Expert: Bill DeShawn - 12/21/2008

Question
Hi ,...
i'm using autocad 2008 and the program was great unless i get adrawing from a friend of me and the every time i open the program or any new drawing amessage appears with strange words and shapes just this litters i understand (QQ:252545152)please tel me what to do.

Answer
Wael:
According to my research it appears that you are using Chinese AutoCAD and that your AutoCAD, like many other AutoCAD Chinese installations, has been been hit hard by the ALS_CHENGWA.A malware program.  Also, according to my research there is a solution.  The solution can be found here:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=ALS%5FCHENGWA%2E...

I will not be able to walk you through this problem, but suffice it to say that you accidentally downloaded a trojan that copied some files to your computer and created some registry entries that caused the creating of a LISP file: ACAD.FAS to be copied to your Support File Search Path, thereby undefining the circle and move commands and replacing them with their own versions of the commands.  When typing a command at the command line, and if it does not do what you expect, use a . (dot) in front of the command.  You can use the English version of the command, too, if you put an underscore in front of the commnand thus:
_.circle
or
_.move

If this works, but the normal commands without the dot do not work, then it is very likely a LISP routine has redefined the command.  In this case the people at Trend Micro seem to have discovered the problem.  Hopefully you can find a solution with them.

The good thing about all this is that ACAD.fas should be easy to find and delete.  The fact that it is a FAS file instead of LSP is a sign that it is probably perfectly OK to delete it, because most people that use ACAD.LSP, won't be affected by it after deleting the infection.  If they had an ACAD.LSP file, it probably is still unchanged.  If there is an ACAD.FAS present, it will take priority on loading over ACAD.LSP.  If you delete ACAD.FAS, ACAD.LSP will load normally, provided ALS_CHENGWA.A didn't delete it when it installed ACAD.FAS.    

You could try to test all this by turning off ACADLSPASDOC (setting it to 0).  If it everything works better it could be a sign that all I was telling you is true.  But if something in the malware rewrites registry settings when you start AutoCAD, then it might not make any difference.

In the future, be very careful of emails that you read, files that you download, etc.  Use Google.com or your favorite search engine to seek information about the file you are about to download to see whether or not you are getting what you expect.  Get recommendations about downloading programs from multiple sources before clicking on the download link.


Keep in touch
Bill DeShawn
http://my.sterling.net/~bdeshawn