[Prev][Next][Index][Thread]

sulfnbk.exe HOAX - Re: (meteorobs) Fw: Attention!

sulfnbk.exe HOAX

http://www.symantec.com/avcenter/venc/data/sulfnbk.exe.warning.
htmlULFNBK.EXE Warning

Reported on: April 17, 2001 Last Updated on: January 8, 2002 at
02:34:38 PM PST

Symantec Security Response encourages you to ignore any messages
regarding this hoax. It is harmless and is intended only to cause
unwarranted concern.

Type: Hoax

Description:

The following hoax email was first reported in Brazil, and the
original email was in Portuguese. Other language versions are in
circulation. Currently, the English language versions are most common.

CAUTIONS:

This particular email message is a hoax. The file that is mentioned in
the hoax, however, Sulfnbk.exe, is a Microsoft Windows 95/98/Me
utility that is used to restore long file names, and like any .exe
file, it can be infected by a virus that targets .exe files.

NOTE: The Sulfnbk.exe file is not required to run Windows. It may be
necessary if you need to restore long file names if the file names
become corrupted. For additional information, read the Microsoft
Knowledge Base article Description of Sulfnbk.exe and How to Replace
the Program File (Q301316) The virus/worm W32.Magistr.24876@mm can
arrive as an attachment named Sulfnbk.exe. The Sulfnbk.exe file used
by Windows is located by default in the C:\Windows\Command folder.

NOTE: The C:\Windows\Command folder is the usual default location for
this file. It is possible that if you have a custom installation, or a
special configuration that was installed by the computer manufacturer,
the file could be in a different location.

If the file is located in any other folder (except as noted), or
arrives as an attachment to a email message, then it is possible that
the file is infected. In this case, if a scan with the latest virus
definitions and with NAV set to scan all files does not detect the
file as being infected, quarantine and submit the file to SARC for
analysis by following the instructions in the document How to submit a
file to SARC using Scan and Deliver.

If you have deleted the Sulfnbk.exe file from the C:\Windows\Command
folder and want to know how to restore the file, see the How to
restore the Sulfnbk.exe file section at the end of this document.


English versions

NOTE: Several versions are shown, with the most recent ones shown
first. Many more have been reported. All have the same basic theme.

Version 1 Hello! I just got this letter from my friend and yes I had
the virus as well please follow the directions to see if you have the
virus and then follow the directions to get rid of it. Like my friend
I am sorry that I passed it along as well.

Dear All: We received a virus on a message. I followed the
instructions below and found that it had been spread to our computer.
I followed the instructions and located the virus and was able to
delete it. The bad news is that you probably have it, as you are in My
Address book! More bad news is that my anti virus program did not
detect this virus. The virus lies dormant for 14 days and then "kills"
your hard drive.

Here is what to do. If you follow the instructions and then see that
you have the virus, you need to send a similar e-mail to everyone in
your address book.

Remove the virus by following these steps: 1. Go to "Start." Then to
"Find" or "Search". 2. In the "Search for files or folders" type
sulfnbk.exe -- this is the name of the virus. 3. In the "Look in"
section, make sure you are searching Drive C. 4. Hit "Search" or
"Find". 5. If your search finds this file, it will be an ugly blackish
icon that will have the name sulfnbk.exe. DO NOT OPEN IT! If it does
not show up on your first "Search", try a "New Search." 6. Right click
on the file -- go down to "Delete" and left click. 7. You will be
asked if you want to send the file to the Recycling Bin -- say "Yes".
8. Go to your Desktop (where all your icons are) and right click on
the Recycle Bin and either manually delete the sulfnbk.exe program or
empty the entire bin. 9. If you found the virus on your system, send
this or a similar e-mail to all in your address book because this is
how it is transferred.

Sorry for the trouble and my apologies for having unwittingly
"infected" you. You'll want to check for this virus again for the next
couple days until everyone in your address book has seen it and
deleted it, otherwise, being in their address book, your PC will get
infected all over again so don't forget to check!

Ed Majden wrote:

>     I just received this via Rudy Nagy.  Please check your computer for this
> virus by following the instructions below.  I am sending this to everyone
> that I have sent emails to.  You may or may not have been infected but it is
> worth checking.
> Ed
>
> > > > Subject: Attention!
>
> > > > on your computer*
> > > >
> > > > 1. Click on "Start", then click on "find" or "search"
> > > >
> > > > 2. In the "search for files or folders" type     sulfnbk.exe
> This
> > > > is
> > > > the name of the virus.

The archive and Web site for our list is at http://www.meteorobs.org
To stop getting all email from the 'meteorobs' lists, use our Webform:
http://www.meteorobs.org/subscribe.html
References: