[Imc] SULFNBK virus is a hoax

[gilgan]

In April-May 2001 there appeared a hoax message concerning a new virus that 
was reportedly discovered in Windows' Long File Name Backup utility 
SULFNBK.EXE. We checked several versions of this utility from Windows 
installations and found no infection in it. Here's the original hoax message:

---Begin Hoax Text -------------------------------------------


 Virus   SULFNBK.EXE


 Instructions to find and delete it.
 1. Start and got to Find Files. Type the name: SULFNBK.EXE
 2. If it is there, open Windows Explorer, look for the file
 where you found it, and then delete. Don't left click and don't
 open it even if there is a fire, o.k.?
 3. Just delete it.
 4. Mine was in Windows/Command.
 5. The person wh passed this warning to me found it in
 Windows/Config.


 And Norton did not discover it...

---End Hoax Text -------------------------------------------

Please ignore this hoax and don't pass it on.

It should be noted that Magistr virus-worm can choose SULFNBK.EXE file as its 
victim, infect it and send it out. So if you find this file attached to an 
e-mail message please delete it, never run the attachment.

Thanks to R.Engelander for the translation of this hoax.

There are 2 minor variants of this hoax:

---Begin Hoax Text -------------------------------------------


 Dear everyone:  Sorry about this, but it seems that there is a
 nasty virus going around, but you can fix it if you act fast.


 Please act URGENTLY. The virus could be in your computer files
 now, dormant but will become active on June 1. Please follow
 directions below to check if you have it and to remove it now. I
 found it and removed it today.


 It was brought to my attention today that a virus is in
 circulation via email. I looked for it and to my surprise I
 found it on mine. Please follow the directions and remove it
 from yours NOW!!!!!


 I do not know how long it has been on my computer, but no Virus
 software can detect it. It will become active on 1 June 2001. It
 might be too late by then. It wipes out all files and folders on
 the hard drive. This virus travels thru E-mail and migrates to
 the 'C:\windows\command' folder. To find it and get rid of it
 off of your computer, do the following.


 Go to the "START" button.
 Go to "FIND" or "SEARCH"
 Go to "FILES & FOLDERS"
 Make sure the find box is searching the "C:" drive.
 Type in; SULFNBK.EXE
 Begin search.
 If it finds it, highlight it.
 Go to 'File' and delete it.
 Close the find Dialog box
 Open the Recycle Bin
 Find the file and delete it from the Recycle bin
 You should be safe.


 The bad part is: You need to contact everyone you have sent ANY
 E-mail to in the past few months. Many major companies have
 found this virus on their computers. Please help your friends
 !!!!!!!!


 Do not rely on your anti-virus software. McAfee and Norton
 cannot detect it because it does not become a virus until June
 1st.


 Whatever you do, do not open the file!!!

---End Hoax Text -------------------------------------------

The second variant:

---Begin Hoax Text -------------------------------------------


 VIRUS COULD BE IN YOUR COMPUTER
 It will become activate on June 1st and will delete all files
 and folders on the hard drive.  No Anti-Virus software can
 detect it because it doesn't become a VIRUS  until 1/6/2001. It
 travels through the e-mail and migrate to your computer. To find
 it please follow the following directions:


 Go To "START" button
 Go to "Find" or "Search"
 Go to files and folders
 Make sure to search in drive C
 Type in; SULFNBK.EXE
 Begin Search
 If it finds it, highlight it and delete it
 Close the dialogue box
 Open the Recycle Bin
 Find the file and delete it from the Recycle Bin
 You should be safe.


 The bad part is you need to contact everyone you sent ANY e-mail
 to in  the past few months.  Many major companies have found
 this virus on their computers. Whatever you do, DO NOT open the
 file.

---End Hoax Text -------------------------------------------

If you receive these hoax messages, please ignore them.

[Description created: May-August 2001]

see also

http://www.symantec.com/avcenter/venc/data/sulfnbk.exe.warning.html