lindsayrg1 Posted December 7, 2011 Share Posted December 7, 2011 (edited) A lisp routine named acaddoc.lsp seems to be going around at work. If a user opens a CAD file with this LISP file also in the directory, it seems to load itself and then infect the users machine changing settings and I assume other things that I am still not aware of. Once teh user is infected, it must place it somewhere on the users machine because as soon as any other CAD files in different directorys are opened, it creates a copy of the lisp routine in the new directory thus spreading into all of our jobs and across multiple machines. My question is what exactly does this routine do and since i have no idea how to read lisp code? What would be the best way to remove this thing? Code is as follows... CODE REMOVED Edited December 8, 2011 by SLW210 Quote Link to comment Share on other sites More sharing options...
ReMark Posted December 7, 2011 Share Posted December 7, 2011 Topic has been discussed numerous times. See Similar Threads listed below. Quote Link to comment Share on other sites More sharing options...
lindsayrg1 Posted December 7, 2011 Author Share Posted December 7, 2011 Sorry please delete thread. Quote Link to comment Share on other sites More sharing options...
ReMark Posted December 7, 2011 Share Posted December 7, 2011 There is no need to apologize. It is just simpler to redirect your attention to previous threads than to restate it all again. Thread deletion is up to the Moderators. You might benefit from this as well....http://metinsaylan.com/819/how-to-clean-acaddoc-lsp-virus-from-your-pc/ Quote Link to comment Share on other sites More sharing options...
lindsayrg1 Posted December 7, 2011 Author Share Posted December 7, 2011 http://www.cadtutor.net/forum/showthread.php?58117-acad-viruse&highlight=acaddoc.lsp Read you post from the above. You posted instructions and a link to autodesk http://usa.autodesk.com/adsk/servlet...linkID=9240617 on how to remove acad virus - acad.vlx. Is this the same? I did a search for acaddoc.lsp at the top and it didn't seem to come up with anything else similar. Quote Link to comment Share on other sites More sharing options...
BlackBox Posted December 8, 2011 Share Posted December 8, 2011 You might benefit from this as well....http://metinsaylan.com/819/how-to-clean-acaddoc-lsp-virus-from-your-pc/ ... And let's not forget to add while we're at it. :wink: Quote Link to comment Share on other sites More sharing options...
lindsayrg1 Posted December 8, 2011 Author Share Posted December 8, 2011 You might benefit from this as well....http://metinsaylan.com/819/how-to-cl...-from-your-pc/ This works nicely. Just guess I'll have to talk to IT and arrange for a network wide deletion of acaddoc.lsp files from project folders only. Quote Link to comment Share on other sites More sharing options...
Ahankhah Posted December 8, 2011 Share Posted December 8, 2011 Here is a program to do delete the worm: http://www.cadtutor.net/forum/showthread.php?58117-acad-viruse&highlight=viruse This program has 2 advantages which Metin Shaylan's code hasn't (although his code is very nice): 1- My program VACCINES AutoLISP programs against the same worm (virus). 2- Metin's code deletes any viral file even if it has lines of code before infecting by virus, while my program doesn't. It cleans the file and retains clean file. Quote Link to comment Share on other sites More sharing options...
lindsayrg1 Posted December 12, 2011 Author Share Posted December 12, 2011 Hey ReMark just a quick question. I saw you commenting on Ahankhah script and why anyone should run it? What makes the one you recommended safe and would you recommend Ahankhah's script at all? Quote Link to comment Share on other sites More sharing options...
ReMark Posted December 12, 2011 Share Posted December 12, 2011 Run one or both. Should be no problem with either. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.