Actually this is not a virus, it is a worm depending on autocad lisp routines. All it does is copying itself in every folder you open a drawing. I created a lisp routine to clean all the existences of the worm from lsp and mnl files located at the autocad support folders.

Update: I created a small program to clear this virus from your lisp files. Download LspCleaner here.

Follow these steps to get rid of this worm:

  1. Download the routine:

      acaddocfix_1.8.zip (1.1 KiB, 14,607 hits)

  2. Load the lisp file using APPLOAD command
  3. The lisp file will run automatically and it will clean all the existences of the worm in your support folders.
  4. Run an antivirus or a cleaner to get rid of “acaddoc.lsp” files. Normally cleaner routine installs a simple routine in your acad20XXdoc.lsp file which automatically clean those files but i recommend cleaning all the viruses with an anti-virus first. You can also download del-acaddoc.bat dos batch file to clean all your drives manually. Run this batch once and it will delete all acaddoc.lsp files on your system.

NOTE: If any of the infected files in your Autocad Support folders are READONLY the cleaner won’t be able to clean those files !!

WARNING: This routine will install a routine to delete “acaddoc.lsp” files. If you somehow use acaddoc.lsp files remove the following lines from your acad20xxdoc.lsp starting with:

(setq acaddocfix t)
;;; ^^ ACADDOCFIX STARTS HERE ^^


Please contact me if you see an error.
Cheers!

56 Responses to “How to clean acaddoc.lsp virus from your pc”

  1. [...] Acaddoc.lsp virüs temizleme lisp programı Şubat 9, 2010 | 5 Comments Tags: acaddoc, antivirus, AutoCAD, cleaner, Lisp, lsp, temizleme, virus. Share Hello there! If you are new here, you might want to subscribe to the RSS feed for updates on this topic.For english:How to clean acaddoc.lsp virus from your pc [...]

  2. Thanassis Silis says:

    Worked flawlessly in an office of 20 ppl and of AutoCAD & Civil 3D versions ranging from v2002 – v2010…

    acaddoc.lsp was not deleted automatically so I ran a search on each pc to delete it manually. That’s normal right?

    What’s not normal is that the antivirus (AVG free) didn’t raise any alarm for the worm, even though in a Microsoft site it is stated that AVG has categorized the worm:
    ‘ACAD/Bursted.B (AVG) ‘
    http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Virus%3AALisp%2FPassdoc.A

    Thanks again!

    • Oh cool, nice to know it works. And yes it doesn’t delete previously generated acaddoc.lsp files in case.
      This worm is a real trouble because it uses a really important file as host.
      Most of antiviruses don’t delete those files in case they have important user scripts.

  3. saeed says:

    thank you
    you make me so happy
    its perfect and you save my life because i’m tirred about this viruse
    you are my turkish Goooooooooood brother.

  4. Merhaba Metin!
    Cok Cok hemde cok tesekkurler. cok iyisin. tum problemlerimiz hall oldu.
    Ben ramin Irandan senden bir defa daha tesekkur ederim.
    Hoscakal.

  5. Makara says:

    Dear Brother.

    I m a victim of virus autcad too. I really need help. Of course, i have follow what u describe upper but the main hamper, it still work. I mean i can’t remove it from my pc.

  6. ankita says:

    hey thanks so much for the information im experiening the same problem. but can u help me with your 2nd step where doi locate the appload command? in autocad or in windows.. please help me out seen its gettin crazy in my laptop now

    • Just enter it to the command line “APPLOAD” and it will show you a dialog to locate the script. Alternatively you can put the fixer script to the support folder and type (load "acaddocfix_1.6") to load it without dialog.

  7. luai says:

    thank u veeeeeeeeeeeeery much….from the deeeep of my heart…thaaaanks alot body…

  8. th says:

    Thank you very much. It`s running perfectly. thank you!

  9. Subhash Gandha says:

    Thank u very much dear metin şaylan. I am relaxed due to your given solution. This virus (?) was embarrasing me since last 15 days. It blocks the network drive. All the files on my network were became read only and no editing/saving was possible form my PC to my network comouter. I have run your two files and the problem is solved.
    Thanks. Subhash (25th January, 2011.,India)

  10. Vitaliy says:

    Metin! Thank you very much! This virus made my AutoCAD very slow and each dwg was opened in new application…. It was terrible. But now it’s OK))).

  11. Selam Metin Saylan,
    thanks you for sharing the file to kill those worm. After 2 days feels like all memory and cpu resource sucked by uncertain things, I realize that acaddoc.lsp is the trouble maker. And then, I find your site.

    Again, Many thanks.
    greets from Bali

  12. Douby says:

    Hi Metin,

    Thanks for the help! The routine worked great for me. I had tried deleting all the infected files by myself but I couldn’t find them all, and you came to save the day.
    Keep up the good work!

    Cheers

  13. Peyman says:

    Hi Metin,
    I tried to use the lisp but there is an error ocurred while loading the lsp file.
    I ‘ll copy you the few last lines of the .lsp file with error warning.
    please let me know how i can fix the error.
    thanks

  14. Peyman says:

    sorry…i forgot to copy those lines,
    here is:
    ..
    ..
    ..
    (while (< lspn lspnum)
    (setq lspfilename (strcat support "\" (nth lspn lspfilelist)))
    (clearfile lspfilename bz)
    (setq lspn (1+ lspn))
    );while
    (princ)
    ; error: An error has occurred inside the *error* functionbad argument type:
    stringp nil

  15. heero says:

    Hi Metin Saylan

    Thank you so muccchhhhhh. This virus has been bothering me for months, making the computer hot every time it opens a file and it’s quite hard to find the cure until I found your website.
    You are a genius man. Once again, thankss!!

    Warm Regards from Bali

  16. Noel says:

    Metin,

    Great help, really save my day. This virus really bugging me for quiete some time now. There is also a virus called acad.fas. Its really a big help if you can find a solution for this.
    Thanks a lot from China

  17. rabia says:

    thank you so much :)
    i can’t believe i got rid of that!

  18. dody says:

    Thank you very much. i have searched many sites but it can’t resolve the problem> you can
    thanks again

  19. Strange says:

    Great JOB, Metin-bey!))
    I don’t know what that file do, was it harmful or did it anything else in AutoCAD work – I just wanted to say THANK YOU, PAL, it worked out and seems like no acaddoc.lsp file exist on my pc anymooooore)

    friendly hugs from Tajikistan, maaaan)

  20. Can Gönül says:

    çooookkkk teşekkür ederim…. sonda kurtuldum açılışta Esc tuşuna basmaktan….

  21. Jack says:

    try in command promt
    del acad.lsp /f/s/q/a

  22. sagar mehta says:

    thank you very much……..it worked
    i was tired of deleting .lsp files
    you ended my problem

  23. elie says:

    thanks man,i dont believe bitdefender 2012 could not solve my problem,and this routine solve it..thanks 1 more time

  24. Baris says:

    Metin, thank you for this tool very much. Does it also clean acad.lsp files which shows up everywhere?

  25. nikrooz says:

    Thank u much! teshakkur! :D

  26. Derek says:

    This .lsp file worked on one installation of Autocad 2011 but it crashes on autocad 2011 MEP.

  27. kimo says:

    i have acad.lsp file it copy it self eache time i open drawing and i can’t open cad directly i must open drawing to open autocad and i tied to use your solution but it didn’t work what should i do .
    thanks

  28. Tities Guritna says:

    It didn’t work, what should I do?
    I think it doesn’t matter for me about worm that shown when i open autoCAD, the main problem is I can’t use command “move” in my CAD, when I command move, the object is coppied…what should I do?

  29. ame says:

    it works bro… thanks a lot..

  30. Abraham says:

    Thank God for your life. It works!!!!!!

  31. Megan says:

    I cannot get AutoCAD to load at all, so I cannot use the APPLOAD command. Is there another method I can use?

  32. Gabbs says:

    Thank you very much!! you’re a genius! :D

  33. Peter Fisher says:

    hello will your script work on an lisp virus that changes the default AutoCAD 2009 menu, and affects how hatch patterns display and affects plotting also?

  34. pallavi says:

    thanx a lot!it really helped me

  35. mahmoud says:

    Thanks Saeed, you are welcome
    my name wezooooooo

  36. flish says:

    Can you tell me where can I find this APPLOAD command or where to enter it?

  37. Mpr says:

    flish,
    Just open autocad and type appload .
    Then navigate to wherever you saved the script file.

  38. gf says:

    Can you tell me where can I find this APPLOAD command or where to enter it?

  39. Phil says:

    Thanks from Italy!! your programs are so cool and run perfectly!!! thx for all!!! have a nice day and we are with you in this “revolution” STRONGER THAN ALL!!!

  40. ali says:

    çok çok teşekkür ederim Allah razı olsun. Büyük bir sorunuma çare oldunuz.

  41. setyawanws says:

    Thank much Metin Saylan. It’s really help me. May I re-post this posting on my blog in indonesian language? For share n help indonesian CAD user, who get problem cause acaddoc.lsp

  42. caduser says:

    I can’t manage to unzip acaddocfix version 1.8. I had no problem with version 1.7, I think that the worm was killed, I ran the commands in the acaddocfix_1.7.lsp file on the autocad command prompt and I don’t get acaddoc.lsp files created in each drawing folder. However, version 1.8 zip file is recognized as a vitus (not the content, the zip file). Is this normal? Is there a difference between versions 1.7 and 1.8? Thank you in advance.

    • Metin Şaylan says:

      They do the same thing, I just removed the portion that added auto cleaner to acad.lsp. So that once virus is removed it no longer occupies your pc. I suggest using LispCleaner application instead of lisp files.

  43. Johanes says:

    You really help me a lot!!!!! It used to take minutes just to open one CAD files because of all the routines it load. But now it’s instantly open…..THANK YOU…..

Leave a Reply

Metin Şaylan is proudly powered by WordPress and SUR