acad viruse

[ghonki]

Dear Mr. Ahankhah,

1. I am sorry that not to tell you the problem.

2. There are two acad.lsp in my computer.

3. one is in USER folder (c:\user\name.domain\...\autocad2007\...\support)

4. and another one is in the folder that I save DWG. ( d:\DWG - for example )

5. if I delete acad.lsp in DWG folder, the acad.lsp will be generated every time I open DRAWINGS.

6. When I delete acad.lsp in USER & DWG folder, the acad.lsp in DWG folder is disappear.

7. I like your script and think it will be help me from infection ( create acad.lsp in USER folder ).

8. The excel files that were deleted is in local hard drive ( c: , d: , for example ) and in thumbdrive ( g: or removable disk ).

Sincerely yours,

Ghon Kijkanjanapaiboon

[Ahankhah]

ghonki, unfortunately I didn't received your email, as well I haven't be informed about your post.

So, if it is not too late, and you still want to get any solution to the problem, let me know.

Edited November 25, 2011 by Ahankhah

[andymai]

Either do a REPAIR or wipe your drive and do a full reinstall.

Hi, I have just recently been affected by the acad.fas and acaddoc.lsp virus files. I have deleted the drawings folder that come with these 2 files and also deleted the file acaddoc.lsp which was automatically created in one of my other drawing folder. I have then reinstalled autocad but the freshly installed CAD opens with the same messed up CAD. Could anyone please help.

[Ahankhah]

andymai,

I didn't hear anything about worm or virus comming with acad.fas. Maybe it is a new virus.

Anyway, you can try running the attached program.

would you please compress the affected acaddoc.lsp and acad.lsp and attach to your next post?

KillWorm142.lsp

Edited March 27, 2012 by Ahankhah

[gl77]

Hi, just to share, i fixed my client autocad, with the method from

, removing :acaddoc.fas and especially the 1BlockedSymbols.fas. And also using the "AutoCAD_Anti-Virus_Protection.exe" from http://www.gempak.org/forum/showthread.php?t=92458 , to clean, although 1 of the packed .fas will be detected by kaspersky, but i think it is a false alarm which it is a reference file already name as 04-ACADDOC-Kampong_Chhnang.fas in the unzipped folder. ty.

[leemindjan]

thanks very much, it worked flawlessly on my computer.

[sorena]

Thank you Ahankhah. Your lisp is worked on my computer too.

[Ahankhah]

thanks very much, it worked flawlessly on my computer.

You are welcome Leemindjan.

 

Thank you Ahankhah. Your lisp is worked on my computer too.

 

You are welcome Sorena.

سپاسگزارم

Edited November 16, 2012 by Ahankhah

[jasonheald]

Hello everyone. Throwing this out to the 'Real' geniuses here. I've been reading this post and have a question about network instances of this worm/virus.

 

I work for a manufacturing company that has a piping detailing department with multiple global offices. All of our offices are showing signs of this worm/virus. The issue is that we have multiple servers, and they are replicated to each other nightly. I need to prevent this worm/virus from spreading further. I suspect that it initially came in from a contractor supplied background.

 

What steps would I need to take using this killworm.lsp to destroy this worm/virus in all of our offices? I don't think I read a solution to a problem in this thread. If I missed it, I apologize. Any help would be greatly appreciated.

 

Best regards.

[Ahankhah]

What steps would I need to take using this killworm.lsp to destroy this worm/virus in all of our offices? I don't think I read a solution to a problem in this thread. If I missed it, I apologize. Any help would be greatly appreciated.

 

1- Download the attached KillWorm200-for-CadTutor.lsp which is a new version of KilWorm.lsp.

 

2- Load it into AuoCAD.

 
(load "KillWorm200-for-CadTutor.lsp")

3- Run "KW".

 
Commad: [b]kw[/b]

4- Enter ALL option to seach all drives.

 

Note: You must map all network paths to Windows valid drives [A:-Z:]

 

Attached: KillWorm200-for-CadTutor.lsp

[PotGuy]

I think Ahankhahis the Worm's worst nightmare!

 

While I don't need for it thankfully, I still thank you for the fact this does exist free of charge and how you go about responding diligently to others.

[Ahankhah]

I think Ahankhahis the Worm's worst nightmare!

 

While I don't need for it thankfully, I still thank you for the fact this does exist free of charge and how you go about responding diligently to others.

PotGuy, Thank you very much for your favor.

 

P.S. My delay in sending this post is due to not having access to any computer (and internet) for a long time.

[PotGuy]

PotGuy, Thank you very much for your favor.

 

P.S. My delay in sending this post is due to not having access to any computer (and internet) for a long time.

 

I noticed when I checked your profile some time ago.

[Kapanther]

Someone should take down the link to this file. Couldnt agree more ReMark

 

Call me skeptical but I would not run a *.fas routine that was downloaded from some unknown website until I knew exactly how it worked and what the ramifications of using it would be. One cannot be too careful these days. For example, someone can be visiting a website and suddenly a message appears stating the user's computer is infected. Then they are prompted to download the "fix" for the problem only to find out later on that the "fix" was actually a virus or malware. By that time it's too late... the damage has been done.

 

What is the source of killworm.fas? Who wrote it and when?

Will you personally vouch for the effectiveness of killworm.fas?

Have you ever used it?

Can you point us to a review written by someone who has used it?

[ReMark]

Those words were spoken in haste at a time when the member was unknown. I no longer have the same concerns and would vouch for the member.

[SLW210]

Someone should take down the link to this file. Couldnt agree more ReMark

 

You seem to have missed the rest of the thread.

[Guest]

Use a good antivirus to scan your pc.I dont think that you can kill a virus with a lisp .........

[dbroada]

Use a good antivirus to scan your pc.I dont think that you can kill a virus with a lisp .........

a good virus scanner is unlikely to detect the AutoCAD virus. This LISP is a specific tool for a specific task.

[ZakV]

Good afternoon, my company has been effected by this I believe. Every time someone opens an AutoCAD file, ACADDOC.lsp gets created in that job folder. I downloaded your script, but when I run it on all, it searches trough a few files, then I get:

 

Searching: "c:\Documents and Settings\administrator\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\"; error: file pattern specification is too long

 

It starts with

"Searching: "c:\Documents and Settings\administrator\AppData\Local\Application Data\Adobe\Color\" then adds a "\Application Data" and searches again and again until it runs out of characters.

 

Any help would be greatly appreciated!

[SBHayes]

Good afternoon, my company has been effected by this I believe. Every time someone opens an AutoCAD file, ACADDOC.lsp gets created in that job folder. I downloaded your script, but when I run it on all, it searches trough a few files, then I get:

 

Searching: "c:\Documents and Settings\administrator\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\"; error: file pattern specification is too long

 

It starts with

"Searching: "c:\Documents and Settings\administrator\AppData\Local\Application Data\Adobe\Color\" then adds a "\Application Data" and searches again and again until it runs out of characters.

 

Any help would be greatly appreciated!

 

 

 

Same problem as the above. Also, when I run the Select, it comes up:

Select option [Active/Passive/ALL/Select/?/eXit]: S

Message: bad argument type: VLA-OBJECT nil