.FAS files are infected

[Anonymous]

Every day we are receiving multiple incident regarding .fas files been infected by virus.

[cadffm]

Wow, we will need a lot of time to read all of your informations 😉

What are the names of that files?

What product you talk about?

It should be easy to solver the problem, but only if we would sitting in front of the PC.

You yould start an AutoDesk TELEPHONE support case!

https://knowledge.autodesk.com/customer-service/account-management/users-software/support-options/ph...

Giving you instructions to remove the problem about the forum is hard.

[pendean]

Did you just install or update your anti-virus software?

[maratovich]

95% of antiviruses work only on the white list, there is no file analysis.
Your files are not in the whitelist, so the antivirus is lying that it is a virus.
You need to send the file to the anti-virus site for verification.
After that, the antivirus will say that the files are clean and add to the white list. You update the antivirus and everything will work fine.

[cadffm]

You should use 95% of the anti-vir software what i know(and the rest of the world).

They not work with only a whitelist in standard setup ootb.

But this is not the point here, because acad not replicate erased files..

So it seems the TO really have a "virus".

What i understood:

He erased n files, after Acad restart the files appears again.

Or in folder where a file was opend or saved.

Did you unstand the post different to me?

The TO would find help pages about known variant of software like this, but he ask in the forum and so i guess he need more help as a simple link to one of the akn pages.

Thats why i prefer the telephone support.

[cadffm]

@Anonymous 

a) Do you nothing or

b) did you erase the files (or move them in quarantine)

and they come back?

If a) ignore my answers.

[Anonymous]

acad.fas file keeps infected and antivirus keeps detecting the infection. Please check the file name and MD5 value. Mose of antivirus detected the file as malicious.

MD5

655cad31000dac2ddaa8952094d7f839

aa90dc46799ef6c27f4192711f414935

File names

• acad.fas

https://www.virustotal.com/#/file/6040eef9d70a2e9238b46b2ffb473ab8e85c184acdbdf5499c74102c14562d6f/d...

https://www.virustotal.com/#/file/fc5ab5d6d18c76d741e15cec67357fab8a4390056842feccfa57bea445250ea2/d...

I need to know if these files are necessary for AUTOCAD application or we can block the files from creating on workstation?

Will this affected the functionality of the application if we block the acad.fad?

[Anonymous]

https://www.virustotal.com/#/file/fc5ab5d6d18c76d741e15cec67357fab8a4390056842feccfa57bea445250ea2/d...

Almost most antivirus are marked as malicious. i do not think all antivirus has not analyzed the files and marking as malicious.

[maratovich]

Have you sent to check on the site antivirus?
Give me your file, I'll send it myself.

[Anonymous]

files are available in the site you can download and verify yourself.

[maratovich]

impossible to download.

[JTBWorld]

Where are these .FAS files coming from?

Have you created them yourself by compiling to FAS? If that's the case it is most possibly a so called false positive so you need to white list. If you have not created themself you need to be more cautious and contact the source of the files. It could be bad .FAS files like described here and here.

[Anonymous]

Please check the attachment for sample

[Anonymous]

Any update on the file submitted.

[JTBWorld]

You did not reply to the questions on the source of the fas file. If you uploaded the fas file only an Antivirus software can check it. Try VirusTotal online. 

[Anonymous]

When a drawing is opened from a server, it may create some or all of the following files in same folder. I think the source is form AUTOCAD application. Please check the link below.

https://knowledge.autodesk.com/support/autocad/troubleshooting/caas/sfdcarticles/sfdcarticles/How-to...

[JTBWorld]

AutoCAD does not create these so my guess is you are infected. 

[Anonymous]

Yes, As per the document it says below listed files will be created by AUTOCAD application.

acad.lsp
acaddoc.lsp
acad.lsp
acad.fas
acad.vlx
acaddoc.fas
bankup.bak
beifen.bak

Can you check and let us know. If required we will create a rule to block the file been created but need a conformation this action will be affected the drawing and the application.

[JTBWorld]

Only as part of the installation to the installation folder locations. And not in drawing folders or the like. 

[cadffm]

...NOT by autocad application.

Read the linked page again and try to solve your problem : https://knowledge.autodesk.com/support/autocad/troubleshooting/caas/sfdcarticles/sfdcarticles/How-to...

Or do what i wrote 5 days ago: Start a support case (telephone support) if are are not able to help yourself.