Remove Poor. Description and removal instructions

Title: Poor
Type: Remote Administration Tools	Severity scale: (57 / 100)

A Remote Administration Tool is a special kind of hacker spyware, used for remote access and control of other people's computers. The attacker infects the PC via the e-mail or File and Print Sharing. A "server" allows him to connect via a "client" on his own machine. The functions of a RAT may vary, depending on the needs of the hacker. Some RATs can't really harm your PC and the only purpose they were made for is hooliganism. But some versions can steal vital information, delete files and even crash your system. The author of this pest is a hacker called Bernhard Mõhr. He wrote this pest in November 2000.

From the publisher:

"Dear Ladies and Gentlemen, I'm a software developer and have started to write programs with MS .net technology. There is a possibility to create assemblies (=programs) on the fly without the need of a compiler. I think this is a quite dangerous feature. For example you can write a (useful) program and integrate a very small piece of code as backdoor. My "proof of concept"-program runs in background and if the user visits a prepared website, the code for the virus is extracted from the html-page, an assembly created and executed. In the background-program are no malicious commands, it needs only a runtime version of MS .net to be started. The whole code for the virus is located in the website as comments. On bigger websites and with some effort the code could be hidden better and nobody could find it. My "proof of concept" waits for the creation of a *.htm file on drive C: (happens surfing through the internet due the caching of IE) and extracts the virus code from there (the page http://www.billyx.com/ProofVirus.htm contains the virus). The virus lists all files from drive C: and deletes the file C:\ProofVirus.txt. The creation of a virus is simple: Write the virus in C#, compile is and disassemble it with the .net disassemble and you can write your own code into the html-page (please notice not all commands are supported by my executable but its only a matter of some minutes to add more). The application is only a proof of concept but could be developed more sophisticated quite easy. It works on the PCs i tested, I hope it also works on yours for demonstration. I think there are 2 possible points to increase security: - The on the fly creation of assemblies in .net is very dangerous -> protect it - Usual documents like html, doc, bmp, jpg, ... should be scanned by the virus-scanner not for malicious commands, I think all content not understood by the (usual) application or disabled by the user should be filtered out. In other words the content should run through a filter that for example only allows valid html to pass through (I'm thinking of a technology like in webwasher but more sophisticated). Yours Bernhard Mõhr"

FORUM:
Discuss Poor in
spyware removal forum

Poor properties:
• Allows remote user connection
• Hides from the user
• Stays resident in background

Automatic Poor removal:

remover for Poor

Other programs to remove Poor:

• SUPERAntiSpyware - Review - Download
• CounterSpy - Review - Download
• Windows Defender - Review - Download

Information added: 22/04/05
Information updated: 22/04/05

Additional resources related to Poor:

Attention: If you know or you have a website or page about Poor removal, feel free to add a link to this list: add url

more resources

Post Comment:

Attention: Use this form only if you have additional information about Poor parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.