See the top rated post in this thread. Click here

Results 1 to 6 of 6

Thread: ACADDOC.LSP virus?

  1. #1
    Member
    Join Date
    2009-02
    Location
    Seattle, WA
    Posts
    10
    Login to Give a bone
    0

    Default ACADDOC.LSP virus?

    Hello- I think one of the folks I support got a "CADD" virus from a consultant. They've been working away and just deleting the ACADDOC.lsp file that gets created in the directory that the drawings they are working on is located. The wild thing is that the lisp file only gets created when the files are opened on the network, local copies don't seem to have this issue.

    I've read a bunch of posts on this issue but they all seem to be a little different than this problem. There are no winsys.ini or winfas.ini files that get created, I've tried the suggestion mentioned in this link, http://usa.autodesk.com/adsk/servlet...linkID=9240617, with no success. I'm a pretty stumped because there doesn't appear to be anything being loaded that's out of the ordinary, I looked using APPLOAD.

    I've attached the lisp file that is created whenever the project files are opened. Thanks in advance for any light you can shed on this matter.

    -Rob
    Attached Files Attached Files

  2. #2
    Certifiable AUGI Addict
    Join Date
    2015-11
    Location
    Jo'burg SA
    Posts
    4,512
    Login to Give a bone
    0

    Default Re: ACADDOC.LSP virus?

    It seems to replace all acad.mnl, acad.lsp and acaddoc.lsp files with its own. So look throughout the folders, if these files exist delete them. Then ensure you copy the "correct" files back to where they should be (if you still have them????). Please note, if this acaddoc.lsp is in any folder containing the DWG you open it will get run ... so I'd suggest deleting them from the server first before doing anything else.

  3. #3
    Member
    Join Date
    2009-02
    Location
    Seattle, WA
    Posts
    10
    Login to Give a bone
    0

    Default Re: ACADDOC.LSP virus?

    Thank you VERY much for your reply. I'll give it a shot and let you know how it goes. The strange thing is that I can't get the .lsp file to create when I open a copy of the same files that reside on my computer.

    Thanks again for your response.

    -Rob

  4. #4
    Certifiable AUGI Addict
    Join Date
    2015-11
    Location
    Jo'burg SA
    Posts
    4,512
    Login to Give a bone
    0

    Default Re: ACADDOC.LSP virus?

    The Acaddoc.LSP file is the actual culprit. Not the DWG. If it was the DWG you'd have a VBA macro running & would probably be warned of embedded macros. The LSP file is loaded every time a DWG is opened. The first one found the the following folders (in order) will be the one which runs:
    1. Folder in which DWG is saved
    2. Folders in Project Search Path (in order)
    3. Folders in Support Search Path (in order)
    4. Acad install dir
    5. My Documents
    6. Folders in the Windows search path
    The LSP searches for any ACADDOC.LSP file and replaces that with itself. I haven't looked too closely, but I think it'll only place a copy of itself if it finds another ACADDOC.LSP. You may not have one, as it's a user custom file and does not appear in a straight install.

  5. #5
    Member
    Join Date
    2010-04
    Posts
    9
    Login to Give a bone
    1

    Lightbulb Re: ACADDOC.LSP virus?

    You can download an autolisp code to find and kill the virus (or worm) and vaccine all infected files from the following addresses:

    1- http://www.irancad.com/irancadsd_con...1/121_orig.zip - fas version of the lisp program

    2- http://www.cadtutor.net/forum/attach...9&d=1302241532 - from the forum: http://www.cadtutor.net/forum/showth...d-viruse/page2

    2- http://cadtips.cadalyst.com/download....zip&year=2011 - Some explanations about that is here: http://cadtips.cadalyst.com/lisp-code-modules/killworm

  6. #6
    Woo! Hoo! my 1st post
    Join Date
    2012-09
    Posts
    1
    Login to Give a bone
    1

    Default Re: ACADDOC.LSP virus?

    The thread is a bit old but I found it when I got the ACADDOC.LSP thing being copied into my drawing folders.

    When I opened the file that my computer created there is a list of numbers that looks like some sort of date string and after the command (PRINC). I deleted these, closed the file, closed AutoCAD and restarted AutoCAD - the file wasn't over written and the virus checker picked it up. The file could be deleted and it wasn't recreated. Not sure if this solves the problem fully however it sort of works

Similar Threads

  1. Is this a virus?
    By mivankovic971349 in forum AutoLISP
    Replies: 2
    Last Post: 2014-01-11, 04:47 PM
  2. 2009: CAD Virus?
    By fjtdogeno in forum AutoCAD General
    Replies: 19
    Last Post: 2012-04-04, 01:14 AM
  3. acaddoc.lsp virus
    By jeff.richards in forum AutoCAD General
    Replies: 5
    Last Post: 2010-01-22, 08:49 PM

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •