Undoing the Damage Done by Virus Hoax

If you fell for the June 1 virus hoax and dutifully deleted the SULFNBK.EXE file from your Windows 98 operating system, don't panic. Chances are good that you won't notice that the file has been removed, its loss won't harm Windows 98, and the file can be easily replaced.

Several sites are already offering advice on how to restore the SULFNBK.EXE file, including McAfee.com in Sunnyvale, California, and Securityportal.com, an online service provided by AtomicTangerine in San Francisco.

Computer users recently received e-mail warnings that the SULFNBK.EXE file was infected with a virus and should be deleted if found. Although experts quickly dismissed the warnings as a hoax, many people deleted the file, which is a standard part of Windows 98 and makes backups of all the Long File Names (LFN) on a computer.

With the proper switch, it is used to restore those file names, says Bruce P. Burrell, antivirus team leader at the University of Michigan. He is also a member of the Anti-Virus Information Exchange Network (AVIEN).

Losing the file won't have much of an impact on your system, says Robert Vibert, a researcher of malicious software and solution architect for Segura Solutions in Braeside, Ontario, and AVIEN's moderator. "Few people use it, and it does not harm the operating system," he says.

The only users who would notice SULFNBK.EXE missing would be those who use an archaic system that doesn't recognize LFNs.

AVIEN says the public began calling its center after stories in the media appeared about the SULFNBK.EXE hoax. Worried that they might have damaged their operating systems by removing the file, readers flooded AVIEN and media outlets with calls and e-mails seeking help, says Paul Schmehl, an AVIEN founding member and supervisor for support services at the University of Texas at Dallas.

Hoaxes of this type can usually be identified by the "authority" used to prove their authenticity, says Joe Hartmann, director of North American virus research for Trend Micro, a security vendor in Cupertino, California.

He and other experts suggest that if users doubt the authenticity of a warning, they can check any number of Web sites that track viruses and hoaxes, such as AVIEN, or the CERT Coordination Center at Carnegie Mellon University in Pittsburgh.