virus or trojen embedded auto cad file

[Nel_Zelpher]

About two weeks ago my company had a virus outbreak.  At that time I decided to look at some of our AutoCAD files that were behaving strangely.  Looking at the files with note pad I noticed that some of the files had a large amount of repeating code on the end of them:

  ‑RTVSPropertyOp30F  f  ‑RTVSPropertyOp31F  f  ‑RTVSPropertyOp32F  @`ÁÀÌ?I†F

---

Sþ†@  ÁÂ$

---

/

---

  f  ‑RTVSPropertyOp0F  f  ‑RTVSPropertyOp1F  f  ‑RTVSPropertyOp2F  f  ‑RTVSPropertyOp3F  f  ‑RTVSPropertyOp4F  f  ‑RTVSPropertyOp5F  f  ‑RTVSPropertyOp6F  f  ‑RTVSPropertyOp7F  f  ‑RTVSPropertyOp8F  f  ‑RTVSPropertyOp9F  f  ‑RTVSPropertyOp10F  f  ‑

At that time most of the other files did not have this code at the end of them.  Now it is difficult to find a file that does not have the code at the end of it. 

It has sent me some back up files, and I have compared them.  The backup files do not have this code. 

I am looking for someone who can tell me if our AutoCAD files are infected, or if this is normal...

at this time I have decided not to attach a file, to this conversation

[Icemanau]

Take a look at this thread. It may be of help.

http://forums.autodesk.com/t5/AutoCAD-Electrical/AutoCAD-Electrical-2013-Possible-Virus-acad-lsp/m-p...

Regards Brad

[Nel_Zelpher]

I have followed this advice for killing a worm... the software says worm not detected aborting action...

It does not appear to be that particular worm.  if that is the case.

I guess I will need to post a file and just have somone look at it. 

attached to this comment are two files... the first starting with ~ is an original file from back up without the strange code at the end of it.

The second is the same file as it exists after sitting in the network for a period of time... it does have the strange code at the end of it.

Both files were created with autocad electrical 2011

any one who can please look at the files and tell us if anything is strange. 

other comments: I have knotised that commands seem to be repeating on auto cad:

1.  do a batch print, walk away to pick up the print and when I return, the batch print command has reactivated.

2.  select a group of objects, right click try to find a command, but specify opposit corner flashes across the comand bar and previus selection is lost...

[mathalekar]

We have passed your issue to concerned team.

[raviP_ADSK]

Can you repost the file starting with ~? The one you uploaded is not a valid drawing file.

[Nel_Zelpher]

This file is the backup file.

[raviP_ADSK]

Can you repost the file "~02 CHARMS 96 DRAWING INDEX.dwg"?The one you posted above is not a valid drawing file. Looks like it somehow got corrupted during posting.

[Nel_Zelpher]

It got corrupted again?

[Icemanau]

Rpothine said the file they downloaded was not a valid ACAD file.

As the file is a BACKUP, you may need to restore it to a normal file before you post it.

You may may also need to rename the file to remove the tilde (~) character from the file name.

Regards Brad

[Nel_Zelpher · Accepted solution]

This ishue has been resolved... We deleted the correct files because they were sensitive.

That strange code at the end is actually because of differences in 2000 and 2012 file formats.

Sent from my iPhone