F-Secure: Be Sure
Main
F-Secure Logo - Be Sure
Select local site


Privacy Policy
Legal Notices
Contact Us

Hoax Warnings

Alphabetical Index
NAME:Sulfnbk.exe virus hoax
ALIAS:Long File Name Backup utility virus hoax

In April-May 2001 there appeared a hoax message concerning a new virus that was reportedly discovered in Windows' Long File Name Backup utility SULFNBK.EXE. We checked several versions of this utility from Windows installations and found no infection in it.

The icon of the original Sulfnbk.exe file looks like that:

However, some e-mail worms (for example, Magistr) might sometimes send an infected SULFNBK.EXE in an e-mail attachment.

Bottom line: if you get SULFNBK.EXE in an e-mail attachment, it's probably a virus. If you find it from your Windows directory, it's probably not.

What to do if you already found SULFNBK.EXE from your Windows\system directory and deleted it? Not to worry, most users never need this tool. But if you run into problems with long filenames and start to see things like "FILENA~1.TXT" in your Windows Start Menu, you might need the tool. In that case, follow these Microsoft instructions to restore it:

http://support.microsoft.com/directory/article.asp?ID=KB;EN-US;Q301316

Here's the original hoax message:

---Begin Hoax Text ------------------------------------------- 

 Virus   SULFNBK.EXE


 Instructions to find and delete it.
 1. Start and got to Find Files. Type the name: SULFNBK.EXE
 2. If it is there, open Windows Explorer, look for the file
 where you found it, and then delete. Don't left click and don't
 open it even if there is a fire, o.k.?
 3. Just delete it.
 4. Mine was in Windows/Command.
 5. The person wh passed this warning to me found it in
 Windows/Config.


 And Norton did not discover it...

---End Hoax Text -------------------------------------------

Please ignore this hoax and don't pass it on.

It should be noted that Magistr virus-worm can choose SULFNBK.EXE file as its victim, infect it and send it out. So if you find this file attached to an e-mail message please delete it, never run the attachment.

Thanks to R.Engelander for the translation of this hoax.

There are several minor variants of this hoax:

---Begin Hoax Text ------------------------------------------- 

 Dear everyone:  Sorry about this, but it seems that there is a
 nasty virus going around, but you can fix it if you act fast.


 Please act URGENTLY. The virus could be in your computer files
 now, dormant but will become active on June 1. Please follow
 directions below to check if you have it and to remove it now. I
 found it and removed it today.


 It was brought to my attention today that a virus is in
 circulation via email. I looked for it and to my surprise I
 found it on mine. Please follow the directions and remove it
 from yours NOW!!!!!


 I do not know how long it has been on my computer, but no Virus
 software can detect it. It will become active on 1 June 2001. It
 might be too late by then. It wipes out all files and folders on
 the hard drive. This virus travels thru E-mail and migrates to
 the 'C:\windows\command' folder. To find it and get rid of it
 off of your computer, do the following.


 Go to the "START" button.
 Go to "FIND" or "SEARCH"
 Go to "FILES & FOLDERS"
 Make sure the find box is searching the "C:" drive.
 Type in; SULFNBK.EXE
 Begin search.
 If it finds it, highlight it.
 Go to 'File' and delete it.
 Close the find Dialog box
 Open the Recycle Bin
 Find the file and delete it from the Recycle bin
 You should be safe.


 The bad part is: You need to contact everyone you have sent ANY
 E-mail to in the past few months. Many major companies have
 found this virus on their computers. Please help your friends
 !!!!!!!!


 Do not rely on your anti-virus software. McAfee and Norton
 cannot detect it because it does not become a virus until June
 1st.


 Whatever you do, do not open the file!!!

---End Hoax Text -------------------------------------------

Another variant:

---Begin Hoax Text ------------------------------------------- 

 VIRUS COULD BE IN YOUR COMPUTER
 It will become activate on June 1st and will delete all files
 and folders on the hard drive.  No Anti-Virus software can
 detect it because it doesn't become a VIRUS  until 1/6/2001. It
 travels through the e-mail and migrate to your computer. To find
 it please follow the following directions:


 Go To "START" button
 Go to "Find" or "Search"
 Go to files and folders
 Make sure to search in drive C
 Type in; SULFNBK.EXE
 Begin Search
 If it finds it, highlight it and delete it
 Close the dialogue box
 Open the Recycle Bin
 Find the file and delete it from the Recycle Bin
 You should be safe.


 The bad part is you need to contact everyone you sent ANY e-mail
 to in  the past few months.  Many major companies have found
 this virus on their computers. Whatever you do, DO NOT open the
 file.

---End Hoax Text -------------------------------------------

Another variant:

---Begin Hoax Text ------------------------------------------- 

 Dear all,


 Please take this e-mail seriously.  I just received this message,
 checked my C drive for it and found the virus.


 Message to repair: I found out that I had this virus resident on my hard
 drive and chances are that you have it too since you are all in my
 address book.  This virus lies dormant for 14 days and then kills your
 hard drive.  Here is how to stop it!  If you've got it, send this letter
 to everyone in your address book.


 Here's what the party who passed in on to me told me to do, and it seems to work:


 Remove it by following these steps:


 1.  Go to "start", then to "find or search"  (depending on your computer.)
 2.  In the "search for files or folders" type sulfnbk.exe  - This is the virus.
 3.  In the "look in" make sure you are searching drive "C".
 4.  Hit the "search or find" button.
 5.  If this file shows up (it's an ugly blackish icon that will have the name sulfnbk.exe) - DO NOT OPEN IT!!
 6.  RIGHT click on the blackish icon - go down to "delete" and left click it.
 7.  It will ask you if you want to send it to the recycle bin.  Say yes.
 8.  Go to your desktop (where all the icons are) and double click on the Recycle Bin.
 9.  RIGHT  click on the "sulfnbk.exe" and delete again  - or empty the bin.


 If you find it, send this E-mail to all in your address book, because
 that is how it is transmitted.

---End Hoax Text -------------------------------------------

Swedish translation of the hoax:

---Begin Hoax Text ------------------------------------------- 

  Vi har fått en virus som sprider sig genom adressboken, eftersom ni
  befinner
  er i denna adressbok så har den säker hamnat ier dator (den går förbi
  Norton)
  Varning! Man märker inget de 14 första dagarna men den försör sedan hela
  hårddisken.


  Gör följande för att få bort den:
  1. Gå till "start" och välj "sök"
  2  Välj "filer eller mappar " och slå: sulfnbk.exe (virusens namn)
  3  Letaa i "C:" och starta sökningeen genom att trycka "sök nu"
  4  Om ni får upp ikonen flytta den direkt till papperskorgen ! ÖPPNA DEN
  INTE
  5  Tryck höger musknapp och välj "ta borT och klicka sedan "ja" för att
  skicka den till papperskorgen.
  6  Slutligen töm papperskorgen. Glöm inte detta steg.
  7  Skicka sedan detta meddelande till alla i er adressbok


  Hälsningar Eskilstuna MK
---End Hoax Text -------------------------------------------

If you receive these hoax messages, please ignore them.

[Description created: May-August 2001]