As I mentioned in my last post, I had some reservations about the code provided by Autodesk to deal with suspect acad.vlx and logo.gif files. Based on a suggestion from Jimmy Bergmark, I have written my own, safer version which you can download here: clean_virus_safe.lsp.

The comments at the top of the clean_virus_safe.lsp file explain what to do with it, but I will reproduce some of the relevant points here.

• Purpose: Checks for existence of acad.vlx and logo.gif files, which are associated with virus AL/Logo-A, also known as ACAD/Unexplode, ACAD/Agent.A or ACM_UNEXPLODE.B. Written as a safer alternative to Autodesk’s code which deletes suspect files without prior warning. This code renames the files instead.
• Legal: Provided as-is with no warranty whatsoever, use at own risk. May be distributed freely.
• Usage: Append the contents of this file into a startup LISP file (e.g. acaddoc.lsp in your search path – create such a file if it does not exist). Autodesk’s suggestion to modify the acad20xx.lsp file should not be followed: this is bad practice. The acad20xx.lsp file is Autodesk’s file and any modifications you make to it are likely to be lost when updates and patches are applied.
• Effects: Any and all files named acad.vlx and logo.gif and located in AutoCAD’s search path will be renamed, e.g. “acad.vlx” will become “[Suspected Virus] acad.vlx0”. The name will end in a number starting with 0. If other suspect files are later found in the same location, those files will be renamed to end with 1, 2, 3 and so on.

I don’t have a copy of the actual virus, and would like to get hold of one with a view to possibly improving this code. If you have a copy, I would be grateful if you could contact me so I can dissect it.