Citazione:
Jdbgmgr.exe file hoax
Reported on: April 12, 2002
Last Updated on: March 20, 2003 10:50:15 AM
Symantec Security Response encourages you to ignore any messages regarding this hoax. It is harmless and is intended only to cause unwarranted concern.
Type: Hoax
This hoax, like the SULFNBK.EXE Warning hoax, tries to encourage you to delete a legitimate Windows file from your computer. Jdbgmgr.exe is the file to which the hoax refers, and it is the Microsoft Debugger Registrar for Java. The Jdbgmgr.exe file may be installed when you install Windows.
NOTE: Recent versions of this hoax take advantage of the recent outbreak of the W32.bugbear@mm worm. The Jdbgmgr.exe file mentioned in the hoax has a bear icon. The actual W32.bugbear@mm worm file is a .exe file and does not have a bear icon.
The Windows Jdbgmgr.exe file has a teddy bear icon in the hoax, as illustrated below:
CAUTION: A virus can infect Jdbgmgr.exe. The W32.Efortune.31384@mm virus, in particular, targets this file. Norton AntiVirus has provided protection against W32.Efortune.31384@mm since May 11, 2001.
NOTE: If you have already deleted the Jdbgmgr.exe file, in most cases, you do not need to re-install it. The following quote is extracted from the Microsoft Knowledge Base article, "Virus Hoax: Microsoft Debugger Registrar for Java (Jdbgmgr.exe) Is Not a Virus (Q322993)."
"The Microsoft Debugger Registrar for Java (Jdbgmgr.exe) is only used by Microsoft Visual J++ 1.1 developers.
If you follow the e-mail message instructions and delete this file, you do not have to recover it unless you use Microsoft Visual J++ 1.1 to develop Java programs on Windows XP, Windows NT 4.0, Windows 98 Second Edition, Windows 98, or Windows 95."
If you need to restore this file, follow the instructions in "Virus Hoax: Microsoft Debugger Registrar for Java (Jdbgmgr.exe) Is Not a Virus (Q322993)."
Hoax message
This hoax has appeared in several languages. Some examples of the exact content, which is copied from the hoax message, are:
English, version 1
I found the little bear in my machine because of that I am sending this message in order for you to find it in your machine. The procedure is very simple:
The objective of this e-mail is to warn all Hotmail users about a new virus that is spreading by MSN Messenger. The name of this virus is jdbgmgr.exe and it is sent automatically by the Messenger and by the address book too. The virus is not detected by McAfee or Norton and it stays quiet for 14 days before damaging the system.
The virus can be cleaned before it deletes the files from your system. In order to eliminate it, it is just necessary to do the following steps:
1. Go to Start, click "Search"
2.- In the "Files or Folders option" write the name jdbgmgr.exe
3.- Be sure that you are searching in the drive "C"
4.- Click "find now"
5.- If the virus is there (it has a little bear-like icon with the name of jdbgmgr.exe DO NOT OPEN IT FOR ANY REASON
6.- Right click and delete it (it will go to the Recycle bin)
7.- Go to the recycle bin and delete it or empty the recycle bin.
IF YOU FIND THE VIRUS IN ALL OF YOUR SYSTEMS SEND THIS MESSAGE TO ALL OF YOUR CONTACTS LOCATED IN YOUR ADDRESS BOOK BEFORE IT CAN CAUSE ANY DAMAGE.
English, version 2
Dear All
I'm sorry about this; but I received this E-mail from a client regarding a virus that was inadvertently passed on to everyone in their address book. I followed the instructions and YES, IT WAS ON MY COMPUTER.
Since you are in my address book, I am sending this on to you as a precaution. NORTON 2002 DID NOT DETECT IT!
Here are the instructions on how to check for this virus and delete it if you have it too. It only took a few minutes, following these instructions. Be sure to notify all in your address book too (which will take longer than deleting the virus from your computer).
Since you are in our address book, there is a good chance you will find it in your computer too unless you have an Apple or MAC. The virus (called jdbgmgr.exe) is not detected by Norton or McAfee anti-virus systems. The virus sits quietly for 14 days before damaging the system. It is sent automatically by messenger and by the address book, whether or not you sent Emails to your contacts. Here's how to check for the virus and how to get rid of it:
YOU MUST DO THIS
1. Go to Start, Go to Find or Search option
2. In the File Folder option, type the name: jdbgmgr.exe
3. Be sure you search your C: drive and all sub-folders and any otherdrives you may have.
4. Click "Find Now"
5. The Virus has a Teddy Bear icon with the name jdbgmgr.exe DO NOT OPENIT
6. Go to Edit (on menu bar), choose "Select All" to highlight the file without opening it.
7. Now go to File (on the menu bar) and select Delete. It will then go to the Recycle Bin.
8. Go to the Recycle Bin and Delete it
IF YOU FIND THE VIRUS, YOU MUST CONTACT ALL THE PEOPLE IN YOUR ADDRESS BOOK, SO THEY CAN ERADICATE IT IN THEIR OWN ADDRESS BOOKS.
To do this:
a) Open a new e-mail message
b) Click the icon of the address book next to the "TO"
c) Highlight every name and add to "BCC"
d) Copy this message enter subject paste to e-mail
Am very sorry about this nuisance. This age of technology is not that great sometimes. We are victims!
English, version 3 (The BlankA version)
Dear All,
BlankA virus has been passed to me by a contact. My address book in turn has been affected. Since you are in my address book there is a good chance
you will find it in your computer too.
I followed the direction below and eradicated the virus easily. The virus (called jdbgmgr.exe) is not detected by Norton or McAfee anti-virus
systems. The virus sits quietly for 14 days before damaging the system. It is sent automatically by messenger and by the address book whether or not
you sent emails to your contacts.
Here is how you check for the virus and get rid of it.
1. Go to start, find or search option.
2. In the file/folders option, type the name: jdbgmgr.exe
3. Be sure to search your C: drive and all the subfolders and any other drives you may have.
4. Click "find now"
5. The virus has a teddy bear icon with the name jdbgmgr.exe. DO NOT OPEN IT
6. Go to edit (on the menu bar), choose "select all" to highlight the file without opening it.
7. Now go to the file (on the menu bar) and select delete. It will then go to the recycle bin.
8. Empty your recycle bin.
IF YOU FIND THIS VIRUS,YOU MUST CONTACT ALL THE PEOPLE IN YOUR ADDRESS BOOK SO THEY CAN ERADICATE IT IN THEIR OWN ADDRESS BOOKS.
To do this:
(a) Open a new e-mail message
(b) Click on the icon of the address book next to the "TO"
(c) Highlight every name and add to "BCC"
(d) Copy this message above and paste to e-mail.
(e) Enter subject
Apologies for the inconvenience and to those of you who have had this message several times from different people!
Czech
[CUT]
Danish
[CUT]
Dutch
[CUT]
French
[CUT]
German
[CUT]
Italian
Abbiamo ricevuto un virus che si trasmette automaticamente a tutti gli indirizzi di posta elettronica. Se si eseguono le seguenti istruzioni si cancella senza causare danni.
FARE LA VERIFICA DESCRITTA PER ELIMINARE IL VIRUS.
Il virus si chiama jdbgmgr.exe e si trasmette automaticamente tramite Messenger ed anche attraverso la rubrica degli indirizzi. Il virus NON E'RILEVATO da McAfee o Norton e rimane in letargo 14 giorni prima di recare
dei danni al sistema .Per eliminarlo basta eseguire le seguenti operazioni:
1) Cliccare sullo schermo in basso a destra "Avvio o Start"
2) Cliccare su "Trova", andare da "Files o Cartelle" e scrivere il nome
del virus: jdbgmgr.exe
3) Assicurarsi che cerchi sul disco "C"
4) Cliccare su "Cerca ora"
5) Se appare il virus (l'icona è un orsacchiotto) NON APRIRE !!
6) Cliccare sul pulsante destro del mouse ed eliminare.
7) Andare sul cestino e cancellare definitivamente.
SE AVETE TROVATO IL VIRUS NEL VOSTRO COMPUTER INVIATE QUESTO MESSAGGIO A TUTTE LE PERSONE CHE SI TROVANO SULLA VOSTRA RUBRICA D'INDIRIZZI O E-MAILS.
Polish
[CUT]
Portuguese
[CUT]
Spanish
[CUT]
Swedish
[CUT]
Additional information:
Security Response has received reports of the circulation of a fake email message with information about this hoax, purporting to be sent by Symantec. The email has the following characteristics:
From: "Symantec Corporation" <support@symantec.com>
Subject: Virus Hoax Warning
Symantec does not know the exact content of the hoax email at this time. However, it has been reported that this particular version of the hoax may actually be using the Backdoor.Omed.B exploit to download malicious content to your computer.
Revision History:
May 21, 2002: Included information regarding possible malicious email, purporting to be sent by Symantec.
Write-up by: George Koris
