HACKETT-L Archives
Archiver > HACKETT > 2001-05 > 0990906925
From: Rocky Mountain Hi RV Park <>
Subject: [HACKETT-L] SARC Write-up - SULFNBK.EXE Warning
Date: Sat, 26 May 2001 13:55:25 -0600
This is a multi-part message in MIME format.
--------------529796B4437A0780486D53F1
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
This virus is a hoax. Please go to the following link to read about it.
And, please, always check viruses out before you tell anyone.
Marcie== Looking for Hacketts in Sussex Co. NJ c1780's.
http://www.symantec.com/avcenter/venc/data/sulfnbk.exe.warning.html
--
Roy and Marcie Van Deren
http://kalispell.bigsky.net/rmhc/
Rocky Mountain "HI" RV Park
Kalispell, MT 59901
--------------529796B4437A0780486D53F1
Content-Type: text/html; charset=iso-8859-1;
name="sulfnbk.exe.warning.html"
Content-Transfer-Encoding: 8bit
Content-Disposition: inline;
filename="sulfnbk.exe.warning.html"
Content-Base: "http://www.symantec.com/avcenter/venc/
data/sulfnbk.exe.warning.html"
Content-Location: "http://www.symantec.com/avcenter/venc/
data/sulfnbk.exe.warning.html"
<HTML>
<!-- Lotus-Domino (Release 5.0.6a - January 17, 2001 on Windows NT/Intel) -->
<HEAD>
<TITLE>SARC Write-up - SULFNBK.EXE Warning</TITLE><!-- META CONTENT -->
<META content="text/html; charset=windows-1252" http-equiv="Content-Type">
<meta name="Description" content="The following hoax email has been reported in Brazil. The original email is in
Portuguese; it is followed by an English translation.
CAUTION: This particular email message is a hoax. The file that is mentioned in
the hoax, however, Sulfnbk.exe, is a Microsoft Windows utility that is used to
restore">
<meta name="keywords" content="SARC, macro, Trojan horse, virus, worm, Symantec, Internet security, Content security, Internet content, e-mail filtering, mobile code detection, Intrusion detection, Vulnerability assessment, AntiVirus, Anti-virus, Norton, vulnerability assessment, intrusion, intrusion detection, network, network protection, computer, computer safety, SULFNBK.EXE Warning">
<META content="MSHTML 5.00.2314.1000" name="GENERATOR">
<!-- SYMANTEC STYLE SHEETS -->
<STYLE type="text/css">
BODY {
MARGIN: 0pt
}
</STYLE>
<!-- SARC STYLESHEETS -->
<LINK href="http://www.symantec.com/avcenter/style/new.sarc.style.css"; rel="styleSheet">
<LINK href="http://www.symantec.com/avcenter/style/style.css"; rel="styleSheet">
</HEAD>
<BODY TEXT="000000" BGCOLOR="FFFFFF" background="http://www.symantec.com/images/navbar/us.navbar.background.gif"; leftMargin="0" topMargin="0" marginwidth="0" marginheight="0">
<!-- OUTERMOST TABLE - START -->
<table border="0" cellPadding="0" cellSpacing="0" height="100%" width="769">
<TBODY>
<!-- TOP SPACER ROW -->
<TR height="12">
<TD align="left" bgColor="#ffffff" height="12" vAlign="top" width="9">
<IMG height="11" width="9"
src="http://www.symantec.com/images/navbar/us.navbar.clear.gif"></TD>;
<TD align="left" bgColor="#ffffff" height="12" vAlign="top" width="144">
<IMG height="11" width="1"
src="http://www.symantec.com/images/navbar/us.navbar.clear.gif"></TD>;
<TD align="left" bgColor="#ffffff" height="12" vAlign="top" width="616"></TD>
</TR>
<TR align="left" height="234" vAlign="top">
<!-- LEFT SPACER COLUMN -->
<TD align="left" height="234" vAlign="top" width="9"></TD>
<!-- MAIN SYMANTEC NAVIGATOR -->
<TD align="left" height="234" vAlign="top" width="144">
<!-- NAVIGATOR - START -->
<table border="0" cellPadding="0" cellSpacing="0" height="100%" width="144">
<TBODY>
<TR>
<TD align="left" vAlign="top">
<A href="http://www.symantec.com/">;
<IMG alt="Symantec United States" border="0" height="85" width="144"
src="http://www.symantec.com/images/navbar/us.logo.symantec.gif"><BR></A>;
<A href="http://www.symantec.com/globalsites.html">;
<IMG alt="global sites" border="0" height="26" width="144"
src="http://www.symantec.com/images/navbar/us.navbar.globalsites.gif"></A><BR>;
<A href="http://www.symantec.com/product/">;
<IMG alt="products" border="0" height="26" width="144"
src="http://www.symantec.com/images/navbar/us.navbar.products.gif"></A><BR>;
<A href="http://www.symantec.com/purchase/">;
<IMG alt="purchase" border="0" height="26" width="144"
src="http://www.symantec.com/images/navbar/us.navbar.purchase.gif"></A><BR>;
<A href="http://www.symantec.com/techsupp/">;
<IMG alt="service and support" border="0" height="26" width="144"
src="http://www.symantec.com/images/navbar/us.navbar.support.gif"></A><BR>;
<A href="http://www.symantec.com/avcenter/">;
<IMG alt="security updates" border="0" height="26" width="144"
src="http://www.symantec.com/images/navbar/us.navbar.security.gif"></A><BR>;
<A href="http://www.symantec.com/downloads/">;
<IMG alt="downloads" border="0" height="26" width="144"
src="http://www.symantec.com/images/navbar/us.navbar.downloads.gif"></A><BR>;
<A href="http://www.symantec.com/corporate/">;
<IMG alt="about symantec" border="0" height="26" width="144"
src="http://www.symantec.com/images/navbar/us.navbar.about.gif"></A><BR>;
<A href="http://www.symantec.com/search/">;
<IMG alt="search" border="0" height="26" width="144"
src="http://www.symantec.com/images/navbar/us.navbar.search.gif";
width=144></A><BR>
<A href="http://www.symantec.com/feedback/">;
<IMG alt="feedback" border="0" height="26" width="144"
src="http://www.symantec.com/images/navbar/us.navbar.feedback.gif"></A><BR>;
<IMG height="1"
src="http://www.symantec.com/images/navbar/us.navbar.grey.gif"; width="144"><BR><P>
<FONT size="1" face="geneva,arial,helvetica,sans-serif"><BR>
©1995-2001 Symantec Corporation.<BR>
All rights reserved.<BR><BR>
<A href="http://www.symantec.com/legal/legal_note.html">Legal Notices</A><BR>
<A href="http://www.symantec.com/legal/privacy.html">Privacy Policy</A><BR></FONT></P>
</TD>
</TR>
</TBODY>
</TABLE>
<!-- NAVIGATOR - END -->
</TD>
<TD height="234" width="616">
<!-- BANNER GRAPHIC -->
<IMG alt="security updates" height="63" width="594"
src="http://www.symantec.com/images/avcenter/masthead594.gif">;
<!-- OUTER CONTENT TABLE -- START -->
<table border="0" cellPadding="10" width="616">
<TBODY>
<TR vAlign="top">
<TD align="left" vAlign="top">
<!-- INNER CONTENT TABLE -- START -->
<table border="0" cellPadding="0" cellSpacing="0" height="1078" width="596">
<TBODY>
<TR vAlign="top">
<TD align="left" vAlign="top" width="574">
<table border="0" cellPadding="0" cellSpacing="0">
<TBODY>
<TR height="506">
<TD height="506" vAlign="top" width="367">
<!-- VIRUS WRITE-UP - START -->
<!-- VID_XREF= -->
<h1>SULFNBK.EXE Warning</h1>
<!-- DATES -->
<table><tr><td><font face="Arial" size="2"><i>Reported on: April 17, 2001</i></font></font></td></tr><tr><td><font face="Arial" size="2"><i>Last Updated on: May 15, 2001 at 05:28:25 PM PDT</i></font></font></td></tr></table>
<!-- Buttons (Printer Friendly, etc) -->
<BR><!-- PRINTER FRIENDLY BAR -->
<TABLE WIDTH=100% BORDER=0 CELLSPACING=0 CELLPADDING=2 BORDER=1>
<TR VALIGN=top>
<TD BGCOLOR="E8E8E8"><a href="./pf/sulfnbk.exe.warning.html"><img src="http://www.symantec.com/techsupp/images/ver4/buttons/button_kb_printerfriendly.gif"; width=34 height=30 alt="Printer-friendly version" border="0" align="left"><FONT FACE="Arial" SIZE="2">Printer-friendly version</FONT></a></TD>
</TR>
</TABLE>
<!-- END PRINTER FRIENDLY NAVBAR --><BR>
<P>The following hoax email has been reported in Brazil. The original email is in Portuguese; it is followed by an English translation.
<P><B>CAUTION:</B> This particular email message is a hoax. The file that is mentioned in the hoax, however, Sulfnbk.exe, is a Microsoft Windows utility that is used to restore long file names, and like any .exe file, it can be infected by a virus that targets .exe files.<BR>
<BR>
<BR>
<B>Original Portuguese version</B>:<BR>
<BR>
Vocs acreditam que uma amiga da lista enviou um alerta e os procedimentos que deveriam ser tomados para a possvel deteco do maledeto SULFNBK.EXE. e eu fui conferir s por desencargo de conscincia. Pois ...O bichinho tava l, escondidinho at da McAfee e do Norton, talvez esperando algum gatilho pr comear a trabalhar, n?<BR>
A vo, moada, as orientaes que eu segui risca e que me levaram ao tal coisinha rum:<BR>
<BR>
1 - Iniciar/Localizar Pastas. Digite o nome do "mardito": SULFNBK.EXE<BR>
2 - Se for encontrado, abra o Windows Explorer, v at a pasta onde ele se encontra alojado e delete-o de l ou do prprio ambiente do Localizar; - No click com o boto esquerdo sobre ele e no abra o arquivo nem em caso de incndio, ok?<BR>
3 - Apenas delete o bichinho.<BR>
4 - O meu estava em Windows/Command. <BR>
5 - O vrus da pessoa que passou o aviso estava em Windows/Config.<BR>
<BR>
Sim, o Norton e nem o McAfee no detectou. <BR>
No sabemos se ele faz algum estrago na mquina, mas acho que ningum aqui vai querer testar para saber, n?<BR>
Gente, sem brincadeiras, j tirei o meu daqui....<BR>
E nem imaginava que tivesse hspedes no PC. <BR>
Minha vacina est super-atualizada!!!<BR>
Faam o mesmo, ok?<BR>
<BR>
<BR>
<B>Translated English version</B>:<BR>
<BR>
Do you believe that a friend of mine sent me an alert and the procedure that we have to follow for the possible infection of SULFNBK.EXE. And I had checked, just to make sure. An then... the file was there, hidden even of McAfee and Norton, maybe waiting something to start work.<BR>
Well, see bellow the procedure that I followed step by step, and I found the file:<BR>
<BR>
1. Start/Find Folders. Type the file name: SULFNBK.EXE<BR>
2. If it find, open Windows Explorer, browse into the folder where the file is and delete it. Do not click with left button on the file and do not open it.<BR>
3. Just delete it<BR>
4. Mine was on Windows/Command<BR>
5. The virus from the person who gave the alert was on Windows/Config<BR>
<BR>
Yes, Norton and McAfee do not detect it.<BR>
We do not know if it makes some damage on the machine, but I think that anybody will not want to test it to know, will it?<BR>
Folks, this is not a fun, I delete it from my computer.<BR>
And my definitions are updated.<BR>
Do it the same, ok?<BR>
<!-- a.k.a. -->
<!-- category -->
<P><B>Category:</B> <A HREF="http://www.symantec.com/avcenter/refa.html#hoax">Hoax</A>;
<!-- infection length -->
<!-- virus definitions -->
<!-- threat assessment -->
<!-- wild - section -->
<!-- damage - section -->
<!-- distribution - section -->
<!-- technical description -->
<!-- removal instructions -->
<!-- additional information -->
<BR>
<B><BR>
Please ignore any messages regarding this hoax and do not pass on messages. Passing on messages about the hoax only serves to further propagate it.<BR>
</B>
<p><img src="http://www.symantec.com/avcenter/graphics/black.gif"; width="380">
<BR>
<!-- author / coauthor -->
<p><i>Write-up by: Patrick Martin</i>
<!-- taf - Tell-A-Friend -->
<!--<I>Updated: September 12, 2000 1:09:05 PM</I>--><!-- begin taf -->
<form method="POST" action="http://www.symantec.com/avcenter/cgi-bin/taf.cgi">;
<input type=image src="http://www.symantec.com/sabu/graphics/taf_env.gif"; border=0 alt="Tell A Friend">
<I><FONT SIZE=2 FACE="Arial">Tell a Friend about this Write-Up</FONT></I>
<input type="hidden" name="title" value="SULFNBK.EXE Warning">
</form>
<!-- end taf -->
<BR>
<!-- VIRUS WRITE-UP - END -->
<!-- SIDEBAR -->
</TD>
<TD height="506" width="10">
<IMG alt="" border="0" height="1" width="10"
src="http://www.symantec.com/images/us.avcenter.clear.gif"></TD>;
<TD align="left" height="506" vAlign="top" width="197">
<!-- Begin Sidebar Area -->
<table border="0" cellspacing="0" cellpadding="0" width="175">
<!-- SECURITY UPDATES -->
<tr>
<td width="5"></td>
<td width="190"><a href="http://www.symantec.com/avcenter/"; class="sidebartitlelink">Security Updates</a></td>
</tr>
<tr>
<td width="5"></td>
<td width="190"><font size="1" face="geneva,arial,helvetica,sans-serif">Symantec AntiVirus Research Center and SWAT</font></td>
</tr>
<!-- Spacer Row -->
<tr>
<td width="5"></td>
<td width="190"><img src="http://www.symantec.com/images/clear.gif"; width="1" height="5" border="0"></td>
</tr>
<!-- DOWNLOAD VIRUS DEFINITIONS -->
<tr>
<td width="5"></td>
<td width="190"><a href="http://www.symantec.com/avcenter/download.html"; class="sidebartitlelink">Download Virus Definitions</a></td>
</tr>
<tr>
<td width="5"></td>
<td width="190"><font size="1" face="geneva,arial,helvetica,sans-serif">Keep your protection up to date</font></td>
</tr>
<!-- Spacer Row -->
<tr>
<td width="5"></td>
<td width="190"><img src="http://www.symantec.com/images/clear.gif"; width="1" height="5" border="0"></td>
</tr>
<!-- VIRUS ENCYCLOPEDIA -->
<tr>
<td width="5"></td>
<td width="190"><a href="http://www.symantec.com/avcenter/vinfodb.html"; class="sidebartitlelink">Virus Encyclopedia</a></td>
</tr>
<tr>
<td width="5"></td>
<td width="190"><font size="1" face="geneva,arial,helvetica,sans-serif">Search for Information on Viruses, Worms and Trojan Horses</font></td>
</tr>
<!-- Spacer Row -->
<tr>
<td width="5"></td>
<td width="190"><img src="http://www.symantec.com/images/clear.gif"; width="1" height="5" border="0"></td>
</tr>
<!-- VIRUS HOAXES -->
<tr>
<td width="5"></td>
<td width="190"><a href="http://www.symantec.com/avcenter/hoax.html"; class="sidebartitlelink">Virus Hoaxes</a></td>
</tr>
<!-- Section Description -->
<tr>
<td width="5"></td>
<td width="190"><font size="1" face="geneva,arial,helvetica,sans-serif">Information on Virus Hoaxes</font></td>
</tr>
<!-- Spacer Row -->
<tr>
<td width="5"></td>
<td width="190"><img src="http://www.symantec.com/images/clear.gif"; width="1" height="5" border="0"></td>
</tr>
<!-- JOKES -->
<tr>
<td width="5"></td>
<td width="190"><a href="http://www.symantec.com/avcenter/jokes.html"; class="sidebartitlelink">Jokes</a></td>
</tr>
<!-- Section Description -->
<tr>
<td width="5"></td>
<td width="190"><font size="1" face="geneva,arial,helvetica,sans-serif">Information on Jokes</font></td>
</tr>
<!-- Spacer Row -->
<tr>
<td width="5"></td>
<td width="190"><img src="http://www.symantec.com/images/clear.gif"; width="1" height="5" border="0"></td>
</tr>
<!-- NEWSLETTER -->
<tr>
<td width="5"></td>
<td width="190"><a href="http://www.symantec.com/avcenter/newsletter.html"; class="sidebartitlelink">Newsletter</a></td>
</tr>
<tr>
<td width="5"></td>
<td width="190"><font size="1" face="geneva,arial,helvetica,sans-serif">Email Sent from the Symantec AntiVirus Research Center</font></td>
</tr>
<!-- Spacer Row -->
<tr>
<td width="5"></td>
<td width="190"><img src="http://www.symantec.com/images/clear.gif"; width="1" height="5" border="0"></td>
</tr>
<!-- CALENDAR -->
<tr>
<td width="5"></td>
<td width="190"><a href="http://www.symantec.com/avcenter/calendar"; class="sidebartitlelink">Virus Calendar</a></td>
</tr>
<tr>
<td width="5"></td>
<td width="190"><font size="1" face="geneva,arial,helvetica,sans-serif">Monthly Calendar Listing Trigger Dates for Viruses</font></td>
</tr>
<!-- Spacer Row -->
<tr>
<td width="5"></td>
<td width="190"><img src="http://www.symantec.com/images/clear.gif"; width="1" height="5" border="0"></td>
</tr>
<!-- REFERENCE AREA -->
<tr>
<td width="5"></td>
<td width="190"><a href="http://www.symantec.com/avcenter/refa.html"; class="sidebartitlelink">Reference Area</a></td>
</tr>
<tr>
<td width="5"></td>
<td width="190"><font size="1" face="geneva,arial,helvetica,sans-serif">Learn About Virus Detection Technologies</font></td>
</tr>
<!-- Spacer Row -->
<tr>
<td width="5"></td>
<td width="190"><img src="http://www.symantec.com/images/clear.gif"; width="1" height="5" border="0"></td>
</tr>
<!-- SUBMIT VIRUS SAMPLES -->
<tr>
<td width="5"></td>
<td width="190"><a href="http://www.symantec.com/avcenter/submit.html"; class="sidebartitlelink">Submit Virus Samples</a></td>
</tr>
<tr>
<td width="5"></td>
<td width="190"><font size="1" face="geneva,arial,helvetica,sans-serif">Send Suspected Threats for Review</font></td>
</tr>
<!-- Spacer Row -->
<tr>
<td width="5"></td>
<td width="190"><img src="http://www.symantec.com/images/clear.gif"; width="1" height="5" border="0"></td>
</tr>
<tr>
<td width="5"></td>
<td width="185"><br><br><a href="http://www.check-mark.com/cgi-bin/redirect.pl"><img src="http://a1828.g.akamai.net/7/1828/76/dbb6451e976141/www.symantec.com/avcenter/graphics/checkmark.gif"; border="0"></a></td>
</tr>
</table>
<!-- End Sidebar Area -->
<!-- End Write-up Table -->
</TD>
</TR>
</TBODY>
</TABLE>
<!-- End Overall Table -->
</TD></TR></TBODY></TABLE>
<!-- INNER CONTENT TABLE -- END -->
</TD></TR></TBODY></TABLE>
<!-- OUTER CONTENT TABLE -- END -->
</TD></TR></TBODY></TABLE>
<!-- OUTERMOST TABLE - END -->
</BODY>
</HTML>
<BR>
</BODY>
</HTML>
--------------529796B4437A0780486D53F1--
This thread:
| [HACKETT-L] SARC Write-up - SULFNBK.EXE Warning by Rocky Mountain Hi RV Park <> |