BRETHREN-L Archives

Archiver > BRETHREN > 2002-03 > 1015340948


From: "Avid Angler" <>
Subject: Response to: [BRE] Fw: virus warning- IMPORTANT
Date: Tue, 5 Mar 2002 10:09:08 -0500
References: <05ac01c1c453$f3d903e0$6fc7f7cd@draperfa>


Glen,

Thank you for your e-mail today regarding the 'SULFNBK.EXE Warning'. I always take such warnings seriously make every possible effort to keep the AntiVirus software on my computer current. I recently received an e-mail warning like the one you sent today from two other persons and looked into this alleged virus. However, what I found out is that Symantec, the company that makes the Norton AntiVirus software had this one listed at their AntiVirus Research site as a hoax. The following report is from the Symantec AntiVirus Research Center description of it on their website at the link I have included at the bottom of this page.

Thanks'
Bob Cain

CAUTIONS:
a.. This particular email message is a hoax. The file that is mentioned in the hoax, however, Sulfnbk.exe, is a Microsoft Windows 95/98/Me utility that is used to restore long file names, and like any .exe file, it can be infected by a virus that targets .exe files.

NOTE: The Sulfnbk.exe file is not required to run Windows. It may be necessary if you need to restore long file names if the file names become corrupted. For additional information, read the Microsoft Knowledge Base article Description of Sulfnbk.exe and How to Replace the Program File (Q301316)

b.. The virus/worm W32.Magistr.24876@mm can arrive as an attachment named Sulfnbk.exe. The Sulfnbk.exe file used by Windows is located by default in the C:\Windows\Command folder.

NOTE: The C:\Windows\Command folder is the usual default location for this file. It is possible that if you have a custom installation, or a special configuration that was installed by the computer manufacturer, the file could be in a different location.

If the file is located in any other folder (except as noted), or arrives as an attachment to a email message, then it is possible that the file is infected. In this case, if a scan with the latest virus definitions and with NAV set to scan all files does not detect the file as being infected, quarantine and submit the file to SARC for analysis by following the instructions in the document How to submit a file to SARC using Scan and Deliver.

c.. If you have deleted the Sulfnbk.exe file from the C:\Windows\Command folder and want to know how to restore the file, see the How to restore the Sulfnbk.exe file section at the end of this document.
If you have further questions about this I recommend that you log on to the Symantec AntiVirus Research site at the following link and read their full report.

http://symantec.com/avcenter/venc/data/sulfnbk.exe.warning.html

-----------------------------------------------------------------
----- Original Message -----
From: "gvmdrapr" <>
To: <>
Sent: Tuesday, March 05, 2002 9:41 AM
Subject: [BRE] Fw: virus warning- IMPORTANT


> This warning came from an innocent young person, and I didn't
> believe it at first. When her family sent the warning again, I checked
> and found it and successfully deleted it, without damage, as far as I know.
>
> You should check yours, as it may have been transferred from my
> computer to eveyone who received mail from me, as I understand
> how it works.
>
> Follow the instructions below, and let your computer search for it.
> Be careful that you use the correct finger (mouse button) so you
> don't open it, but delete it instead.
>
> Glen
> > ----- Original Message -----
> > Sent: Tuesday, March 05, 2002 12:27 AM
> > Subject: virus warning- IMPORTANT
> >
> > > Hi everyone, these are directions to look for a virus on your
> > > computer. I'm sending this to everyone in my address book because
> > > that is how it is transferred. I got this from somebody else.
> > > Anyway, I found out that this file WAS on my computer, so please,
> > > Please!!! check your computers!!!!!! I'm sorry if you didn't expect
> > > to be on my address book list, but I haven't updated my address
> > > book in a long time/. I hope everyone
> > > is doing well!
> > > (Please pass this on)
> > >
> > >
> > >
> > > TO ALL WHO ARE IN MY ADDRESS BOOK
> > >
> > > I have been warned about a virus called 'sulfnbk.exe' and found it on
> > > my
> > > machine. It could well have come to your machine as you are in my
> > > email
> > > address book. The virus lies dormant for fourteen days, then kills
> > > your hard
> > > drive, so it is important that you act now. By following the
> > > instructions
> > > below, we were able to delete it. The bad news is that you probably
> > > have it,
> > > as you are in our address book! Please be warned, our Anti-virus
> > > program
> > > (the current version of Norton) did not pick this one up!
> > >
> > > If you follow the instructions below and then see that you have the
> > > virus,
> > > you need to send a similar e-mail to everyone in your address book.
> > > Remove
> > > the virus by following these steps......
> > >
> > > 1. Go to 'Start', the 'Find' or 'Search'.
> > >
> > > 2. In the 'Search for files or folders' type sulfnbk.exe - this is
> > > the na me
> > > of the virus.
> > >
> > > 3. In the 'look in' section, make sure you are searching the 'C'
> > > drive.
> > >
> > > 4. Hit 'Search' or 'Find'.
> > >
> > > 5. If your search finds this file, it will have an ugly black icon
> > > and the
> > > name 'sulfnbk.exe' - DO NOT OPEN IT!
> > >
> > > 6. Right click on the file - go down to 'delete' and left click.
> > >
> > > 7. You will be asked if you want to send the file to the recycling
> > > bin -
> > > say 'Yes'.
> > >
> > > 8. Go back to your desktop, (where all the icons are), and right
> > > click on
> > > the recycling bin - then, either empty the entire bin, or manually
> > > delete the
> > > 'sulfnbk.exe' program.
> > >
> > > 9. If you have found this virus in your system, send this e-mail to
> > > everyone in your address book as this is how the virus is transferred.
> > >
> > > 10. If your search did not find this virus, check all your other
> > > drives,
> > > just to make sure. (Sorry about this , but it came from someone else,
> > > and so
> > > we had to do the same thing)
> > >
> > >
> > >
> > >
> > >
> > > Care2 make the world greener!
> > > http://www.care2.com - Get your Free e-mail account that helps save
> > Wildlife!
>
>
>
> ==== BRETHREN Mailing List ====
> 7 -------------------
> The Fellowship of Brethren Genealogists
> (owners of this list-server)
> Now have a Homepage on The World Wide Web
> To visit it point your browser to
> http://www.cob-net.org/fobg/
> ------------------
>
>


This thread: