New MaxScript Virus: Spy CA

Vasyl Lukianenko
3D Artist and Technical Author

Date: September 25, 2024 Updated on: September 26, 2024 Reading time: 4 min Views: 645

What is Spy CA?

Spy CA is a new class of viruses that can be delivered along with third-party 3D models downloaded from online resources or 3D Stocks.

The virus is a Maxscript code that is written to the Custom Attributes of an object and is executed when a scene is opened, a model is merged, or an object is manipulated.

Special thanks to user Danylo Botsman for providing the scene.

I did reverse engineering during which I learned that the script affects the following:

Long opening of scenes
Creation of unwanted files in the system along the path c:/Users/[User]/AppData/Local/
Creation of unwanted attributes in objects
Sending data about a unique PC identifier to the C&C server
Disabling 3Ds Max Security Tools by overwriting settings in 3dsmax.ini

If you are using Security Tools and see a message like the one in the picture above, it means that you are infected.

In 3Ds Max 2024 and higher, the script is blocked for execution, but the virus code remains in the Custom Attributes of the object. Therefore, there is a risk of transferring a scene or object with this virus to another user who does not have protection. As a result, the code may be executed on an unprotected computer, so I strongly recommend using Prune Scene!

Prune Scene

How does the virus work?

The virus creates a mac.dat file in system files with information to be sent to the C&C server. Usually a unique identifier is written there.

c:/Users/[User]/AppData/Local/com/mac.dat

Personal data is sent: MAC address, unique identifier and other information to a remote server at https://api[.]yutu[.]cn/blackBox/checkData in China.

The virus also tries to completely disable 3Ds Max Security Tools by overwriting the settings in 3dsmax.ini!

At the moment, this is all the actions of the virus. But with a large number of objects with similar Custom Attributes, the scene slows down significantly when starting or when manipulating objects.

How to detect Spy CA?

There are several ways to detect this virus:

When Security Tools is enabled, you will see a message (screenshot at the beginning of the article)
When Prune Scene is installed, you will be notified that this virus has been removed
You can manually check your scene, how to do this read below

Manual way to detect Spy CA. Open Maxscript Listener, copy and paste the following line and press Enter:

(fn detectSpyCA = (for i in custattributes.getSceneDefs() where i.name == #Sound_GrayDeskUnderFourOldDriverGoPlane do return true; return false); detectSpyCA())

The result of executing the line should return: false. If the execution result is: true - you are infected!

How to remove the virus completely?

Unfortunately, 3Ds Max Security Tools only blocks the execution of this virus and the most effective way is to use Prune Scene.

Prune Scene will completely remove all Custom Attributes from the scene that use malicious code. The most important thing is that it does it automatically!

This virus can also be cleaned up easily and manually by doing all the objects in the scene Convert To Mesh, then Convert To Poly, in order to remove Custom Attributes.

Conclusion

Spy CA poses a serious threat to 3Ds Max users, capable of injecting malicious Maxscript code through Custom Attributes of objects. Even though new versions of 3Ds Max block the execution of this virus, its presence in scenes remains, presenting a potential danger to other users without appropriate protection.

It is recommended to use tools like Prune Scene to completely remove malicious attributes and prevent virus transmission. It is important to exercise caution when working with files downloaded from third-party sources and regularly check scenes for such threats.

The text of the article has also been updated, where I keep a log of all viruses and threats for 3Ds Max. I recommend reading:

Attention ALC and CRP viruses in 3Ds Max!

FAQ

1. What is Spy CA?

Spy CA is a MaxScript-based virus that can infect Autodesk 3ds Max scenes and user environments, causing unwanted behavior and potentially spreading between project files.

2. How does Spy CA spread?

Like many 3ds Max script viruses, it can spread through infected scene files, downloaded assets, or scripts obtained from untrusted sources.

3. Which versions of 3ds Max can be affected?

Script viruses can affect multiple versions of Autodesk 3ds Max, depending on how the malicious script was created and installed.

4. What are the signs of a Spy CA infection?

Common symptoms may include unexpected script execution, unknown startup scripts, unusual error messages, performance issues, or suspicious files appearing in MaxScript startup folders.

5. Can an infected scene spread the virus to other files?

Yes. Some MaxScript viruses can automatically infect other scenes that are opened or saved on the same system.

6. Is Spy CA dangerous for project files?

Yes. Like other script-based malware, it can disrupt workflows, modify files, and create problems that affect scene stability and productivity.

7. Can antivirus software detect Spy CA?

Sometimes, but not always. Traditional antivirus solutions may not detect every MaxScript-based threat, especially if it is new or specifically targets 3ds Max environments.

8. How can I check if my system is infected?

You can inspect startup script folders, review recently installed scripts, monitor suspicious behavior inside 3ds Max, and use specialized cleanup tools designed for 3ds Max environments.

9. Can infected models downloaded from the internet contain viruses?

Yes. Scene files obtained from untrusted sources may contain embedded scripts capable of spreading malware within 3ds Max.

10. How can I protect myself from MaxScript viruses?

Use trusted model sources, keep your software updated, avoid running unknown scripts, and regularly scan your scenes and startup folders.

11. Can a virus slow down 3ds Max?

Yes. Some script viruses can consume resources, create background processes, generate errors, and reduce overall performance.

12. What should I do if I discover an infection?

Stop sharing affected files, scan your scenes and system, remove malicious scripts, and verify that startup folders are clean before continuing work.

13. Can script viruses spread within a studio?

Yes. If infected files are shared through a network, file server, or asset library, multiple workstations may become affected.

14. Is prevention better than cleanup?

Absolutely. Regular scene checks, secure workflows, and proactive protection are usually far easier than recovering from a widespread infection.

15. Can cleanup tools help remove Spy CA?

Yes. Specialized tools designed for 3ds Max can help detect and remove script-based infections from scenes and user environments.

16. Why should 3D artists be aware of script viruses?

Because a single infected file can disrupt projects, waste production time, affect multiple users, and potentially spread throughout an entire studio pipeline.

Vasyl Lukianenko
3D Artist and Technical Author

Vasyl Lukianenko is a 3D artist and technical author focused on practical workflows, optimization, and production-ready techniques. He publishes tutorials, courses, and tools to help artists work faster and get cleaner results.