SULFNBK Hoax

Content

SULFNBK Hoax

Type: Hoax
SubType: -
Discovery Date: 04/20/2001
Length: N/A
Minimum DAT: N/A ( )
Updated DAT: N/A ( )
Minimum Engine: 5.1.00
Description Added: 05/10/2001
Description Modified: 12/28/2001 3:00 PM (PT)

Risk Assessment

Corporate User: N/A
Home User: N/A

Tab Navigation

Characteristics

AVERT HOAX Notice!!

McAfee AVERT Labs would like to inform you of a new email HOAX.

This email message is just a HOAX. Although, the SULFNBK.EXE file may become infected by a number of valid viruses (most commonly W32/Magistr@MM, the details of this HOAX message are not based on actual events.

We are advising users who receive the email to delete the message and DO NOT pass it on as this is how an email HOAX propagates.

SULFNBK.EXE is a Microsoft Windows utility that is used to restore long file names

It uses this icon:

Small

Large

Below is the actual text from the message that may be received via email. There are numerous variations on these messages.

(English version)

A VIRUS could be in your computer files now, dormant but will become active on June 1. Try not to USE your Computer on June 1st. FOLLOW DIRECTIONS BELOW TO CHECK IF YOU HAVE IT AND TO REMOVE IT NOW. No Virus software can detect it. It will become active on June 1, 2001. It might be too late by then. It wipes out all files and folders on the hard drive. This virus travels thru E-mail and migrates to the 'C:\windows\command' folder. To find it and get rid of it off of your computer, do the following.
Go to the "START" button.
Go to "FIND" or "SEARCH"
Go to "FILES & FOLDERS"
Make sure the find box is searching the "C:" drive.
Type in: SULFNBK.EXE
Begin search.

If it finds it, highlight it. Do not double click or file will automatically open.
Go to 'File' and delete it.
Close the find Dialog box
Open the Recycle Bin
Find the file and delete it from the Recycle bin
You should be safe.

The bad part is: You need to contact everyone you have sent ANY E-mail to in the past few months. Many major companies have found this virus on their computers. Please help your colleagues and friends !

DO NOT RELY ON YOUR ANTI-VIRUS SOFTWARE. McAFEE and NORTON CANNOT DETECT IT BECAUSE IT DOES NOT BECOME A VIRUS UNTIL JUNE 1ST.

WHATEVER YOU DO, DO NOT OPEN THE FILE!!!

(Spanish version)

(Portuguese version)

Gente, � s�rio. N�o deletem antes de ler. Quem me passou essa mensagem foi
um amigo e o v�rus SULFNBK.EXE estava escondido nos nossos computadores.
Leiam com aten��o, t�?
� verdade !!!!
Eu verifiquei e tinha o virus nos computadores aqui da empresa que possuem
acesso � internet.
 N�o � piadinha nem pegadinha (juro!)

"Alerta Vermelho!

Pessoal, procedimentos que deveriam ser tomados para a poss�vel detec��o do
maledeto SULFNBK.EXE. e eu fui conferir s� por desencargo de consci�ncia.
Pois �...O bichinho tava l�, escondidO at� do Norton, talvez esperando algum
gatilho pr� come�ar a trabalhar......

A� v�o as orienta��es que eu segui � risca e que me levaram ao tal coisinha
ru�m:

1 - Iniciar/Localizar Pastas. Digite o nome do animal: SULFNBK.EXE
2 - Se for encontrado, abra o Windows Explorer, v� at� a pasta onde ele foi
encontrado e n�o abra o arquivo nem em caso de inc�ndio, ok?
3 - Apenas delete o cara de l�.
4 - O meu estava em Windows/Command.

Sim, o Norton n�o detectou.
Sim, o Viruscan da Mcafee n�o detectou.
N�o sabemos se ele faz algum estrago na m�quina, mas acho que ningu�m aqui
vai querer testar para saber!!!!
Eu nem imaginava que tivesse h�spedes no meu PC.
Meu Norton est� atualizado e o Scandisk da MCafee tamb�m!

(Dutch slightly modified version of the Sulfnbk.exe Hoax )

(Italian slightly modified version of the Sulfnbk.exe Hoax )

(French version)

ATTENTION VIRUS!
Nous pr�venons toutes les personnes � qui nous avons certainement envoy� des
E-mail les mois pr�c�dents, ceci suite � un message d'un interlocuteur
habituel. Le virus "fnbk" �tait effectivement dans notre disque dur mais n'a
pas �t� actif � ce jour sur notre ordinateur.  Ce virus est programm� pour
devenir actif. A cause du d�lai d'activation, il n'est pas d�tect� par les
logiciels de d�tection des virus comme McAfee ou Norton.
Personne ne sait depuis quand le virus est dans le syst�me. Il est possible
que cela fasse plusieurs mois.
Quand ce virus deviendra actif, il supprimera tous les dossiers et fichiers
de votre (ou vos) disques durs. Le virus se propage par E-mail et infiltre
le dossier 'C:\WINDOWS\COMMAND'.  Pour le trouver et le supprimer de votre
ordinateur, suivez les instructions suivantes :
	Cliquez sur "D�marrer"
	Choisissez "Rechercher"
	Choisissez "Fichiers ou dossiers"
	Allez � "Rechercher dans " et s�lectionner "disques durs locaux
(C:)" Dans la ligne "Nom du fichier ou dossier recherch�", tapez :
SULFNBK.EXE Si le fichier est trouv�, s�lectionnez le mais NE L'OUVREZ PAS
!!!
(pour le s�lectionner sans l'ouvrir, faites "�dition" puis "s�lectionner
tout",
		car en principe il n'y a qu'un seul fichier).
		Dans le menu fichier, cliquez sur "Supprimer".
		Fermer la fen�tre "r�sultat de la recherche".
		Videz la corbeille.
La bonne nouvelle c'est que maintenant vous �tes en s�curit�. La mauvaise
nouvelle, c'est que si vous avez trouv� ce virus sur votre ordinateur, vous
risquez d'avoir contamin� les personnes auxquelles vous avez envoy� des
mails depuis plusieurs mois. C'est ce qui m'arrive et c'est la raison de ce
message. Alors faites comme moi, contactez les  personnes de votre carnet
d'adresses et envoyez leur ce message imm�diatement.

Symptoms

(German slightly modified version of the Sulfnbk.exe Hoax )

FW:WICHTIGE NACHRICHT, an alle, die von uns in letzter Zeit eMails erhalten
haben. Es Kann sein, dass mit den eMails ein VIRUS �bertragen wurde, der
nur selten von Anti-Viren-Programmen aufgesp�rt wird. So haben auch wir 
ihn erhalten und vermutlich an Sie weitergegeben! Dieser Virus ist so
programmiert, dass er sich erst zu einem sp�teren Zeitpunkt aktiviert und 
daher von vielen Virenprogrammen nicht erkannt wird. Sobald sich der Virus 
aktiviert, l�scht er alle Dateien/Ordner von der Festplatte. Er verbreitet 
sich �ber E-Mail und infiltriert C:\WINDOWS\COMMAND.
Um den Virus aufzusp�ren und zu vernichten bitte folgende Schritte
beachten:In Windows 95/98 auf "Start" klicken dann "Suchen", "Dateien / Ordner",Name: SULFNBK.EXE, Suche in: "C". Ist der Rechner "infiziert", erscheint die Datei im Ergebnisfeld.Diese Datei darf AUF KEINEN FALL ge�ffnet werden.Bitte wie folgt weiterverfahren:"Bearbeiten", dann "Alles markieren" (es steht nur diese Datei im Ergebnisfeld) und die Datei L�schen.Zum Schluss auf jeden Fall noch den Papierkorb leeren.
Die gute Nachricht ist, dass Ihr/Euer Rechner jetzt sauber ist.
Die schlechte Nachricht: wenn der Virus gefunden wurde, so sind
vermutlich auch die Rechner von Leuten befallen, die von Ihnen/Euch
in letzter Zeit Mails erhalten haben. Darum bitte diese Mail unbedingt
an alle schicken, die in den letzten Monaten e-mails von Ihnen bekommen haben.

Method of Infection

Removal

In the event that SULFNBK.EXE was deleted erroneously, the following method may be used to restore the file from backup. Note: WindowsNT/2000/XP systems do not need or use SULFNBK.EXE and restoration of this file is not available or required for these systems.

-- Windows 98 Instructions --

1) Click START - RUN, type SFC and hit ENTER
2) In the "Specify the system file you would like to restore" field, type C:\WINDOWS\COMMAND\SULFNBK.EXE and hit ENTER
3) In the RESTORE FROM field, type in the path to your WINDOWS CAB files
(ie. C:\WINDOWS\OPTIONS\CABS)
(ie. D:\WIN98 where D is the drive letter assigned to your CD-ROM)
4) Click OK and continue with the restore function

-- End Windows 98 Instructions --

-- Windows ME Instructions --

1) Click START - RUN, type MSCONFIG and hit ENTER
2) Click the Extract Files button
3) In the "Specify the system file you would like to restore" field, type C:\WINDOWS\COMMAND\SULFNBK.EXE and hit ENTER
4) In the RESTORE FROM field, type in the path to your WINDOWS CAB files
(ie. C:\WINDOWS\OPTIONS\INSTALL)
5) Click OK and continue with the restore function

-- End Windows ME Instructions --

Variants

N/A

All Information

Overview -

Aliases

sulfnbk.exe

Characteristics

Characteristics -

AVERT HOAX Notice!!

McAfee AVERT Labs would like to inform you of a new email HOAX.

We are advising users who receive the email to delete the message and DO NOT pass it on as this is how an email HOAX propagates.

SULFNBK.EXE is a Microsoft Windows utility that is used to restore long file names

It uses this icon:

Small

Large

Below is the actual text from the message that may be received via email. There are numerous variations on these messages.

(English version)

DO NOT RELY ON YOUR ANTI-VIRUS SOFTWARE. McAFEE and NORTON CANNOT DETECT IT BECAUSE IT DOES NOT BECOME A VIRUS UNTIL JUNE 1ST.

WHATEVER YOU DO, DO NOT OPEN THE FILE!!!

(Spanish version)

(Portuguese version)

"Alerta Vermelho!

A� v�o as orienta��es que eu segui � risca e que me levaram ao tal coisinha
ru�m:

(Dutch slightly modified version of the Sulfnbk.exe Hoax )

(Italian slightly modified version of the Sulfnbk.exe Hoax )

(French version)

Symptoms

Symptoms -

(German slightly modified version of the Sulfnbk.exe Hoax )

Method of Infection

Method of Infection -

Removal -

-- Windows 98 Instructions --

-- End Windows 98 Instructions --

-- Windows ME Instructions --

-- End Windows ME Instructions --

Variants

Variants -

N/A

McAfee > Theat Center > Virus Detail Page

Navigation

Utility Navigation

Content

SULFNBK Hoax

Type

SubType

Discovery Date

Length

Minimum DAT

Updated DAT

Minimum Engine

Description Added

Description Modified

Risk Assessment

Tab Navigation

Overview

Aliases

Characteristics

Symptoms

Method of Infection

Removal

Variants

Variants

All Information

Overview -

Aliases

Characteristics

Characteristics -

Symptoms

Symptoms -

Method of Infection

Method of Infection -

Removal -

Removal -

Variants

Variants -

Threat Resources

Footer