AL/Bursted-AS lsp virus causing long drawing opening times

[edezzie]

I have a problem with Autocad 2008 and a drawing called d2.dwg which seems to have the AL/Bursted-AS lsp virus in it and is causing long opening times for drawings it is xref'd into (eg d1.dwg).

d2.dwg was opened and saved in another computer abroad with a different version of autocad and the virus copied across.

Since then it is taking forever to open d1.dwg as it is stuck for 20mins trying to open the d2.dwg xref in it.

d2.dwg opens fine and quickly on its own.

If I restore an earlier version of d2.dwg (before virus in it), d1.dwg opens normally and quickly.

Deleting, auditing, recovering, and purging absolutley everything in d2.dwg does not resolve the issue.

The empty d2.dwg file is still ~300kb

Drawing a line in the empty d2.dwg file, copying it into a newly created empty dwg file called d3.dwg, deleting d2.dwg, and renaming d3.dwg -> d2.dwg will not solve the issue. d1.dwg still takes forever to open

The new d3.dwg jumps from 35kb to ~250kb after saving the new line when it should increase by no more than 1kb. This tells me the virus is being copied with the line.

A huge amount of work has been done on the d2.dwg file since it received the virus and I can't redraw all this work, and copying, wblocking, etc all will not work.

Is there any solution?

[Jay_B]

Have you seen This ?

[edezzie]

Thats helpful however I need to remove the virus from the dwg drawing file.

The lsp never executes in the drawing I think? as I have "Load acad.lsp with every drawing" unticked.

The issue for me is that if d2.dwg is opened directly or is accessed from another drawing as an xref, then the lsp virus file is created and for whatever reason in the latter scenario the creation of the lsp virus file takes 20 mins.

[Alfred.NESWADBA]

Hi,

I have never heard of a LISP-virus that is transfered within a DWG-file (at least I can't believe that).

So I guess you have one (at least one, may be more) files infected, files like ACAD.LSP or ACADDOC.LSP or ACADxxxxDOC.LSP (where xx stands for your version of AutoCAD, e.g. for 2008 so the filename is named ACAD2008DOC.LSP).

So either you run an automatic repair from antivirus-software vendors that can repair your system from that virus or you search for all files like ACAD*.LSP, delete them and do a repair install of AutoCAD.

Make sure that your search includes hidden- and system-folders.

- alfred -

[Jay_B]

I agree with Alfred, also the link to Symantec re: the topic states the following message:

Technical Details:

"It is important to note that the virus does not damage or modify the drawing files in any way."

[edezzie]

I cleaned my system and the lsp files of the virus lsps as you instructed and they were detected and deleted. Now the lsp files are no longer being created when I open or access the suspect file but I still have the long opening times.

Is there anything else that could be copying across with the line?

Attached is an example with 2 files. For these:

I cleaned all lsp's on my system, virus lsps were found and deleted.
I created two brand new dwgs and named them d1.dwg and d2.dwg
I copied a line from the suspect file into d2.dwg (its size increased from 35kb -> 276kb) and xref'd it into d1.dwg.
It takes 20 mins to open d1.dwg.

Thanks for your help.

[Jay_B]

If you aren't in the habit of doing so, I would clean out your temp folder.

Close all of your applications prior to deleting the temp files & delete everything in the following folder that it will let you delete.
C:\Users\brubble\AppData\Local\Temp (This is for Windows 7 temp folder location.) if your on XP it will be C:\Documents and Settings\your computer name\Local Settings\Temp\.
Reboot your computer.

[Alfred.NESWADBA · Accepted solution]

Hi,

that are not new drawings (at least not D2.DWG) based on a clean template, either you used one of your templates or you have any tools installed or you did copy objects from another drawing to the DWG1 that created a lot of annoations scales.

DWG2 has 1967 annotationscales ... and that makes the loadind of the XRef that slow!

Use command _-SCALELISTEDIT and use option _RESET to get rid of them (at least for D2.DWG).

- alfred -

[edezzie]

Thank you!!

That command worked. When I brought up the SCALELISTEDIT window

the following error came up:

************** Exception Text **************
System.IndexOutOfRangeException: Index was outside the bounds of the array.
   at Autodesk.AutoCAD.ApplicationServices.ScaleListHelpers.loadScaleList(String[] scaleStr, Double[] scaleNum, Double[] scaleDenom, Int32[] scaleCount)
   at Autodesk.AutoCAD.ScaleList.ScaleListForm.Read()
   at Autodesk.AutoCAD.ScaleList.ScaleListForm.restoreData(Boolean bResetIfNoData)
   at Autodesk.AutoCAD.ScaleList.ScaleListForm..ctor()
   at Autodesk.AutoCAD.ScaleList.Commands.ScaleListEditCmd()
   at AcMgCommandClass.InvokeWorker(AcMgCommandClass* , MethodInfo mi, Object commandObject, Boolean bLispFunction)
   at AcMgCommandClass.InvokeWorkerWithExceptionFilter(AcMgCommandClass* , MethodInfo mi, Object commandObject, Boolean bLispFunction)
   at AcMgCommandClass.Invoke(AcMgCommandClass* , gcroot<System::Reflection::MethodInfo ^>* mi, Boolean bLispFunction)
   at AcMgCommandClass.CommandThunk.Invoke(CommandThunk* )

 so I reset the scales in the command line via -SCALELISTEDIT

I guess it wasn't related to the virus after all.