About the SULFNBK.exe File Hoax

The email message SULFNBK.EXE is a hoax. It encourages you to delete the existing SULFNBK.exe file on your computer. In this case, the SULFNBK.exe is a Microsoft Windows 95/98/Me utility that restores long file names.

Often, the hoax is based on an existing threat. For instance, without virus protection, the SULFNBK.exe file on your computer has the potential to become infected by a number of valid viruses (most commonly the W32/Magistr@MM virus). The hoax email takes advantage of this threat by encouraging you to delete the file from your computer. Check out McAfee's SULFNBK.EXE hoax page for more information.

It is a good idea to immediately delete any messages containing SULFNBK.EXE and not email them to anyone else.

SULFNBK.exe Hoax email Contents

Below is the actual text from the hoax message that you may receive in your email. There are numerous variations on these messages.

************ START ************
A VIRUS could be in your computer files now, dormant but will become active on June 1. Try not to USE your Computer on June 1st.

FOLLOW DIRECTIONS BELOW TO CHECK IF YOU HAVE IT AND TO REMOVE IT NOW.

No Virus software can detect it. It will become active on June 1, 2001. It might be too late by then. It wipes out all files and folders on the hard drive. This virus travels thru email and migrates to the C:\windows\command folder. To find it and get rid of it off of your computer, do the following.

Go to the Start button.
Go to Find or Search
Go to Files & folders.
Make sure the find box is searching the C: drive.
Type in: SULFNBK.EXE
Begin search.
If it finds it, highlight it. Do not double click or file will automatically open.
Go to File and delete it.
Close the find Dialog box
Open the Recycle Bin
Find the file and delete it from the Recycle bin
You should be safe.

The bad part is: You need to contact everyone you have sent ANY email to in the past few months. Many major companies have found this virus on their computers. Please help your colleagues and friends!

************ END ************

Another common variation on this message is:

************ START ************

Dear All: We received a virus on a message. I followed the instructions below and found that it had been spread to our computer. I followed the instructions and located the virus and was able to delete it. The bad news is that you probably have it, as you are in My Address book! More bad news is that my anti-virus program did not detect this virus. The virus lies dormant for 14 days and then "kills" your hard drive.

Here is what to do. If you follow the instructions and then see that you have the virus, you need to send a similar email to everyone in your address book.

Remove the virus by following these steps:

  1. Go to "Start." Then to "Find" or "Search".
  2. In the "Search for files or folders" type sulfnbk.exe -- this is the name of the virus.
  3. In the "Look in" section, make sure you are searching Drive C.
  4. Hit "Search" or "Find".
  5. If your search finds this file, it will be an ugly blackish icon that will have the name sulfnbk.exe. DO NOT OPEN IT! If it does not show up on your first "Search", try a "New Search."
  6. Right click on the file -- go down to "Delete" and left click.
  7. You will be asked if you want to send the file to the Recycling Bin -- say "Yes".
  8. Go to your Desktop (where all your icons are) and right click on the Recycle Bin and either manually delete the sulfnbk.exe program or empty the entire bin.
  9. If you found the virus on your system, send this or a similar email to all in your address book because this is how it is transferred.

Sorry for the trouble and my apologies for having unwittingly"infected" you. You'll want to check for this virus again for the next couple days until everyone in your address book has seen it and deleted it, otherwise, being in their address book, your PC will get infected all over again so don't forget to check!

************ END ************

 

Restore the SULFNBK.exe file to your computer if it has been deleted

If you mistakenly delete the SULFNBK.exe file, you can follow these steps to restore it.

Note: Windows 2000/XP systems do not need or use SULFNBK.exe. Restoration of this file is not needed or possible for these systems.

If you are using Windows 95 or 98:
1. Click Start, then click Run.
2. In the Open box, type SFC, then click OK.
3. In the Specify the system file you would like to restore field, type C:\WINDOWS\SYSTEM\SULFNBK.EXE, then click Start.
4. In the Restore from field, type C:\WINDOWS\OPTIONS\CABS.
5. Click OK, then follow the prompts to restore the file.

If you are using Windows Me:
1. Click Start, then click Run.
2. Type MSCONFIG, then click OK.
3. Click Extract File....
4. In the Specify the system file you would like to restore field, type C:\WINDOWS\SYSTEM\SULFNBK.EXE, then click Start.
5. In the Restore from field, type C:\WINDOWS\OPTIONS\INSTALL.
6. Click OK, then follow the onscreen prompts to restore the file.