24

SULFNBK.EXE is an executable file that came with Windows 98 and Millennium, and is known for sporting a pretty… interesting icon in the former:

The hand-drawn icon of SULFNBK.EXE, as it appears in Windows 98. The icon consists of barely legible black squiggles on a transparent background, presumably meant to be the letters “LFN BK”, but looking more like “LFΠ 9K”. Below the icon is a file name caption reading “Sulfnbk.exe”.

It has also become pretty infamous for being subject to a virus hoax directing users to delete the file; the virus claim was likely prompted by the unusual icon. Presumably this is why the latter version of Windows replaced it with a more bland Windows flag logo.

However, other than assurances that it’s not a virus and vague description of it being necessary “if you need to restore long files names if they become damaged or corrupted” (Q301316), I’m having a pretty hard time finding any information on how to use it when I do. Launching the executable directly just shows the error message “Bad command line format”; no help information is given when launching it from the command line with the /? option either.

What does that file actually do? What damage did it do to the system to remove it as the hoax directed?

user3840170
  • 23,072
  • 4
  • 91
  • 150

1 Answers1

36

Very little, it turns out.

The official description is more-or-less correct, though leaning towards less, and also rather vague about the circumstances: the primary task of SULFNBK is to back up long file names when upgrading Windows, and to restore them when going back to the old version. To perform this function, SULFNBK has two modes of operation:

  • With the /B:⟨directory⟩ switch, it reads C:\PATH.INI and creates a file named WINLFN.INI within the given ⟨directory⟩ containing mappings of short file names to long ones.
  • With the /R switch, it reads WINLFN.INI from the location pointed to by UninstallDir= within MSDOS.SYS and renames files back to their long names.

The separate executable is necessary, because both the installer and the uninstaller are Win16 executables, which are only able to access short file names.0 The installer (SUWIN.EXE) has to be a Win16 executable, because it must be possible to run it under Windows 3.x, or under the bundled mini-Windows 3.x when it is launched from DOS. The uninstaller is also a dual-mode executable, and even when it is launched from Windows, part of its job is performed in pure DOS, where long file names are also unavailable. So a helper executable is needed.

When the upgrade installer is launched from within a Windows 9x session, a PATH.INI file is created and SULFNBK is launched with the /B option to generate the WINLFN.INI file. The uninstaller, conversely… doesn’t do anything with that. There is specific code within UNINSTAL.EXE that would have set up SULFNBK with the /R option to run, but it’s nowhere invoked. Not even through RUNDLL shenanigans. The user may still be able to invoke SULFNBK manually, but given that it seems completely undocumented other than in a Windows 98 beta version manual, it’s not clear how they are even supposed to know about it. (For what it’s worth, I managed to find one article about it… in Czech, of all languages.)

The executable also has two other modes of operation, completely unrelated to backing up long file names:

  • With the /X switch, it spawns a background task that seems to suppress “low disk space” warnings as long as it is running. The installer spawns this one and leaves it running until the first restart.
  • With the /L switch, it populates the Favorites directory of the user’s profile with items described in the [LinkBar] section of %WINDIR%\INF\SETUP.INF; this mode of operation is used when Windows creates a new user profile. The links added advertise Microsoft services; chances are you never wanted those anyway. (If you squint, you might be able to call that malware behaviour; perhaps the virus rumour wasn’t such a hoax after all.)

All in all, SULFNBK seems to be a dumping ground for a few rarely-performed one-off tasks that, for one reason or another, couldn’t be integrated into some other place; a hack as elegant as its icon. If it’s missing from your system, chances are you will not ever notice, not unlike the appendix.

0 At least with normal APIs. I suspect they might have gotten away with directly calling interrupt 0x21 service 0x71. For whatever reason, they did not.

user3840170
  • 23,072
  • 4
  • 91
  • 150
  • 5
    As great as this answer is, I was really hoping you also explained the story behind the goofy icon. – Jim Nelson Jan 03 '24 at 18:33
  • 2
    @JimNelson Maybe it was an early AI image generator that they were testing. – ErikF Jan 03 '24 at 23:35
  • 23
    +1 Just for completeness, the name is fairly self-explanatory (following a Windows tradition): System Upgrade Long File Name BacKup – TooTea Jan 04 '24 at 07:58
  • 8
    @JimNelson Probably just a bit of an inside joke where a developer has drawn the crudest possible icon in mspaint for a tool that should never be seen by actual users. – TooTea Jan 04 '24 at 08:00
  • 1
    I found that interrupt 0x21 service 0x71 didn't actually work in real mode on Windows 95. It only worked if the 32 bit kernel was running, which it won't be during setup. (Never tried on '98.) – Joshua Jan 05 '24 at 00:25
  • @TooTea indeed, and of course they had to fit it into 7.3 format so the DOS side could run it. – OrangeDog Jan 05 '24 at 11:29
  • @TooTea I remember something similar to that on an old HP/Compaq (forget which) laptop I had in the 00s. Though it was the filenames and descriptions in this case, not the icons. – AJM Jan 05 '24 at 13:04
  • 2
    @user3840170 That was an amazing amount of research, and a very detailed answer! Well done! – AJM Jan 05 '24 at 13:05
  • @TooTea I wouldn’t get too attached to this expansion, I’ve seen the “SU” letters explained differently elsewhere. – user3840170 Feb 18 '24 at 19:23