MUST re_cover! virus showing text in AutoCAD drawing
Have you seen MUST re_cover! text showing up when you open your AutoCAD drawing? This is not an error message produced by AutoCAD or Windows, it is a text produced by a variant of acad.vlx virus that appears as a drawing. Trying to recover your file with AutoCAD recover command will not help. Your file might appear as if totally corrupted but it is not. It looks like the virus creators were not that bad when they made it, because they have given you a hint on what to do to recover your file. As you may have already noticed, the hint is MUST re_cover!.
What we are going to do is that we will use the virus itself to TRY to recover the malformed AutoCAD dwg file. When I say “to try” it means that our attempt to recover the file may or may not work depending on several facts:
- We cannot fully trust the virus (but do we have other options?).
- The virus may not be the same that everyone has faced, although showing the same text.
- As we will see later in this article, the virus creators may have missed something about dwg files that it will not work on some of them correctly and so recovering the file may produce a deformed useless drawing.
Important: The following is intended to help you recover your AutoCAD dwg drawings that have been corrupted by MUST re_cover! virus. However, I GIVE YOU NO GUARANTEE WHATSOEVER THAT THIS WOULD WORK ON YOUR COMPUTER OR WOULD RECOVER YOUR FILES, DO IT AT YOUR OWN RISK!
Precautions: To avoid any or further loss of data,
- If your AutoCAD is infected with the virus, symptom: each time you open a file it is transformed and show MUST re_cover! text, then you need to STOP OPENING AUTOCAD FILES ESPECIALLY THE ONES WHICH ARE STILL CLEAN… and continue reading my article.
- If you have a file that is showing MUST re_cover! text, do not make any changes to it, because this might cause the recovery process to fail.
- YOU SHOULD BACKUP YOUR FILES INCLUDING THE ACAD.VLX VIRUS FILE BEFORE ATTEMPTING TO RECOVER YOUR CORRUPTED FILES.
- Do not clean your computer from the virus before you USE THE VIRUS ITSELF TO RECOVER YOUR FILES.
- You may want to try doing the recovery on a test computer that you are not using in a production environment or even your personal use. Other than installing the required software on the test computer, you need ACAD.VLX virus file and your corrupted AutoCAD dwg files.
Note: If your AutoCAD is not infected and you have a file that shows the text of the virus, maybe you brought your file from a flash memory, then you have to bring also the acad.vlx file (possibly present in your flash memory) so that you can proceed and attempt recovery.
Note: If you desperately need to open an AutoCAD file right now and your AutoCAD is infected with the virus, then do the following with caution and make sure you make a copy of the file before doing it: Open the AutoCAD application alone (see images below) and then choose File, Open and browse to your file. The virus will not be loaded in this case even if acad.vlx is present in the same directory; and your file would not be transformed.
AutoCAD program shortcut
Opening an AutoCAD file using the Menu bar
How does this virus transform your file to an unusable form?
The MUST re_cover! virus is started when you double click on an AutoCAD dwg file present with acad.vlx virus file in the same folder. acad.vlx will be loaded automatically and will transform your dwg file into unusable (apparently corrupted) file. It will show transformation percentage like the one in the figure below.
MUST re_cover! virus corrupting an AutoCAD dwg file
After that, it will save the file and you will have no .bak file for it to recover from, because it will delete the .bak file. And you will see “MUST re_cover!” text.
If this has happened once on a computer, then the virus has infected the AutoCAD environment. Let us just call or describe it as AutoCAD infected.
So, what should we do?
As the virus is asking us to do, we are not going to recover the file; instead we are going to re_cover the file. (Yes, it is different :) )
The following was done using AutoCAD 2007. I will show you 4 different ways to try recovering your files. You can choose any one and start applying, or look for the one that matches your case right now.
Case 1: AutoCAD already infected. This is the case where the virus has run at least once on your computer.
- If the AutoCAD Program is open, then do the following:
- If your corrupted file is not open, open it using File,Open from the menu then browse to it.
- Load the acad.vlx file: type appload in the command line, then browse to the acad.vlx file (usually, you will find it in the same directory of your corrupted dwg file).
- type re_cover in the command line and press Enter. You will see the percentage of the recovery process, wait until it finishes.
- If the AutoCAD Program is not open then do the following:
- Double click on the file you want to recover and wait until it loads.
- Then type re_cover in the command line and press Enter. You will see the percentage of the recovery process, wait until it finishes.
Case 2: AutoCAD is not infected. This is the case where your file got infected from another computer and you didn’t run your file while acad.vlx hanging around it in the same folder. This also can be the case where you have chosen to recover your file on a test computer. Caution: The following will infect your AutoCAD, this is what we want so that you can recover your files. But I recommend you do it on a test computer.
- If the AutoCAD Program is open then do the following:
- If your corrupted file is not open, open it using File,Open from the menu then browse to it.
- Load the acad.vlx file: type appload in the command line, then browse to the acad.vlx file (usually, you will find it in the same directory of your corrupted dwg file).
- type re_cover in the command line and press Enter. You will see the percentage of the recovery process, wait until it finishes.
- If the AutoCAD Program is not open then do the following:
- Double click on the file you want to recover and wait until it loads. (Or use File, Open from the Menu).
- Load the acad.vlx file: type appload in the command line, then browse to the acad.vlx file (usually, you will find it in the same directory of your corrupted dwg file).
- type re_cover in the command line and press Enter. You will see the percentage of the recovery process, wait until it finishes.
The following image shows the recovery process.
MUST re_cover! recovering an AutoCAD drawing
Note: It really makes no difference which method of the above 4 you have chosen unless you want to do it on a test computer. I just wanted to make it clear for you to know what you should do in a certain case.
If one of the above ways succeed in running the recovery process (seeing the percentage of recovery…), observe what shows up after it finishes. 2 possible results:
- Recovery was successful: this is the case where you indeed see your drawing is back! Congratulations! :) You can now save it.
- Recovery was unsuccessful: this is the case where you see deformed drawings. This happens because the original file had proxy graphics that AutoCAD warned about its inability to allow editing of them, the file was transformed by the virus to show MUST re_cover! hint, but their recovery process was unsuccessful. Unfortunately, I don’t know any way around this, and there may be no way around it. The virus creators have probably missed something about it. And unfortunately again, we can’t contact the virus support. :)
Important: if the recovery was not successful then DO NOT SAVE, you might be able to find another solution to recover your file.
Note: A file that has been recovered using the re_cover command of the virus will NOT return back to its identical form although it has recovered your drawings. It will add some proxy graphics object that the virus creators seem to be using to identify that this file has been transformed and recovered and in this case the virus will not transform it again even if AutoCAD was still infected or acad.vlx is in the same directory of your dwg file.This recovered dwg file can be loaded by double clicking on it without the need to go through the Must re_cover! process again (may or may not work this way depending on the virus variant).
Do the same recovery process for every AutoCAD dwg file you need to recover. And when you have no more files to recover, proceed with the following instructions to clean your AutoCAD and computer from the virus.
Cleaning your AutoCAD and computer from the virus:
- Now that you have recovered your files, it is time to clean up your computer from the virus. Click here to view the Autodesk article Acad.vlx Virus Cleanup. After you do it, anytime you double click on an AutoCAD file and the program launches , it will delete the acad.vlx from the same directory, and will cleanup AutoCAD from the virus.
- You can also delete all acad.vlx files that have been created. Make a search for it and delete them all.
Now, this is very important: DO NOT ATTEMPT TO USE THIS VIRUS FOR FUN
Do not try to scare your friends or anybody by injecting the acad.vlx file into their work directory and then have their files transformed. Frankly, it is not funny at all, and you may not be able to recover their files, because as I said before:
- You cannot trust the virus, and you don’t know which variant you have.
- The recovery process may or may not succeed.
- Even with successful recovery, the file is not exactly identical to the original one (as I explained before).
Want to get updates for new posts? Subscribe to my RSS feed and follow me on twitter :)
You can also get the ITfall blog updates by Email.
And don't forget to share this post and leave a comment ;)
42 Comments
Dear Amer,
Really useful post. Thanks a lot
Regards
Ajith
Thanks amer,
It was very useful for me.. thank u once again for ur work..
keep the good work
your the best man
10x Amer
good work
tony
thx alot amer.. very helpful
thank you all for your kind comments, I am glad that it helped you. ;)
Amer,
Great post!
You saved me a lot of time on how to recover our cadd files.
very thankfull to u my friend.once again i appreciate u for the the great work
i tried to clean the vlx virus using the autocad link u gave.
i did everything the instruction said, but the virus is still there..
is there anyway to do this?
@Felicia
If your file was showing MUST re_cover! text and was not recovered to show the drawings again then even if you put the file on a clean computer that has never been subject to the virus, it will still show the MUST re_cover! text.
After you have followed the instructions on the AutoDesk site, and when you opened a file did you see a process of file conversion by the virus? (it means, did you see a percentage of conversion as illustrated in the figures?). Also, before the virus corrupts the file, you will see the drawings as usual and then a conversion process (percentage…) and then it will show the MUST re_cover! text.
So, if you have seen the MUST re_cover! text directly when you opened the file, then you cannot assume that the virus was not cleaned from your computer.
An easy way to test and see if you have applied the AutoDesk instructions correctly, is to see if the acad.vlx file disappears when you double-click any file in the same directory of the acad.vlx file (make sure that you have a backup copy of the file before doing so).
Very Smart, Thank you Amer. We had a problem with this “thing” and i really thank you for solving this issue.
But i have to admit that the guy behing this virus is a pretty smart guy also :) hehe
Thank You,
Great Post
Alex
you are excellent man, thanks a lot.
Thankfull to u my friend.once again i appreciate u for the the great work
thanks man!
Hello
i have a problem finding the acad.vlx file
thanks a lot dear u did a very great help for the autocad users
again thanks a lot.
@Amer Kachmar
thanks for the very smart help amer.
i think this column is very useful for every CAD user.
Thanks a lot……………..Amer Kachmar
this is very informatic column for every cad user
thanks a lot…………..Amer Kachmar
how can i remove autocad virus
omg!! thanks sooooooo much! very helpful, excellent!
Thank you so much, it was very helpful for me.. keep up the good work Amer
Dear Amer,
Thanks for this tips. Keep the work on going.
Thank you, this is very very usefull.
Thanks alot
You saved us alot of time and efforts
appreciated!
Thank you for the tip… Acutually the persons who are creating virus don’t know the effort of the person to create that drawing..
Thanks Amer,
but there is something not cleared at autodesk site concerning “Acad.vlx Virus Cleanup”; where i should find Roamablerootprefix and how to work with it??
[[ ROAMABLEROOTPREFIX\Support\acad.mnl
Note: Replace ROAMABLEROOTPREFIX with the value returned by the ROAMABLEROOTPREFIX system variable. ]]
plz help
Hi,
Pleae help me….
my computer is showing Must Re_cover any time when i open drawing
what will i do ?
Dear Amer,
thanks for a great work, you saved me, ALHAMDULELLAH
keep going
thanks for your valuable time, and very clear instructions
waleed
I have been trying to follow the Autdesk process of “cleaning” my infected AutoCAD. I am having many problems, I cannot save the file in step 2 after adding the additional text, I get an “Access Denied” notice.
In step 3, I cannot find any line of code similar to the one described for “copying the virus”. I also do not understand the ROAMABLEROOTPRIFEX.
Please help me, I have many corrupt files that and I am trying to prevent others on our network to be infected with this virus.
Dear Amer Kachmar ,
dont know how can i appreciate you. Really you are a genious.
Thank you very much.
IS ANY SHORT KEY TO USED ATTRIBUTES COMMAND?
No words to appreciate …
I have same problem as:
Pm
Posted October 14, 2010 at 9:36 AM | Permalink
Hi Amer
I have the same question:
I have been trying to follow the Autdesk process of “cleaning” my infected AutoCAD. I am having many problems, I cannot save the file in step 2 after adding the additional text, I get an “Access Denied” notice.
In step 3, I cannot find any line of code similar to the one described for “copying the virus”. I also do not understand the ROAMABLEROOTPRIFEX.
Thanks
Kevin
thanks a lottttttttt more useful
i have a photo copy of autocad file write in it must re cover how i can open it
i have autocad 2011..
thank u
thanks for the instructions on how to re_cover acad.vlx virus… it was successful and save me a lot from big trouble
Thanks a lot Amer!
you saved my day
where can i get the acad vlx files
Thank you for sharing this info.. I successfully re_cover all my drawing files..
:)
thank u very much