Beware of Using Ammyy Remote

[ddrecovery]

I had an instance a little while ago where I needed someone to sign into my system to look at a job. It was on a Windows PC that I had not previously used for remote work. I downloaded the free version of Ammyy. The helper logged in, did some work then logged out. About an hour later the Ammyy authorization screen popped up again. I presumed it was the helper logging back in to take a look at the job, but they started searching my system. I opened notepad and asked if I could help (again thinking this was my helper). The intruder asked me to all a certain phone number, I did presuming it was the helper. The guy on the end of the line said he was from McAffe and I had viruses he needed to clear..... I am sure you have heard that one before. Before he could do anything I switched the system off and the removed Ammyy.

Not sure how he got the Ammyy login code. Maybe he was tracking the download and has a way of deciphering the login code. Not sure exactly how he did it, but please beware. This is probably only applicable to new downloads, but who knows.

[LarrySabo]

They use a random number to log into any computer running Ammyy having that Client ID. I used Ammyy for years but gave up on it when all the anti-virus programs quarantined it and most browsers wouldn't even allow it to be downloaded. I password-protected my copy and had the customer download that via my website, and never once had a problem (aside from those just mentioned regarding A-V and browser). I have since switched to AnyDesk and have had no such issues, but if you allow any remote client access when prompted, you still are exposed to the same risk--unless you know the person requesting access and arranged for the connection. I install AnyDesk on all my customers' computers and set a password for unattended access. Works great!

Send your freshly-downloaded copy of Ammyy to VirusTotal and read the scary results!