triumphs
[Top] [All Lists]

Re: Fw: virus ->HOAX<-

To: Rave Racer <Ravewar@home.com>, triumphs@autox.team.net
Subject: Re: Fw: virus ->HOAX<-
From: Fred Marks <marks_fred@yahoo.com>
Date: Thu, 31 May 2001 06:52:34 -0700 (PDT)
HOAX ALERT: SULFNBK.EXE

Computer Associates has been receiving several client
inquiries with regards to the so called SULFNBK.EXE
hoax 

As well as portraying all the standard hoax features,
(warns of a dire 'danger' then suggests that the
receiver should send it onto all of their friends to
minimize the damage that the 'virus' may cause) this
e-mail hoax advises the user to delete the file
SULFNBK.EXE which it states is a virus. For greater
impact and added realism, this hoax mentions that the
information contained within has been garnered from a
competitor's anti-virus site.

Two things should be noted about the file SULFNBK.EXE.

First, it is a standard utility program included with
some versions of Windows and normally installed in the
'Command' subdirectory of the Windows installation
directory. It has a somewhat odd icon that often leads
users to be suspicious of it, and this is not helped
by the fact that the EXE file does not have an
extended 'properties sheet' if right-clicked in
Explorer and its 'Properties' viewed.

Second, because of its location size and being a
PE-style EXE, SULFNBK.EXE is commonly included as an
attachment in email messages sent by the Win32.Magistr
virus. Thus, if you receive a copy of SULFNBK.EXE as
an email attachment, that could well be an infected
copy of the file and an indication that the sender is
infected with Win32.Magitsr.


TYPICAL SULFNBK.EXE Hoax Warning:

The text on this page is part of a hoax and is not a
legitimate warning or offer. We present it here to
help you identify any hoax messages that you receive.
Please note that hoaxes often have several variations
in circulation, so you may receive a hoax message that
is similar, but not identical to the message
below. This particular hoax may also appear in
Spanish.

     "I found a virus in my computer that was sent to
me by somebody. The virus will activate itself on the
1st of JUNE and according to McaFee web site will
destroy every single file in the hard drive.
     If you have the virus it should be in your
computer by now.
     The file name is SULFNBK.EXE. You can find it in
the Windows explorer and then eliminate the file.
     (Do not forget to eliminate it from the Trash as
well!)

     Please pass this information to everyone you
know."
Get personalized email addresses from Yahoo! Mail - only $35 
a year!  http://personal.mail.yahoo.com/

///  triumphs@autox.team.net mailing list
///  To unsubscribe send a plain text message to majordomo@autox.team.net
///  with nothing in it but
///
///     unsubscribe triumphs
///


<Prev in Thread] Current Thread [Next in Thread>
  • Re: Fw: virus ->HOAX<-, Fred Marks <=