Restoring Sulfnbk.exe

[InfoSec News <isn () c4i org>]

http://securityportal.com/articles/sulfnbk20010529.html

[I'm posting this mainly because on another list I'm on, another
security professional (not infosec) passed an alert from the IT
manager for the UN offices in that part of the world and a fair 
amount of people followed the instructions on its face value on 
how to remove the virus and started deleting sulfnbk.exe, I have 
to think this wasn't an isolated incident.  - WK]


By Ken Dunham (malwarehelp () securityportal com)
May 29, 2001 

If you've been fooled by the recent Sulfnbk.exe hoax you may want to
restore the file that you deleted from your hard drive. Follow the
instructions below to restore Sulfnbk.exe to your drive.

Important Note: If Sulfnbk.exe arrives as an email attachment you
should consider it infected until proven otherwise - Magistr has been
spreading under this name via email.

Instructions

1. Locate Precopy1.cab on the Windows 98 CD in the Win98 directory or
   from a Windows 98 DMF floppy disk (disk 1).

2. Use a program like WinZip to extract the CAB file contents to the
   hard drive. 
  
   Personally, I like to copy the file to my hard drive and then
   right-click and drag the file to a new location on the desktop to
   unzip it to a new directory, using WinZip. 

   Note: When unzipping this file you may encounter prompts to extract
   other CAB files linked to Precopy1.cab. Cancel out other extractions
   and ignore the warnings unless this entire process fails for some
   reason.

3. Locate Sulfnbk.exe within the newly extracted set of archives. Move
   it to the C:\Windows\Command location of your computer. 

If you are unable to obtain Sulfnbk.exe using the instructions above
contact your local vendor or SecurityPortal staff at
malwarehelp () securityportal com for additional assistance.







ISN is hosted by SecurityFocus.com
---
To unsubscribe email isn-unsubscribe () SecurityFocus com.