How to clean acaddoc.lsp virus from your pc

This article is obsolete. Check our lisp removal software Lisp Cleaner for a better and easier solution.

[note]Türkçesi: Acaddoc.lsp virüs temizleme lisp programı[/note]

Actually acaddoc.lsp is not a virus, it is a worm depending on autocad lisp routines. All it does is copying itself in every folder you open a drawing. I created a lisp routine to clean all the existences of the worm from lsp and mnl files located at the autocad support folders.

Follow these steps to get rid of this worm:

  1. Download the routine:
    [warning]Lisp file is removed. Please use Lisp Cleaner to get rid of this worm.[/warning]
  2. Load the lisp file using APPLOAD command
  3. The lisp file will run automatically and it will clean all the existences of the worm in your support folders.
  4. Run an antivirus or a cleaner to get rid of “acaddoc.lsp” files. Normally cleaner routine installs a simple routine in your acad20XXdoc.lsp file which automatically clean those files but i recommend cleaning all the viruses with an anti-virus first. You can also download del-acaddoc.bat (link removed) dos batch file to clean all your drives manually. Run this batch once and it will delete all acaddoc.lsp files on your system.

[note]NOTE: If any of the infected files in your Autocad Support folders are READONLY the cleaner won’t be able to clean those files !![/note]
[warning]WARNING: This routine will install a routine to delete “acaddoc.lsp” files. If you somehow use acaddoc.lsp files remove the following lines from your acad20xxdoc.lsp starting with:

(setq acaddocfix t)
;;; ^^ ACADDOCFIX STARTS HERE ^^

[/warning]
Please contact me if you see an error.
Cheers!

59 thoughts on “How to clean acaddoc.lsp virus from your pc”

  1. Worked flawlessly in an office of 20 ppl and of AutoCAD & Civil 3D versions ranging from v2002 – v2010…

    acaddoc.lsp was not deleted automatically so I ran a search on each pc to delete it manually. That’s normal right?

    What’s not normal is that the antivirus (AVG free) didn’t raise any alarm for the worm, even though in a Microsoft site it is stated that AVG has categorized the worm:
    ‘ACAD/Bursted.B (AVG) ‘
    http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Virus%3AALisp%2FPassdoc.A

    Thanks again!

    1. Oh cool, nice to know it works. And yes it doesn’t delete previously generated acaddoc.lsp files in case.
      This worm is a real trouble because it uses a really important file as host.
      Most of antiviruses don’t delete those files in case they have important user scripts.

  2. thank you
    you make me so happy
    its perfect and you save my life because i’m tirred about this viruse
    you are my turkish Goooooooooood brother.

  3. Dear Brother.

    I m a victim of virus autcad too. I really need help. Of course, i have follow what u describe upper but the main hamper, it still work. I mean i can’t remove it from my pc.

  4. hey thanks so much for the information im experiening the same problem. but can u help me with your 2nd step where doi locate the appload command? in autocad or in windows.. please help me out seen its gettin crazy in my laptop now

    1. Just enter it to the command line “APPLOAD” and it will show you a dialog to locate the script. Alternatively you can put the fixer script to the support folder and type (load "acaddocfix_1.6") to load it without dialog.

  5. Thank u very much dear metin şaylan. I am relaxed due to your given solution. This virus (?) was embarrasing me since last 15 days. It blocks the network drive. All the files on my network were became read only and no editing/saving was possible form my PC to my network comouter. I have run your two files and the problem is solved.
    Thanks. Subhash (25th January, 2011.,India)

  6. Metin! Thank you very much! This virus made my AutoCAD very slow and each dwg was opened in new application…. It was terrible. But now it’s OK))).

  7. Selam Metin Saylan,
    thanks you for sharing the file to kill those worm. After 2 days feels like all memory and cpu resource sucked by uncertain things, I realize that acaddoc.lsp is the trouble maker. And then, I find your site.

    Again, Many thanks.
    greets from Bali

  8. Hi Metin,

    Thanks for the help! The routine worked great for me. I had tried deleting all the infected files by myself but I couldn’t find them all, and you came to save the day.
    Keep up the good work!

    Cheers

  9. Hi Metin,
    I tried to use the lisp but there is an error ocurred while loading the lsp file.
    I ‘ll copy you the few last lines of the .lsp file with error warning.
    please let me know how i can fix the error.
    thanks

  10. sorry…i forgot to copy those lines,
    here is:
    ..
    ..
    ..
    (while (< lspn lspnum)
    (setq lspfilename (strcat support "\" (nth lspn lspfilelist)))
    (clearfile lspfilename bz)
    (setq lspn (1+ lspn))
    );while
    (princ)
    ; error: An error has occurred inside the *error* functionbad argument type:
    stringp nil

  11. Hi Metin Saylan

    Thank you so muccchhhhhh. This virus has been bothering me for months, making the computer hot every time it opens a file and it’s quite hard to find the cure until I found your website.
    You are a genius man. Once again, thankss!!

    Warm Regards from Bali

  12. Metin,

    Great help, really save my day. This virus really bugging me for quiete some time now. There is also a virus called acad.fas. Its really a big help if you can find a solution for this.
    Thanks a lot from China

  13. Great JOB, Metin-bey!))
    I don’t know what that file do, was it harmful or did it anything else in AutoCAD work – I just wanted to say THANK YOU, PAL, it worked out and seems like no acaddoc.lsp file exist on my pc anymooooore)

    friendly hugs from Tajikistan, maaaan)

  14. i have acad.lsp file it copy it self eache time i open drawing and i can’t open cad directly i must open drawing to open autocad and i tied to use your solution but it didn’t work what should i do .
    thanks

  15. It didn’t work, what should I do?
    I think it doesn’t matter for me about worm that shown when i open autoCAD, the main problem is I can’t use command “move” in my CAD, when I command move, the object is coppied…what should I do?

  16. Thanks from Italy!! your programs are so cool and run perfectly!!! thx for all!!! have a nice day and we are with you in this “revolution” STRONGER THAN ALL!!!

  17. Thank much Metin Saylan. It’s really help me. May I re-post this posting on my blog in indonesian language? For share n help indonesian CAD user, who get problem cause acaddoc.lsp

  18. I can’t manage to unzip acaddocfix version 1.8. I had no problem with version 1.7, I think that the worm was killed, I ran the commands in the acaddocfix_1.7.lsp file on the autocad command prompt and I don’t get acaddoc.lsp files created in each drawing folder. However, version 1.8 zip file is recognized as a vitus (not the content, the zip file). Is this normal? Is there a difference between versions 1.7 and 1.8? Thank you in advance.

    1. They do the same thing, I just removed the portion that added auto cleaner to acad.lsp. So that once virus is removed it no longer occupies your pc. I suggest using LispCleaner application instead of lisp files.

  19. You really help me a lot!!!!! It used to take minutes just to open one CAD files because of all the routines it load. But now it’s instantly open…..THANK YOU…..

  20. Hi Metin Şaylan

    I loaded the routine, but the acaddoc.lsp archives still appears. I run your lsp cleaner and all the acaddoc.lsp archive was deleting. So what i did wrong??

    THX from México

    1. You can find cleaner routine searching for acaddocfix on internet, but i advice using LspCleaner which is a better alternative, because it searches all folders. Cleaner routine only cleans current folder of the drawing.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>