Home / malware

PDF

Worm:ALisp/Copicad.A

First posted on 12 January 2012.
Source: Microsoft

Aliases :

Worm:ALisp/Copicad.A is also known as Virus.Acad.Pasdoc.n (Kaspersky), ALS.Bursted.B (Symantec).

Explanation :

Worm:ALisp/Copicad.A is a worm that targets installations of AutoCAD software. It replaces the contents of an AutoCAD file with its own.
Top

Worm:ALisp/Copicad.A is a worm that targets installations of AutoCAD software.

It arrives in the computer along with a drawing file (DWG). When the DWG file is launched, Worm:ALisp/Copicad.A is automatically loaded and executed by AutoCAD.

Once executed, it searches for the file 'base.dcl' in the AutoCAD path. If located, Worm:ALisp/Copicad.A looks for the file 'acaddoc.lsp' in the same folder. It then replaces the contents of the AutoCAD file 'acaddoc.lsp' with its own content.



Analysis by Daniel Radu

Last update 12 January 2012

 

TOP