Parasite: Aornum

This record last updated Tue Sep 20 2005 00:34:14

PLEASE NOTE: Due to the overwhelming extent of this problem and the unbelievable volume of email we have received, we regret that we cannot respond to questions about browser parasites at this time. If you have attempted to contact us about this parasite please accept our apology for not responding. "Thank you's" are always appreciated ;-)

Description

Aornum is a task started with Windows which keeps in contact with its controlling servers, combined with an IE Browser Helper Object.

Also known as

Ornum (its folder name in Program Files), iWon Plus.

Distribution

Is included in more recent bundles of iWon software including the iWon toolbar and Prize Machine.

What it does

Advertising

Yes. Opens pop-up adverts whilst browsing with IE.

Privacy violation

Unknown. Aornum passes opaque strings of characters to its servers, the meaning of which is unclear.

Security issues

Aornum downloads and executes code signed by iWon, for update purposes.

Stability problems

None known, though it will try to connect to iWon when you a file Explorer window, which is annoying if you have auto-connect.

Removal

Go to the Control Panel’s Add/Remove Programs option and remove ‘iWon Plus’. You will probably also want to remove the ‘iWon EZ Setup’ entry which is the installer (allowing iWon-signed code to be installed from a web page) and the ‘iWon Search Assistant’ which monitors terms entered into search engines and hijacks IE search settings.

(The ‘iWon co-pilot’ toolbar is not known to be harmful, you can choose to keep or remove it.)

Next, open the registry (Start->Run->regedit) and find the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Delete the ‘Aornum’ value. Now reboot and you should be able to delete the ‘Ornum’ folder in Program Files, and anything in the ‘iWon’ folder you didn’t keep.