It would also be possible that a virus comes through other means like ARX or DLL files possibly in combination with EXE, BAT, CMD or VBS files that could register the files to make them load automatically.
Personally I have never run in run into any AutoCAD related virus or malware. Probably because they are not that common.
ACAD.Star was probably the first VBA virus for AutoCAD and was discovered in 2000 by Kaspersky more than a year after the AutoCAD 2000 version was released.
Another way to get infected is if you download a cracked AutoCAD version that is injected with a virus or worm.
AL/Bursted-Fam is a family of AutoCAD LISP (AutoLISP) virus. If an infected file is received as ACAD.LSP and an AutoCAD Drawing is loaded from the same folder the virus becomes resident within AutoCAD. AL/Bursted-Fam edits the existing global ACAD.LSP or creates one to load itself at AutoCAD startup from another LSP file in the same folder. When an AutoCAD drawing (DWG file) is editted an ACAD.LSP will be created in the same folder as the drawing. – Sophos. Another one is AL/Billy-A
One good thing with AutoCAD 2010 is that VBA is not even installed as default and eventually VBA will not be available for AutoCAD at all. :)
The AL/Bursted Fam surely made a fun of us for a while yet it can be stated that AutoCAD is not really the main target of many virus authors. The AL/Bursted Fam is still considered to be low threat category by Sophos so we can still feel safe.
ReplyDeleteMind you if you have a hooky copy of AutoCAD that is a different issue.
By not including the VB editor in the latest AutoCAD 2010 surely decrease the chances of being infected.
Regards
CroAxis