected file cannot be reopened, it states that a user currently has it open even though we had just closed it.

[ReMark]

AutoCAD writes the dwl file when a drawing is opened in anything other than read-only status. The dwl file contains infomation on who, what computer and time / date the drawing was opened. This can be verified by locating a dwl file and opening it with Notepad.

I don't think it is possible the virus, as you call it, could be in the file itself.

[ReMark]

DWL files are created by the whohas.arx registry key. If you want to stop the creation of dwl files during the current AutoCAD session you must type appload at the command line. This will bring up the Load/Unload Applications dialog box. Go to the Loaded Applications tab and using the scroll buttons go to the bottom of the listed applications. Click on whohas.arx. Look to the right. Click on the Unload button. In the rectangular window at the bottom of the dialog box you'll see the following message: whohas.arx successfully unloaded. Now click on the Close button. That's it. Keep in mind this is only for the session of AutoCAD you are in. Once you close it out and then reopen it later AutoCAD will start creating dwl files every time you open a drawing. There is a way to permanently stop the creation of dwl files but it involves editting the Registry. Do you really want to do this?

[ReMark]

Here is a sample output from a dwl file I opened using Notepad.

mark MMM Wednesday, July 08, 2009 11:46:30 AM

[lordjkpff]

it was a theroy...:)

Now an even bigger mess is it appears that some people have checked the box "Don't show me this again", and now every file they open and save gets this language pack error.

Once you press "open" or check the "Don't show me this again" a acad.vlx file is created. Then it changes the acaddoc and a few other files on the computer who opened it. That is when commands start to go haywire.

http://discussion.autodesk.com/forums/thread.jspa?threadID=733104&tstart=75

The virus arrived in several manifestations. It exploits AutoCAD's automatic loading of reserve-named "program files" such as acaddoc. lsp (the most prevalent one found so far), acad.lsp, acad.fas. acad.vlx, etc. Once infected, it has the curious habit of growing the infected files to become huge (I have seen an acaddoc.lsp grow up tp 50 MB and more during one outbreak). Also, it
infects a number of .LSP and .MNL files in the AutoCAD \support folder
location. Typically I just sort the \support folder by DATE, because the
infected files will be very recent, and you'll notice that the small lisp and
mnl files get very large, often into multi-megabytes. One needs strategies
to fight the threat. I keep protected copies of the good original .LSP
& MNL files to copy back down to an infected station. We've had no new
outbreaks in the last 5 months or so.



Important: not all virus detection picks up
these files. The signatures can change, since they are just text files,
but when AutoCAD launches, the text of course gets read and executes doing it's
malicious work. We do a lot of international work, and this particular
virus hailing from China, often comes innocently enough in file transmittals of
CAD files sent to us by clients and consultants... they probably don't realize
they're infected.

Using the WBLOCK command seems to clean infected files except Civil 3D files, some objects will not go with the WBLOCK.

Is there any purge that strip whatever it is out of the drawing? Whatever it is, it is in the drawing!

[ReMark]

If you do not know what "it" is then what are you purging? When you do use the purge command do you purge regapps? I believe I've seen a reference to a LISP routine called SuperPurge but I can't recall what benefits it offers over the regular purge command.

[ReMark]

Well then, what are your choices at this point? Care to try an experiment? Pick one of the computers that is "infected" and wipe the hard drive. Then reinstall your OS and your CAD software. Test it with a known "clean" drawing. What happens?

[lordjkpff]

Yep, Regapps was one of the first things we tried... and we don't know what "it" is either, we just know "it" is causing problems..

We are in contact with the Manusoft, makers of SuperPurge, unfortunately we have to go item by item to figure out what "it" is...

[ReMark]

Not interested in sacrificing one of your computers then are you?

[lordjkpff]

Unfortunately it has nothing to do with the computer station, it has to do with the dwg files. We have found the acad.vlx all over our server, it is saved where your infected drawing is saved.


We used Superpurge to see if we could track down the APP. We open a CLEAN file and ran superpurge. We made a screen shot of the items it found in the drawing, it was a small list.

Then we recovered a infected file and saved it. Then went back to the clean file and saved it which infected it. We confirmed by trying to open the file and it gave the language pack error. We then ran Superpurge on the file and notice ONE MORE APP had been added to the file.

The APP is called:

App IDs: [1]
ADE

THE PROBLEM IS, YOU CAN SUPERPURGE THE APP, BUT YOU CANNOT SAVE WITHOUT INFECTING THE FILE AGAIN!!!

WE NEED A WAY TO PURGE THIS APP AND SAVE THE DRAWING!!!
Screen Shots Before & After:

[lordjkpff]

Just to add, i wasn't ignoring the brand new computer option, it was a great suggestion and we did that too. We are actually using the menus from that computer to replace corrupted ones on the workstations. We have narrowed the root of the problem to be contained in the dwg's.

We are also trying and old school approach and creating a dummy, blank acad.vlx file and a script to replace them on our server until Autodesk tells us how to purge the app and save without re-infecting it.

[ReMark]

Acad.vlx? If you run appload at the command line this file shows up in the Loaded Applications list?

[ReMark]

F.Y.I. - FAS and VLX files. As per AutoDesk:

"FAS and VLX files are compiled AutoLISP® files that were created with Visual LISP®. FAS files contain a single compiled AutoLISP routine, whereas VLX files contain multiple routines."

[ReMark]

If you want a complete list of all ARX, FAS and VLX files being loaded you can use the routine acadinfo.lsp. To use this utility enter (load"acadinfo") on the command line and press Enter. Next type acadinfo and press Enter. The Select file name dialog box should appear on your screen with the default acadinfo.txt already listed. You can indicate to AutoCAD where you want to save this file. I saved mine to the Desktop. You should then see something very similar to this:

ACADINFO is a utility for gathering information about
your AutoCAD installation and current setup. The routine
will examine your system and write a text file called
'C:\Documents and Settings\mark\Desktop\acadinfo.txt'
to your hard drive.

At this point you can press ENTER to continue or ESC to cancel. Assuming you elect to continue this is what you should see next:

Examining your AutoCAD setup. Please wait...
Performing load tests...
AutoCAD menu utilities loaded.
AutoCAD Express Tools Copyright © 2002-2004 Autodesk, Inc.
Writing AutoCAD system variable information...
Formatting and writing ouput. Please wait...\
Output written to: "C:\Documents and Settings\mark\Desktop\acadinfo.txt"
Done.

Go to your Desktop and open acadinfo.txt and the information you seek will be located at or very near the top of the file. The file also contains, among other things, a complete list of all system variables and their current setting.

[lordjkpff]

Nope, the thing is when you open an infected file, even if you go through the recover command, and then open a non-infected file, then save it, it to is now infected. The .vlx only show up is you press "Open" or "Don't show this again" box when the language pack comes up. Then the next time you run AutoCAD it rewrites your commands.

Autodesk sends us this....

Please take a look at the following link:

http://discussion.autodesk.com/forums/thread.jspa?messageID=6180777&#6180777 (http://discussion.autodesk.com/forums/thread.jspa?messageID=6180777&#6180777)

It would be good to look through the entire thread, but in particular look at the post from markdoel on February 18th at 7:25 am. This gives a good way to search for these files. You want to delete all vlx files on your system, and then replace the bad lsp files with ones from a machine that does not have the problem. I will also post one more link to another discussion group also referencing this issue.

And of course Autdesk's #1 solution is:

If this does not work then we may need to look into a 'clean' reinstall on the affected machines to assure that all bad files are replaced.


They keep ignoring the fact that this malicious APP resided "INSIDE" the dwg file and just opening it will infect any other file saved after.

There was one possible helpful post on that page with a link to a lisp file that could show all hidden objects in a dwg file. However that link has no pot of gold (lisp) at the end of it. It appears that this lisp is only a mystic fairytale.

Posted by: Gary_K on Jun 27, 2009 7:45 AM
http://cadtips.cadalyst.com/display-properties/turn-objects-invisible-or-visible

Does anyone have such a lisp..

[ReMark]

Sounds like you're stuck between a rock and a hard place. Even if you clean out every computer (wipe and reinstall OS and all programs) as soon as you try to work with the drawing file you become infected again. How many infected drawing files do you suppose you have at this point?

[ReMark]

Are you saying you could not download the LISP file? Actually it is a zip file named HTH2058.zip. I was able to download it and unzip it. The zip file contained one file called Hide&Show.lsp. The routine is called by typing InVis. It purports to be able to turn objects invisible and then visible again. Use it to amaze your friends or hide something more sinister? The author does refer to "objects" so I'm not sure what you hoped to do with it. Care to explain?

[ReMark]

By the way, I did not try the lisp routine out so I can't tell you if it works or not.

[lordjkpff]

Tried the lisp, it found no hidden objects!

We have found this acad.vlx file throughout our server with the earliest date of 6/29, we figure someone received an updated background from an architect and it spread from there. We are considering going to a backup copy of our network which means we would lose 2 weeks worth of work!

I hope Autodesk is working with Symantec or another virus company to fix this. I have noticed more chatter popping up with this same malicious behavior.

I SUGGEST TO ANYONE TO EDUCATE YOUR CAD USERS, IF THEY SEE SUSPICIOUS WARNINGS TO ALERT THE CAD MANAGER!!!

[Car5858]

I would convert the infected files to pdf, before reverting to the network back up.

I have looked for the drawing that I had a problem with, That drawing is no longer in my system. I tend to deleat drawings after I convert to pdf to save space on the HD.

I also agree with the alert.

[ReMark]

I searched my standalone workstation and everything on our network and did not find any file named acad.vlx but then I did not expect to. I guess that at this point this is between your firm and AutoDesk. I wouldn't expect much in the way of help from Symantec (just my opinion).

Please keep us informed as to what transpires. Thanks and good luck.

[lordjkpff]

UPDATE:

Autodesk has given up on the tech support end and states that WBLOCK is the answer. Symantec has reported that they are starting to see a surge of similar requests for assistance.

For basic AutoCAD files the use of WBLOCK or a "Hard" Superpurge will remove the malicious virus within the DWG.

HOWEVER as for Civil 3D or any other vertical product, as of yet, there is no safe way to remove the virus without losing the intelligent data produced by the vertical product.

[ReMark]

Thank you for that update. Did AutoDesk tech support have anything useful to say other than WBlock? I mean about the "virus" in general.

[lordjkpff]

Here is a collection of the communiqués from Autodesk:

….Unfortunately we are not able to support things like custom lisp routines here in Product Support. :unsure:(Wasn''t a custom lisp file, "IT" was in a dwg given to us from our client, "IT" is contained within the "root" dictionary of the DWG) I may have some other resources I can point you to to help with the issue. However, I'd like to try and understand what is happening a little bit better first. Please send me screen shots of any and all error messages you are receiving. I can then investigate those here to see if I can find what is happening. Thank you very much…

….Thank you for sending in the screenshots. I was able to do some research on those error messages. The language pack box will appear when there are objects in the file that were created with a different language. It is notifying you that you should install the pack so that all objects will appear correctly. However, I did see a few instances where the language pack box appears when it should not. :?(What does that mean?) In those cases, you can click the 'suppress' button on that box and the message will no longer appear. :!:(We tried this and it is a BAD IDEA, THIS IS HOW YOU BECOME INFECTED!!)However, if there actually is information from a different language, they should take the time to install the appropriate pack…..

…Unfortunately, as is the case with any virus type problem, you may need to roll back somewhat to a spot when you did not have infections. :shock:(Seriously! Can you imagine rolling back weeks worth of work.) You need to delete all infected files off the problematic machines, and then clean the bad files using the steps I provided. If the files cannot be repaired, you will need to delete them and either recreate them or restore them from backup from before they were infected. I know this may sounds like a long process, but if the problem is indeed in the DWG's, the only way to fix it is to either fix them or delete them…

…Also, you had mentioned earlier that you thought you had this tracked down to one particular file that might be the problem. Please perform the following steps to clean that file. If you think that some of your template files are also infected, you may want to run this same test. These steps will give you the cleanest possible files to work with. :huh:(The only step that has some promise is number 6)

1) Open one of the problematic files and make sure all layers are on and thawed.
2) Detach any XREF's.
3) Run AUDIT.
4) Run PURGE and delete anything that it lets you.
5) Run -PURGE and delete all.
6) Using the WBLOCK command, block out all the information in the file to create a new drawing. Select the objects by windowing them; do not just type ALL.
7) Open a blank DWG. Do not use any templates.
Using the INSERT command, insert the file created in step 3.
9) EXPLODE the newly inserted information so it is not a block any longer.
After cleaning the files, please try working with them again and see if the problem still exists.

[ReMark]

Sounds more like "you're on your own here bud".