I have a file in /windows/command called
sulfnbk.exe
U have been told this is a dormant virus set to activate on June 1st. Is this true or is anyone familar with what this file does?
This is a troublesome hoax that is being passed around. Although Norton admits that the sulfnbk.exe is susceptible to a virus, because it is a normal Windows file, this message is classified as a hoax.
The virus that infects it IS detectable by all AV software! There is no software that can detect a hoax but, just by reading the message you can see it is a hoax… Hoaxes tend to have a familiar ring to them.
SULFNBK.EXE, a utility shipped as part of the Windows 98 operating system that allows users to restore long file names, and now the victim of a bogus virus warning. The hoax message urges users to search their systems for the presence of SULFNBK.EXE and, if found, delete it. Of course, it's a legitimate Win98 operating system file, so anyone running Windows 98 will find it. And many, it seems, have deleted it. Following are the steps to take to restore SULFNBK.EXE from your Windows 98 operating system CD. You will want to have your Windows 98 operating CD in the CD-ROM drive bay. If the program autoruns (launches), just click Exit.
A word of caution. Any executable has the potential to be infected. Any executable received via email should be considered infected until proven otherwise. There is a vast difference between the SULFNBK.EXE file that legitimately resides on your hard drive, and an SULFNBK.EXE arriving via email. The Magistr virus randomly selects, infects, and sends portable executable files (PE EXE) files less than 132Kb in length. This makes SULFNBK.EXE, with its paltry 45,056 file size, a perfect candidate. Thus, if you were to receive SULFNBK.EXE via email, consider it infected.
Windows 98 includes a handy tool known as the System File Checker which can be used to restore damaged or deleted files. To open SFC, click "Start" | "Run" and type "SFC" without the quotes. Click "OK". System File Checker will launch a dialogue box with two choices. Choose "Extract one file from installation disk".
In the "Specify the system file you would like to restore" box, type "sulfnbk.exe" (without the quotes). Click "Start".
You will be prompted to specify the location that contains the file you want to extract and the destination directory for that file. You will need to input the "Restore from" location and the "Save file in" location.
"Restore from" will be the win98 folder on your Windows 98 operating system CD. It is easiest and most accurate to use the "Browse" button to locate and select the folder. The "Save file in" destination folder is the Windows directory and Command subdirectory. For example,
C:\WIN98\COMMAND
When both boxes have been filled in, click OK. You should receive a message stating "The file has been successfully extracted". Click OK and close any remaining SFC dialog boxes.
One final note, if you're one of the unfortunate who purchased a computer that comes with the notorious "Restore CD" only, you probably will not be able to use that CD to restore the file (or install new hardware, or update/replace drivers, or do much of anything except restore your system to factory defaults). Contact your computer vendor and ask them to send you a true copy of the Windows 98 operating system that you purchased with your system. Oh... and good luck getting them to send it.
Jim Hardin
2 Intern
•
2053 Posts
108
0
Posted May 30th, 2001 19:00
This is a troublesome hoax that is being passed around. Although Norton admits that the sulfnbk.exe is susceptible to a virus, because it is a normal Windows file, this message is classified as a hoax.
The virus that infects it IS detectable by all AV software! There is no software that can detect a hoax but, just by reading the message you can see it is a hoax… Hoaxes tend to have a familiar ring to them.
If in doubt, go to Norton’s site http://www.symantec.com/avcenter/index.html and see what they say about it.
Here is the Long version from McAffe's site
http://antivirus.about.com/compute/antivirus/library/weekly/mcurrent.htm?once=true
SULFNBK.EXE, a utility shipped as part of the Windows 98 operating system that allows users to restore long file names, and now the victim of a bogus virus warning. The hoax message urges users to search their systems for the presence of SULFNBK.EXE and, if found, delete it. Of course, it's a legitimate Win98 operating system file, so anyone running Windows 98 will find it. And many, it seems, have deleted it. Following are the steps to take to restore SULFNBK.EXE from your Windows 98 operating system CD. You will want to have your Windows 98 operating CD in the CD-ROM drive bay. If the program autoruns (launches), just click Exit.
A word of caution. Any executable has the potential to be infected. Any executable received via email should be considered infected until proven otherwise. There is a vast difference between the SULFNBK.EXE file that legitimately resides on your hard drive, and an SULFNBK.EXE arriving via email. The Magistr virus randomly selects, infects, and sends portable executable files (PE EXE) files less than 132Kb in length. This makes SULFNBK.EXE, with its paltry 45,056 file size, a perfect candidate. Thus, if you were to receive SULFNBK.EXE via email, consider it infected.
Windows 98 includes a handy tool known as the System File Checker which can be used to restore damaged or deleted files. To open SFC, click "Start" | "Run" and type "SFC" without the quotes. Click "OK". System File Checker will launch a dialogue box with two choices. Choose "Extract one file from installation disk".
In the "Specify the system file you would like to restore" box, type "sulfnbk.exe" (without the quotes). Click "Start".
You will be prompted to specify the location that contains the file you want to extract and the destination directory for that file. You will need to input the "Restore from" location and the "Save file in" location.
"Restore from" will be the win98 folder on your Windows 98 operating system CD. It is easiest and most accurate to use the "Browse" button to locate and select the folder. The "Save file in" destination folder is the Windows directory and Command subdirectory. For example,
C:\WIN98\COMMAND
When both boxes have been filled in, click OK. You should receive a message stating "The file has been successfully extracted". Click OK and close any remaining SFC dialog boxes.
One final note, if you're one of the unfortunate who purchased a computer that comes with the notorious "Restore CD" only, you probably will not be able to use that CD to restore the file (or install new hardware, or update/replace drivers, or do much of anything except restore your system to factory defaults). Contact your computer vendor and ask them to send you a true copy of the Windows 98 operating system that you purchased with your system. Oh... and good luck getting them to send it.
Message Edited on 05/30/01 05:47PM by Jim Hardin