Do not use Ammyy Admin (Remote login) software. Ransomware Alert.

[d5aqoëp]

Today I needed help with installing digital signature certificate and I couldn't. So I called up the support line. The guy was helpful and asked me to install this freeware Ammyy Admin which is TeamViewer alternative. So I went to the Ammyy website and downloaded the  file. Ran it and the guy remotely solved my issue. After 1/2 hr, my PC speakers were alive with voice "Your PC has been encrypted" go to this link on Tor and pay 2 bitcoins to decrypt your data. My wallpaper changed to Cerber Ransomware. All files were renamed to some gibberish alphanumerical names with cerber3 extension. Windows defender? Ohh poor fella. The damn antivirus didn't even know what was going on. Full system scan after encryption revealed nothing.

 

I did a clean 3 pass format and reinstalled Windows again. My backup was of yesterday's so I did not lose any data. So big <snipped> to those ransomware makers. Let them rot in hell while I move on with my life. Only 2 hrs lost but I still can smile.

 

Now the real part. I did a little google search on this Ammyy Admin website and apparently they get hacked every month or so when they randomly start packaging this Cerber ransomware in their executable. Which makes me think that  they are hand in gloves with the ransomware coders. My advice to fellow Neowinians: Do not use Ammyy Admin for remote access needs. There are several other alternatives.

[+warwagon]

Which AV did you have?

[d5aqoëp]

The mighty Windows Defender

[+BudMan]

where exactly did you download it from..  And where did you get the idea it was free.  It is not free for business use.  How and who were you sharing with, maybe he was infected and it jumped to your machine From the connection.

 

I agree with your advice though - why would you use that when you can just use teamviewer??  have you looked at the website hehehe

[sc302]

26 minutes ago, d5aqoëp said:

The mighty Windows Defender

really???

 

 

the only thing mighty about it is how bad it is.  I vaguely remember a Microsoft whitepaper stating to not use it as your primary av source, don't take my word for it...I am sure if you google how bad defender is you can come up with your own conclusion.  That thing couldn't detect a 20 year old virus, much less any ransomware.

[+InsaneNutter]

47 minutes ago, d5aqoëp said:

Now the real part. I did a little google search on this Ammyy Admin website and apparently they get hacked every month or so when they randomly start packaging this Cerber ransomware in their executable. 

The website looks like a scam in my opinion anyway, even if it is legit little effort seems to go in to maintaining the site / product: "Copyright © 2015 Ammyy"

 

Last website update: "07/03/2014 Ammyy Admin v3.5 released"

[xendrome]

Why install a "Teamviewer" alternative, when Teamviewer Host or Teamviewer Host Portable works fine... or any of the other well known Remote PC assist apps, kinda your fault for using crap software...

[+BudMan]

^ agreed on the crap software.  But not sure I would blame the OP..  Seems that was what was suggested by the support team he called.  Which I am curious what company that was.  The company you got your cert from?  Who suggest you use this software?  Do they own a legal license since clearly they are using it for business use.  So did they point to where they have a copy they distribute to their customers.  Or they just said get it off the net?  Did they give you a link to the actual site (yeah its crappy) or did you grab it from like cnet or something?

[d5aqoëp]

2 hours ago, BudMan said:

^ agreed on the crap software.  But not sure I would blame the OP..  Seems that was what was suggested by the support team he called.  Which I am curious what company that was.  The company you got your cert from?  Who suggest you use this software?  Do they own a legal license since clearly they are using it for business use.  So did they point to where they have a copy they distribute to their customers.  Or they just said get it off the net?  Did they give you a link to the actual site (yeah its crappy) or did you grab it from like cnet or something?

I had asked their support to get access of my pc through TeamViewer (which I already had installed) but he was trained to say it was not on their pc. They only had Ammyy Admin. So I had no choice. I downloaded it from Ammyy Admin's website as it is the first google search result. Even CNet would have been safer.

 

@sc302

I said mighty defender in a sarcastic way. It is worthless junk which just sits there and takes up resources on all Windows PCs.

 

This was my first Virus infection in years and I don't even remember when the last I was infected. Yet I have learned nothing. Obviously I will not double click BritneySpears.exe but I might definitely execute app installer which looks legit. This right here is the modulus operandi of future attacks.

[xendrome]

Who is "their support"

[wakjak]

7 minutes ago, xendrome said:

Who is "their support"

Must have been "Microsoft technical support, my name is Rob Johnson" (in a thick indian accent)

[+BudMan]

Yeah I am also curious who their support is?

 

And while they might have their own tool or sure use something other than tv.  They didn't direct you to where to get it, like from their site - they said just google it?  That is complete utter BS..  Who exactly is this support company?

[d5aqoëp]

I myself from Mumbai and the Digital Certificate issuer is a Mumbai based company with local call centre. The support guy might not even know that Ammyy Admin website routinely gets compromised. The digital certificate is used to sign the income tax documents before uploading to Govt website for filling tax returns.

[+BudMan]

So this is a gov sponsored support??  Wow... Who is taking wagers that their use of Ammyy they are telling people to use is not even legal licensed for business use??

[d5aqoëp]

Not govt. definitely not. This company is just a contractor who is cutting costs by using freely available remote login software instead of commercial ones like TeamViewer.

[+BudMan]

"freely available"

 

Does not mean FREE for business use.. Anyone can download TV, its FREE for personal use.. Same goes with this crap alternative they are suggesting.. Read their license agreement..  Or shoot first thing on their page

 

Did they miss the non- part of that statement?

[goretsky]

Hello,

 

The following series of Tweets starting with this one might be of interest:

 

 

Regards,

 

Aryeh Goretsky

 

[Danielx64]

http://news.softpedia.com/news/ammyy-admin-website-compromised-to-spread-cerber-3-ransomware-508330.shtml

[+BudMan]

I would really bring this up to this so called "support" so the next poor schmuck doesn't have the same thing happen.  That link posted by Danielx64 pretty much spells how crappy that company is.  Love the part of notification and response they got days later about please provide license number heheheh

[cork1958]

On 9/21/2016 at 7:36 PM, d5aqoëp said:

I had asked their support to get access of my pc through TeamViewer (which I already had installed) but he was trained to say it was not on their pc. They only had Ammyy Admin. So I had no choice. I downloaded it from Ammyy Admin's website as it is the first google search result. Even CNet would have been safer.

 

@sc302

I said mighty defender in a sarcastic way. It is worthless junk which just sits there and takes up resources on all Windows PCs.

 

This was my first Virus infection in years and I don't even remember when the last I was infected. Yet I have learned nothing. Obviously I will not double click BritneySpears.exe but I might definitely execute app installer which looks legit. This right here is the modulus operandi of future attacks.

You even know that Windows Defender is junk and yet you still use it?! Why in the world would anyone do that, especially anyone that knows even a little bit about that fact?

 

Definitely glad you had a current backup though!

[Riggers]

This is why i don`t like downloading software from places that don`t provide and MD5/SHA 1 for you to reference against. Also surely a product such as this should be digitally signed. I suppose in hindsight running the exe through virustotal or Jotti might have been good practice...

[+BudMan]

Maybe they don't have enough paying customers so now they have gotten into the rasonsomware business hehehe.

 

I really do not blame the OP on this sort of thing.  You call a company for support and they say hey use this.. For starters THEY should be providing their customer with direct link to what they want them to use, off their website.  And 2nd it should be freaking legal if your doing business.  I would bet a LARGE sum of money, LARGE that this support company is not licensed for business use of this software.

 

But I agree with you, why would you use such software.  Shoot I put up the compiled versions of iperf for windows and I provide hash for them.

 

You know another sign of crapware - don't even provide you direct link on their website, they have you give them your email address..  I hate that practice!!!  Sign that the actual thing they are making money off of is selling valid email addresses hehehe

[sc302]

fwiw, webex is all hosted on the webex site not the company site.  

 

It is usually companyname.webex.com

 

;P

[Anibal P]

13 minutes ago, sc302 said:

fwiw, webex is all hosted on the webex site not the company site.  

 

It is usually companyname.webex.com

 

;P

 

It really freaks out newer employees that have not used Webex before, especially since we route the logins through our eSSO servers first 

[Danielx64]

17 hours ago, BudMan said:

Maybe they don't have enough paying customers so now they have gotten into the rasonsomware business hehehe.

 

I really do not blame the OP on this sort of thing.  You call a company for support and they say hey use this.. For starters THEY should be providing their customer with direct link to what they want them to use, off their website.  And 2nd it should be freaking legal if your doing business.  I would bet a LARGE sum of money, LARGE that this support company is not licensed for business use of this software.

 

But I agree with you, why would you use such software.  Shoot I put up the compiled versions of iperf for windows and I provide hash for them.

 

You know another sign of crapware - don't even provide you direct link on their website, they have you give them your email address..  I hate that practice!!!  Sign that the actual thing they are making money off of is selling valid email addresses hehehe

Yeah the other day I had no choice but to provide fake information just to get a trial of installshield. you know what else pisses me off? Not having prices up so you have to contact then to get a quote.

[d5aqoëp]

 I tried to contact my CA and he was unreachable for past 3-4 days. Today he called up and told me that he had to suspend work because he was infected with Cerber ransomware while trying to import his digital certificate. 

 

He lost 20 days of work and took last few days to get up to speed. I wished I could've warned him. Apparently this Virus is wreaking havoc in India because this useless tech support company is asking everyone to install Ammyy Admin. Their digital signature flash drive has install problems. So they are using remote login to push the updated version of installer which correctly installs their newer digital signature.