virus hoax

[crptcblade]

Anybody hear of this virus hoax? It states that a file has been planted in your computer through e-mail, and that the file will destroy every file on your computer. You are advised to delete the file immediatly. Well, the file is called SULFNBK.EXE, and its in the windows\command directory. I read on Symantec.com that the file is used by Windows to restore long file names.

My boss, rather than read up on this virus scare, went ahead and searched his computers for the file. And he found it on every computer, imagine that! So he freaked out and deleted the file off of every computer he has.

Wnybody know what this will do to his computers when he goes to turm them back on tomorrow?

[Emo]

I Have The File!!!

But my McAfee says it's not infected in anyway...

What should I do?

-Emo

[Matthew Gates]

It's not a virus, it converts short names into long names.
Someone jus' said it was a virus and people got scared, so they delete it right away.

Don't delete the file, go read any news, it'll tell you the same (zdnet, cnet ?, ...).

[billfaceuk]

It's was an easy target for a virus hoax as it's got such a stupid icon!

[chrisjk]

No offence to your boss or anything but some people can be pretty dense.

If email warnings don't come come from a reliable source, ignore them (I subscribe to McAfee Dispatch newsletter and it told me days ago that there was a hoax circulating even before I knew about it).

[scoutt]

yes I got that letter in my mail, but as chrisjk said, don't trust anybody unless you know where it came from ie. mcAfee or norton.

if you think about it, it was pretty smart to say that that was a virus, everybody has it.

I guess people will never learn. how many other virus's will it take to make people understand that you don't trust anybody.

[Dreamlax]

You could say the IO.SYS file is a virus, that'll screw up someone's computer more than that file which does long filenames.

IO ... IO ... could stand for something virus-like.

I'm not that kind of person though.

[edit]
And not everyone has that file. NT doesn't have it (or I can't find it).

[parksie]

Well, messing around with long file names can corrupt the disk, but if IO.SYS is missing then DOS can't boot, which gives you very few opportunities for destruction. You can copy it off a startup disk...you do have a startup disk, don't you?

[Dreamlax]

Well, no, I don't think I do have a startup disk. Not to worry though because I have 16 other computers I can create one from.

[Juan Carlos Rey]

That .exe is almost never needed: It is used in case you uninstall Windows 95/98 and then install it again, so it can restore the long filenames that DOS truncated. But if this is not your situation, you can live fo ever without Sulfnbk.

Anyway, I'll give you two ways to restore it:

1- Open the Windows installation CD, locate the Win98 folder, and then PRECOPY1.CAB -opoen it with winzip, and restore only Sulbnk.exe to its original folder (c:\windows\command)

2- Use the DOS command: EXTRACT /Y /L c:\windows\command PRECOPY1.CAB SULFNBK.EXE

It reminds me of the dumb virus I posted here a while ago... Visit:

http://161.58.186.97/showthread.php?s=&threadid=22179

Cheers!

[Jethro]

Hey Juan pass that one onto crptcblade's boss, he would probably enjoy a day restoring PCs.

Er, your boss wan't the least bit suspicious of the "send to your friends" bit.

[zuperman]

i think that this virus rumor started in my country...

...my ex-boss call me at 2:00am just to tell me to delete that file,...what a dumb

[Bloodeye]

Here's some good links with more info. They also warn about Sulfnbk.exe e-mail attachments as having the possiblity to carry the Magistr virus\worm. So in other words it's a hoax, but it's not a hoax.

http://securityportal.com/articles/sulfnbk20010529.html
http://www.symantec.com.sg/avcenter/...e.warning.html
http://www.data-fellows.com/hoaxes/sulfnbk.shtml