Virus alert, last chance to delete it

14 replies [Last post]
Alan Roberts
Alan Roberts's picture
Offline
Joined: May 3 1999

A Dutch friend has just alerted me to a virus. I found a copy of it on my PC and deleted it (no idea where it came from though). He says it's triggered on June 1st. Look for sulfnbk.exe in Windows/command. DON'T RUN IT, or if you do, don't tell me what it does, I'd rather bask in the reassurance that it hasn't bitten me.

Get my test cards document, and cards for 625, 525, 720 and 1080. Thanks to Gavin Gration for hosting them.
Camera settings documents are held by Daniel Browning and at the EBU
My book, 'Circles of Confusion' is available here.
Also EBU Tech.3335 tells how to test cameras, and R.118 tells how to use the results.

Hawk
Offline
Joined: Nov 5 2000

Mick

Rich T
Offline
Joined: Aug 14 2000

Lifted from Langalist( I recommend this Newsletter) :-

1) The "SULFNBK" June 1st Virus Hoax

I've gotten many notes from readers who forwarded a chain letter to me (usually along with 500 other unlucky recipients) that went something like this:

Do you believe that a friend of mine sent me an alert and the procedure that we have to follow for the possible infection of S U L F N B K . E X E . And I had checked, just to make sure. An then... the file was there, hidden even of McAfee and Norton, maybe waiting something to start work....

The original recipients of this note checked their systems and were alarmed when they find S U L F N B K . E X E there. Well, S U L F N B K . E X E file is a normal part of Windows that's used in managing long file names (the file is usually found in in your C:\Windows\Command folder). Antivirus routines don't detect the file because it's not a virus. The "virus" warning is a complete hoax.

There is a worm that can arrive as an email attachment named S U L F N B K . E X E, but that has nothing to do with the current hoax. All the major AV tools know how to handle that worm; and by now everyone should know that you should never, ever---- EVER--- click on any email attachment, no matter what it's named or whom it's from, without first at least running it through an AV scanner. And in any case, the use of the name S U L F N B K . E X E is coincidental. The worm could have been called any Windows file; there's nothing special about S U L F N B K . E X E.

What's more, virus chain letters are almost always hoaxes: A good rule of thumb is NEVER to forward any email just because it says "Urgent: Pass this on to everyone!" or comes from a buddy. In fact, anytime you get any email with a "pass this on to everyone!" in it, or a letter that has been forwarded dozens of times, it's almost always (99.99999% of the time) a hoax or scam designed solely to generate a chain letter--- that is, to trick the gullible into perpetrating the hoax.

Don't be taken in! It only takes *literally* a minute to find out about if any email about:

--supposed virus alerts (even if the email says they're "confirmed by IBM, Microsoft, AOL and Oracle" or some such)
--pending legislation, including email surcharges and taxes
--sick/dying/missing children who need email or prayers
--body part theft rings
--free vacation giveaways
--free money or products from Bill Gates (or Disney or AOL or Nokia or....) to those who forward the most emails
--foreign government workers who will pay you to let them move large sums of money through your bank account
--or any of hundreds of similar chain letters.

These are ALL almost always pure, utter hoaxes and scams.

You can make yourself chain-letter-proof by taking literally about a minute to check up on any claims made in chain letters. There are any number of resources you can use, including:

Symantec Anti Virus Research Center at http://www.symantec.com/avcenter/index.html

McAfee Associates Virus Hoax List at http://vil.mcafee.com/hoax.asp?

Department of Energy Computer Incident Advisory Capability at http://ciac.llnl.gov/ciac/CIACHoaxes.html

Debunking online and email hoaxes: http://www.kumite.com/myths/

The Urban Legends Web Site at http://www.urbanlegends.com

Urban Legends Reference Pages at http://www.snopes.com

Datafellows Hoax Warnings at http://www.Europe.Datafellows.com/news/hoax.htm

ALWAYS take a few seconds to verify the truth of any chain email like this, and then tell your friends ONLY if it proves true. Otherwise, you're not doing your friends any favors, and in fact, you're just helping the hoaxers to waste people's time and bandwidth.

Additional resources to strengthen your BS detectors:

How To Evaluate Internet Research Sources at http://www.virtualsalt.com/evalu8it.htm

How To Evaluate Information Sources at http://www.vuw.ac.nz/~agsmith/evaln/evaln.htm

[This message has been edited by Rich T (edited 01 June 2001).]

[This message has been edited by Rich T (edited 01 June 2001).]

tim.callaghan
Offline
Joined: Apr 4 2001

Well Alan,

You've just deleted your 8.3 longfile name compatibilty, ah well. You probably will never need it anyway!

Oh yeh, watch at for the new killer virus, to not get it you have delete any file on your system with the following name:-

IO.sys
MSDOS.sys
Command.com
Boot.ini
NTLDR
NTOSKRNL
HAL.DLL
NTDETECT

And then put your system in the bath, run it, and get in with it, and turn it on.

Then everything will be just fine

Ignore the above please

Tim

Chirpy
Offline
Joined: Sep 7 2000

I caught a 'FLU' virus a few years ago...turned me into a Newt! (I got better!)

Chirpy

Chirpy's Big Breakfast can be heard on Radio England International. These are repeat shows (he's retired now) played Monday to Friday 8am-12 noon and repeated in the evening from 8pm-midnight. Also, Sunday 8am-12 noon. (Click link to listen) www.onlineradio5.com/2013/06/radio-england-international.html

tom hardwick
Offline
Joined: Apr 8 1999

One day son, all this will be yours.
What? The curtains?

Chirpy
Offline
Joined: Sep 7 2000

Nih!

Chirpy's Big Breakfast can be heard on Radio England International. These are repeat shows (he's retired now) played Monday to Friday 8am-12 noon and repeated in the evening from 8pm-midnight. Also, Sunday 8am-12 noon. (Click link to listen) www.onlineradio5.com/2013/06/radio-england-international.html

tom hardwick
Offline
Joined: Apr 8 1999

I'm sorry, I'm going to have to shoot you.

Chirpy
Offline
Joined: Sep 7 2000

I've got a slug

Chirpy's Big Breakfast can be heard on Radio England International. These are repeat shows (he's retired now) played Monday to Friday 8am-12 noon and repeated in the evening from 8pm-midnight. Also, Sunday 8am-12 noon. (Click link to listen) www.onlineradio5.com/2013/06/radio-england-international.html

mooblie
mooblie's picture
Offline
Joined: Apr 27 2001

Buuuuurn 'im !!

Martin - DVdoctor in moderation. Everyone is entitled to my opinion.

Phill Power
Offline
Joined: Oct 29 2000

Does it talk?

Eh?

Nudge-nudge, wink-wink, say no more!

--
Phill Power
Freelance Conference Technician
Phill@Power.com
" TARGET=_blank>http://Phill.Power.com

Alan Roberts at work
Offline
Joined: May 6 1999

Jolly good, no harm done then. Interestingly, I didn't get the standard form of the email, Bart must have had it in German from someone (he's Dutch living in Germany) and I got only a much edited panic message. Fortunately, I didn't pass it on to anyone, only posted it here.

Back to the day job then.

[This message has been edited by Alan Roberts at work (edited 01 June 2001).]

tim@work
Offline
Joined: Apr 30 2001

Just a little note,

There is also a duplicate of this mail flying around that does have a virus as an attachment, further confusing the siuation.

So don't open any attachments that this mail may have!

Tim

Alan Roberts at work
Offline
Joined: May 6 1999

I rarely open attachments from anybody, let alone folk I don't know.

Charles
Offline
Joined: Apr 7 1999

Received this from VUNET,just another twist.
Regards
Charles
HOAX VIRUS BACK - THIS TIME FOR REAL

A new wave of emails with 'sulfnbk.exe' in the subject line are being
sent to users - and this time it may actually contain a harmful virus. http://www.vnunet.com/News/1122482

------------------

Regards
Charles
avsvideo.co.uk