We are currently having an issue with AutoCAD Electrical 2013. When we open a drawing, something happens and a file ("acad.lsp") is added to the folder where the drawing resides. I am not well versed in lsp language, however, upon opening the acad.lsp file in Notepad, it appears to be writing something to the registry. It also appears that it is not restricted to one computer, but multiple users are having the same issue. Has anyone come across this? Is it a virus? If it is a virus, what does the virus do or attempt to do? Is there a solution? I ran our antivirus program doing a deep scan on one computer, but the antivirus did not indicate a virus.
Can you copy/paste the contents of this newly created acad.lsp file here?
Strange behaviour indeed....
Here are links about this problem:
http://cadtips.cadalyst.com/lisp-code-modules/killworm (see attachment for files)
http://metinsaylan.com/819/how-to-clean-acaddoc-lsp-virus-from-your-pc/
Regards,
Vladimir
Attached is the lsp file that the worm, virus or whatever it is has created. Vladimir: What do I do with the KillWorm.zip file?
I have followed the steps as outlined in the article: "How to detect and remove the Acad.vlx virus" http://usa.autodesk.com/adsk/servlet/ps/dl/item?siteID=123112&id=13717811&linkID=9240617. Unfortunately, it doesn't appear to have worked on my computer. The virus/worm/whatever still creates the "acad.lsp" file in whatever sub-folder from which I am opening drawings. In steps 3 and 4 of the article, it says to delete a line of code (if found) in the acetauto.lsp, ai_utils.lsp and acad.mnl files. None of the files I opened contained the line of code AutoDesk recommends removing. Any other suggestions?
Here is post #8 that explains how to use killworm:
To get rid of the virus, Follow these instructions:
1- Download http://www.irancad.com/irancadsd_content/media/image/2011/01/121_orig.zip
2- Decompress the file.
3- You will find a file named: KillWorm.fas.
4- Enter AutoCAD.
5- Issue "APPLOAD" command.
6- You see a dialog box titled: Load/Unload Applications.
7- Locate KillWorm.fas in the area above.
8- Press Load botton.
9- Press Close botton.
10- An alert box opens, showing that you must enter "KW" to run the command.
11- Issue "KW".
12- At the prompt: "Select option [Active/Passive/ALL/?]: " enter:
Active to search, find, then kill the virus if it is active.
Passive to search, find, then kill the virus even if it is not currently active.
ALL to search all local drives and folders.
? to see a brief help about the command.
This program not only kills the virus, but also vaccines all LSP and MNL files from future comming viruses.
When I run the KW command, selecting ALL, there is an error message: Data\"; error: file pattern specification too long
You should find folders/files with long paths and make them shorter than, I think, 255 characters.
To find those files you can use attached software.