# New Virus Hoax... Appears Legit

**URL:** <https://boards.straightdope.com/t/new-virus-hoax-appears-legit/110907>\
**Category:** Miscellaneous and Personal Stuff I Must Share\
**Created:** [May 26, 2002, 1:20pm UTC](https://boards.straightdope.com/t/new-virus-hoax-appears-legit/110907 "2002-05-26T13:20:19Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![Turbo\_Dog](https://avatars.discourse-cdn.com/v4/letter/t/ce73a5/32.png) [@Turbo\_Dog](https://boards.straightdope.com/u/Turbo_Dog)\
**Post date:** [May 26, 2002, 1:20pm UTC](https://boards.straightdope.com/t/new-virus-hoax-appears-legit/110907/1 "2002-05-26T13:20:19Z")

</div>

Hopefully this will save some people a bit of time:

There’s a new one floating around under the guise of being one of those Outlook Auto-sent deals. Here’s a bit of the warning:

> [@](#):
>
> I just received this alert and found the virus in my computer. Please eradicate it in yours&nbsp;.&nbsp;The virus, called jdbgmgr.exe, is NOT detected by Norton or McAfee anti-virus systems. The virus sits quietly for 14 days before damaging the system. It’s sent automatically by the messenger and by the address book, whether or not you sent emails to your contacts. I have checked my computer, found it and deleted it. Here’s how to check for the virus and delete it:  
> Do this:
> 
> 1. Go to start, Find or Search option
> 2. In the files/folders option, type jdbgmgr.exe  
> 3)&nbsp;Be sure you search C:drive  
> 4)&nbsp;Click “find now”  
> 5)&nbsp;the virus has a teddy bear icon with the name jdbgmgr.exe DO NOT OPEN IT!!!  
> 6)&nbsp;Right click and delete it. It will then go to the recycle bin  
> 7)&nbsp;Go to the recycle bin and delete it there as well

jdbgmgr is a legitimate Windows file and is supposed to be there. Ignore the email warning should you get it.

That is all.

---

<div class="post-metadata">

**Author:** ![Ice\_Wolf](https://avatars.discourse-cdn.com/v4/letter/i/dfb087/32.png) [@Ice\_Wolf](https://boards.straightdope.com/u/Ice_Wolf)\
**Post date:** [May 26, 2002, 1:44pm UTC](https://boards.straightdope.com/t/new-virus-hoax-appears-legit/110907/2 "2002-05-26T13:44:02Z")

</div>

Thanks for that, **Turbo Dog** – but why does that file have a teddy bear icon? (I had to take a look – and saw th’ bear.) Is this a touch o’ playful Gates?

---

<div class="post-metadata">

**Author:** ![Reeder](https://avatars.discourse-cdn.com/v4/letter/r/c6cbf5/32.png) [@Reeder](https://boards.straightdope.com/u/Reeder)\
**Post date:** [May 26, 2002, 1:51pm UTC](https://boards.straightdope.com/t/new-virus-hoax-appears-legit/110907/3 "2002-05-26T13:51:45Z")

</div>

Anyone who deletes a file from his computer because an email tells him to deserves whatever he gets.

---

<div class="post-metadata">

**Author:** ![Turbo\_Dog](https://avatars.discourse-cdn.com/v4/letter/t/ce73a5/32.png) [@Turbo\_Dog](https://boards.straightdope.com/u/Turbo_Dog)\
**Post date:** [May 26, 2002, 2:01pm UTC](https://boards.straightdope.com/t/new-virus-hoax-appears-legit/110907/4 "2002-05-26T14:01:25Z")

</div>

**Ice Wolf** I have no idea. It’s used to debug Applets, so probably yes, it’s just a cute thing. But it’s the teddy bear that throws people off. If you delete it, the only thing that will happen is some applets may not play. Nothing major, and easily restored.

---

<div class="post-metadata">

**Author:** ![Tranquilis](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tranquilis/32/3639_2.png) [@Tranquilis](https://boards.straightdope.com/u/Tranquilis)\
**Post date:** [May 26, 2002, 2:08pm UTC](https://boards.straightdope.com/t/new-virus-hoax-appears-legit/110907/5 "2002-05-26T14:08:50Z")

</div>

Another… _fine_… example of ‘social engineering’. :mad:

---

<div class="post-metadata">

**Author:** ![Ice\_Wolf](https://avatars.discourse-cdn.com/v4/letter/i/dfb087/32.png) [@Ice\_Wolf](https://boards.straightdope.com/u/Ice_Wolf)\
**Post date:** [May 26, 2002, 2:28pm UTC](https://boards.straightdope.com/t/new-virus-hoax-appears-legit/110907/6 "2002-05-26T14:28:00Z")

</div>

Computer programming is way out of my league, but it could be the “teddy bear icon” is a programming thing. I found the following on a site regarding [“Programming Humour”](http://f2.org/humour/programming/):

> [@](#):
>
> From “The Practice of Programming” by Brian W Kernighan & Rob Pike:  
> Another effective [debugging] technique is to explain your code to someone else. This will often cause you to explain the bug to yourself. Sometimes it takes no more than a few sentences, followed by an embarrassed “Never mind. I see what’s wrong. Sorry to bother you.” This works remarkbly well; you can even use non-programmers as listeners. **One university computer center kept a teddy bear near the help desk. Students with mysterious bugs were required to explain them to the bear before they could speak to a human counselor.**

Bolding mine.

Seeing as jdbgmgr.exe is the Java Debugging Manager – maybe?

---

<div class="post-metadata">

**Author:** ![Ice\_Wolf](https://avatars.discourse-cdn.com/v4/letter/i/dfb087/32.png) [@Ice\_Wolf](https://boards.straightdope.com/u/Ice_Wolf)\
**Post date:** [May 26, 2002, 2:33pm UTC](https://boards.straightdope.com/t/new-virus-hoax-appears-legit/110907/7 "2002-05-26T14:33:30Z")

</div>

Oh, and Symantec have reported [emails](http://www.europe.f-secure.com/hoaxes/jdbgmgr.shtml) along the hoax’s lines coming apparently from them, but by virus (such as Magistr).

Lovely people out there, I _don’t_ think! ☹

---

<div class="post-metadata">

**Author:** ![Siege](https://avatars.discourse-cdn.com/v4/letter/s/dbc845/32.png) [@Siege](https://boards.straightdope.com/u/Siege)\
**Post date:** [May 26, 2002, 4:13pm UTC](https://boards.straightdope.com/t/new-virus-hoax-appears-legit/110907/8 "2002-05-26T16:13:36Z")

</div>

I read about this on C-Net early last week. It is a hoax, and, IIRC, **Ice Wolf** got it right. jdbgmgr.exe is the Java debugger manager. Perhaps my next thread for IMHO or the Pit should be appropriate punishments for people who spread internet rumors/glurge. ☹

CJ

---

<div class="post-metadata">

**Author:** ![Wicked\_Blue](https://avatars.discourse-cdn.com/v4/letter/w/2acd7d/32.png) [@Wicked\_Blue](https://boards.straightdope.com/u/Wicked_Blue)\
**Post date:** [May 26, 2002, 5:47pm UTC](https://boards.straightdope.com/t/new-virus-hoax-appears-legit/110907/9 "2002-05-26T17:47:13Z")

</div>

I got that email twice, once from my mother and once from my sister-in-law. I smelled hoax as soon as I read it, and did a little research.  
I sent them [here](http://www.europe.f-secure.com/hoaxes/jdbgmgr.shtml) for instructions on replacing that file, and scolded them both for listening to a forwarded email.  
I was also kind enough to include a link to snopes to help them see through any more internet bullshit they may be tempted to forward to me. 🙂

Fighting ignorance since 9/4/73,  
Rose

---

<div class="post-metadata">

**Author:** ![wring](https://avatars.discourse-cdn.com/v4/letter/w/838e76/32.png) [@wring](https://boards.straightdope.com/u/wring)\
**Post date:** [May 26, 2002, 8:33pm UTC](https://boards.straightdope.com/t/new-virus-hoax-appears-legit/110907/10 "2002-05-26T20:33:07Z")

</div>

I got that one twice myself, once from a sister in law who generally knows better. It was so simliar to another one that I’d gotten a few months ago (w/same instructions only icon you needed to look for was a little scarey looking thing), that went around in Cubicle -land. I found (then) the appropriate snopes link and sent that around.  
of course, since then, techno-lad at the cubicle place has put in some filters, so “snopes” is no longer available (it trips the word ‘entertainment’). So, won’t be able to prove it’s a hoax when it goes around there.

---

<div class="post-metadata">

**Author:** ![GuanoLad](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/guanolad/32/42_2.png) [@GuanoLad](https://boards.straightdope.com/u/GuanoLad)\
**Post date:** [May 27, 2002, 1:04am UTC](https://boards.straightdope.com/t/new-virus-hoax-appears-legit/110907/11 "2002-05-27T01:04:27Z")

</div>

I had a customer last week who fell for this one. I don’t blame her, though, it is a lot more convincing than most of them out there.

---

<div class="post-metadata">

**Author:** ![Rushgeekgirl](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rushgeekgirl/32/3715_2.png) [@Rushgeekgirl](https://boards.straightdope.com/u/Rushgeekgirl)\
**Post date:** [May 27, 2002, 6:16am UTC](https://boards.straightdope.com/t/new-virus-hoax-appears-legit/110907/12 "2002-05-27T06:16:38Z")

</div>

I received at least five emails with this warning from…well meaning…friends 🙂

I had it all ready to delete but at the last moment decided to google the file name, just to see exactly what it was.

So glad I did.

---

<div class="post-metadata">

**Author:** ![MisterThyristor](https://avatars.discourse-cdn.com/v4/letter/m/ecccb3/32.png) [@MisterThyristor](https://boards.straightdope.com/u/MisterThyristor)\
**Post date:** [May 28, 2002, 6:51am UTC](https://boards.straightdope.com/t/new-virus-hoax-appears-legit/110907/13 "2002-05-28T06:51:58Z")

</div>

> [@](#):
>
> \*Originally posted by wring \*  
> \*\*I got that one twice myself, once from a sister in law who generally knows better. It was so simliar to another one that I’d gotten a few months ago (w/same instructions only icon you needed to look for was a little scarey looking thing), that went around in Cubicle -land. I found (then) the appropriate snopes link and sent that around.  
> of course, since then, techno-lad at the cubicle place has put in some filters, so “snopes” is no longer available (it trips the word ‘entertainment’). So, won’t be able to prove it’s a hoax when it goes around there. \*\*

Send them to the [CIAC Hoaxbuster’s web site](http://hoaxbusters.ciac.org/). This doesn’t cover urban legends the way Snopes does, but it does cover very well the fake virus alerts, chain mail hoaxes, etc.

Elsewhere on the site (which is sponsered by the Department of Energy) are warnings for real viruses, trojans and worms.
