AutoCAD Electrical Forum
Welcome to Autodesk’s AutoCAD Electrical Forums. Share your knowledge, ask questions, and explore popular AutoCAD Electrical topics.
cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

AutoCAD Electrical 2013 Possible Virus - acad.lsp

8 REPLIES 8
Reply
Message 1 of 9
dstrood
1857 Views, 8 Replies

AutoCAD Electrical 2013 Possible Virus - acad.lsp

We are currently having an issue with AutoCAD Electrical 2013. When we open a drawing, something happens and a file ("acad.lsp") is added to the folder where the drawing resides. I am not well versed in lsp language, however, upon opening the acad.lsp file in Notepad, it appears to be writing something to the registry. It also appears that it is not restricted to one computer, but multiple users are having the same issue. Has anyone come across this? Is it a virus? If it is a virus, what does the virus do or attempt to do? Is there a solution? I ran our antivirus program doing a deep scan on one computer, but the antivirus did not indicate a virus.

8 REPLIES 8
Message 2 of 9
rhesusminus
in reply to: dstrood

Can you copy/paste the contents of this newly created acad.lsp file here?

Strange behaviour indeed....

 


Trond Hasse Lie
AutoCAD Electrical and EPLAN expert
Ctrl Alt El
Please select "Accept Solution" if this post answers your question. 'Likes' won't hurt either. 😉
Message 3 of 9
vladop
in reply to: dstrood
Message 4 of 9
dstrood
in reply to: dstrood

Attached is the lsp file that the worm, virus or whatever it is has created. Vladimir: What do I do with the KillWorm.zip file?

Message 5 of 9
vladop
in reply to: dstrood

Message 6 of 9
dstrood
in reply to: dstrood

I have followed the steps as outlined in the article: "How to detect and remove the Acad.vlx virus" http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112&id=13717811&linkID=9240617. Unfortunately, it doesn't appear to have worked on my computer. The virus/worm/whatever still creates the "acad.lsp" file in whatever sub-folder from which I am opening drawings. In steps 3 and 4 of the article, it says to delete a line of code (if found) in the acetauto.lsp, ai_utils.lsp and acad.mnl files. None of the files I opened contained the line of code AutoDesk recommends removing. Any other suggestions?

Message 7 of 9
vladop
in reply to: dstrood

Here is post #8 that explains how to use killworm:

 

To get rid of the virus, Follow these instructions:
1- Download http://www.irancad.com/irancadsd_content/media/image/2011/01/121_orig.zip
2- Decompress the file.
3- You will find a file named: KillWorm.fas.
4- Enter AutoCAD.
5- Issue "APPLOAD" command.
6- You see a dialog box titled: Load/Unload Applications.
7- Locate KillWorm.fas in the area above.
8- Press Load botton.
9- Press Close botton.
10- An alert box opens, showing that you must enter "KW" to run the command.
11- Issue "KW".
12- At the prompt: "Select option [Active/Passive/ALL/?]: " enter:
Active to search, find, then kill the virus if it is active.
Passive to search, find, then kill the virus even if it is not currently active.
ALL to search all local drives and folders.
? to see a brief help about the command.

 

This program not only kills the virus, but also vaccines all LSP and MNL files from future comming viruses.

Message 8 of 9
mscharapenko
in reply to: vladop

When I run the KW command, selecting ALL, there is an error message:  Data\"; error: file pattern specification too long

Message 9 of 9
vladop
in reply to: mscharapenko

You should find folders/files with long paths and make them shorter than, I think, 255 characters.

To find those files you can use attached software.

Can't find what you're looking for? Ask the community or share your knowledge.

Post to forums  

Autodesk Design & Make Report

”Boost