VIRUS ALERT!!!!!!!! IMPORTANT....READ PLEASE!!!!!

A friend sent me an e-mail telling me that I needed to go to 'start'....'find'....and type in 'SULFNBK.EXE' and if it showed up on my C: drive , DELETE IT IMMEDIATELY and then EMPTY THE RECYCLE BIN!!! It is not due to activate till June 1st and it is supposed to have the ability to wipe out all your files and folders! I DID find it on mine, so immediately sent a warning to all my e-mail friends to check there comps! It only takes a minute to check and its better to be safe than sorry!!!!! June 1st approacheth......

P.S. I found this article on 'hoaxes' but I would STILL rather be safe than sorry since it is not an 'absolute necessity' file... http://www.norton.ch/avcenter/venc/d...e.warning.html
------------------
Nothing is 'idiot-proof'.....they always come out with better idiots.

[This message has been edited by nonboxer (edited 05-27-2001).]

Boy you are quick. I just started a second post on this not realizing you were all over it https://discussions.virtualdr.com/. I just want to know if it is real or not. I'd hate to think that I deleted something I'll need later. We'll see. https://discussions.virtualdr.com/

------------------
You miss 100% of the shots you never take !

http://www.europe.f-secure.com/hoaxes/sulfnbk.shtml

------------------
I want my Win98 Emachine back !!!

MAXXIMILIAN'S

I do trust U and I did have it.
Foud it and remove it from the recycle bin...Thanx NONBOXER....nice weekend

------------------
Glad to Help
99.3% of the times you can found the error in the interfase between the keyboard and the chair

It's on my machine,44 kb application,modified on 4/23/99.Are you sure it's a virus.

Hi Cowboy.......
SULFNBK.EXE is a 'start-up' file that is not totally necessary as far as I can tell (there are others that will do the same job).
But just in case this IS a 'real' problem....I would rather delete it now and add it back in sometime AFTER the June 1st 'activate' date....I believe in 'BETTER SAFE THAN SORRY'! https://discussions.virtualdr.com/ HAPPY Memorial Day Weekend!!!!!


------------------
Nothing is 'idiot-proof'.....they always come out with better idiots.

THANK GOD it's just a hoax! I just tried nonboxers thingy and it showed up in C:\WINDOWS\Command I nearly had a fit! LOL https://discussions.virtualdr.com/

What does 'SULFNBK.EXE' do anyhow? And what of the people who have deleted it?

Thanx

Mo
https://discussions.virtualdr.com/

------------------
You Are The Weakest Link....Goodbye!

When I delete the file it goes into my GoBack program. Will it still execute from there? Found it in Windows\Command.

------------------
52 AND STILL LEARNING

I found this article on 'hoaxes' but I would STILL 'rather be safe than sorry' since it is not an 'absolute necessity' file... http://www.norton.ch/avcenter/venc/d...e.warning.html


I'll reinstall it AFTER the June 1st date, if necessary

P.S. Mo.....it's just a 'start-up' file....not totally necessary as far as I can tell since there are others that do the same job.
------------------
Nothing is 'idiot-proof'.....they always come out with better idiots.

[This message has been edited by nonboxer (edited 05-27-2001).]

Found this

Just what is SULFNBK.EXE? It's a utility shipped as part of the Windows 98 operating system that allows users to restore long file names. Thus, anyone using the Windows 98 operating system would find this file on their system. If the hoax were received by these users, and believed, many might delete the file thinking their antivirus software had somehow failed to detect the virus. In fact, it wouldn't be the first time signature-based scanners failed to detect a new virus, making the entire hoax even easier to believe.

If you aren't confused yet, you should be. Hoaxes survive simply by causing confusion. They provide just enough real sounding information to guarantee a pretty high degree of faith. The more believable, the more users willing to pass it along. Hence hoaxes are very much like a manually driven virus, relying on the user to deliberately pass along the "infection". In the case of the SULFNBK.EXE warning there's a double whammy: as users pass it along, it clogs email servers and drains resources; and those who delete it may need the file at some point. Worse, this could be a stepping stone to a new trend in hoax writing - targeting necessary system files, warning of dire consequences and instructing users to immediately delete them. If the right files were targeted, users following the warning's instructions could find themselves worse off than if a "real" virus had hit. In other words, hoaxes may soon be featuring malicious payloads deliberately executed by the gullible and unsuspecting user.

HERE

How to repair HERE


[This message has been edited by Ed S (edited 05-27-2001).]

Here is a good site to check for hoaxes. It's where I got the link I posted above.

http://www.datafellows.com/news/hoax.htm

Just for future reference.

------------------
I want my Win98 Emachine back !!!

MAXXIMILIAN'S

wouldn't you have to open a e-mail attachement for this virus to work.I never open attachements,I just delete them.

Just for future reference.

Maxx......Isn't it true that ANY '.exe' CAN have a Virus attached to it?? If so, and there IS a possiblity that one may have been attached here....what is a good reason NOT to go ahead and delete it??


------------------
Nothing is 'idiot-proof'.....they always come out with better idiots.

nonboxer, it should be left alone it's installed with every version of Windows, I'm not sure what it does but I do know it should be there.

nonboxer - Are you some kind of idiot?
There's a serious flaw in your 'virus warning' philosophy, partner - you're NOT checking the facts! Go to maximillians' link and READ the damned thing!
Urging people to delete SYSTEM FILES without knowing the the heck you're talking about is the very height of irresponsibility on your part!
Are you just too lazy to check out the hoax sites (which are all over the net) before shooting off a post like that or what?
Don't you think (I'm just assuming you think) that much better advice (if anything) would have been for people to just see if they had the file on their computer and then SCAN IT WITH THEIR UPDATED AV PROGRAM to SEE if it was infected?
Other 'hoax-checking' sites: http://www.antivirus.com/pc-cillin/v...oaxes/hoax.asp http://vil.mcafee.com/hoax.asp .
Tighten up! Pete

------------------
Compaq4/100,4gigHD,52mbRAM,W98SE,IE5.01/SP2,Mod@ http://suggestafix.com/Mod@http://www.morelerbe.com/cgi-bin/ubb-cgi/ultimatebb.cgi[/url]

Philgo......The checking I've done so far says it is a 'start up' file that restores long file names.....I also got the impression that there are other files that do that as well.....I hate being part of a 'hoax' but I'll leave it deleted and restore it AFTER June 1st 'activate' date is past.
P.S. Yes, I am an overly cautious person... https://discussions.virtualdr.com/

------------------
Nothing is 'idiot-proof'.....they always come out with better idiots.

nonboxer,

Here's an example: Let's say I was a person with malicious intent and wanted to wreck other people's machines, but was too lazy to actually write a virus. Instead I just start a hoax chain that tells people to delete files that my virus (Had I actually written one) would destroy. Now I have accomplished my goal without doing much. I just ran a find file on my system for *.exe and turned up 659 files. If I deleted all the executables (potential virus locations), I wouldn't have anything left to run. I wasn't looking to belittle you with "the future reference" remark. Just wanted people to know about the site.

------------------
I want my Win98 Emachine back !!!

MAXXIMILIAN'S

Wooooh Steven, a bit over the top me thinks.

http://www.symantec.com/avcenter/ven...e.warning.html

------------------
SMILE
and post back
[ Book mark this post to find it again]

Quote:

---

Originally posted by StevenPeterYevchak:
nonboxer - Are you some kind of idiot?

---

Steven....Well, YES, I AM 'some' kind of idiot...what kind exactly has not been totally determined yet(I am basically a 'romantic', so there is ONE kind right there).
However, the e-mail warning I received was from a trusted and intelligent friend and the research I did on this file IN SPITE OF THE HOAX WARNING, told me it wouldn't hurt to delete this file for now, and restore afterwards just to be safe. You have a good weekend too. https://discussions.virtualdr.com/

------------------
Nothing is 'idiot-proof'.....they always come out with better idiots.

[This message has been edited by nonboxer (edited 05-27-2001).]

Right click and choose properties and that will show the date of the file and as was stated before the date is from 1999. My go back will show the revisions of this file. As of today there aren't any. The original install is shown and no changes since so I think I'll leave it the way it is. The origination of this hoax is Brazil and I'm assuming that someone ran across the file on their harddrive and didn't know what it did but found out and is banking on the fact that few people will know either. Everybody off the ledge and back inside and please NO MORE COFFEE and least for the rest of the day. I have a friend who is consumed with fears of contrails(the vapor left by a high att. jets in the sky) and there are a great many who believe that the contrails are the result of chemicals the government is spraying on the population to experiment with chem warfare. These people are physically ill and want to sue the government. There is something inherent in the human condition that makes us want to believe this stuff. So delete away and enjoy yourselves.

------------------
My hand is steady, my eyes are cold. A voice inside my head keeps saying "Do as you are told".

erm,
you will actually do what the pesthead who invented the hoax wants you to ??

next they'll want you to do msimn.exe or mprexe.exe
https://discussions.virtualdr.com/


------------------
We can only learn when you tell us what worked. So Please bookmark your topic, and let us know?
You'll help someone with a similar problem when you do.

Kind regards, Jaak

I think it is a general rule of bulletin boards that any post titled in caps with gobs of exclamation marks can safely be left unread.

NonBoxer,
Glad its not a virus, but you also stated that you did research before you took action. This is a quote from your opening post: "I DID find it on mine, so immediately sent a warning to all my e-mail friends to check there comps!It only takes a minute to check and its better to be safe than sorry!!!!! June 1st approacheth......"

Not to belittle, but maybe a little more time researching first before panicking and sounding the alarm.
Thanks to Ed S for the explaination and the link to replace the file for those that panicked and deleted it.
ROFL https://discussions.virtualdr.com/

lol@ slipe! I think I may just USE that as a guideline from now on!

nonboxer - You took that hit with great good grace! Yeah, I cmae down hard - but I truly believe it was warranted in this case. It's just not that hard to check this stuff out beforehand.
Okay, no more caffiene or chemically-laden contrails (or anything else!) for me today! Pete

------------------
Compaq4/100,4gigHD,52mbRAM,W98SE,IE5.01/SP2,Mod@ http://www.suggestafix.com/ & http://www.morelerbe.com/cgi-bin/ubb-cgi/ultimatebb.cgi

Ok, I'm new here, but I'll tell you this.
Get a Win98 installation CD, look in the Precopy1.cab file with any unzipper and PRESTO ! you'll find SULFNBK.EXE. Extract it anywhere on your HD then run a FC of this new file against the original one. They do match.
So I guess this is a nice hoax, invented by someone that also noticed the strange bitmap attached to this file.
If it is not an hoax then it's time to sue Mr.Gates and kick his sanctimonius A..

OK everybody, lay off of nonboxer now, she probably has never come across hoax's like this before, after all she thought that she was doing us all a favour.

Go buy Microsofts Windows 98 resource kit an excellent resource book. You can look up the file (utility) on page 473 under administering long file names. It is a utility to backup files to a server that does not support win 98 long file names. This utility saves and restores long file names.

------------------

Quote:

---

Never be afraid to try something new. Remember that amateurs built the Ark. Professionals built the Titanic.

---

Maxx.....You are absolutely right....this kinda stuff COULD result in some real damage...I've just always had a tendency to believe 'just because I'm paranoid doesn't mean somebody's NOT out to get me' https://discussions.virtualdr.com/
Eminence had an excellent suggestion...always right-clicking and checking 'properties' for date is a GREAT way to check out this stuff....and I will suggest it to any and all in the future! Phil is right too.....my FIRST reaction was to warn my friends thru e-mail and here..Sorry if I 'reacted' too severely. https://discussions.virtualdr.com/

"To Err is Human...To Forgive, Divine"

------------------
Nothing is 'idiot-proof'.....they always come out with better idiots.

No problem, nonboxer. I understand what you were intending. The thought was in the right place. https://discussions.virtualdr.com/ The particular nasty part of hoax like this is the June 1st deadline. It makes people rush into something. Don't know who's worse, the hoaxers or the script kiddies. https://discussions.virtualdr.com/

------------------
I want my Win98 Emachine back !!!

MAXXIMILIAN'S

Nonboxer, anyone can make a mistake. I am sure no one doubts that you meant well. Rather than you being overly cautious, it would appear you were not cautious enough, and you fell for a scam. The older members, who have been around since God, will never even pay attention to an E-Mail Virus Warning, unless the E-Mail comes from someone they know.

If in doubt, check it out. I will not belabour the point, as many others have pointed out the reasonable steps to take, to verify whether the virus is real or a hoax.

One of the real Catch 22's in this situation is that quite often the E-Mail Alert itself, may contain a virus.

Don't let it get to you, The difference between those who make mistakes and those who don't is that the first group learns from their mistakes, and rarely makes the same one twice.

You did your Mea Culpa, and that should suffice for anyone who was inconvenienced. In your defence, the file does have a wierd icon attached to it, so that in itself might have given the impetus to someone to perpetrate the hoax.

Just remember. If you haven't made enough mistakes today, there is always tomorrow.

The ones who worry me are the ones who never make mistakes or do any thing wrong. I am always right says the Emperor, by the way How do you like my new suit?

Peace
https://discussions.virtualdr.com/



------------------
Me.

whhhoa, I got here late, leason learned nonboxer https://discussions.virtualdr.com/ Im sure steve just grabbed that idiot part off you signature in a wild rage.... all is quiet now,,, geeesh https://discussions.virtualdr.com/

------------------
"Onward Through the fog"

ErrorCity

Quote:

---

If you aren't confused yet, you should be.

---

Is this warning not a double edged sword though?

There is the first email that warns of a virus - a hoax.

Then we have the second email that contains that file as an attachment - that file contains a virus!

Quote:

---

"Because of how the events have unfolded in the past few days, it is SecurityPortal's view that Sulfnbk.exe emails, previously identified as a hoax, are actually poorly constructed warnings about Magistr being distributed as an email attachment with the filename Sulfnbk.exe. There is no reason to remove Sulfnbk.exe from the local drive of a machine. However, any copy of Sulfnbk.exe received as an email attachment should be considered infected until scanned with updated antivirus software (which can detect Magistr). Few people actually use this program and nobody needs to be sending it out via email."

---

http://www.securityportal.com/articl...x20010516.html

Basically from what I've read, if the file is on your hd (it should be) then you're fine. If the file is contained within an email, then that file is a potential virus and shouldn't be opened.

Or so I'm told https://discussions.virtualdr.com/

Zin


------------------
Standing on the Shoulder of Giants

...and so the plot thickens!

Thanks for the info, Zinzan.

One thing that could lead people to believe the hoax message is the unusual crappy icon (LFN BK) of the file and this could be what the hoaxer is relying on.

its simply a Log File Backup Tool

------------------
"Onward Through the fog"

ErrorCity

StevenPeterYevchak

Glad you cooled off and realized your over zealous post, and thank you for sort of apologizing to nonboxer.

Hoax's couple of links posted here is a recap:
http://www.norton.ch/avcenter/venc/d...e.warning.html
http://www.europe.f-secure.com/hoaxes/sulfnbk.shtml

My Personal Best http://www.datafellows.com/news/hoax.htm
http://www.antivirus.com/pc-cillin/v...oaxes/hoax.asp
http://vil.mcafee.com/hoax.asp
http://www.securityportal.com/articl...x20010516.html

We must all remember that there are folks out there relatively new to computers and will react to these HOAX virus warnings. Maybe the one that sends these out initially gets their jollies from knowing this.

I average 5 a week at a minimum, some from computer literate folks. I always hit the "REPLY TO ALL" and send them the hoax site above. This seems to help.

As said through research is the key before deleting any files, if your not sure, ask someone, or go to some of the links above.

------------------
Murf

Visit-Murf's Windows Garage
Murf's On-Line Specialty Store

Say there EG from french lick,
is this the kind of stuff your friend is into? http://www.sightings.com/general10/crow.htm

https://discussions.virtualdr.com/ Opovet https://discussions.virtualdr.com/

------------------
I know it is true because I read it on the internet from a VirtualDr link!!

Opovet,
It never occurs to these people that there's a grid pattern because the air traffic controllers have to keep the big airplanes from running into each other because it might be bad, real bad.

------------------
My hand is steady, my eyes are cold. A voice inside my head keeps saying "Do as you are told".

One important point I noted in this thread is the logic that says that I got the email from a trusted friend and I forwarded it on because of that.

The unfortunate thing is that a lot of viruses (and hoaxes) will, almost by definition come from a trusted friend. After all, those are the people with whom you share email traffic, and thus are likely to get fowarded material from.

The key point I want to make is that even though you receive something (a warning or an attachment) from someone you know and trust, that does not make what you receive trustworthy. Bad stuff is most likelky to come from someone you know.

The social engineering on this thing is pretty good, boy, I hope someone doesn't combine meanness with this type of manipulation.

------------------
I try to keep an open mind, but not so open as my brain falls out.