NWA-PCUG Newsletter Article
You Did What? Why?
Read This!! It's a Hoax!!!
by Rod Ream, Pasadena IBM Users Group, July 2001
(click to email author)

That was the start of a conversation with a client who'd just deleted a file from the \windows\command folder. That's because they'd received an urgent e-mail message from a friend, warning them of an unknown virus.

The message they received was quite clever and, as of this writing, is still being forwarded by darned near everyone without a second thought. The e-mail indicated that the file to be deleted contains a virus that will launch within a week and needs to be zapped without delay. The reader is warned in-what else?--LARGE SIZED TYPE with lots of exclamation points that if they do not act quickly they face destruction of all their files and folders. The message concludes by stating that none of the virus scanning programs can detect this viral threat.

My client had one machine with Internet access and 2 stand-alone systems without Internet access. They followed the instructions in the message and found that all 3 of their systems contained the supposedly dangerous file. They deleted it as instructed and then, wondering if they'd done the right thing, gave me a call.

In this case the filename was SULFNBK.EXE, but it could have been any file. If the hoax authors get away with this once, you can bet your bippy they'll be back with something else. (In case you are wondering, SULFNBK.EXE is used to backup long file names when you upgrade from one version of Windows to another. If you don't like the new version and want to go back, this file preserves those long file names for you)

To put things in perspective, my client had deleted a file they knew nothing about, based on the advice of some they didn't know well. The author of the hoax had accomplished the task of zapping a file on someone else's system as easily as if he'd written and launched a real virus.

Of course, by coming up with this scam, he'd caused the system owner to become his willing and unwitting agent. There are laws against damaging a computer system, if this ploy isn't included, perhaps it should be, as it could be just as destructive.

I thought it was time to take the client back to school, so I proceeded to explain how to avoid being taken in, the next time the hoaxters look for a sucker. Here are some things you can look for before you let panic set in:

o Does the message indicate one of your messages contained a virus when it was received at the other end? When I receive an infected message I always alert the sender by e-mail as well as by phone and I tell them specifically the name of the detected infection.

o Is the sender someone that would be a knowledgeable person about virus detection? (Is your brother-in-law really a knowledgeable source? Really?)

o Big clue! The message said that the major anti-virus companies couldn't detect this thing. Hogwash! The hoaxter compounded the issue by confusing virus detection with virus activation - the date that the time bomb is supposed to trigger. If no one can detect it, then what makes anyone but a psychic know that it's going to go B-A-N-G!! on a certain date?

o Did the message look like it's been forwarded over and over? If you've ever received chain letters from an AOL subscriber, then this shouldn't need an explanation.

o Is this something that's currently being reported by the major news outlets? Sorry folks, but Entertainment Tonight and the Springer Show don't qualify.

o What does your own anti-virus software show, when you scan your system? How long has it been since you updated your scanner's virus definitions? You do have up-to-date antivirus software don't you?

Producers of virus detection software (there's a couple hundred companies doing this) compete with one another to be the first to not only detect a new threat, but to be able to neutralize it as well. Within a day or two of the initial discovery the major companies will have an update available - that's how they make their money.

You see, viruses can be very difficult to detect if they are polymorphic (self masking), but there always has been something that's detectable. Any claim that these highly regarded companies can't detect something, but Uncle Bob can detect it, should be disregarded on its face.

With that in mind, your first line of defense is up-to-date virus detection software. If you can't recall the last time you downloaded a new set of detection definitions, then it's probably not. If you don't have anti-virus software on the system, there are several on-line detection sites with the best (in my opinion) being http://www.housecall.antivirus.com which is a free service of Trend Micro, publishers of PC-cillin and other AV products. Your second line of defense is obviously common sense. Use it, it's free!

Copyright Rod Ream 2001, Rod Ream PC Consulting. Rod Ream is senior tech support for the Pasadena IBM Users Group and president of PC Consulting. Reach him at 626/280-6850 or RodReam@techie.com

Click here to return to top