Its a hoax. Don't try to remove it
Here is what Symantec has to say about it
Jdbgmgr.exe file hoax
Reported on: April 12, 2002
Last Updated on: July 16, 2002 07:22:47 AM PDT
Symantec Security Response encourages you to ignore any messages regarding this
hoax. It is harmless and is intended only to cause unwarranted concern.
Type: Hoax
This is a hoax that, like the SULFNBK.EXE Warning hoax, tries to persuade you
to delete a legitimate Windows file from your computer. The file that the hoax
refers to, Jdbgmgr.exe, is a Java Debugger Manager. It is a Microsoft file that
is installed when you install Windows.
It has a teddy bear icon as described in the hoax:
CAUTION: Jdbgmgr.exe, like any file, can become infected by a virus. One virus
in particular, W32.Efortune.31384@mm, targets this file. Norton AntiVirus has
provided protection against W32.Efortune.31384@mm since May 11, 2001.
NOTE: If you have already deleted the Jdbgmgr.exe file, some Java applets may
not run correctly. This is not a critical system file. The file version may
vary with your operating system and version of Internet Explorer. If you want
to restore the file, read the instructions in the How to restore the
Jdbgmgr.exefile section at the end of this document.
Hoax message
This hoax has appeared in several languages. Some are as follows:
English
> Date: Mon, 9 Sep 2002 14:53:51 +0100
> From: Duncan Haldane <[log in to unmask]>
> Subject: Fw:
> To: [log in to unmask]
>
> Dear all
>
> I'm truly sorry to have to forward this message I received this morning but
> would ask you please to follow the instructions and delete this latent virus
> from your address books. I apologise for inadvertently passing a virus on.
>
> Yours
>
> Duncan Haldane
>
>
>
>> This is a multi-part message in MIME format.
>>
>> ------=_NextPart_000_0027_01C257A0.2C78E6E0
>> Content-Type: text/plain;
>> charset="iso-8859-1"
>> Content-Transfer-Encoding: quoted-printable
>>
>> Dear All,
>>
>> We am very sorry about this: a friend of ours has just told us she may =
>> have infected our Address Book with a virus - we checked, and she is =
>> right. As you are in our Address Book, your computer may also, in turn, =
>> have been infected. The
>> virus ( called jdbgmgr.exe ) is not detected by Norton or McAfee =
>> anti-virus
>> systems. The virus sits dormant for 14 days before damaging the system. =
>> It's
>> sent automatically by messenger and by the address book, whether or not =
>> you
>> sent e-mails to your contacts. Here is how to check for the virus and =
>> how to
>> get rid of it.
>>
>> 1. Go to Start, click on Find or Search option.
>> 2. In the Files/Folders option, write the name jdbgmgr.exe
>> 3. Be sure you search your C: drive and any other drives you may have.
>> 4. Click "Find now "
>> 5. The virus has a teddy bear icon with the name jdbgmgr.exe DO NOT OPEN =
>> IT.
>> 6. Go to edit; choose "select all" to highlight the file without opening =
>> it
>> 7. Now go to file and select "delete". It will then go to the Recycle =
>> Bin
>> 8. Go to the Recycle Bin and delete it there as well.
>>
>> IF YOU FIND THIS VIRUS YOU MUST CONTACT ALL THE PEOPLE IN YOUR ADDRESS =
>> BOOK
>> SO THAT THEY CAN ERADICATE IT IN THEIR OWN ADDRESS BOOKS. I AM EXTREMELY
>> SORRY ABOUT THIS I'M SURE THAT AS I HAVE FOUND IT EVERYONE IN MY ADDRESS
>> BOOK WILL HAVE IT AS WELL.
>>
>> To do this open new e-mail message
>> Click the photo of address book next to "To"
>> Click every name and add it to BCC
>> Copy this message, enter Subject, paste to e-mail, send.
>>
>>
>> Sorry to add an extra job. We hope all is well with you
>> and yours,
>>
>> Best Wishes
>> Richard and Caroline Tracey
>>
>>
>> ------=_NextPart_000_0027_01C257A0.2C78E6E0
>> Content-Type: text/html;
>> charset="iso-8859-1"
>> Content-Transfer-Encoding: quoted-printable
>>
>> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
>> <HTML><HEAD>
>> <META content=3D"text/html; charset=3Diso-8859-1" =
>> http-equiv=3DContent-Type>
>> <META content=3D"MSHTML 5.00.2314.1000" name=3DGENERATOR>
>> <STYLE></STYLE>
>> </HEAD>
>> <BODY bgColor=3D#ffffff>
>> <DIV><FONT face=3DArial size=3D2>Dear All,<BR><BR>We am very sorry about =
>> this: a=20
>> friend of ours has just told us she may have infected our Address Book =
>> with a=20
>> virus - we checked, and she is right. As you are in our Address =
>> Book, your=20
>> computer may also, in turn, have been infected. The<BR>virus ( called=20
>> jdbgmgr.exe ) is not detected by Norton or McAfee anti-virus<BR>systems. =
>> The=20
>> virus sits dormant for 14 days before damaging the system. It's<BR>sent=20
>> automatically by messenger and by the address book, whether or not =
>> you<BR>sent=20
>> e-mails to your contacts. Here is how to check for the virus and how =
>> to<BR>get=20
>> rid of it.<BR><BR>1. Go to Start, click on Find or Search option.<BR>2. =
>> In the=20
>> Files/Folders option, write the name jdbgmgr.exe<BR>3. Be sure you =
>> search your=20
>> C: drive and any other drives you may have.<BR>4. Click "Find now =
>> "<BR>5. The=20
>> virus has a teddy bear icon with the name jdbgmgr.exe DO NOT OPEN =
>> IT.<BR>6. Go=20
>> to edit; choose "select all" to highlight the file without opening =
>> it<BR>7. Now=20
>> go to file and select "delete". It will then go to the Recycle Bin<BR>8. =
>> Go to=20
>> the Recycle Bin and delete it there as well.<BR><BR>IF YOU FIND THIS =
>> VIRUS YOU=20
>> MUST CONTACT ALL THE PEOPLE IN YOUR ADDRESS BOOK<BR>SO THAT THEY CAN =
>> ERADICATE=20
>> IT IN THEIR OWN ADDRESS BOOKS. I AM EXTREMELY<BR>SORRY ABOUT THIS I'M =
>> SURE THAT=20
>> AS I HAVE FOUND IT EVERYONE IN MY ADDRESS<BR>BOOK WILL HAVE IT AS=20
>> WELL.</FONT></DIV>
>> <DIV><FONT face=3DArial size=3D2><BR>To do this open new e-mail =
>> message<BR>Click the=20
>> photo of address book next to "To"<BR>Click every name and add it to =
>> BCC<BR>Copy=20
>> this message, enter Subject, paste to e-mail, send.<BR><BR><BR>Sorry to =
>> add an=20
>> extra job. We hope all is well with you<BR>and yours,<BR><BR>Best=20
>> Wishes<BR>Richard and Caroline Tracey<BR></DIV></FONT></BODY></HTML>
>>
>> ------=_NextPart_000_0027_01C257A0.2C78E6E0--
>>
>>
>
********************************************************************************
Benjamin Richler
Institute of Microfilmed Hebrew Manuscripts
Jewish National and University Library
POB 34165 Jerusalem 91341
Tel. 972-2-6586233 FAX 972-2-6511771
http://sites.huji.ac.il/jnul/imhm/
|
