Results 1 to 2 of 2
  1. #1
    2005 Linkshare Golden Link Award Winner  ecomcity's Avatar
    Join Date
    January 18th, 2005
    St Clair Shores MI.
    From Tech section...
    "While just browsing the iWon site is relatively harmless, the potential privacy problem stems from the installation of its iWonPlus subscriber package, which allows members access to other site features such as chat.
    A viewer tipped TechTV to the fact that the extra software from iWon also installs the nasty piece of spyware called aornum.exe. Aornum tracks user Web-browsing habits and sends that data back to

    IWon says it collects user data and shares it with third-party marketing organizations unless users have opted out of such information sharing. IWon says it also uses the personal data to send "targeted e-mail" to users.

    This practice is clearly noted in the iWon privacy policy: "… iWon Software Products automatically communicate over the Internet with iWon's servers and, in order to provide you with information or services, may convey to iWon certain information regarding your activities, including, for example, the URL of sites you visit."

    But most disturbing is that the aornum program will apparently continue to send tracking data even after members elect to remove the iWonPlus software from their computers.

    How Aornum Avoids Deletion

    The instructions at iWon's site advise members to use the add/remove programs function in the Windows operating system software if they wish to uninstall iWon's extra programs.

    But after performing the add/remove procedures and rebooting one of TechTV's computers, a software scan still found traces of the aornum program. Aornum had renamed some of its files "ornum" and hid the program deeper on the computer.

    Within minutes the program was attempting to send data. Our firewall logged the series of requests, noting aornum.exe as the offending malware.

    Especially disturbing is that iWon is a TRUSTe company, meaning it promises to publish a privacy policy and live by its tenets. Nowhere in the iWon privacy policy does it state that the spyware program will hide itself and continue transmission after you attempt to remove it. has not returned TechTV's e-mail or phone calls in response to questions regarding the spyware.

    Sniffing for iWon’s Spyware

    TechTV set up a test machine to see if the aornum software is as insidious as our tipster proposed.

    We took a newly imaged Windows XP desktop computer, installed two free spyware-detection programs — Ad-aware and Spybot — and then scanned the machine with both programs. Neither one detected any spyware associated with aornum or iWon.

    We also installed the free consumer version of the Zone Alarm firewall and set it to detect and alert us to all outgoing traffic to the Internet.

    We then visited the iWon site and signed up for its services. We discovered that playing online bingo doesn't install the spyware, but can become habit-forming.

    We rescanned our computer with the two spyware detectors and still found no alerts for aornum.

    We then downloaded the iWon chat program to qualify for "more winning opportunities" and began browsing the Internet and playing the iWon slot machine games (also habit-forming). It was then that our firewall gave its first warning. Aornum was attempting to send data.

    A scan with Ad-aware didn't detect aornum, but Spybot picked up multiple entries.

    Canning the Concealed Code

    We followed the iWon removal instructions to rid our PC of aornum and discovered that our only recourse was to uninstall all of the iWon software using the add/remove function in Window XP's control panel. Once removed, all of the previous iWon gaming, chat, and prize functionality was gone.

    After a reboot, we scanned our computer with Spybot and found aornum entries. There were fewer of them and their locations and registry modifications had changed. We began accessing the Internet and again our firewall popped up, alerting us that aornum was attempting to send an outgoing data transmission.

    The iWon removal instructions left the spyware on our computer. That means aornum is a Trojan horse, or malicious hidden program, and not just spyware.

    To truly rid our PC of the program, we used the "search and destroy" function in Spybot, rebooted the computer in safe mode, searched the entire computer for "aornum," deleted all references to the Trojan, emptied our Recycle Bin, and rebooted the machine normally.

    A subsequent Spybot scan gave our computer a clean bill of health. So far there have been no additional alerts from our firewall.This is the best removal advice we can offer. It keeps you from having to do a registry edit and you can do it for free."

    Thanks Linkshare for promoting a pseudo merchant who purposely uses Malware/spyware to monitize their business and sell off privacy information.

    WebMaster Mike

  2. #2
    Join Date
    August 22nd, 2009
    [B] It is now Aug 22, 2009 and I wish to relate is still displaying the same behavior today. I had to remove the malware "Personal Antivirus" from two of my PC's on the same day. It is a drive-by infection that is near impossible to remove. It took 5 hours to remove the first infection. Gamers and surfers, beware!

  3. Newsletter Signup

+ Reply to Thread

Similar Threads

  1. Replies: 13
    Last Post: October 24th, 2004, 02:07 PM
  2. Affiliate doing driveby installs..Linkshare position? Merchants?
    By flamingoworld in forum Rakuten LinkShare - LS
    Replies: 40
    Last Post: June 7th, 2004, 07:28 AM
  3. spyware nuker at shareasale installs trojan and adware
    By jc101 in forum Suspicious Activity!
    Replies: 18
    Last Post: April 20th, 2004, 02:51 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts