Thoughts on AMMYY?

[tucsonpc]

So, at $100 for the customizable package, AMMYY is an attractive option for the price. I've used it a couple times, but I was wondering if anyone here had any robust experience with it?

I just signed up for MaxFocus, so if I move in this direction, it'll be for non-managed clients or situations where TakeControl/TeamViewer decide to act up.

 

[Larry Sabo]

It's been discussed several times before. It's a bit frustrating that so many A-Vs automatically quarantine it unless you disable active protection or define it as an exception. I've also had the occasional problem with UAC and clicks not being recognized on some systems but there's no common reason to these that I have been able to figure out. For the price, it's still a great remote support app for those who don't do a lot of it.

 

[rsarceno]

I used Ammyy Admin as a backup. It's reliable but like Larry said, most AV will block it.
I have to give client additional instructions to run it which is sometime a pain in the b**t.

 

[OaksLabs]

Ammyy is my employer's go to RST. The AV challenge is real.....I've been working on packing the EXE to make it less malicious looking, and I've shaved ~5 AV's off the list....but it's the old programming that's being flagged...I'd test the free version first.

 

[ell]

I've been using Ammyy for over a year now and like it a lot. I have my logo on the app and host it on my website for clients to download BUT never use it without a password on it, before I bought it I used the free version and a couple times some random hacker would log into my host before they could close the app. As Larry mentioned it is a battle to keep the clients protection from blocking you, and msfts too so I guess for someone who doesn't do a lot of remote support its ok, and its cheap but if I used it every week I'd probably shop for something else because of that.

 

[ell]

Ammyy is my employer's go to RST. The AV challenge is real.....I've been working on packing the EXE to make it less malicious looking, and I've shaved ~5 AV's off the list....but it's the old programming that's being flagged...I'd test the free version first.

So are you saying the newer versions of the app are less flagged?

 

[OaksLabs]

So are you saying the newer versions of the app are less flagged?

No. The program itself (all versions) use old programming styles that are flagged as malicious.

 

[ell]

No. The program itself (all versions) use old programming styles that are flagged as malicious.

I see, keep us updated on your efforts, curious how you come out.

 

[ell]

So are you saying the newer versions of the app are less flagged?

Ammyy is my employer's go to RST. The AV challenge is real.....I've been working on packing the EXE to make it less malicious looking, and I've shaved ~5 AV's off the list....but it's the old programming that's being flagged...I'd test the free version first.

I'd like to try to do it too, if you have the time share what tools your using and how your doing it, thanks!

 

[OaksLabs]

I'd like to try to do it too, if you have the time share what tools your using and how your doing it, thanks!

Well I'd probably have the whole problem solved if I could find a good command line tool that would be portable and could zip/unzip password protected archives silently.....7Zip just isn't working for me....[I could just pack a big sparse file in with the exe, because most AV's won't scan the big files....but it's not a desirable solution...]

 

[ComputerRepairTech]

I havent used ammy admin in a very long time, is the file digitally signed?

Edit: the file you send to people

 

[ell]

Well I'd probably have the whole problem solved if I could find a good command line tool that would be portable and could zip/unzip password protected archives silently.....7Zip just isn't working for me....[I could just pack a big sparse file in with the exe, because most AV's won't scan the big files....but it's not a desirable solution...]

I've played around with ollydbg and resource hacker but I'm a total noob, can't offer any help but sure would like to, I'm about to give up on it with all hoops I have to go through to run it on a clients pc, just about all my cleanup tools kill it too, even when I install it as a service to reboot. I may send a message to Ammyy and see if they're going to change the code any time soon.

 

[ell]

I havent used ammy admin in a very long time, is the file digitally signed?

Edit: the file you send to people

Process explorer doesn't show its verified.

 

[ell]

Well I'd probably have the whole problem solved if I could find a good command line tool that would be portable and could zip/unzip password protected archives silently.....7Zip just isn't working for me....[I could just pack a big sparse file in with the exe, because most AV's won't scan the big files....but it's not a desirable solution...]

how about this one for portable and silent unzip? http://keepass.info/help/v1/setup.html

 

[OaksLabs]

how about this one for portable and silent unzip? http://keepass.info/help/v1/setup.html

KeePass is a password manager, and I don't actually see a zip/unzip tool on that page....

What I'm looking for is something line this:

<program.exe> -extract <file.zip> -silent -password <qwerty123> -destination <C:\Users\Public\Documents>

Where I can open a password protected zip folder (or any other archive format...) without the user having to type in anything. I'd compile this script, use the Ammyy Icon on the compiled .exe file, and put it on a customer's desktop as if it is the regular Ammyy program.

 

[ell]

KeePass is a password manager, and I don't actually see a zip/unzip tool on that page....

What I'm looking for is something line this:

<program.exe> -extract <file.zip> -silent -password <qwerty123> -destination <C:\Users\Public\Documents>

Where I can open a password protected zip folder (or any other archive format...) without the user having to type in anything. I'd compile this script, use the Ammyy Icon on the compiled .exe file, and put it on a customer's desktop as if it is the regular Ammyy program.

hmmm, I host a password protected Ammyy for clients to download on my website, (only available with purchased version) there should be no need for a password to extract just the archive, I enter the access password on my end once the exe is extracted and launched, I found this, you already tried the -sfx switch here? http://ntsblog.homedev.com.au/index...cting-archive-runs-setup-exe-7zip-sfx-switch/

 

[MDD1963]

If you can simply prevent a client from accepting the first invitation connection from India or Russia that comes along, the program AMMYY itself is harmless, and works well....; if the makers would accept one simple suggestion, it should be to have by default that the client service stopped upon first running the application, which should prevent miscreants from instantly connecting. Or at add some default option to 'confirm connection'... (As near as I can tell, one should tell a client (using the commonly downloaded version) to hit "Stop" on the client side the instant the program starts, which will disallow any incoming connection until access permissions/password can be set)

Anything that to have the program begin running instantly willing to accept connections from anywhere....

 

[OaksLabs]

hmmm, I host a password protected Ammyy for clients to download on my website, (only available with purchased version) there should be no need for a password to extract just the archive, I enter the access password on my end once the exe is extracted and launched,

The issue is not anything to do with malicious Ammyy operators or client access to the file -- it's an issue that 28/56 anti-virus engines flag the file as malicious -- and you can't even download it in Google Chrome [Chrome blocked the file, so Ammyy now has a message saying you can't download the .exe from Google Chrome]. This is what I mean: https://www.virustotal.com/en/file/...7d5bb086aff4e189d3562eca/analysis/1443133916/


I have a solution drafted, I just won't have time to work on it until next week. I should be able to encrypt the main exe and pack it into a wrapper application, and thus obfuscate the code and make it more palatable to AV programs....

 

[ell]

The issue is not anything to do with malicious Ammyy operators or client access to the file -- it's an issue that 28/56 anti-virus engines flag the file as malicious -- and you can't even download it in Google Chrome [Chrome blocked the file, so Ammyy now has a message saying you can't download the .exe from Google Chrome]. This is what I mean: https://www.virustotal.com/en/file/...7d5bb086aff4e189d3562eca/analysis/1443133916/


I have a solution drafted, I just won't have time to work on it until next week. I should be able to encrypt the main exe and pack it into a wrapper application, and thus obfuscate the code and make it more palatable to AV programs....

Exactly, I'm anxious to hear back from you. I even msged ammyy about it, asking if they would be updating anytime soon to prevent the blocking, they thought I was talking about malicious users and not the antivirus prgms blocking it. So I didn't get anywhere with them

 

[madcow007]

I have used ASProtect in the past to lower false positives with ammyy however I have not used it in a few years since I'm now a screenconnect user. I also managed to create a UI replacement using AHK I will try to find my old documentation and example code when I return home.