Sulfnbk.exe is not a virus

An e-mail urging folks to search for an alleged virus-infected filed called “sulfnbk.exe” on their Windows computer is a hoax.

This harmless file exists on most Windows 95, Me, and 98 machines, and is not evidence of a virus infection. Deleting it won’t destroy your computer, but it will make you feel very silly when someone tells you the real deal.

Here’s the original e-mail.

Collected 1/12/2002

Please take this seriously, just moments ago when this was sent to me, I
checked my C drive and found that I had the virus, which apparently is
undetectable by Norton or McAfee. It is a virus which remains dormant
for 14 days then activates and wipes out the hard drive data. It is
carried from address book to address book.

Since you are in my book, or I sent information to you within the last
week, I want to share this message in case you, too, picked it up. The
directions for removing are as follows:

1. Go to “Start” then to “find or search”

2. In the “Search/Find” for files or folders type in “sulfnbk.exe”
this is the virus.

3. In the “Look in” make sure you’re searching Drive C

4 Hit “search” button

5. If this file shows up (It is an ugly blackish icon that will have
the name “sulfnbk.exe”) DO NOT OPEN IT

6 RIGHT CLICK ON THE FILE GO DOWN TO DELETE AND LEFT CLICK.

7 It will ask you if you want to send it to the recycle bin, say
yes.

8 Go to your desk top and double click on your recycle bin and
delete

If you find it, send this email to all people in your address book,
because that is how its transferred.

Sorry for the bad news. Hopefully, you won’t find it, or at least will
find it in time to avoid problems with your hard drive.

As I mentioned in the introduction, Sulfnbk.exe is a part of Windows 95, 98 and Me. According to Symantec.com, the file’s not necessary for running Windows, but it is used by Windows to restore files that have long file names.

This having been said, according to Symantec and other sites, this file has been targeted in the past by viruses — specifically the W32.Magistr.24876@mm virus, which sends the file as an attachement. Generally speaking, the file should reside in C:\Windows\Command; if you find it in another folder (or if you received it as an e-mail attachment) then it may be infected with a virus; you should scan it with your anti virus software immediately.

• Symantec.com: A good overview of this hoax, including instructions on how to restore Sulfnbk.exe if you deleted it.
• McAffee.com: This site contains English, Spanish, French and German variations of this hoax, as well as instructions on how to restore the file.