Cad Virus

[lindsayrg1]

A lisp routine named acaddoc.lsp seems to be going around at work. If a user opens a CAD file with this LISP file also in the directory, it seems to load itself and then infect the users machine changing settings and I assume other things that I am still not aware of. Once teh user is infected, it must place it somewhere on the users machine because as soon as any other CAD files in different directorys are opened, it creates a copy of the lisp routine in the new directory thus spreading into all of our jobs and across multiple machines.

 

My question is what exactly does this routine do and since i have no idea how to read lisp code? What would be the best way to remove this thing?

 

Code is as follows... CODE REMOVED

Edited December 8, 2011 by SLW210

[ReMark]

Topic has been discussed numerous times. See Similar Threads listed below.

[lindsayrg1]

Sorry please delete thread.

[ReMark]

There is no need to apologize. It is just simpler to redirect your attention to previous threads than to restate it all again.

 

Thread deletion is up to the Moderators.

 

You might benefit from this as well....http://metinsaylan.com/819/how-to-clean-acaddoc-lsp-virus-from-your-pc/

[lindsayrg1]

http://www.cadtutor.net/forum/showthread.php?58117-acad-viruse&highlight=acaddoc.lsp

 

Read you post from the above.

 

You posted instructions and a link to autodesk http://usa.autodesk.com/adsk/servlet...linkID=9240617 on how to remove acad virus - acad.vlx. Is this the same? I did a search for acaddoc.lsp at the top and it didn't seem to come up with anything else similar.

[BlackBox]

You might benefit from this as well....http://metinsaylan.com/819/how-to-clean-acaddoc-lsp-virus-from-your-pc/

 

... And let's not forget to add

 while we're at it. :wink:

[lindsayrg1]

You might benefit from this as well....http://metinsaylan.com/819/how-to-cl...-from-your-pc/

 

This works nicely. Just guess I'll have to talk to IT and arrange for a network wide deletion of acaddoc.lsp files from project folders only.

[Ahankhah]

Here is a program to do delete the worm: http://www.cadtutor.net/forum/showthread.php?58117-acad-viruse&highlight=viruse

This program has 2 advantages which Metin Shaylan's code hasn't (although his code is very nice):

1- My program VACCINES AutoLISP programs against the same worm (virus).

2- Metin's code deletes any viral file even if it has lines of code before infecting by virus, while my program doesn't. It cleans the file and retains clean file.

[lindsayrg1]

Hey ReMark just a quick question. I saw you commenting on Ahankhah script and why anyone should run it? What makes the one you recommended safe and would you recommend Ahankhah's script at all?

[ReMark]

Run one or both. Should be no problem with either.