Hoax virus alert could cripple Windows Java

[InfoSec News <isn () c4i org>]

http://www.theregister.co.uk/content/55/25294.html

By John Leyden
Posted: 15/05/2002 at 17:21 GMT

Antivirus experts are warning of a hoax virus alert which might trick 
users into deleting an important file on their Windows machines. 

The fake warning tells users to search their hard drives and delete a 
file called jdbgmgr.exe, a filename used by Microsoft's Debugger 
Registrar for Java, which may be present quite legitimately on many 
computers. 

But the Magistr-A virus is capable of sending infected copies of 
jdbgmgr.exe, and this seems to have spawned the misplaced warning, 
which is gaining ground. 

Deleting Microsoft's Debugger Registrar for Java may result in Java 
programmes failing to run after the user has deleted legitimate copies 
of jdbgmgr.exe. 

Rob Rosenberger's Virus Myths first reported on the jdbgmgr.exe hoax 
alert (which he says should more properly be called an urban myth) 
last month. Anti-virus vendor Sophos backed up his analysis today, by 
warning that it has "received enquiries from thousands of concerned 
computer users about the subject". 

The rule of thumb here is if you find a copy of jdbgmgr.exe on your 
computer, then it's probably not infected; but if you receive 
jdbgmgr.exe as an email attachment, then it probably is infected. If 
you receive an unsolicited executable file in your email, delete the 
email. 

One other source of reassurance is that most AV packages have been 
able to detect Magistr-A for over a year, so if your anti-virus 
software is up to date, you will be protected from the Magistr virus 
anyway. 

The panic caused by messages about jdbgmgr.exe is similar in many ways 
to the sulfnbk.exe hoax alert last year, which like the latest panic 
is believed to have been caused by a clueless - but well-meaning - 
user. 

Users should avoid passing on virus warnings to friends, instead 
checking out the facts on an anti-virus Web site (or Vmyths.com). 
Alternatively they could forward the warning whoever in their company 
is responsible for virus protection, so that they can decide if it is 
valid. 



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn'
in the BODY of the mail.