<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 5.50.4522.1800" name=GENERATOR></HEAD>
<BODY>
<DIV> Good My Friends,</DIV>
<DIV> </DIV>
<DIV> Upon receiving a virus warning
on this list this morning, I got online and went to the McAfee and Symantec
websites, as bitter experience has taught me to do. Rest easy folks, this one
was a hoax. The following is quoted from Symantec.com's security response
section:</DIV>
<DIV> </DIV>
<DIV>---------------------------------------------------------------------------------------------------------</DIV>
<DIV>Symantec Security Response - Jdbgmgr.exe file hoax</DIV>
<DIV> Jdbgmgr.exe file hoax<BR> Reported on: April 12, 2002
<BR> Last Updated on: December 03, 2003 10:25:09 AM</DIV>
<DIV> </DIV>
<DIV> This hoax, like the SULFNBK.EXE Warning hoax, tries to encourage you
to delete a legitimate Windows file from your computer. Jdbgmgr.exe is the file
to which the hoax refers, and it is the Microsoft Debugger Registrar for Java.
The Jdbgmgr.exe file may be installed when you
install Windows.</DIV>
<DIV> </DIV>
<DIV>Notes: <BR> Some versions of this hoax take advantage of an actual
threat, the <A href="mailto:W32.bugbear@mm">W32.bugbear@mm</A> worm. The
Jdbgmgr.exe file mentioned in the hoax has a bear icon. The actual <A
href="mailto:W32.bugbear@mm">W32.bugbear@mm</A> worm file is a .exe file and
does not have a bear icon. Other versions of this hoax have slightly different
<BR>ways in which they refer to the Jdbgmgr.exe file, usually in the subject of
the email message. </DIV>
<DIV> </DIV>
<DIV>For example: <BR> Subject: "jdbg" Virus: how to detect and
remove.</DIV>
<DIV> </DIV>
<DIV>NOTE: Recent <BR> The Windows Jdbgmgr.exe file has a teddy bear icon
in the hoax.</DIV>
<DIV> </DIV>
<DIV>CAUTION: A virus can infect Jdbgmgr.exe. The <A
href="mailto:W32.Efortune.31384@mm">W32.Efortune.31384@mm</A> virus in
particular targets this file. Norton AntiVirus has provided protection against
<A href="mailto:W32.Efortune.31384@mm">W32.Efortune.31384@mm</A> since May 11,
2001.</DIV>
<DIV> </DIV>
<DIV>NOTE: If you have already deleted the Jdbgmgr.exe file, in most cases, you
do not need to re-install it. The following quote is extracted from the
Microsoft Knowledge Base article, "Virus Hoax: Microsoft Debugger Registrar for
Java (Jdbgmgr.exe) Is Not a Virus (Q322993)."</DIV>
<DIV> </DIV>
<DIV> "The Microsoft Debugger Registrar for Java (Jdbgmgr.exe) is only
used by Microsoft Visual J++ 1.1 developers.<BR> If you follow the e-mail
message instructions and delete this file, you do not have to recover it unless
you use Microsoft Visual J++ 1.1 to develop Java programs on Windows XP, Windows
NT 4.0, Windows 98 Second Edition, Windows 98, or Windows 95."</DIV>
<DIV> </DIV>
<DIV> If you need to restore this file, follow the instructions in "Virus
Hoax: Microsoft Debugger Registrar for Java (Jdbgmgr.exe) Is Not a Virus
(Q322993)."</DIV>
<DIV> </DIV>
<DIV>Hoax messages<BR> This hoax has appeared in several languages. Some
examples of the exact content, which is copied from the hoax message, are:</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV> English, version 2</DIV>
<DIV> </DIV>
<DIV> Dear All</DIV>
<DIV> </DIV>
<DIV> I'm sorry about this; but I received this E-mail from a
<BR> client regarding a virus that was inadvertently passed
<BR> on to everyone in their address book. I followed the
<BR> instructions and YES, IT WAS ON MY COMPUTER. </DIV>
<DIV> </DIV>
<DIV> Since you are in my address book, I am sending this on
<BR> to you as a precaution. NORTON 2002 DID NOT DETECT IT!
</DIV>
<DIV> </DIV>
<DIV> Here are the instructions on how to check for this virus
<BR> and delete it if you have it too. It only took a few
<BR> minutes, following these instructions. Be sure to notify
<BR> all in your address book too (which will take longer
<BR> than deleting the virus from your computer). </DIV>
<DIV> </DIV>
<DIV> Since you are in our address book, there is a good
<BR> chance you will find it in your computer too unless you
<BR> have an Apple or MAC. The virus (called jdbgmgr.exe) is
<BR> not detected by Norton or McAfee anti-virus systems. The
<BR> virus sits quietly for 14 days before damaging the
<BR> system. It is sent automatically by messenger and by the
<BR> address book, whether or not you sent Emails to your
<BR> contacts. Here's how to check for the virus and how to
<BR> get rid of it:?br> <BR> YOU MUST DO
THIS<BR> 1. Go to Start, Go to Find or Search option
<BR> 2. In the File Folder option, type the name:
jdbgmgr.exe<BR> 3. Be sure you search your C: drive and all
sub-folders <BR> and any other drives you may have.
<BR> 4. Click "Find Now"<BR> 5. The Virus
has a Teddy Bear icon with the name <BR> jdbgmgr.exe DO NOT
OPEN IT <BR> 6. Go to Edit (on menu bar), choose "Select All"
to <BR> highlight the file without opening it.
<BR> 7. Now go to File (on the menu bar) and select Delete.
<BR> It will then go to the Recycle Bin.
<BR> 8. Go to the Recycle Bin and Delete
it<BR> IF YOU FIND THE VIRUS, YOU MUST CONTACT ALL THE PEOPLE
<BR> IN YOUR ADDRESS BOOK, SO THEY CAN ERADICATE IT IN THEIR
<BR> OWN ADDRESS BOOKS. </DIV>
<DIV> </DIV>
<DIV> To do this:<BR> a) Open a new e-mail
message<BR> b) Click the icon of the address book next to the
"TO"<BR> c) Highlight every name and add to
"BCC"<BR> d) Copy this message enter subject paste to
e-mail<BR> Am very sorry about this nuisance. This age of
<BR> technology is not that great sometimes. We are victims!
</DIV>
<DIV> </DIV>
<DIV>--------------------------------------------------------------------------------------------------------</DIV>
<DIV> </DIV>
<DIV> My friends, there are many
strange and twisted people out there, and some of them will delight in having
people they will never meet put themselves to trouble, only to delete legitimate
files and possibly hamstring their own computer (ala sulfnbk.exe hoax).
</DIV>
<DIV> Please, when you get a virus
warning, never assume anything, either about your safety or about your danger.
Go online to McAfee or Symantec and search their security responses. You'd be
amazed at the number of things like this there are.</DIV>
<DIV> </DIV>
<DIV>
In Joyful Service,</DIV>
<DIV> </DIV>
<DIV>
Iain MacCrimmon</DIV>
<DIV> </DIV></BODY></HTML>