acad viruse

[ReMark]

thanx alot but i still have that viruse if u have another thing we can try it

Either do a REPAIR or wipe your drive and do a full reinstall.

[troggarf]

My program is free of charge for CADTutor forum members and observers. I owe more than this to CADTutor...

 

My apologies, When I saw another compiled code in response to the initial compiled code as a solution, my defenses were up.

Its people like you who make Cad Tutor such a great resource.

Thanks Ahankhah

[ReMark]

Well we at least know the source now so that should put some minds to rest.

 

Thank you Ahankhah. My apologies for not saying so earlier.

 

One can never be too careful.

[Ahankhah]

traggarf and ReMark,

my dears,

It's OK. Don't worry about it:lol:.

[bhaskar]

hi...ahankhah.....

I have downloaded the lsp and fas files you ve put up.

I have 20 computers in my office and most of them are facing problems during loading of files ( takes too long)

and saving them in the network (again takes too long)

Yes we have tried various remedies to get rid of the acad.lsp ( which seems to get recreated in every project folder)

and acaddoc.lsp.....also *.fas and some *.vix or something.

you have mentioned how to use the killworm.fas......on the previous page.

Can you tell us how to use the killworm.lsp please.

thanks

[bhaskar]

anyone else who may have tried ahankhah's remedy successfully???

[Ahankhah]

hi...ahankhah.....

I have downloaded the lsp and fas files you ve put up.

I have 20 computers in my office and most of them are facing problems during loading of files ( takes too long)

and saving them in the network (again takes too long)

Yes we have tried various remedies to get rid of the acad.lsp ( which seems to get recreated in every project folder)

and acaddoc.lsp.....also *.fas and some *.vix or something.

you have mentioned how to use the killworm.fas......on the previous page.

Can you tell us how to use the killworm.lsp please.

thanks

 

Just copy killworm.lsp anywhere on your local hard disk on which your AutoCAD is running, then open AutoCAD and load killworm.lsp into ACAD. Now you can call KW command. It will prompt you to select one of the options. I prefere "Active" option, because it shows whether your AutoCAD is infected or not. You can also use "Passive", if you know the worm is here but you are not sure the AutoCAD currently is infected or not.

 

I enclose the last version of my program here.

 

P.S. If your computers are just slow and there is no missing commands, It is probable that they are not infected by acaddoc.lsp worm!

KillWorm142.lsp

Edited July 14, 2011 by Ahankhah

[minion]

1-when i press on scrol right menu appear not pan

2-hatching not working and not appear

3-zooming very slow

when i use system variabels commends it corect prevouse conflict bu when i reopen eror com again.

thanx

 

I have the same problem.

mbuttonpan is set to 0

fill variable is set to 0

zoomfactor is set to 16

 

then an acad.lsp showed on my folders after i opened a file

 

my version became this when i open a dwg file with the same acad.lsp on it. then my autocad haywired.

i already made an lsp to set those to their default but its a hassle every time i open the software to type my command.

is there any way to revert my autocad to the way it was. basically im just a noob to lsp and i can only write simple lsp.

what i understand is that acad.lsp will be loaded once if the ACADLSPASDOC variable is set to 0 but why when i open another dwg the settings above are the default and the acad.lsp file will show on the folder.

 

thanks in advance

[Ahankhah]

I have the same problem.

mbuttonpan is set to 0

fill variable is set to 0

zoomfactor is set to 16

 

then an acad.lsp showed on my folders after i opened a file

 

my version became this when i open a dwg file with the same acad.lsp on it. then my autocad haywired.

i already made an lsp to set those to their default but its a hassle every time i open the software to type my command.

is there any way to revert my autocad to the way it was. basically im just a noob to lsp and i can only write simple lsp.

what i understand is that acad.lsp will be loaded once if the ACADLSPASDOC variable is set to 0 but why when i open another dwg the settings above are the default and the acad.lsp file will show on the folder.

 

thanks in advance

 

If your problems are due to behaviour of ACADDOC.LSP worm, you can download above mentioned Killworm.lsp (Killworm142.lsp) and run it. It shows you which files are infected and cleans them.

Please send me your feedbacks to enhance its abilities.

[minion]

thanks mr. ahankhan

I tried the killworm.lsp. here are the results:

active option- no worm found

passive option-file is already clean

all- autocad fatal error

 

i don't know if this is also a symptom but some of my file, the hatch on model space covers the leader and revcloud on paper space also some drawings when i print shows a line even if it not in the drawing (also can be seen at print preview).

 

tomorrow i'll upload the acad.lsp (1Mb in size). i tried opening it but it only shows symbols.now almost all autocad 2008 in our office are infected

[ReMark]

Follow AutoDesk's recommended procedure for uninstalling AutoCAD and preparing your system for a clean install. Directions can be found on the AutoDesk website.

[Ahankhah]

thanks mr. ahankhan

I tried the killworm.lsp. here are the results:

active option- no worm found

passive option-file is already clean

all- autocad fatal error

 

i don't know if this is also a symptom but some of my file, the hatch on model space covers the leader and revcloud on paper space also some drawings when i print shows a line even if it not in the drawing (also can be seen at print preview).

 

tomorrow i'll upload the acad.lsp (1Mb in size). i tried opening it but it only shows symbols.now almost all autocad 2008 in our office are infected

 

minion, thank you very much for your feedback.

 

1- This shows you are not acaddoc.lsp virus infected and there is another reason causing problems on your computers.

 

2- When you select All option, the program searches all active partitions entirely, but unfortunately AutoCAD in this process crashes. I guess this is for a bug in vl-file-... functions.

Instead you can use Select option to force program to search selected folders (and subfolders).

 

If it is possible to you, send log of your AutoCAD session to forum to more considerations. To make log files, issue "LOGFILEON" command in AutoCAD. To know the name of log file, enter "LOGFILENAME" in command line. After exiting AutoCAD, find the log file and send it to forum. I hope CADTutor members find out some solutions for it.

[minion]

i'm the one who needs thanking you. but i think i fix the problem. on my local support folder, i search for lisp file and i came into acadappp.lsp then i delete it. when i open my cad i set the variables mbuttonpan, fill and zoomfactor and it stays the same values even if i restart the autocad software. thanks for all the help. kindly give feedback if it works. and one thing delete all acad.lsp with a file size of 1Mb because if you open the cad file. it will activate the symptoms again.

[Ahankhah]

Glad to see you solved the problem successfully.

[ghonki]

Dear Mr. Ahankhah,

I use AUTOCAD 2007 in THAILAND. The acad.lsp will generate automatically when I open CAD file. I use "KW" as your suggestion. But it show "Ignore Protected LSP" or something like this. Your script can not delete the acad.lsp. How can I do now ? Please help me.

[Ahankhah]

Dear Mr. Ahankhah,

I use AUTOCAD 2007 in THAILAND. The acad.lsp will generate automatically when I open CAD file. I use "KW" as your suggestion. But it show "Ignore Protected LSP" or something like this. Your script can not delete the acad.lsp. How can I do now ? Please help me.

 

The KillWorm can't read protected AutoLISP programs, so the virus infected lisp file is ignored by KW.

I guess this is a new version of ACADDOC.LSP virus/worm which is protected.

 

Should you send your ACAD.LSP or ACADDOC.LSP file (or any infected file) to my email?

Please follow these instructions:

1- Compress infected files into ZIP or RAR files.

2- Send them to ahankhah_AT_irancad.com (substitute _AT_ with @).

I hope I can find a way to get rid of the new virus/worm

[ghonki]

Dear Ahankhah,

1. I send VIRUS ( ACAD.LSP ) to your Email as your request.

2. The acad.lsp in user folder is IGNORE by KW.

3. The acad.lsp in work folder is created automatic. I know it because I delete it every time.

4. If I delete all two acad.lsp , They will disappear.

5. If I do not delete them, DWG file & EXCEL file in my computer will be deleted.

6. I don't know how acad.lsp is created in user folder.

7. May KW kill this worm ?

8. Thank you in advance for your help

Sincerely yours,

Ghon Kijkanjanapaiboon

[Ahankhah]

Dear Ahankhah,

1. I send VIRUS ( ACAD.LSP ) to your Email as your request.

...

I haven't received any email from your end. Would you check your recipient's address?

[Ahankhah]

2. The acad.lsp in user folder is IGNORE by KW.

Because as you mentioned it is protected and KW just reads contents of source lisp files to find probable virus in them.

 

3. The acad.lsp in work folder is created automatic. I know it because I delete it every time.

Perhaps it is created by an executable program. Check any Picture (*.gif, etc) in the same folder.

 

4. If I delete all two acad.lsp , They will disappear.

You didn't mention to the second ACAD.LSP file. What and where is it?

 

5. If I do not delete them, DWG file & EXCEL file in my computer will be deleted.

Please explain more about your excell file. Where is it and what is the relationship between it and AutoCAD?

 

6. I don't know how acad.lsp is created in user folder.

Check my answer to your question no 3

 

7. May KW kill this worm?

KW can't do the risk of killing an unknown lisp file, may be it is a necessary protected file.

[ghonki]

Dear Mr. Ahankhah,

1. ACAD.LSP that I SENT to you by EMAIL "newcentury@sanook.com".

2. This email is local email in Thailand. So, it may be late. If you receive the email , Please tell me.

3. I can not attach virus RAR in hotmail or yahoo-mail because it will be scan and found that it contain virus before attach file.

4. Maybe you received the email but it is in junk mail box. Please Check it again.

Sincerely yours,

Ghon Kijkanjanapaiboon