Computing.Net > Forums > Security and Virus > Aornum

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Aornum

Reply to Message Icon

Name: shirley
Date: October 29, 2002 at 06:44:46 Pacific
OS: windows xp
CPU/Ram: hp
Comment:

i asked iwon about Aornum..
They replied with in 2 days,

i saved the letter if anyone would like to contact me.....



Sponsored Link
Ads by Google

Response Number 1
Name: hylian_lynk
Date: October 29, 2002 at 10:07:29 Pacific
Reply:

You Win the Loss of Your Privacy
Software at iWon Web Site Tracks Users Even After Removal
By Becky Worley, Tech Live

Oct. 23 — IWon.com offers prize money of up to $1 million to Web surfers who visit the Internet portal site and make it their homepage. But a chance to win money also means that members may be losing something more important: their privacy.

While just browsing the iWon site is relatively harmless, the potential privacy problem stems from the installation of its iWonPlus subscriber package, which allows members access to other site features such as chat.

A viewer tipped TechTV to the fact that the extra software from iWon also installs the nasty piece of spyware called aornum.exe. Aornum tracks user Web-browsing habits and sends that data back to iWon.com.

IWon says it collects user data and shares it with third-party marketing organizations unless users have opted out of such information sharing. IWon says it also uses the personal data to send "targeted e-mail" to users.

This practice is clearly noted in the iWon privacy policy: "… iWon Software Products automatically communicate over the Internet with iWon's servers and, in order to provide you with information or services, may convey to iWon certain information regarding your activities, including, for example, the URL of sites you visit."

But most disturbing is that the aornum program will apparently continue to send tracking data even after members elect to remove the iWonPlus software from their computers.

How Aornum Avoids Deletion

The instructions at iWon's site advise members to use the add/ remove programs function in the Windows operating system software if they wish to uninstall iWon's extra programs.

But after performing the add/remove procedures and rebooting one of TechTV's computers, a software scan still found traces of the aornum program. Aornum had renamed some of its files "ornum" and hid the program deeper on the computer.

Within minutes the program was attempting to send data. Our firewall logged the series of requests, noting aornum.exe as the offending malware.

Especially disturbing is that iWon is a TRUSTe company, meaning it promises to publish a privacy policy and live by its tenets. Nowhere in the iWon privacy policy does it state that the spyware program will hide itself and continue transmission after you attempt to remove it.

IWon.com has not returned TechTV's e-mail or phone calls in response to questions regarding the spyware.

Sniffing for iWon’s Spyware

TechTV set up a test machine to see if the aornum software is as insidious as our tipster proposed.

We took a newly imaged Windows XP desktop computer, installed two free spyware-detection programs — Ad-aware and Spybot — and then scanned the machine with both programs. Neither one detected any spyware associated with aornum or iWon.

We also installed the free consumer version of the Zone Alarm firewall and set it to detect and alert us to all outgoing traffic to the Internet.

We then visited the iWon site and signed up for its services. We discovered that playing online bingo doesn't install the spyware, but can become habit-forming.

We rescanned our computer with the two spyware detectors and still found no alerts for aornum.

We then downloaded the iWon chat program to qualify for "more winning opportunities" and began browsing the Internet and playing the iWon slot machine games (also habit-forming). It was then that our firewall gave its first warning. Aornum was attempting to send data.

A scan with Ad-aware didn't detect aornum, but Spybot picked up multiple entries.

Canning the Concealed Code

We followed the iWon removal instructions to rid our PC of aornum and discovered that our only recourse was to uninstall all of the iWon software using the add/remove function in Window XP's control panel. Once removed, all of the previous iWon gaming, chat, and prize functionality was gone.

After a reboot, we scanned our computer with Spybot and found aornum entries. There were fewer of them and their locations and registry modifications had changed. We began accessing the Internet and again our firewall popped up, alerting us that aornum was attempting to send an outgoing data transmission.

The iWon removal instructions left the spyware on our computer. That means aornum is a Trojan horse, or malicious hidden program, and not just spyware.

To truly rid our PC of the program, we used the "search and destroy" function in Spybot, rebooted the computer in safe mode, searched the entire computer for "aornum," deleted all references to the Trojan, emptied our Recycle Bin, and rebooted the machine normally.

A subsequent Spybot scan gave our computer a clean bill of health. So far there have been no additional alerts from our firewall.

This is the best removal advice we can offer. It keeps you from having to do a registry edit and you can do it for free.

Copyright 2002 TechTV, Inc. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.


0
Reply to Message Icon

Related Posts

See More


W32.Opaserv.Worm Spyware Blaster Results



Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links

Ads by Google


Results for: Aornum

How do you remove aornum.exe www.computing.net/answers/security/how-do-you-remove-aornumexe/1788.html

aornum.exe www.computing.net/answers/security/aornumexe/1890.html

Aornum, srchasst, tensoft www.computing.net/answers/security/aornum-srchasst-tensoft/2739.html