Craig, The fact that attempting to connect gives the message "not an RFB server" in spite of there being nothing using port 5900 according to netstat strongly suggests that the system has been compromised. Your best bet is to take the system off the network & to run a full virus/malware scan on it.
Regards, Wez @ RealVNC Ltd. > -----Original Message----- > From: Craig Musgrove [mailto:[EMAIL PROTECTED] > Sent: 06 November 2006 15:41 > To: 'James Weatherall'; 'DOUGLAS COWIE' > Cc: [email protected] > Subject: RE: RE: VNC 4.1.2 port 4900 > > > Running netstat -ab does not yield the answers we want.. This > is a windows > 2000 pro system and the netstat options are different than on > a windows xp > box. > However, netstat does not show 5900 in use at all. > I have closed the 5900 port on the router and opened 5901. > If I try to connect internally to 5900 I get a "this is not a > rfb server" > something like that error message. > I suppose I could run a telnet to that port and see what > comes back as a > response. > > > > > > Craig Musgrove > MCSE, MCP+I, MCP > > Sunoka Computer Services > 2173 Shannon Woods Way > Westbank, BC V4T 2R5 > [EMAIL PROTECTED] (work email) > 250-864-1785 (work number) > > > > > -----Original Message----- > From: James Weatherall [mailto:[EMAIL PROTECTED] > Sent: Monday, November 06, 2006 7:31 AM > To: 'Craig Musgrove'; 'DOUGLAS COWIE' > Cc: [email protected] > Subject: RE: RE: VNC 4.1.2 port 4900 > > Craig, > > I would *strongly* advise you to find out what's currently > using port 5900 > on that server, using the netstat -ab command as I previously > suggested, to > make sure it's not something malicious. > > What does VNC Viewer report if you actually try connecting to > port 5900? > > Regards, > > Wez @ RealVNC Ltd. > > > > > > -----Original Message----- > > From: Craig Musgrove [mailto:[EMAIL PROTECTED] > > Sent: 06 November 2006 15:25 > > To: 'James Weatherall'; 'DOUGLAS COWIE' > > Cc: [email protected] > > Subject: RE: RE: VNC 4.1.2 port 4900 > > > > I was wondering that myself. > > Update.. I could not get vnc to work on 5900... Somehting > taking the > > port. > > So I moved it to 5901 and configured the router to forward public > > ports 5901 to internal 5900. > > That's the best I can do. Seems I have another computer at another > > location misbehaving... Will work on that soon > > > > > > > > > > > > > > Craig Musgrove > > MCSE, MCP+I, MCP > > > > Sunoka Computer Services > > 2173 Shannon Woods Way > > Westbank, BC V4T 2R5 > > [EMAIL PROTECTED] (work email) > > 250-864-1785 (work number) > > > > > > > > > > -----Original Message----- > > From: James Weatherall [mailto:[EMAIL PROTECTED] > > Sent: Monday, November 06, 2006 7:15 AM > > To: 'DOUGLAS COWIE' > > Cc: 'Craig Musgrove'; [email protected] > > Subject: RE: RE: VNC 4.1.2 port 4900 > > > > Hi Douglas, > > > > Why? How would that help? > > > > Wez @ RealVNC Ltd. > > > > > > > -----Original Message----- > > > From: DOUGLAS COWIE [mailto:[EMAIL PROTECTED] > > > Sent: 06 November 2006 15:12 > > > To: James Weatherall > > > Cc: 'Craig Musgrove'; [email protected] > > > Subject: Re: RE: VNC 4.1.2 port 4900 > > > > > > Could also check the %windir%\system32\DRIVERS\ETC\SERVICES > > file...... > > > > > > ----- Original Message ----- > > > From: James Weatherall <[EMAIL PROTECTED]> > > > Date: Thursday, November 2, 2006 2:49 am > > > Subject: RE: VNC 4.1.2 port 4900 > > > > > > > Hi Craig, > > > > > > > > Check the Application Event Log - this will list the > > reason why VNC > > > > Server can't listen on port 5900. If it is, asyou > suggest, that > > > > something else is using that port, then you can just run: > > > > > > > > netstat -ab > > > > > > > > And look for a LISTENING line for :5900, which will > indicate the > > > > programthat's causing the trouble. > > > > > > > > Cheers, > > > > > > > > Wez @ RealVNC Ltd. > > > > > > > > > > > > > -----Original Message----- > > > > > From: Craig Musgrove [mailto:[EMAIL PROTECTED] > > > > > Sent: 02 November 2006 01:15 > > > > > To: 'James Weatherall'; [email protected] > > > > > Subject: RE: VNC 4.1.2 port 4900 > > > > > > > > > > Ok I dropped a bomb on this system.. Hiackthis the heck > > out of it. > > > > > VNC now stays on port 5900 when system reboots!.. But I > > > still cannot > > > > > connect... Even from a computer in the same network. > > > > > I check the vnc serivce icon on the taskbar... Not accepting > > > > > connections. > > > > > Trace this to a possible port conflict. > > > > > Change the port to 5901.. System is waiting for connection... > > > > > Connection > > > > > works when adding :5901 to viewer. > > > > > Would love to have this on port 5900...possible this service > > > > could be > > > > > running in the backgournd in a botched uninstall? > > > > > Is there any installer of service cleanup utility VNC has?? > > > > > Close but not yet! > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Craig Musgrove > > > > > MCSE, MCP+I, MCP > > > > > > > > > > Sunoka Computer Services > > > > > 2173 Shannon Woods Way > > > > > Westbank, BC V4T 2R5 > > > > > [EMAIL PROTECTED] (work email) > > > > > 250-864-1785 (work number) > > > > > > > > > > > > > > > > > > > > > > > > > -----Original Message----- > > > > > From: James Weatherall [mailto:[EMAIL PROTECTED] > > > > > Sent: Tuesday, October 31, 2006 2:54 AM > > > > > To: 'Craig Musgrove'; [email protected] > > > > > Subject: RE: VNC 4.1.2 port 4900 > > > > > > > > > > Craig, > > > > > > > > > > Something on your computer is changing the value - you > > may want to > > > > > scan it for viruses or other malware that might be > > tampering, and > > > > > ensure that you don't have any "policies" in effect > that might > > > > > break things. > > > > > > > > > > Wez @ RealVNC Ltd. > > > > > > > > > > > > > > > > -----Original Message----- > > > > > > From: Craig Musgrove [mailto:[EMAIL PROTECTED] > > > > > > Sent: 31 October 2006 00:48 > > > > > > To: 'James Weatherall'; [email protected] > > > > > > Subject: RE: VNC 4.1.2 port 4900 > > > > > > > > > > > > > > > > > > It shows 5900 as the port...until I restart the computer > > > > > and check the > > > > > > key again.. Its then 4900 again > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Craig Musgrove > > > > > > MCSE, MCP+I, MCP > > > > > > > > > > > > Sunoka Computer Services > > > > > > 2173 Shannon Woods Way > > > > > > Westbank, BC V4T 2R5 > > > > > > [EMAIL PROTECTED] (work email) > > > > > > 250-864-1785 (work number) > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -----Original Message----- > > > > > > From: James Weatherall [mailto:[EMAIL PROTECTED] > > > > > > Sent: Monday, October 30, 2006 3:46 AM > > > > > > To: 'Craig Musgrove'; [email protected] > > > > > > Subject: RE: VNC 4.1.2 port 4900 > > > > > > > > > > > > Craig, > > > > > > > > > > > > What does the registry show immediately after you > have re-set > > > > > > the port to the normal value via the VNC Server Properties > > > > > > dialog? > > > > > > > > > > > > Regards, > > > > > > > > > > > > Wez @ RealVNC Ltd. > > > > > > > > > > > > > > > > > > > -----Original Message----- > > > > > > > From: Craig Musgrove [mailto:[EMAIL PROTECTED] > > > > > > > Sent: 27 October 2006 21:38 > > > > > > > To: 'James Weatherall'; [email protected] > > > > > > > Subject: RE: VNC 4.1.2 port 4900 > > > > > > > > > > > > > > Thanks James. > > > > > > > This system is a windows 2000 pro system not on a domain. > > > > > > There are no > > > > > > > policies in place. > > > > > > > I will run more scans looking for nonsense in the > > background. > > > > > > > The registry reflects the same port misconfiguration. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Craig Musgrove > > > > > > > MCSE, MCP+I, MCP > > > > > > > > > > > > > > Sunoka Computer Services > > > > > > > 2173 Shannon Woods Way > > > > > > > Westbank, BC V4T 2R5 > > > > > > > [EMAIL PROTECTED] (work email) > > > > > > > 250-864-1785 (work number) > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -----Original Message----- > > > > > > > From: James Weatherall [mailto:[EMAIL PROTECTED] > > > > > > > Sent: Friday, October 27, 2006 3:00 AM > > > > > > > To: 'Craig Musgrove'; [email protected] > > > > > > > Subject: RE: VNC 4.1.2 port 4900 > > > > > > > > > > > > > > Craig, > > > > > > > > > > > > > > It sounds like something is trashing your VNC Server's > > > > > Service-Mode > > > > > > > settings. > > > > > > > > > > > > > > If the machine's on a domain, you may want to check that > > > > > > > someone hasn't set up a "policy" that's > overriding the port > > > > > > > number. You may also want to run a virus checker on the > > > > > > > system, to ensure that there's nothing tampering > > with settings > > > > > > > maliciously. > > > > > > > > > > > > > > Have you verified that the Service-Mode configuration in > > > > > > the registry > > > > > > > includes the bogus port number? > > > > > > > > > > > > > > Regards, > > > > > > > > > > > > > > Wez @ RealVNC Ltd. > > > > > > > > > > > > > > > > > > > > > > -----Original Message----- > > > > > > > > From: Craig Musgrove [mailto:[EMAIL PROTECTED] > > > > > > > > Sent: 27 October 2006 03:23 > > > > > > > > To: 'James Weatherall'; [email protected] > > > > > > > > Subject: RE: VNC 4.1.2 port 4900 > > > > > > > > > > > > > > > > Yeah its interesting.. > > > > > > > > I have made sure it's the service mode and not the user > > > > > mode I am > > > > > > > > adjusting (service mode starts when computer boots). > > > > > > > > I have uninstalled and whacked the registry of all VNC > > > > > > > > settings...numerous times. > > > > > > > > And you say this is never been a RFB port? This > is now the > > > > > > > 3rd 4.1.2 > > > > > > > > install I have done which the service port is > 4900... 2 of > > > > > > > the 3 stick > > > > > > > > at 5900... > > > > > > > > This one does not. > > > > > > > > I am at a loss. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Craig Musgrove > > > > > > > > MCSE, MCP+I, MCP > > > > > > > > > > > > > > > > Sunoka Computer Services > > > > > > > > 2173 Shannon Woods Way > > > > > > > > Westbank, BC V4T 2R5 > > > > > > > > [EMAIL PROTECTED] (work email) > > > > > > > > 250-864-1785 (work number) > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -----Original Message----- > > > > > > > > From: James Weatherall [mailto:[EMAIL PROTECTED] > > > > > > > > Sent: Thursday, October 26, 2006 8:15 AM > > > > > > > > To: 'Craig Musgrove'; [email protected] > > > > > > > > Subject: RE: VNC 4.1.2 port 4900 > > > > > > > > > > > > > > > > Hi Craig, > > > > > > > > > > > > > > > > You may want to check the settings via the VNC Server > > > > > > > > Properties dialog and in the registry, and ensure that > > > > > > > > you're checking the Service-Mode, not the User-Mode > > > > > > > > settings. Port 4900 is not, nor has it ever > > > > been, > > > > > > > > an RFB port > > > > > > > > number, but it is exactly 1000 less than the > standard RFB > > > > > > > > port on Windows, which seems a bit of a coincidence! > > > > > > > > > > > > > > > > Cheers, > > > > > > > > > > > > > > > > Wez @ RealVNC Ltd. > > > > > > > > > > > > > > > > > > > > > > > > > -----Original Message----- > > > > > > > > > From: Craig Musgrove > [mailto:[EMAIL PROTECTED] > > > > > > > > > Sent: 26 October 2006 15:53 > > > > > > > > > To: 'James Weatherall'; [email protected] > > > > > > > > > Subject: RE: VNC 4.1.2 port 4900 > > > > > > > > > > > > > > > > > > Positive. > > > > > > > > > Last VNC app on the computer was 4.1.1 - was working > > > > fine - > > > > > > > > till the > > > > > > > > > update was required. > > > > > > > > > I am pretty sure there have never been v3 on > the system > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Craig Musgrove > > > > > > > > > MCSE, MCP+I, MCP > > > > > > > > > > > > > > > > > > Sunoka Computer Services > > > > > > > > > 2173 Shannon Woods Way > > > > > > > > > Westbank, BC V4T 2R5 > > > > > > > > > [EMAIL PROTECTED] (work email) > > > > > > > > > 250-864-1785 (work number) > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -----Original Message----- > > > > > > > > > From: James Weatherall [mailto:[EMAIL PROTECTED] > > > > > > > > > Sent: Thursday, October 26, 2006 3:54 AM > > > > > > > > > To: 'Craig Musgrove'; [email protected] > > > > > > > > > Subject: RE: VNC 4.1.2 port 4900 > > > > > > > > > > > > > > > > > > Craig, > > > > > > > > > > > > > > > > > > Are you sure you haven't accidentally installed VNC > > > > 4.1.2 > > > > > > > > > without removing a > > > > > > > > > VNC 3 or VNC 3 based server first? > > > > > > > > > > > > > > > > > > Wez @ RealVNC Ltd. > > > > > > > > > > > > > > > > > > > > > > > > > > > > -----Original Message----- > > > > > > > > > > From: [EMAIL PROTECTED] > > > > > > > > > > [mailto:[EMAIL PROTECTED] On Behalf Of > > > > > > Craig Musgrove > > > > > > > > > > Sent: 25 October 2006 15:43 > > > > > > > > > > To: [email protected] > > > > > > > > > > Subject: VNC 4.1.2 port 4900 > > > > > > > > > > > > > > > > > > > > I posted a question about a problem I had > last week... > > > > > > > > > > I cannot get VNC to remember to use port 5900 > > > > > instead of 4900 > > > > > > > > > > everytime the computer starts. > > > > > > > > > > The problem still exists. No matter what I try, the > > > > server > > > > > > > > > restarts on > > > > > > > > > > a computer restart on port 4900 I have uninstalled, > > > > > > > reinstalled, > > > > > > > > > > reinstalled to new dir (messed up the > service), wipped > > > > the > > > > > > > > > registry of > > > > > > > > > > each and every mention of VNC after an uninstall... > > > > > > > > nothing works.. > > > > > > > > > > still reboots on port 4900. > > > > > > > > > > > > > > > > > > > > Any ideas? > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Craig Musgrove > > > > > > > > > > MCSE, MCP+I, MCP > > > > > > > > > > > > > > > > > > > > Sunoka Computer Services > > > > > > > > > > 2173 Shannon Woods Way > > > > > > > > > > Westbank, BC V4T 2R5 > > > > > > > > > > <mailto:[EMAIL PROTECTED]> > > > > > > > > [EMAIL PROTECTED] (work > > > > > > > > > > email) > > > > > > > > > > 250-864-1785 (work number) > > > > > > > > > > _______________________________________________ > > > > > > > > > > VNC-List mailing list > > > > > > > > > > [email protected] > > > > > > > > > > To remove yourself from the list visit: > > > > > > > > > > http://www.realvnc.com/mailman/listinfo/vnc-list > > > > _______________________________________________ > > > > VNC-List mailing list > > > > [email protected] > > > > To remove yourself from the list visit: > > > > http://www.realvnc.com/mailman/listinfo/vnc-list _______________________________________________ VNC-List mailing list [email protected] To remove yourself from the list visit: http://www.realvnc.com/mailman/listinfo/vnc-list
