Virus e-mail turns out to be hoax

December 18, 2001

Char Minnette said she didn't think twice about an e-mail message from her daughter warning her of a possible computer virus.

The Terre Haute woman followed the e-mail instructions exactly and removed what she thought was a virus in her personal computer. She then contacted as many people as she could via e-mail, passing along her daughter's message.

It was only then that Minnette discovered it was all a computer virus hoax.

This hoax provides instructions for a personal computer user to delete what actually is a Microsoft Windows software program.

"My daughter said she was sending it out to everyone on her e-mail list and recommend that we do that also. I did that and went in and took it off of my computer. Then we get a message from her that it was all a hoax and wasn't necessary," Minnette said.

Unlike a computer virus, a virus hoax will not harm your computer's hard drive or its operating system, said Henjin Chi, professor of computer science at Indiana State University.

A virus hoax normally is e-mailed in chain-letter fashion and generally warns of some devastating, though highly unlikely, type of virus. A computer virus hoax usually does not contain a file attachment and has no reference to a third party who can validate its claim.

In this case, Minnette fell victim to a hoax called SULFNBK.EXE. The virus hoax was first reported in Brazil, South America, with the original e-mail in Portuguese. It was followed by versions in several other languages, according to Symantec, an Internet security technology company with headquarters in Cupertino, Calif.

One of the later English versions says it contains a computer virus that would activate on June 1, 2001. It asks that people contact those they have e-mailed in the past few months. It says that anti-virus software does not detect it.

Another anti-virus company, McAfee, based in Sunnyvale, Calif., first reported its presence in April. The company in May added the computer hoax to its virus profile list.

This particular virus hoax deletes a computer program used by Microsoft's Windows to restore long file names. The program is not needed for normal system operation, according to Symantec.

However, Chi said that because the hoax refers to an ".exe" computer file, it can contain a real computer virus that targets .exe files.

"If it arrives as an attachment to an e-mail message," Chi said, "then it is possible it could contain a virus."

Chi said the best method to determine if a note contains a computer virus or just a virus hoax is to send the message to computer anti-virus companies such as Symantec or McAfee. Another option is not to open an unfamiliar e-mail.

Minnette said she received the message earlier this month. After learning it was a computer hoax, Minnette tried to restore the Windows program through an anti-virus Web site.

"I couldn't find it, so I just left it the way it was. I have not suffered any ill effect that I can recognize," Minnette said. "The problem is you hate to ignore it because you think this might be the one that would do something. I hated that I passed it on to other people."

One of those Minnette contacted was Robert Flott, editor of the Terre Haute Journal of Business. Since then, Flott said he has received the message 10 times in the last five days from other people.

"There is a heightened sense of awareness and fear from people attacking us, but in this case, we are our own worst enemy because we actually attack our own computer. I have a Macintosh, so I did not have the file in my computer," Flott said.

"The problem is, a hoax may teach people to think they can ignore regular computer virus messages that provide warnings," Flott said.

For more information on the SULFNBK.EXE virus hoax and how to restore a deleted program, go to vil.mcafee.com and click on "virus hoaxes" on the left-hand side of the Web page. Another option is to visit Symantec's Web site at http://securityresponse.symantec.com