Title: Poor

Remove Poor. Removal instructions

Severity scale:

(57 / 100)

A Remote Administration Tool is a special kind of hacker spyware, used for remote access and control of other people's computers. The attacker infects the PC via the e-mail or File and Print Sharing. A "server" allows him to connect via a "client" on his own machine. The functions of a RAT may vary, depending on the needs of the hacker. Some RATs can't really harm your PC and the only purpose they were made for is hooliganism. But some versions can steal vital information, delete files and even crash your system. The author of this pest is a hacker called Bernhard Mõhr. He wrote this pest in November 2000.

From the publisher:

"Dear Ladies and Gentlemen, I'm a software developer and have started to write programs with MS .net technology. There is a possibility to create assemblies (=programs) on the fly without the need of a compiler. I think this is a quite dangerous feature. For example you can write a (useful) program and integrate a very small piece of code as backdoor. My "proof of concept"-program runs in background and if the user visits a prepared website, the code for the virus is extracted from the html-page, an assembly created and executed. In the background-program are no malicious commands, it needs only a runtime version of MS .net to be started. The whole code for the virus is located in the website as comments. On bigger websites and with some effort the code could be hidden better and nobody could find it. My "proof of concept" waits for the creation of a *.htm file on drive C: (happens surfing through the internet due the caching of IE) and extracts the virus code from there (the page http://www.billyx.com/ProofVirus.htm contains the virus). The virus lists all files from drive C: and deletes the file C:\ProofVirus.txt. The creation of a virus is simple: Write the virus in C#, compile is and disassemble it with the .net disassemble and you can write your own code into the html-page (please notice not all commands are supported by my executable but its only a matter of some minutes to add more). The application is only a proof of concept but could be developed more sophisticated quite easy. It works on the PCs i tested, I hope it also works on yours for demonstration. I think there are 2 possible points to increase security: - The on the fly creation of assemblies in .net is very dangerous -> protect it - Usual documents like html, doc, bmp, jpg, ... should be scanned by the virus-scanner not for malicious commands, I think all content not understood by the (usual) application or disabled by the user should be filtered out. In other words the content should run through a filter that for example only allows valid html to pass through (I'm thinking of a technology like in webwasher but more sophisticated). Yours Bernhard Mõhr"

Poor properties:
• Allows remote user connection
• Hides from the user
• Stays resident in background

Automatic Poor removal:

remover for Poor

SpyHunter is recommended remover to uninstall Poor. You should confirm using free trial that it detects current version of parasite.

Note: Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manul removal instructions below.

If you failed to remove Poor using SpyHunter please report this to us.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use.

STOPzilla

download | review

We are testing STOPzilla's efficiency at removing Poor (2005-04-22 13:16:42)

Malwarebytes Anti Malware

download | review

We are testing Malwarebytes Anti Malware's efficiency at removing Poor (2005-04-22 13:16:42)

Spyware Doctor

download | review | tutorial

We are testing Spyware Doctor's efficiency at removing Poor (2005-04-22 13:16:42)

XoftSpySE Anti Spyware

download | review

Information added: 2005-04-22 10:39:27
Information updated: 2005-04-22 10:39:27

Additional resources related to Poor:

Attention: If you know or you have a website or page about Poor removal, feel free to add a link to this list: add url

more resources

Post Comment:

Attention: Use this form only if you have additional information about Poor parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Spreading the knowledge:

It is very hard to fight Computer parasites alone in internet space. If you have a website we would be more than happy if you would help us to spread the knowledge about latest threats. You can help your visitors to manage their Computer system manually without aditional expences. Knowledge is the power, we just need to spread it.