VX: Old worm in new shoes (AntiQFX)

[X iniT <x1n1t () yahoo com>]

Hello all,


The attached file seems to be a variant of AntiQFX
worm.

AntiQFX Worm masquerades as 
an old dos utilitly "MSCDEX.EXE". Basically
spreads via shared networks and delets a few 
files which belong to a couple of Photo Editting
softwares.
Its PE-Packed and has an anti-deletion routine.

So you might be guessing whats the big deal!!

Look closely and you'll see that i've attached this
file using my yahoo account. Which happens to be 
protected by NAV !!!

The following link clearly states that NAV detects
this worm since 2002 !!! 
http://securityresponse.symantec.com/avcenter/venc/data/w32.antiqfx.f.worm.html

Same thing is with AVP, ClamV & F-Prot.

Only Sophos detects this file as AntiQFX.F variant.

So keep an eye friends, this incident has really
made me have second thoughts about antivirus softwares
and their reliability.


Regards,
X!


                
__________________________________
Do you Yahoo!?
Yahoo! Mail - 50x more storage than other providers!
http://promotions.yahoo.com/new_mail

Attachment: MSCDEX.zip
Description: MSCDEX.zip