Wait a Minute!!! I thought this looked suspicious. Don't delete the file
yet. When doing a quick search on Microsoft's website, I found that this is
a standard Microsoft file. I don't know what it does, but my guess is that
if you delete it you will have problem running Windows in some way. Thus,
the email itself is the virus! It looks like you've been snookered, B.J. I
am sure someone will soon email the list with what this file actually is.
Dr. Brent Stucker, Director & Asst. Professor
Rapid Manufacturing Center
University of Rhode Island
Dept. of Industrial and Manufacturing Engineering
Gilbreth Hall, 2 East Alumni Ave.
Kingston, RI 02881
ftp: rmc1.ime.uri.edu (anonymous login)
From: email@example.com [mailto:firstname.lastname@example.org]On Behalf Of B.
Sent: Tuesday, May 29, 2001 3:00 PM
Subject: Fw: SULFNBK.EXE resident virus deletion
This virus alert comes from the Air Canada Pilots Association. I found the
virus on my PC. Recommend you follow the instructions below.
Remember to empty the Recycle Bin as well as per these instructions. Sorry
for the problem...
PLEASE FOLLOW THE FOLLOWING PROCEDURE. THIS VIRUS TRAVELS THROUGH E-MAIL
AND MIGRATES TO THE @:\windows\command folder.
TO FIND IT AND DELETE FROM YOUR COMPUTER do the following:
GO TO START BUTTON
GO TO FIND OR SEARCH
GO TO FILES AND FOLDERS
MAKE SURE THE FIND BOX IS SEARCHING THE ' C' DRIVE
TYPE : SULFNBK.EXE
BEGIN SEARCH. IF IT FINDS THE VIRUS ON YOUR COMPUTER, HIGHLIGHT IT AND PRESS
THE DELETE KEY ON KEYBOARD. CLOSE THE FIND DIALOG BOX.
IT IS IMPORTANT THAT YOU NOW CHECK THE RECYCLE BIN< BECAUSE IT ALSO
SHOWED UP IN THAT LOCATION.
OPEN RECYCLE BIN. FIND THE FILE AND DELETE IT FROM THE RECYCLE BIN.
Do not rely on your Anti-virus software like McAFEE, NOR NORTON, ETC.,
because they cannot detect it because it does not become a virus until JUNE
1, then whatever you do do not open the file. I must stress that so
far tonight already the only four people who have followed this procedure
did find the virus in their computer.
For more information about the rp-ml, see http://ltk.hut.fi/rp-ml/
This archive was generated by hypermail 2.1.2 : Fri Jan 04 2002 - 09:57:20 EET