[ISN] Hoax virus alert could cripple Windows Java

From: InfoSec News (isnat_private)
Date: Thu May 16 2002 - 00:14:05 PDT

  • Next message: InfoSec News: "[ISN] "Deceptive Duo" suspects hit in FBI raid"

    http://www.theregister.co.uk/content/55/25294.html
    
    By John Leyden
    Posted: 15/05/2002 at 17:21 GMT
    
    Antivirus experts are warning of a hoax virus alert which might trick 
    users into deleting an important file on their Windows machines. 
    
    The fake warning tells users to search their hard drives and delete a 
    file called jdbgmgr.exe, a filename used by Microsoft's Debugger 
    Registrar for Java, which may be present quite legitimately on many 
    computers. 
    
    But the Magistr-A virus is capable of sending infected copies of 
    jdbgmgr.exe, and this seems to have spawned the misplaced warning, 
    which is gaining ground. 
    
    Deleting Microsoft's Debugger Registrar for Java may result in Java 
    programmes failing to run after the user has deleted legitimate copies 
    of jdbgmgr.exe. 
    
    Rob Rosenberger's Virus Myths first reported on the jdbgmgr.exe hoax 
    alert (which he says should more properly be called an urban myth) 
    last month. Anti-virus vendor Sophos backed up his analysis today, by 
    warning that it has "received enquiries from thousands of concerned 
    computer users about the subject". 
    
    The rule of thumb here is if you find a copy of jdbgmgr.exe on your 
    computer, then it's probably not infected; but if you receive 
    jdbgmgr.exe as an email attachment, then it probably is infected. If 
    you receive an unsolicited executable file in your email, delete the 
    email. 
    
    One other source of reassurance is that most AV packages have been 
    able to detect Magistr-A for over a year, so if your anti-virus 
    software is up to date, you will be protected from the Magistr virus 
    anyway. 
    
    The panic caused by messages about jdbgmgr.exe is similar in many ways 
    to the sulfnbk.exe hoax alert last year, which like the latest panic 
    is believed to have been caused by a clueless - but well-meaning - 
    user. 
    
    Users should avoid passing on virus warnings to friends, instead 
    checking out the facts on an anti-virus Web site (or Vmyths.com). 
    Alternatively they could forward the warning whoever in their company 
    is responsible for virus protection, so that they can decide if it is 
    valid. 
    
    
    
    -
    ISN is currently hosted by Attrition.org
    
    To unsubscribe email majordomoat_private with 'unsubscribe isn'
    in the BODY of the mail.
    



    This archive was generated by hypermail 2b30 : Thu May 16 2002 - 03:35:36 PDT