upd if I have windows rdp connected then I'm able to use ammyy admin rdp. But once i disconnect windows rdp, ammyy admin rdp is also disconnected. This is strange and makes ammyy admin useless (in my configuration). I need ammyy admin rdp to work even if windows rdp is not connected.
Delete this registry value [ Learn More ][ back ] Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
It was GEO-IP filter. I've read about the Amy scam but am not firmilliar with how it is a security risk otherwise. I can see where it could be. I was absolutely not going to punch a hole in my firewall for RDP to this machine. Any tips on fortification of ammyy? Maybe even suggestions of other programs to connect remotely? I want to keep it secure as possible. Thanks for your input all!
You can download the complete package here, including a fully commented metasploit module and detailed README with more information on running it: The one remaining caveat is that Ammyy can connect in two main ways; either by ID, which routes a connection through relay servers run by Ammyy (rl.ammyy.com), or directly by IP. I have only written and used the exploit with a direct IP connection to avoid sending it over the internet, so although the vulnerability should be present either way, I recommend blocking rl.ammyy.com in a hosts file and simply using direct IP connections. Or at this point, feel free to look into making it work over the relays, but I have not.
Free remote administration tool Ammy Admin's official website has been compromised by hackers to serve up malware-laced versions of the legitimate software. The attackers also attempted to hide the nefarious activities behind the ongoing FIFA World Cup 2018 in Russia.
ESET researchers said the issue was first spotted on ammyy.com shortly after midnight on June 13 and persisted until the morning of June 14 - the day the opening ceremony and opening match kicked off.
Users who happened to download software from the site during this time frame also likely received the multipurpose Trojan and banking malware Win32/Kasidet along with the legitimate remote admin software.
But we are unable to block the .cs file transfer with team viewer file transfer. Fortinet support person suggested that, team viewer encrypts the files while transfer process hence, it can't be scanned for dlp. We tried ammyy admin too, but dlp does not scan that either.
You can manage network computers and servers remotely without complicated NAT settings adjustments or Firewall problems. Assist your colleagues with remote access software and be confident all the transmitted data is reliably secured. Using Ammyy Admin as a tool for remote desktop connection and control is the best way to save time and money.
Learn more about remote system administration
By the way, some browsers (e.g. Mozilla Firefox) were flagging the www.ammyy.com website as potentially dangerous at the time of writing this post, and warning about the presence of unwanted software.
In early April, the cybercriminals uploaded a new, slightly modified dropper for distribution. At launch, it used the function GetComputerNameExA to check if the computer being infected was part of a corporate network; if so, it launched the Lurk malicious program along with the remote administration tool. This shows that the cybercriminals were specifically hunting for corporate workstations and servers.
Interestingly, on June 1 the content of the dropper changed. On that very day, it was reported that the creators of Lurk had been arrested, and the website began distributing a new malicious program, Trojan-PSW.Win32.Fareit, in place of Lurk; this new Trojan was also designed to steal personal information. This suggests the malicious actors behind the Ammyy Admin website breach are offering the chance to buy a place on their Trojan dropper in order to spread malware from ammyy.com.
According to Kaspersky Lab data, the Lurk trojan has been propagated through ammyy.com since early February 2016. Company researchers believe that attackers used weaknesses in the Ammyy Admin website security system, in order to add the malware to the installation archive of the remote access software. Kaspersky Lab experts informed the website owners about the incident immediately after spotting it, and they apparently fixed the problem.
Kaspersky Lab products detect the above-mentioned malware as Trojan-Spy.Win32.Lurk and Trojan-PSW.Win32.Fareit, and prevents their installation from the ammyy.com website. We urge organizations to check their networks against this malware.
Ammyy Admin facilitates remote maintenance and control of other systems. The software can also transmit its own desktop and audio content to any targeted system. This Ammyy Admin functionality can also be used to organize remote training courses and online presentations. As a remote maintenance software, Ammyy Admin can operate as a help desk and provide IT administration capability.
aa06259810