Zend CE has a Worm

After updating the AVGFree virus definitions, I was surprised to find that Zend CE (Community Edition) 4.0.6 had a worm in the JavaServer.exe file. There was greater surprise when Zend CE 5.3.9 (5.6.0-SP1) also had the same worm.

This is the message identifying the worm (click on it to see a full size image), and you can read about this particular worm on the Mcafee site:

Unless you have the full version of AVG or another security program to try and fix the file, you can only quarantine the file. Quarantine or removal disables Zend CE from working. It begs the questions, “how does Zend release a core file with a worm?”

I’ll update this when there’s a fix to this problem.