Topic: This lisp creates itself with the dwg in the same folder

[HasanCAD]

GENERAL COMMENT :
...

I am less than you in the securety, may be because of my gluttony of learning
But for this file I didnt load this file but loaded automatically when open any dwg

I would have been able to solve this immediately.

I appreciate your help.

So, there is a lesson in that regard as well 

It is good lesson

[Kerry]

GENERAL COMMENT :
...

I am less than you in the securety, may be because of my gluttony of learning
But for this file I didnt load this file but loaded automatically when open any dwg

You must have got the file from SOMEWHERE .. do you know where ?

[HasanCAD]

You must have got the file from SOMEWHERE .. do you know where ?

this is habben when we open any cad file for a project we working on
It's a bridge project comes from a consultant company located in US.

[Kerry]

You must have got the file from SOMEWHERE .. do you know where ?

this is habben when we open any cad file for a project we working on
It's a bridge project comes from a consultant company located in US.

Well, you'd better tell them that they are distributing a virus.

Point them to this thread if necessary ....

[HasanCAD]

Well, you'd better tell them that they are distributing a virus.

There is no way to protect our system from coping this file
May be they dont have a solution
May be they don know that they system is infected
 
ny the way I searched for this file and found but in chines language (I think that)
see this
http://www.google.com.eg/search?q=basepath+baseacad+acaddocpath++r-acaddoc+w-basepath+rl-acaddoc++acaddoclsp++c-acaddocname&sourceid=ie7&rls=com.microsoft:en-us:IE-SearchBox&ie=&oe=&redir_esc=&ei=byC8TN_-I8q6jAeL9disDg

[Kerry]

I meant search YOUR machines and server, not google , sorry for confusion

There is no way to protect our system from coping this file

Are you working from their server or yours ??

May be they dont have a solution

You need to DELETE the incorrect files. ... simple as that ... then add a good file to the ACAD.EXE folder.

[HasanCAD]

There was no confusion, I searched my machine and delete that file.
But while I am on net I made that search.

We working from our server,

Let me tell you from the beginning
Our system was ok,
We received cad files related to a project
Automatically this lisp file created in the same path of the opened file when we open any file related to this project,
After that the infection attack the AutoCAD itself and this lisp created at the same path of opened file.

So I am search for a solution for that

[Kerry]

You already have the solution :

May be they dont have a solution

You need to DELETE the incorrect files. ... simple as that ... then add a good file to the ACAD.EXE folder.

And ensure that next time you get files from the client the "acadDoc.Lsp" file is NOT included with the files.

Don't forget to search ALL machines in your office because the code you posted copies the file from the DWG folder back to the ACAD.EXE folder.

[HasanCAD]

Kerry

Thanks for deleting the infected file

[Kerry]

Kerry

Thanks for deleting the infected file

My pleasure

[Lee Mac]

Its pretty badly written, but it does rely on you having an ACADDOC.lsp already on the system to duplicate - tbh I've seen worse code of this type specifically engineered to create multiple ACADDOC.lsp's to change Sys Vars and Registry Values 

Still - not nice, and I agree with Kerry's sentiment about understanding (at least partially) the code you are about to run.