# MA-042.052002: MyCERT Advisory - JDBGMGR.EXE Hoax

**Date:** 17 May 2002  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-042.052002  
**Advisory ID:** MA-042.052002

---

MyCERT received quite a number of reports and enquiries regarding the circulation of an email with the title: "Virus Warning or "Virus Alert", about a new virus that is spreading by MSN Messenger. The name of this virus is jdbgmgr.exe and it is sent automatically by the Messenger and by the address book too.
MyCERT has discovered that this email is a typical [hoax](/en/resources/malware/hoax/main/detail/527/index.html) similar to the SULFNBK.EXE (http://www.symantec.com/avcenter/venc/data/sulfnbk.exe.warning.html) hoax. The hoax requests users to delete a legitimate Windows file, Jdbgmgr.exe from their computers. The Jdbgmgr.exe, is a Java Debugger Manager. It is a Microsoft file that is installed when you install Windows. It has a teddy bear icon as described in the hoax.
If you have deleted the Jdbgmgr.exe file in your computer, you may notice some Java applets may not run correctly. However, this is not a critical system file. The file version may vary depending on the operating system and version of Internet Explorer. The deleted jdbgmgr.exe file can be recovered. Pls refer to the following detail information below.
Detail information on this hoax and to recover the deleted jdbgmgr file is available at:
F-Secure
http://www.antivirus.com/vinfo/hoaxes/hoax5.asp?HName=%22Economic+Slow+Down+in+US%22+Email+Hoax
Symantec
http://securityresponse.symantec.com/avcenter/venc/data/economic.slow.down.html
We advise users to ignore any messages/emails regarding this hoax and do not pass on messages or email. Passing on messages about the hoax only serves to further propagate it.
Users also can verify any emails which they are unsure of hoax or real virus, with MyCERT or with their ISPs or with their Anti-virus vendors.