Tom's Guide | Tom's Hardware | Tom's Games
![]() |
![]() |
![]() |
i asked iwon about Aornum..
They replied with in 2 days,i saved the letter if anyone would like to contact me.....

You Win the Loss of Your Privacy
Software at iWon Web Site Tracks Users Even After Removal
By Becky Worley, Tech LiveOct. 23 — IWon.com offers prize money of up to $1 million to Web surfers who visit the Internet portal site and make it their homepage. But a chance to win money also means that members may be losing something more important: their privacy.
While just browsing the iWon site is relatively harmless, the potential privacy problem stems from the installation of its iWonPlus subscriber package, which allows members access to other site features such as chat.
A viewer tipped TechTV to the fact that the extra software from iWon also installs the nasty piece of spyware called aornum.exe. Aornum tracks user Web-browsing habits and sends that data back to iWon.com.
IWon says it collects user data and shares it with third-party marketing organizations unless users have opted out of such information sharing. IWon says it also uses the personal data to send "targeted e-mail" to users.
This practice is clearly noted in the iWon privacy policy: "… iWon Software Products automatically communicate over the Internet with iWon's servers and, in order to provide you with information or services, may convey to iWon certain information regarding your activities, including, for example, the URL of sites you visit."
But most disturbing is that the aornum program will apparently continue to send tracking data even after members elect to remove the iWonPlus software from their computers.
How Aornum Avoids Deletion
The instructions at iWon's site advise members to use the add/ remove programs function in the Windows operating system software if they wish to uninstall iWon's extra programs.
But after performing the add/remove procedures and rebooting one of TechTV's computers, a software scan still found traces of the aornum program. Aornum had renamed some of its files "ornum" and hid the program deeper on the computer.
Within minutes the program was attempting to send data. Our firewall logged the series of requests, noting aornum.exe as the offending malware.
Especially disturbing is that iWon is a TRUSTe company, meaning it promises to publish a privacy policy and live by its tenets. Nowhere in the iWon privacy policy does it state that the spyware program will hide itself and continue transmission after you attempt to remove it.
IWon.com has not returned TechTV's e-mail or phone calls in response to questions regarding the spyware.
Sniffing for iWon’s Spyware
TechTV set up a test machine to see if the aornum software is as insidious as our tipster proposed.
We took a newly imaged Windows XP desktop computer, installed two free spyware-detection programs — Ad-aware and Spybot — and then scanned the machine with both programs. Neither one detected any spyware associated with aornum or iWon.
We also installed the free consumer version of the Zone Alarm firewall and set it to detect and alert us to all outgoing traffic to the Internet.
We then visited the iWon site and signed up for its services. We discovered that playing online bingo doesn't install the spyware, but can become habit-forming.
We rescanned our computer with the two spyware detectors and still found no alerts for aornum.
We then downloaded the iWon chat program to qualify for "more winning opportunities" and began browsing the Internet and playing the iWon slot machine games (also habit-forming). It was then that our firewall gave its first warning. Aornum was attempting to send data.
A scan with Ad-aware didn't detect aornum, but Spybot picked up multiple entries.
Canning the Concealed Code
We followed the iWon removal instructions to rid our PC of aornum and discovered that our only recourse was to uninstall all of the iWon software using the add/remove function in Window XP's control panel. Once removed, all of the previous iWon gaming, chat, and prize functionality was gone.
After a reboot, we scanned our computer with Spybot and found aornum entries. There were fewer of them and their locations and registry modifications had changed. We began accessing the Internet and again our firewall popped up, alerting us that aornum was attempting to send an outgoing data transmission.
The iWon removal instructions left the spyware on our computer. That means aornum is a Trojan horse, or malicious hidden program, and not just spyware.
To truly rid our PC of the program, we used the "search and destroy" function in Spybot, rebooted the computer in safe mode, searched the entire computer for "aornum," deleted all references to the Trojan, emptied our Recycle Bin, and rebooted the machine normally.
A subsequent Spybot scan gave our computer a clean bill of health. So far there have been no additional alerts from our firewall.
This is the best removal advice we can offer. It keeps you from having to do a registry edit and you can do it for free.
Copyright 2002 TechTV, Inc. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.

![]() |
W32.Opaserv.Worm
|
Spyware Blaster Results
|

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
| Ads by Google |