Results 1 to 2 of 2
November 3rd, 2002, 10:10 PM #1
- Join Date
- January 18th, 2005
- St Clair Shores MI.
From ABCNews.com Tech section...
"While just browsing the iWon site is relatively harmless, the potential privacy problem stems from the installation of its iWonPlus subscriber package, which allows members access to other site features such as chat.
A viewer tipped TechTV to the fact that the extra software from iWon also installs the nasty piece of spyware called aornum.exe. Aornum tracks user Web-browsing habits and sends that data back to iWon.com.
IWon says it collects user data and shares it with third-party marketing organizations unless users have opted out of such information sharing. IWon says it also uses the personal data to send "targeted e-mail" to users.
But most disturbing is that the aornum program will apparently continue to send tracking data even after members elect to remove the iWonPlus software from their computers.
How Aornum Avoids Deletion
The instructions at iWon's site advise members to use the add/remove programs function in the Windows operating system software if they wish to uninstall iWon's extra programs.
But after performing the add/remove procedures and rebooting one of TechTV's computers, a software scan still found traces of the aornum program. Aornum had renamed some of its files "ornum" and hid the program deeper on the computer.
Within minutes the program was attempting to send data. Our firewall logged the series of requests, noting aornum.exe as the offending malware.
IWon.com has not returned TechTV's e-mail or phone calls in response to questions regarding the spyware.
Sniffing for iWon’s Spyware
TechTV set up a test machine to see if the aornum software is as insidious as our tipster proposed.
We took a newly imaged Windows XP desktop computer, installed two free spyware-detection programs — Ad-aware and Spybot — and then scanned the machine with both programs. Neither one detected any spyware associated with aornum or iWon.
We also installed the free consumer version of the Zone Alarm firewall and set it to detect and alert us to all outgoing traffic to the Internet.
We then visited the iWon site and signed up for its services. We discovered that playing online bingo doesn't install the spyware, but can become habit-forming.
We rescanned our computer with the two spyware detectors and still found no alerts for aornum.
We then downloaded the iWon chat program to qualify for "more winning opportunities" and began browsing the Internet and playing the iWon slot machine games (also habit-forming). It was then that our firewall gave its first warning. Aornum was attempting to send data.
A scan with Ad-aware didn't detect aornum, but Spybot picked up multiple entries.
Canning the Concealed Code
We followed the iWon removal instructions to rid our PC of aornum and discovered that our only recourse was to uninstall all of the iWon software using the add/remove function in Window XP's control panel. Once removed, all of the previous iWon gaming, chat, and prize functionality was gone.
After a reboot, we scanned our computer with Spybot and found aornum entries. There were fewer of them and their locations and registry modifications had changed. We began accessing the Internet and again our firewall popped up, alerting us that aornum was attempting to send an outgoing data transmission.
The iWon removal instructions left the spyware on our computer. That means aornum is a Trojan horse, or malicious hidden program, and not just spyware.
To truly rid our PC of the program, we used the "search and destroy" function in Spybot, rebooted the computer in safe mode, searched the entire computer for "aornum," deleted all references to the Trojan, emptied our Recycle Bin, and rebooted the machine normally.
A subsequent Spybot scan gave our computer a clean bill of health. So far there have been no additional alerts from our firewall.This is the best removal advice we can offer. It keeps you from having to do a registry edit and you can do it for free."
Thanks Linkshare for promoting a pseudo merchant who purposely uses Malware/spyware to monitize their business and sell off privacy information.
August 22nd, 2009, 09:18 PM #2
- Join Date
- August 22nd, 2009
[B] It is now Aug 22, 2009 and I wish to relate IWon.com is still displaying the same behavior today. I had to remove the malware "Personal Antivirus" from two of my PC's on the same day. It is a drive-by infection that is near impossible to remove. It took 5 hours to remove the first infection. Gamers and surfers, beware!
By jc101 in forum Rakuten LinkShare - LSReplies: 13Last Post: October 24th, 2004, 02:07 PM
By flamingoworld in forum Rakuten LinkShare - LSReplies: 40Last Post: June 7th, 2004, 07:28 AM
By jc101 in forum Suspicious Activity!Replies: 18Last Post: April 20th, 2004, 02:51 AM