MUST re_cover! virus showing text in AutoCAD drawing

Have you seen MUST re_cover! text showing up when you open your AutoCAD drawing? This is not an error message produced by AutoCAD or Windows, it is a text produced by a variant of acad.vlx virus that appears as a drawing. Trying to recover your file with AutoCAD recover command will not help. Your file might appear as if totally corrupted but it is not. It looks like the virus creators were not that bad when they made it, because they have given you a hint on what to do to recover your file. As you may have already noticed, the hint is MUST re_cover! .

What we are going to do is that we will use the virus itself to TRY to recover the malformed AutoCAD dwg file. When I say “to try” it means that our attempt to recover the file may or may not work depending on several facts:

1. We cannot fully trust the virus (but do we have other options?).
2. The virus may not be the same that everyone has faced, although showing the same text.
3. As we will see later in this article, the virus creators may have missed something about dwg files that it will not work on some of them correctly and so recovering the file may produce a deformed useless drawing.

Important: The following is intended to help you recover your AutoCAD dwg drawings that have been corrupted by MUST re_cover! virus. However, I GIVE YOU NO GUARANTEE WHATSOEVER THAT THIS WOULD WORK ON YOUR COMPUTER OR WOULD RECOVER YOUR FILES, DO IT AT YOUR OWN RISK!

Precautions: To avoid any or further loss of data,

1. If your AutoCAD is infected with the virus, symptom: each time you open a file it is transformed and show MUST re_cover! text, then you need to STOP OPENING AUTOCAD FILES ESPECIALLY THE ONES WHICH ARE STILL CLEAN… and continue reading my article.
2. If you have a file that is showing MUST re_cover! text, do not make any changes to it, because this might cause the recovery process to fail.
3. YOU SHOULD BACKUP YOUR FILES INCLUDING THE ACAD.VLX VIRUS FILE BEFORE ATTEMPTING TO RECOVER YOUR CORRUPTED FILES.
4. Do not clean your computer from the virus before you USE THE VIRUS ITSELF TO RECOVER YOUR FILES.
5. You may want to try doing the recovery on a test computer that you are not using in a production environment or even your personal use. Other than installing the required software on the test computer, you need ACAD.VLX virus file and your corrupted AutoCAD dwg files.

Note: If your AutoCAD is not infected and you have a file that shows the text of the virus, maybe you brought your file from a flash memory, then you have to bring also the acad.vlx file (possibly present in your flash memory) so that you can proceed and attempt recovery.

Note: If you desperately need to open an AutoCAD file right now and your AutoCAD is infected with the virus, then do the following with caution and make sure you make a copy of the file before doing it: Open the AutoCAD application alone (see images below) and then choose File, Open and browse to your file. The virus will not be loaded in this case even if acad.vlx is present in the same directory; and your file would not be transformed.

AutoCAD program shortcut

Opening an AutoCAD file using the Menu bar

How does this virus transform your file to an unusable form?

The MUST re_cover! virus is started when you double click on an AutoCAD dwg file present with acad.vlx virus file in the same folder. acad.vlx will be loaded automatically and will transform your dwg file into unusable (apparently corrupted) file. It will show transformation percentage like the one in the figure below.

MUST re_cover! virus corrupting an AutoCAD dwg file

After that, it will save the file and you will have no .bak file for it to recover from, because it will delete the .bak file. And you will see “MUST re_cover!” text.

If this has happened once on a computer, then the virus has infected the AutoCAD environment. Let us just call or describe it as AutoCAD infected.

So, what should we do?

As the virus is asking us to do, we are not going to recover the file; instead we are going to re_cover the file. (Yes, it is different )

The following was done using AutoCAD 2007. I will show you 4 different ways to try recovering your files. You can choose any one and start applying, or look for the one that matches your case right now.

Case 1: AutoCAD already infected. This is the case where the virus has run at least once on your computer.

• If the AutoCAD Program is open, then do the following:
  1. If your corrupted file is not open, open it using File,Open from the menu then browse to it.
  2. Load the acad.vlx file: type appload in the command line, then browse to the acad.vlx file (usually, you will find it in the same directory of your corrupted dwg file).
  3. type re_cover in the command line and press Enter. You will see the percentage of the recovery process, wait until it finishes.
• If the AutoCAD Program is not open then do the following:
  1. Double click on the file you want to recover and wait until it loads.
  2. Then type re_cover in the command line and press Enter. You will see the percentage of the recovery process, wait until it finishes.

Case 2: AutoCAD is not infected. This is the case where your file got infected from another computer and you didn’t run your file while acad.vlx hanging around it in the same folder. This also can be the case where you have chosen to recover your file on a test computer. Caution: The following will infect your AutoCAD, this is what we want so that you can recover your files. But I recommend you do it on a test computer.

• If the AutoCAD Program is open then do the following:
  1. If your corrupted file is not open, open it using File,Open from the menu then browse to it.
  2. Load the acad.vlx file: type appload in the command line, then browse to the acad.vlx file (usually, you will find it in the same directory of your corrupted dwg file).
  3. type re_cover in the command line and press Enter. You will see the percentage of the recovery process, wait until it finishes.
• If the AutoCAD Program is not open then do the following:
  1. Double click on the file you want to recover and wait until it loads. (Or use File, Open from the Menu).
  2. Load the acad.vlx file: type appload in the command line, then browse to the acad.vlx file (usually, you will find it in the same directory of your corrupted dwg file).
  3. type re_cover in the command line and press Enter. You will see the percentage of the recovery process, wait until it finishes.

The following image shows the recovery process.

MUST re_cover! recovering an AutoCAD drawing

Note: It really makes no difference which method of the above 4 you have chosen unless you want to do it on a test computer. I just wanted to make it clear for you to know what you should do in a certain case.

If one of the above ways succeed in running the recovery process (seeing the percentage of recovery…), observe what shows up after it finishes. 2 possible results:

• Recovery was successful: this is the case where you indeed see your drawing is back! Congratulations! You can now save it.
• Recovery was unsuccessful: this is the case where you see deformed drawings. This happens because the original file had proxy graphics that AutoCAD warned about its inability to allow editing of them, the file was transformed by the virus to show MUST re_cover! hint, but their recovery process was unsuccessful. Unfortunately, I don’t know any way around this, and there may be no way around it. The virus creators have probably missed something about it. And unfortunately again, we can’t contact the virus support.

Important: if the recovery was not successful then DO NOT SAVE, you might be able to find another solution to recover your file.

Note: A file that has been recovered using the re_cover command of the virus will NOT return back to its identical form although the virus has recovered your drawings. It will add some proxy graphics object that the virus creators seem to be using to identify that this file has been transformed and recovered and in this case the virus will not transform it again even if AutoCAD was still infected or acad.vlx is in the same directory of your dwg file. This recovered dwg file can be loaded by double clicking on it without the need to go through the Must re_cover! process again (may or may not work this way depending on the virus variant).

Do the same recovery process for every AutoCAD dwg file you need to recover. And when you have no more files to recover, proceed with the following instructions to clean your AutoCAD and computer from the virus.

Cleaning your AutoCAD and computer from the virus:

1. Now that you have recovered your files, it is time to clean up your computer from the virus. Click here to view the Autodesk article Acad.vlx Virus Cleanup. After you do it, anytime you double click on an AutoCAD file and the program launches , it will delete the acad.vlx from the same directory, and will cleanup AutoCAD from the virus.
2. You can also delete all acad.vlx files that have been created. Make a search for it and delete them all.

Now, this is very important: DO NOT ATTEMPT TO USE THIS VIRUS FOR FUN

Do not try to scare your friends or anybody by injecting the acad.vlx file into their work directory and then have their files transformed. Frankly, it is not funny at all, and you may not be able to recover their files, because as I said before:

1. You cannot trust the virus, and you don’t know which variant you have.
2. The recovery process may or may not succeed.
3. Even with successful recovery, the file is not exactly identical to the original one (as I explained before).

Have you faced this problem before? Were you able to recover your files? Did this article help you? You’re welcome to share your thoughts and comments!

No related posts.