AUTOCAD LISP MALWARE

[allwinaugustine]

Hi friends,

I am experiencing an issue with my autocad2013.
it creates an 'acad.lsp' and 'acad.err' file.
Whenever i open a .dwg file, it sets my zoomfactor=12. Some other variables also changed.
I tried to delete it by following some instructions in autocad forum but it returns back again after .
content of lsp file is attached as screen shot.plzz help

[chriscowgill7373]

Here is what the AKN has to say about it:

https://knowledge.autodesk.com/support/autocad/troubleshooting/caas/sfdcarticles/sfdcarticles/How-to...

it sounds like it is a lengthy process and may not be completed in a single iteration.

since acad.lsp is  a user created file, It would be safe (unless your company actually uses it) to delete any and all instances of it that you find, whether in drawing folders, or on your local harddrive

[allwinaugustine]

Hi AKN,

I tried to delete it from drawing folder, but it comes back every time i
open any dwg file.
Its difficult to delete every time and from every folder as i have more
than 100 files to manage.
I think there might be a permanent solution for it.

--
*Best Regards,*
*Allwin M.A.*

[Alfred.NESWADBA]

Hi,

it also changed the ACAD.MNL file, so check also that file.

Whenever a filename is not written as direct letters I guess it's a bit strange ;(

- alfred -

[rkmcswain]

What @chriscowgill7373 said. >>>> Run a scan and delete ALL instances of this file found on your servers and client PCs.

Any other hack/workaround will just end up costing you more time.

Do you know where this problem originated? If not, you are subject to let it happen again.

[allwinaugustine]

Hi,

I checked acad.mnl file in my support folder.

But i couldn't find initiating command for acad.lsp. please find attached
screen shot.

--
*Best Regards,*
*Allwin M.A.*

[allwinaugustine]

Hi,

I checked acad.mnl file in my support folder.

But i couldn't find initiating command for acad.lsp. please find attached
screen shot.

--
*Best Regards,*
*Allwin M.A.*

[chriscowgill7373]

it doesnt sound like you are searching for all instances per the AKN article:

1. Disconnect the machine from network. 
2. Delete acad.fas and acaddoc.fas from C:\Users\<user>\AppData\Roaming\Autodesk\AutoCAD 20xx\Rxx.x\enu\Support.
3. Delete acad.mnl from C:\Users\<user>\AppData\Roaming\Autodesk\AutoCAD 20xx\Rxx.x\enu\Support.
4. Delete dwg.exe from C:\Users\<user>\AppData\Roaming\Autodesk\AutoCAD 20xx\Rxx.x\enu\Support.
5. Search for the above listed files on local machines and servers and delete them. Open a DWG file and check if any of the files are recreated in \Support folder. If the files return, then continue searching until all files have been removed.