The following is an archived copy of a message sent to a Discussion List run by the Campaign Against Sanctions on Iraq.

Views expressed in this archived message are those of the author, not of the Campaign Against Sanctions on Iraq.

[Main archive index/search] [List information] [Campaign Against Sanctions on Iraq Homepage]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

SULFNBK VIRUS HOAX Re: warning:you may have a virus in your computer

Title: Message
SULFNBK.EXE Virus Hoax:
 
Thank you for the warning but the message is a virus hoax. Do NOT follow the instructions.to delete files in your computer.  Thank you Eric for your message just received.  This gives more information.
 
Please check any virus warning with an anti-virus website before sending it to other people.
You can check this one for yourself on the Symantec (Norton Anti-Virus) website at:
See description below.  Best wishes. 
 
Dai Williams, UK
============================================
Reference from Symantec website:

SULFNBK.EXE Warning

Reported on: April 17, 2001
Last Updated on: December 13, 2001 at 04:37:44 PM PST

Printer-friendly versionPrinter-friendly version Tell a Friend
Symantec Security Response encourages you to ignore any messages regarding this hoax. It is harmless and is intended only to cause unwarranted concern.

Type: Hoax

Description:

The following hoax email was first reported in Brazil. The original email is in Portuguese; it is followed by several other versions.


CAUTIONS:

  • This particular email message is a hoax. The file that is mentioned in the hoax, however, Sulfnbk.exe, is a Microsoft Windows utility that is used to restore long file names, and like any .exe file, it can be infected by a virus that targets .exe files.
  • The virus/worm W32.Magistr.24876@mm can arrive as an attachment named Sulfnbk.exe. The Sulfnbk.exe file used by Windows is located in the C:\Windows\Command folder. If the file is located in any other folder, or arrives as an attachment to a email message, then it is possible that the file is infected. In this case, if a scan with the latest virus definitions and with NAV set to scan all files does not detect the file as being infected, quarantine and submit the file to SARC for analysis by following the instructions in the document How to submit a file to SARC using Scan and Deliver.
  • If you have deleted the Sulfnbk.exe file from the C:\Windows\Command folder and want to know how to restore the file, see the How to restore the Sulfnbk.exe file section at the end of this document.
English versions

Version 1
Do you believe that a friend of mine sent me an alert and the procedure that we have to follow for the possible infection of SULFNBK.EXE. And I had checked, just to make sure. An then... the file was there, hidden even of McAfee and Norton, maybe waiting something to start work.
Well, see bellow the procedure that I followed step by step, and I found the file:

1. Start/Find Folders. Type the file name: SULFNBK.EXE
2. If it find, open Windows Explorer, browse into the folder where the file is and delete it. Do not click with left button on the file and do not open it.
3. Just delete it
4. Mine was on Windows/Command
5. The virus from the person who gave the alert was on Windows/Config

Yes, Norton and McAfee do not detect it.
We do not know if it makes some damage on the machine, but I think that anybody will not want to test it to know, will it?
Folks, this is not fun, I deleted it from my computer.
And my definitions are updated.
Do the same, ok?

Version 2
This one has additional text stating that the virus will activate on June 1st.

It was brought to my attention yesterday that a virus is in circulation via email. I looked for it and to my surprise I found it on mine. ..
Please follow the directions and remove it from yours TODAY!!!!!!!

No Virus software can detect it.  It will become active on June 1, 2001.
It might be too late by then. It wipes out all files and folders on
the hard drive. This virus travels thru E-mail and migrates to the
'C:\windows\command' folder. 

The bad part is: You need to contact everyone you have sent ANY
E-mail to in the past few months. Many major companies have found this virus on
their computers. Please help your friends !!!!!!!!

DO NOT RELY ON YOUR ANTI-VIRUS SOFTWARE. McAFEE and NORTON CANNOT
DETECT IT BECAUSE IT DOES NOT BECOME A VIRUS UNTIL JUNE 1ST.

WHATEVER YOU DO, DO NOT OPEN THE FILE!!!

==
How to restore the Sulfnbk.exe file
If you have deleted this file, restoration is optional. Sulfnbk.exe is a Microsoft Windows utility that is used to restore long file names. It is not needed for normal system operation. If you want to restore it, there is more than one way to do this. See the information that follows.

NOTE: The instructions in this document are provided for your convenience. The extraction of Windows files uses Microsoft programs and commands. Symantec does not provide warranty support for or assistance with Microsoft products. If you have any questions, please see your Windows documentation or contact Microsoft.

Windows Me
If you are using Windows Me, you can restore the file using the System Configuration Utility.
    1. Click Start and then click Run.
    2. Type msconfig and then press Enter.
    3. Click Extract Files. The "Extract one file from installation disk" dialog box appears.
    4. In the "Specify the system file you would like to restore" box, type the following, and then click Start:

    c:\windows\command\sulfnbk.exe

    NOTE: If you installed Windows to a different location, make the appropriate substitution.

    The Extract File dialog box appears.

    5. Next to the "Restore from" box, click Browse, and browse to the location of the Windows installation files. If they were copied to the hard drive, this is, by default, C:\Windows\Options\Install. You can also insert the Windows installation CD in the CD-ROM drive and browse to that location.
    6. Click OK and follow the prompts.


Windows 98
If you are using Windows 98, you can restore the file using the System File Checker.
    1. Click Start and then click Run.
    2. Type sfc and then press Enter.
    3. Click "Extract one file from installation disk."
    4. In the "Specify the system file you would like to restore" box, type the following, and then click Start:

    c:\windows\command\sulfnbk.exe

    NOTE: If you installed Windows to a different location, make the appropriate substitution.

    The Extract File dialog box appears.

    5. Next to the "Restore from" box click Browse, and browse to the location of the Windows installation files. If they were copied to the hard drive, this is, by default, C:\Windows\Options\Cabs. You can also insert the Windows installation CD in the CD-ROM drive and browse to that location.
    6. Click OK and follow the prompts.

Windows 95 (or alternative method for Windows 98/Me)
If you are using Windows 95, you need to use the extract command. This can also be used on Windows 98/Me.
    1. Click Start, point to Find or Search, and then click Files or Folders.
    2. Make sure that "Look in" is set to (C:) and that Include subfolders is checked.
    3. In the "Named" or "Search for..." box, type:

    precopy1

    4. Click Find Now or Search Now. If it does not exist on the hard drive, then insert the Windows installation CD and repeat the search on that drive.
    5. When you find the file, write down the location of Precopy1, for example, C:\Windows\Options\Cabs. This is your Source Path.
    6. The general form of the Extract command is:

    extract <Source Path>\precopy1.cab sulfnbk.exe /L c:\windows\command

    So if the source path is C:\Windows\Options\Cabs, then the Extract command becomes:

    extract c:\windows\options\cabs\precopy1.cab sulfnbk.exe /L c:\windows\command

    NOTE: If you installed Windows to a different location, make the appropriate substitution.

    7. Click Start and then click Run.
    8. Type the following, making the appropriate substitutions as previously noted

    extract <Source Path>\precopy1.cab sulfnbk.exe /L c:\windows\command

    9. Click OK.

For more information on how to use the Microsoft Extract command, see the Microsoft Knowledge Base document, How to Extract Original Compressed Windows Files, Article ID: Q129605


Write-up by: Patrick Martin

----- Original Message -----
Sent: Friday, December 21, 2001 7:36 AM
Subject: FW: warning:you may have a virus in your computer

 
 
HI all please read this warning as fast as you could
 
 
 
-----Original Message-----
From: h.alrawi [mailto:h.alrawi@uruklink.net]
Sent: Thursday, December 20, 2001 1:05 AM
To: ali hassan
Cc: D.MAZIN; ahmed; Yasser AL-Rawi; wissam dawaf; Samar AL-Rawi; Salam AL-Rawi; RESCO; Osama Al_Rawi; Nawfal AL-Rawi; Nagham AL-Jelibi; Mohammed AL-abbasi; Luca BRUNO; kaisobaidi; hasnaa alkhafaf; Guy Gerro; Ghazwan Al-Mukhtar; Francois OUF; firas shuga3; Farah Othman
Subject: Fw: warning:you may have a virus in your computer
Importance: High

 
----- Original Message -----
From: Nawfal
Sent: Wednesday, December 19, 2001 7:22 PM
Subject: Fw: warning:you may have a virus in your computer

 
----- Original Message -----
From: alamood
Sent: Wednesday, December 19, 2001 3:03 PM
Subject: Fw: warning:you may have a virus in your computer

Take this message and do as it say it is real!!!!!!
 
Faris Al-Amood.
----- Original Message -----
From: al.saab
Sent: Wednesday, December 19, 2001 1:07 AM
Subject: warning:you may have a virus in your computer

Dear All,
 
I have received this message today warning me that an ugly virus may be in my computer.  The person who sent it said their PC was infected. 
 
I made a search and found the virus and have destroyed it.  The bad news is that your probably have it, as you are in "MY"address book and this is how it is transferred.  This virus lies dormant for 14 days and then kills your hard drive.
 
By following the instructions below I was able to delete the virus.  If you find the virus, you need to send a similar e-mail to everyone in your address book.
 
The Virus can be removed by following these steps;

1.  Go to "Start" button.  Then to "Find" or "Search".
2.  In the "Search for files or folders" type - sulfnbk.exe - "this is the name of the virus".
3.  In the "Look In" section, make sure you are searching the C Drive.
4.  Hit "Search" or "Find"
5.  You are looking for an ugly blackish icon that will have the name - sulfnbk.exe.  "DO NOT OPEN IT"!
6.  Highlight the file - go to "Delete".
7.  Send the file to the Recycling Bin.
 
8.  Delete it again from your Recycle Bin or empty the entire bin.
9.  If you found this virus on your system, send this message to all your address book because this is how it is transferred.

10. If it does not show up on your first "Search" try a "New Search".

I'm sorry for the trouble and our apologies for having unwittingly "infected" you, should it have been passed on to you.

Kind regards
 
Mohammed AL-SAAB

GIF image

GIF image

[Campaign Against Sanctions on Iraq Homepage]