http://www.theregister.co.uk/content/55/25294.html By John Leyden Posted: 15/05/2002 at 17:21 GMT Antivirus experts are warning of a hoax virus alert which might trick users into deleting an important file on their Windows machines. The fake warning tells users to search their hard drives and delete a file called jdbgmgr.exe, a filename used by Microsoft's Debugger Registrar for Java, which may be present quite legitimately on many computers. But the Magistr-A virus is capable of sending infected copies of jdbgmgr.exe, and this seems to have spawned the misplaced warning, which is gaining ground. Deleting Microsoft's Debugger Registrar for Java may result in Java programmes failing to run after the user has deleted legitimate copies of jdbgmgr.exe. Rob Rosenberger's Virus Myths first reported on the jdbgmgr.exe hoax alert (which he says should more properly be called an urban myth) last month. Anti-virus vendor Sophos backed up his analysis today, by warning that it has "received enquiries from thousands of concerned computer users about the subject". The rule of thumb here is if you find a copy of jdbgmgr.exe on your computer, then it's probably not infected; but if you receive jdbgmgr.exe as an email attachment, then it probably is infected. If you receive an unsolicited executable file in your email, delete the email. One other source of reassurance is that most AV packages have been able to detect Magistr-A for over a year, so if your anti-virus software is up to date, you will be protected from the Magistr virus anyway. The panic caused by messages about jdbgmgr.exe is similar in many ways to the sulfnbk.exe hoax alert last year, which like the latest panic is believed to have been caused by a clueless - but well-meaning - user. Users should avoid passing on virus warnings to friends, instead checking out the facts on an anti-virus Web site (or Vmyths.com). Alternatively they could forward the warning whoever in their company is responsible for virus protection, so that they can decide if it is valid. - ISN is currently hosted by Attrition.org To unsubscribe email majordomoat_private with 'unsubscribe isn' in the BODY of the mail.
This archive was generated by hypermail 2b30 : Thu May 16 2002 - 03:35:36 PDT