Tom's Guide | Tom's Hardware | Tom's Games
![]() |
![]() |
![]() |
What is aornum.exe and why does this try to connect to the internet. I have it blocked but I don't know what the program is for

It is SpyWare, and it looks like it is originating from IWon's site. It is used to spy on your "Browsing Habits". I currently don't know how to remove it. But if it is like other spyware you can bet you are going to have to go into your registry. Word is Ad-Ware does not detect it, yet. If I find more I will post. I hate Viruses and Trojans probably more than most people. Well we won't go there right now.
Later!Underdog
V-Peace-V

Looks as though IWon knows about this SpyWare.
Here is a removal I found on another BBS posted by someone there. Would you beleive you go to IWon to run the removal? I have not tested this, so I don't know if it works or not.
Later!
Underdog
V-Peace-VRemoval Instructions:
The files is question are not a trojan virus, unless you are loosely using
the term. Simply use the Ad/Remove option on iWon Plus, iWon Prize Machine,
and co-pilot - iWon. This does effectively remove the software from your
system, however, the uninstall is sloppy, it leaves behind some defunct
registry entries: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Aornum
and HKLM\Software\iWon. It also leaves behind the file AornumSP.exe in
\Program Files\Ornum\Aornum1 as well as some files in the cache and possibly
some files in \Program Files\iWon. These can be deleted safely and voila,
your system is clean of iWon. I must say however that I am very disturbed
by iWon's brute force invasion of my system installing software that runs
automatically. It is one thing to allow me to use their prize machine, it
is another to put that junk on there, perhaps I should have read the
agreement more carefully.

This is a piggy back trojan. Created by IWON PRIZE MACHINE> Read the information on the privacy notice on IWON. The instruction that IWON is giving to people to remove it from there system does not work completely. This program can be turned back on secretly by iwon and ???? to monitor your surfing habits and ????.... Monitor port #80 on your computer. Rest Assured this is not a benefit to you. Boycott IWON!

ok have tried to remove several times, even went to msconfig and shut down from startup it reloads, the file for aornum is in program files under ORNUM to delete with windows xp you must got to task manager end proccess then go to program files and delete if you do not end proccess in task manager it will not allow removal of file, i cant stand crap like what iwon did good luck

Adaware does detect the aornum.exe. You have to update your adaware regularly.
The only problem when it "removed?" it from my system, it still left behind a few folders. When I tried to delete them thru my file manager, I received 3 error messages that I couldn't remove them because they were being shared by windows.And one message said access was denied to me. Hey,it's my computer. I want them gone. >:(

Aornum,ornum, or if it changes to tensoft.exe as one response on here mentioned. This is a trojan, it is very difficult to remove from your system. It tends to hide in the registry waiting to be switched on without your knowledge or consent. It continues to send data via port 80 if you unistall exactly as iwon mention's. I ran visual route twice daily for 2weeks and before it gets to iwon.com it is blocked at UUNET Tech or domain Alter.net 157.130.91.82. Why would they block there servers from visual route? IWon and what they did with the prize machine was very underhanded. Iwon has been blocked from my home and work computers! I continue to monitor port#80 very closely. Rest assured IWON did not do you a favor with aornum!

I have used Iwon as a my internet home page for 2 or 3 years. I hardly ever play their games, but I like their user-friendly format, and fluff-free one page headline news. I also like to think that maybe, just maybe someday, simply by logging on and checking weather, stocks, news etc, I may win some big cash.
Well, my old computer breaks down, my bosses get me a fantastic new one, and by default I start looking at MSN. I dont like the format or the fluff. So for a week I'm typing in Iwon.com on MSN to get to my favorite search engine. I should've just made iwon my home-page again with a desktop icon and all. I'd get around to it. But today as I'm logging into iwon, the prize machine pops up, says "Brad-we want you back", and offers me 500 entries. I hadn't spun the prize machine wheels in like a year 'cause i'd never won diddly 'cept more spins or stupid discount coupons, but i agreed and got sucked in. First, the prize machine sets itself up as a desktop icon. Great, my bosses are gonna love that!!! So that's my first little hassle. No big deal to remove, or so I thought. Now, every time I log on to the web, Norton alerts me to this Aornum crap. I'm no techno-geek. I don't program, or design web sites, or even really get into computing. I use one every day to do my office work, to send e-mail, and to check up on news. I should've read the prize machine consent form, or whatever it was that I obviously just clicked past. I'd like to see what couched language or euphamisms they used when I hit "I agree" or "I accept...to bend over and let them rape my brand-new computer."

It is spyware from IWon.
The latest ref updates for adaware dated 9/24/02 do recognize and remove it

![]() |
![]() |
![]() |

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
| Ads by Google |