Actually this is not a virus, it is a worm depending on autocad lisp routines. All it does is copying itself in every folder you open a drawing. I created a lisp routine to clean all the existences of the worm from lsp and mnl files located at the autocad support folders.
Follow these steps to get rid of this worm:
- Download the routine:
acaddocfix_1.6.lsp (8,7 KiB, 2.077 hit) - Load the lisp file using APPLOAD command
- The lisp file will run automatically and it will clean all the existences of the worm in your support folders.
- Run an antivirus or a cleaner to get rid of “acaddoc.lsp” files. Normally cleaner routine installs a simple routine in your acad20XXdoc.lsp file which automatically clean those files but i recommend cleaning all the viruses with an anti-virus first. You can also download del-acaddoc.bat dos batch file to clean all your drives manually. Run this batch once and it will delete all acaddoc.lsp files on your system.
NOTE: If any of the infected files in your Autocad Support folders are READONLY the cleaner won’t be able to clean those files !!
WARNING: This routine will install a routine to delete “acaddoc.lsp” files. If you somehow use acaddoc.lsp files remove the following lines from your acad20xxdoc.lsp starting with:
(setq acaddocfix t) ;;; ^^ ACADDOCFIX STARTS HERE ^^
Please contact me if you see an error.
Cheers!
Merhabalar, Ben Metin Şaylan. 27 yaşındayım. Gemi İnşa Mühendisiyim. Istanbul'da yaşıyorum ve şu anda Yeni Tip Karakol Botu projesinde tekne tasarım şefi olarak çalışıyorum. Ayrıca hobi olarak web tasarımı ve programlama ile ilgileniyorum.
Pingback: Acaddoc.lsp virüs temizleme lisp programı | Metin Şaylan
Worked flawlessly in an office of 20 ppl and of AutoCAD & Civil 3D versions ranging from v2002 – v2010…
acaddoc.lsp was not deleted automatically so I ran a search on each pc to delete it manually. That’s normal right?
What’s not normal is that the antivirus (AVG free) didn’t raise any alarm for the worm, even though in a Microsoft site it is stated that AVG has categorized the worm:
‘ACAD/Bursted.B (AVG) ‘
http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Virus%3AALisp%2FPassdoc.A
Thanks again!
Oh cool, nice to know it works. And yes it doesn’t delete previously generated acaddoc.lsp files in case.
This worm is a real trouble because it uses a really important file as host.
Most of antiviruses don’t delete those files in case they have important user scripts.
thank you
you make me so happy
its perfect and you save my life because i’m tirred about this viruse
you are my turkish Goooooooooood brother.
Thanks Saeed, you are welcome :)
Merhaba Metin!
Cok Cok hemde cok tesekkurler. cok iyisin. tum problemlerimiz hall oldu.
Ben ramin Irandan senden bir defa daha tesekkur ederim.
Hoscakal.
Merhaba Ramin, programin isinize yaramasina sevindim.
Yorumun icin tesekkürler :)