False Virus Warnings - New one in UK...

Subject: RE: False Virus Warnings - New one in UK...
From: Sorcha
Date: 01 Aug 02 - 09:03 PM

Oh for pity's sake................

Subject: RE: False Virus Warnings - New one in UK...
From: Jeri
Date: 01 Aug 02 - 08:34 PM

Mr Virus, I remember seeing that "BUDDYLST" hoax something like 4 years ago. Is it on the loose again? Best to verify EVERYthing before you take action.

Subject: RE: False Virus Warnings - New one in UK...
From: GUEST,Mr. Virus
Date: 01 Aug 02 - 07:58 PM

Objet: Fw: Danger - Virus - Danger

This is not a joke This information came from Microsoft. Please pass it on to anyone you know who has access to the Internet. You may receive an apparently harmless Budweiser screen saver, entitled BUDDYLST.SIP. If you do -DO NOT OPEN IT UNDER ANY CIRCUMSTANCES, but delete it immediately. Once opened, you will lose EVERYTHING on your PC. Your hard disc will be completely destroyed and the person who sent you the message will have access to your name and password via the Internet. As far as we know, the virus was circulated yesterday morning. It's a new virus, and extremely dangerous. Please copy this information and e-mail it to everyone in your address book. We need to do all we can to block this virus. AOL has confirmed how dangerous it is, and there is no anti-virus program yet, which is capable of destroying it. Please take all the necessary precautions and pass this information on to your friends, acquaintances and work colleagues

Subject: RE: False Virus Warnings - New one in UK...
From: treewind
Date: 30 May 02 - 01:29 PM

Escamillo suggests:

Add a new e-mail address to your list, named !!!000. This is an invalid address but Outlook Express will allow you to enter it. It is automatically placed first in the list. As soon as a virus opens the list and tries to start sending mails, it produces the error "invalid address" and is stopped.

Not true. It might work on some viruses but it doesn't really protect you much: lots of viruses bypass that - for instance some have their own SMTP client code so MS outlook plays not part in the sending of copies.

Anahata

Subject: RE: False Virus Warnings - New one in UK...
From: Mr Red
Date: 30 May 02 - 01:28 PM

don't forget the sucker punch - following the sflnbak.exe virus haox at least one virus was named sflnbak.exe. If Norton says it's kosher I guess it is OK. Keep updating those definitions.

Subject: RE: False Virus Warnings - New one in UK...
From: selby
Date: 30 May 02 - 01:25 PM

I got badly stung with a virus so much so that my ISP took me of line I was advised to get a anti virus from a free web site www.grisoft.com It is brilliant it checks everyday for viruses and updates and its FREE. I suspect everybody on mudcat was attacked by me I knew nothing about it,I thought I had norton anti virus working for me including updates but I had failed with a subscribtion apparently. Keith

Subject: RE: False Virus Warnings - New one in UK...
From: Escamillo
Date: 30 May 02 - 06:23 AM

A good trick to prevent uncontrolled output of e-mails from your computer :

Add a new e-mail address to your list, named !!!000. This is an invalid address but Outlook Express will allow you to enter it. It is automatically placed first in the list. As soon as a virus opens the list and tries to start sending mails, it produces the error "invalid address" and is stopped.

If you actually want to send email to all your list, you can withdraw that address and reenter it afterwards. But please don't do it, you may hardly find a reason for massive e-mails, which are most annoying, are a good vehicle for worms and viruses, and could disclose hundreds of private addresses to the cyberocean full of pirates.

Unknown senders or suspicious subjects: DELETE them without reading, EVEN when they don't include attachments. Update to Outlook Express v6. Set preferences to "downloads deactivated". Use a firewall like ZoneAlarm, check your disk with Ad-Aware spy detector (www.lavasoft.org).Make frequent backup copies, and pray.

Un abrazo - Andrés (paranoid ? me? )

Subject: RE: False Virus Warnings - New one in UK...
From: JohnInKansas
Date: 30 May 02 - 04:27 AM

CarolC -

If you found the jdbgmgr.exe file at all, it's likely that it is still where it's supposed to be. It should be in your Windows\System directory, if you want to verify absolutely that it's in the right place. (The "System" directory may be called WINNT\System32 if you have a "late model" version of Windows.)

In all the versions I have available to look at, the file size is 15KB. If the location is in System or System32 directory, and file size is 15 KB, I would be inclined to assume all is well, and just keep it in mind if I found out that some Java thing wasn't working later.

(It's not very likely I'd ever notice, because java apps are pretty much turned off on all my machines.)

John

Subject: RE: False Virus Warnings - New one in UK...
From: CarolC
Date: 30 May 02 - 01:33 AM

Thanks John. This is what I've done. I hit "start", and selected "search/for files and folders". Then typed "exe" into the "search for files or folders named" box. This brought up a whole bunch of things, two of which had teddy bear icons. One of them says SETDEBUG under it, and the other says JDBGMGR under it.

Can I assume that the one that says JDBGMGR is the one I want, and the fact that I found it with the search I did means it's still where it belongs?

Subject: RE: False Virus Warnings - New one in UK...
From: JohnInKansas
Date: 30 May 02 - 01:10 AM

Carol C -

Depending on which version of Windows you're using, the jdbgmgr.exe file should be in \Windows\System or in WINNT\System32 directory.

Windows does incorporate some "self-fix" features that are not too well known. Particularly for things in the "System" directory (dir name may vary) when a Registry entry calls for a file that is missing, Windows can look in backup stores and sometimes can replace it. It is possible that you deleted it, and Windows put it back - although this can only(?) happen during a reboot in the ordinary manner of things.

If your machine is set up with an "administrator" password, it might also be set to prohibit a "user" from messing with things in the System folder. In the usual course of things, it would give you an "error message" that says something like "access not authorized," if this were the case; but there are a lot of variables in possible configurations.

There is also a setting in Win Explorer (some versions) where you can "turn off" the "confirm before delete" function, and avoid the "Are you sure you want to delete ...." message that you would otherwise get. (Right click on the "Recycle Bin" in most versions.) If the "confirm" switch is off, other messages - like "xxx.exe is a program file. If you delete it you may not be able to run some programs" may also fail to display.

With the "confirm" function off, a delete may fail without informing you that it wasn't done - in some configurations.

You cannot (normally) delete a file that is open or in use. Since the file in question is a "java" file (sort of a "webby" thing), if you are using "web view" and are using an "animated" desktop of any sort, it may be opened automatically(?) and any attempt to delete it would fail.

In short - there are a number of things that could cause what you describe, (allow for the detail in your description) but there is little that someone without access to your machine is likely to sort out. You will need to decide whether it worries you enough to seek local help - or stand by and see if someone else sees a better answer.

John

Subject: RE: False Virus Warnings - New one in UK...
From: CarolC
Date: 29 May 02 - 11:49 PM

I just got sucked into the JDBGMGR hoax. (Fortunately, I did not send it to anyone else.) The warning was from my father and he knows a lot more about computers than I do, so I figured it was for real.

Now here's what I'd like to know, if anyone can tell me. Every time I tried to delete this file, when I went back to see if it was gone, it was back again. And when I tried to reinstall (per the Norton instuctions on what to do if we got snookered), I got a message saying that this file could not be deleted or copied.

So can anyone tell me if that means that I didn't ever succeed in deleting it in the first place, and it's still where it belongs?

Grateful in advance for any answers.

Subject: RE: False Virus Warnings - New one in UK...
From: GUEST,Maurice
Date: 18 May 02 - 02:44 PM

can anybody give me some advice, please? I think I might have picked up some sort of virus or Trojan...everytime I go online four folders appear in my "internet explorer content" folder. If I delete them they reappear soon afterwards. They change their names from time to time, names for example "7kekzx1d" "Cpyzcd2z" "Feznclru"...etc. I have an up-to-date antivirus program and a firewall. I don't know much about computers, so can somebody tell me if these things have an innocent explanation, and if not how do I get rid of them permanently?...Thanks!

Subject: RE: False Virus Warnings - New one in UK...
From: Stilly River Sage
Date: 18 May 02 - 01:02 PM

That klez worm and it's variants is a nasty little sucker. It tries to disable your antivirus software (so if you disabled it yourself to download and install someting, be sure to engage it again immediately) and it has a variety of "random" wording it uses to blend in with regular email more easily. I was peppered with this stuff, a lot of it apparently from a Canadian address. My Norton antivirus quarantined the one that got through (I send spam text to the Earthlink "Spaminator" and the first piece I received looked like spam). But like McGrath, I wasn't infected by the virus and didn't spread it. I had the misfortune to be in the address book of some computer that did get it, and was named as the "sender" of the posts. I've received a lot of error messages, so it was sent widely, including to technical places with automated reply messages.

Always search out a reliable primary source of virus and/or hoax information before acting on forwarded warnings from friends.

SRS

Subject: RE: False Virus Warnings - New one in UK...
From: Mr Red
Date: 18 May 02 - 12:23 PM

I got a real virus hit that Norton warned me about but I would have ignore the rock.exe file as a matter of policy from anyone let alone a couple who would not (in my estimation) want to play "a excite game" (sic). It really is a matter of logic - does the person telling you this know what they are telling you? Are you confident of the PC literacy of the person who told them. OK a warning is a warning - so ask someone who does know about these things.
The problem with the sflnbak.exe hoax is that a genuine virus now uses a file with that name.
Sucker punch?
Solution? - Norton! et al.

Subject: RE: False Virus Warnings - New one in UK...
From: 8_Pints
Date: 17 May 02 - 09:59 PM

One mechanism for verifying data coming from authenticated users without interference is a 'Digital signature'.

Most email systems now support this, but not many people use the facility yet.

Have a look at the email or browser help facility for more explanation.

Bob vG

Subject: RE: False Virus Warnings - New one in UK...
From: McGrath of Harlow
Date: 17 May 02 - 12:29 PM

One of those got me a bit unpopular a few months back when it send out virus loaded emails to everybody in the address list on an email that had been sent to me, with my name as sender. Some of them were people I'd never heard of till they emailed me to ask what was going on.

My anti-virus security is a bit better now, touch wood.

Here is a genuine virus warning about a particularly sneaky one. Thisnis an email I received from Pete Shaw who runs some folk sites in the UK:

I spend time debunking hoax virus warnings and telling people never to open unknown email attachments, and I have been caught by one, which I'm warning you about below.

I get regular Microsoft update announcements and what looked like another arrived from Microsoft Corporation Security Centre, email address [e-mail] headed Internet Security Update. The email looked genuine but advises you to run the attachment, which is q216309.exe

The attachment contains the W32Gibe@mm worm. Full details of it are at http://securityresponse.symantec.com/avcenter/venc/data/[e-mail]

Luckily I spotted it immediately, so no-one else got it from me.

Don't open questionable attachments, although how you're now supposed to tell, now they come disguised like this, I don't know.

Subject: RE: False Virus Warnings - New one in UK...
From: MMario
Date: 17 May 02 - 12:16 PM

there is one (I don't remember the name - I think it is a klez variant) that now subs names from the address book into the "From" field when it sends out it's little e-mail worms.

Subject: RE: False Virus Warnings - New one in UK...
From: Joe Offer
Date: 17 May 02 - 12:12 PM

Good point, Pete. I've received a number of well-intentioned messages from friends lately, apologizing for having sent me a virus and instructing me to delete this or another file from my computer. Usually, I just go to www.google.com and search for the name of the file I'm instructed to delete. So far, it has been a hoax every time.

Usually, I go to symantic.com or mcafee.com, but you can do a limited check for virus information a lot quicker on Google.

I'm wondering about something else. Last week, I got an e-mail that was supposedly from Norton Antivirus, and appeared to have been sent out automatically. It said I had sent such-and-such a virus to so-and-so. So-and-so is not on my e-mail address book, and I have no record of having sent e-mail to this person. I scanned my computer, and there was no virus. Is the e-mail I got another kind of hoax?

-Joe Offer-

Subject: False Virus Warnings - New one in UK...
From: clansfolk
Date: 17 May 02 - 06:27 AM

Just had another false "Virus" - "delete this file email.." just so you're aware - deleting the mentioned will cause you problems....

details.....

Fake virus warning causing users harm

Well-meaning souls tell each other to delete important system files... d'oh!

A fake virus warning telling users to delete important Windows files is spreading fast.

Anti-virus experts say the false virus warning, titled jdbgmgr.exe, which is a filename used by MS Debugger Registrar for Java, is being spread by well-meaning users. The email-based hoax invites users to search and delete the Debugger file. Once the file is deleted it may prevent some Java programmes running.

The fake warning was first spotted by Rob Rosenberger who runs a hoax alert service. His warning was then backed up by anti-virus vendor Sophos.

Graham Cluley, senior technology consultant at Sophos, said: "If you receive an unsolicited executable file in your email, simply delete the email. This is a confusing hoax, but the message is simple: you should never launch or open unsolicited code on you computer."

For related news, see:
The virus hoax that costs drives

www.silicon.com/a44768
Industry cried 'wolf' when it should have been crying 'Magistr'

www.silicon.com/a44906 Worm threatens web-based email accounts
www.silicon.com/a44849

Top ten viruses for May
www.silicon.com/a44839

hope the above information is of use to someone out there

Pete