topic Re: AUTOCAD LISP MALWARE in AutoCAD Forum

AUTOCAD LISP MALWARE

allwinaugustine — Mon, 20 Mar 2017 11:41:15 GMT

Hi friends,

I am experiencing an issue with my autocad2013.
it creates an 'acad.lsp' and 'acad.err' file.
Whenever i open a .dwg file, it sets my zoomfactor=12. Some other variables also changed.
I tried to delete it by following some instructions in autocad forum but it returns back again after .
content of lsp file is attached as screen shot.plzz help

Re: AUTOCAD LISP MALWARE

chriscowgill7373 — Mon, 20 Mar 2017 11:47:15 GMT

Here is what the AKN has to say about it:

https://knowledge.autodesk.com/support/autocad/troubleshooting/caas/sfdcarticles/sfdcarticles/How-to-remove-fas-and-lsp-virus-from-a-server.html

it sounds like it is a lengthy process and may not be completed in a single iteration.

since acad.lsp is a user created file, It would be safe (unless your company actually uses it) to delete any and all instances of it that you find, whether in drawing folders, or on your local harddrive

Re: AUTOCAD LISP MALWARE

allwinaugustine — Mon, 20 Mar 2017 11:55:21 GMT

Hi AKN,

I tried to delete it from drawing folder, but it comes back every time i
open any dwg file.
Its difficult to delete every time and from every folder as i have more
than 100 files to manage.
I think there might be a permanent solution for it.

--
*Best Regards,*
*Allwin M.A.*

Re: AUTOCAD LISP MALWARE

Alfred.NESWADBA — Mon, 20 Mar 2017 11:55:31 GMT

Hi,

it also changed the ACAD.MNL file, so check also that file.

Whenever a filename is not written as direct letters I guess it's a bit strange ;(

- alfred -

Re: AUTOCAD LISP MALWARE

rkmcswain — Mon, 20 Mar 2017 12:01:06 GMT

What @chriscowgill7373 said. >>>> Run a scan and delete ALL instances of this file found on your servers and client PCs.

Any other hack/workaround will just end up costing you more time.

Do you know where this problem originated? If not, you are subject to let it happen again.

Re: AUTOCAD LISP MALWARE

allwinaugustine — Mon, 20 Mar 2017 12:01:45 GMT

Hi,

I checked acad.mnl file in my support folder.

But i couldn't find initiating command for acad.lsp. please find attached
screen shot.

--
*Best Regards,*
*Allwin M.A.*

Re: AUTOCAD LISP MALWARE

allwinaugustine — Mon, 20 Mar 2017 12:01:45 GMT

Hi,

I checked acad.mnl file in my support folder.

But i couldn't find initiating command for acad.lsp. please find attached
screen shot.

--
*Best Regards,*
*Allwin M.A.*

Re: AUTOCAD LISP MALWARE

chriscowgill7373 — Mon, 20 Mar 2017 12:04:51 GMT

it doesnt sound like you are searching for all instances per the AKN article:

Disconnect the machine from network.
Delete acad.fas and acaddoc.fas from C:\Users\<user>\AppData\Roaming\Autodesk\AutoCAD 20xx\Rxx.x\enu\Support.
Delete acad.mnl from C:\Users\<user>\AppData\Roaming\Autodesk\AutoCAD 20xx\Rxx.x\enu\Support.
Delete dwg.exe from C:\Users\<user>\AppData\Roaming\Autodesk\AutoCAD 20xx\Rxx.x\enu\Support.
Search for the above listed files on local machines and servers and delete them. Open a DWG file and check if any of the files are recreated in \Support folder. If the files return, then continue searching until all files have been removed.