Discovered on Dec 28, 1999
     It has a payload, which will delete files of a specific type and filename.

     The worm runs on the system as MSCDEX.EXE and is 114,688 bytes.
     The worm enumerates the network resources and copies itself to the remote systems startup directory. It sometimes modifies the autoexec.bat file to include the following references for its execution:
@echo off
mscdex.exe

On a remote Windows NT machine it will copy itself as:
\winnt\profiles\Administrator\Start
Menu\Programs\Startup\mscdex.exe
or
\winnt\profiles\All Users\Start
Menu\Programs\Startup\mscdex.exe
On a remote Windows 95/98 machine it copies itself as:
\windows\Start
Menu\Programs\Startup\mscdex.exe

The worm searches for the following file extensions and then attempts to delete them:
.bth
.mar
.gly
.isp
.pos
.bru
.qfo
.que
.cat
.lut
.lso

It also deletes the following executables:
QFXWIN.EXE
QFXWIN.INI
QFXWIN1.DLL
QFXCC.DLL
AVER.INI
AMWIN1.DLL
AMCC.DLL
AVERMAGIC.EXE
AMAGIC.EXE

The worm is written in C++ and packed by PEPACK (32bit executable packer). The executable is also protected by a HASP layer.