When the dialog window pops up again, don't close it. Open task manager, sort
the list by CPU time and move the dialog window around so that the corresponding
process climbs up the list. With this, you should see if the process is called
winvnc.exe or anything else. You could then do a search of the exe file in the disk
as well as in the registry. Search the name inside any bat or ini files (esp
win.ini). It might be launched there.
If this doesn't help, you have to use Process Explorer from SysInternal. But
this requires a bit more expertise and the manipulation would be even longer to
explain (and I'm not sure to be clear enough), so I'm not going to describe here
unless necessary.
> -----Message d'origine-----
> De : David Broadwell [mailto:[EMAIL PROTECTED]
> Envoyi : mardi 20 avril 2004 09:01
> @ : [EMAIL PROTECTED]
> Objet : 'Another instance of RealVNC is already running.'
>
> This error message 'Another instance of RealVNC is already running,' would
> not bug me in the least, save for one disturbing fact, I already have VNC
> open. This message pops up out of the blue when my system is idle, making me
> suspect that either someone has scheduled VNC to run (which is not the
> case), or a trojan/spyware variant has installed itself aside my legit
> RealVNC install.
>
> To try to eliminate the later, I've run the most updated spybot search and
> destroy, adaware, and my 'symantec client security' anti-virus at it's most
> recent update.
>
> That I have seen this is only happening once per boot, that I can tell. It
> hasn't been watched for long enough for me to really know yet. So, for any
> spyware to dial home, it has to be known by my firewall, unless it's using
> the open 5900 VNC port I'm at a loss to pinpoint it.
>
> Relevant software versions;
> Windows 2k Server SP4+ PII450/386mb/20gb
> Zone Alarm Pro 4.5
> WinVNC 3.3.6
>
> As an idea, I did a complete uninstall of 3.3.6 as well as all registry
> entries for ORL and VNC. Reinstalled the newest 3.3.7, set a solid password.
>
> After the upgrade, I left WinVNC not running for three hours, at that time I
> checked the task list and WinVNC had automatically spawned and I think I
> have a captive copy of some exploit or other.
>
> Suggestions?
>
> --
>
> David Broadwell
> _______________________________________________
> VNC-List mailing list
> [EMAIL PROTECTED]
> To remove yourself from the list visit:
> http://www.realvnc.com/mailman/listinfo/vnc-list
_______________________________________________
VNC-List mailing list
[EMAIL PROTECTED]
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list
