Virus:​W32/Bursted

Threat description

Details

CATEGORYMalware
TYPEVirus

Summary

A malicious program that secretly integrates itself into program or data files. It spreads by integrating itself into more files each time the host program is run.



Removal

Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

Bursted is a virus written for AutoCAD's embedded scripting language, AutoLISP. It replicates in a separate file, "acad.lsp" that is automatically executed by AutoCAD. It does not affect the actual drawing files.

The virus arrives in a file "acad.lsp" that is located in the same directory as the AutoCAD drawing files. When the drawing is opened, AutoCAD will automatically load and execute the contents of the "acad.lsp". The virus copies itself to AutoCAD's Support directory as "acadapp.lsp".

The virus also appends the load command to the "acad.lsp" in the Support directory, so the virus will be executed every time when AutoCAD is started. After that the virus will copy itself to every directory as "acad.lsp" from where the user opens AutoCAD drawings.

Payload

The virus hooks three AutoCAD internal commands - EXPLODE, XREF and XBIND - effectively disabling them. Additionally the virus will change the existing BURST command so that it will display the following message:

Detection

Detection in F-Secure Anti-Virus was published on December 4th, 2003 in update:

Database: 2003-12-04_05

Submit a Sample

Suspect a file or URL was wrongly detected?
Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info