The AOL4FREE "Virus" Is A Hoax

Last significant update: 16 April, 1997

Update (4/16/97): There now appears to be a program with the name AOL4FREE.COM, but (a) it is not a virus; it is a Trojan; (b) the email described below is still a bogus warning. See the CIAC bulletin for more information (leaving our site)

Better still, see what Dr Solomon's has to say about the AOL4FREE email hoax and the Trojan. If you like, you can even download an Extra Driver that will detect this Trojan until DSAV releases a version that has internal recognition of the AOL4FREE Trojan, no matter what it is named (leaving our site).

by Bruce P. Burrell (bpb@umich.edu
for the U-M Virus Busters (virus.busters@umich.edu)

This information can be freely reproduced in any medium, as long as the information is unmodified.

Thanks to Roger Burns for first bringing this to our attention on 26 March, 1997. Here is the first report we had of the AOL4FREE hoax, and my reply:

--- Begin reply ---
Date: Wed, 26 Mar 1997 03:03:20 -0500 (EST)
From: "Bruce P. Burrell" 
To: [snip]
Cc: virus.busters@umich.edu
Subject: Re: [Fwd: (Fwd) Fwd: AOL VIRUS (fwd)] (fwd)

Hi, [snip].  Thanks for the report; feel free to forward my response to
any of the recipient list. 

On Mon, 24 Mar 1997, [snip] wrote:

> 
> I have received this and have responded too the sender and some of the
> people on the list.  You might like too look at it....

   Thanks.  How did you respond?  It's almost certainly a hoax, or at
least a false alarm -- one cannot be attacked merely by reading email,
unless one has foolishly configured the email reader to execute
attachments.  More below.

---------------------
[lots of headers snipped]
> Forwarded message:
> Subj:    AOL VIRUS
> Date:    97-03-14 09:34:30 EST
> From:    Spreads101
> To: [snipped]
> THIS WAS SENT TO ME BY TWO PEOPLE.  PLEASE BEWARE...

   Typical hoax style.  "It happened to lots of folks, but I won't tell
you who so that it may be verified."  Inquiring minds want to know.

> Anyone who recieves this must send it to as many people as you can.  
> It is essential that this problem be reconciled as soon as possible.  

   it is essential that the author make as big a stink as possible.

> A few hours ago, I opened an E-mail that had the subject heading of
> aol4free.com   Within seconds of opening it, a window appeared and
> began to display my files that were being deleted.  

   Possibly; one may be sure that not all email programs allow opening
windows.  F'rinstance, I'm using pine on a unix box, coming in with Kermit
on a PC.  Not a window in sight.

> I immediately shut down my computer, but it was too late.  

   Uh huh.

> This virus wiped me out.  

   Not a virus.  If it WERE anything other than a myth, it would be a
Trojan Horse.  As it is, though, it's a hoax.

> It ate the Anti-Virus Software that comes with the Windows '95 Program 

   No antivirus software comes with Win95.

> along with F-Prot AVS.  Neither was able to detect it.  

   Of course not; it's is very difficult to detect that which does not
exist.

> Please be careful and send this to as many people as possible, so maybe
> this new virus can be eliminated. 

   Suppose this actually -were- a virus.  How does telling people this
help to eliminate it, aside from suggesting that we should or should not
open our email messages based on the Subject: field?

   Instead, send it to as FEW people as possible.  Help stamp out email
hoaxes.

   -BPB

visits to this page since 06 April, 1997 EDT