'Another instance of RealVNC is already running.'

David Broadwell dbroadwell "at" mindspring.com
Tue Apr 20 07:56:01 2004

This error message 'Another instance of RealVNC is already running,' would
not bug me in the least, save for one disturbing fact, I already have VNC
open. This message pops up out of the blue when my system is idle, making me
suspect that either someone has scheduled VNC to run (which is not the
case), or a trojan/spyware variant has installed itself aside my legit
RealVNC install.

To try to eliminate the later, I've run the most updated spybot search and
destroy, adaware, and my 'symantec client security' anti-virus at it's most
recent update.

That I have seen this is only happening once per boot, that I can tell. It
hasn't been watched for long enough for me to really know yet. So, for any
spyware to dial home, it has to be known by my firewall, unless it's using
the open 5900 VNC port I'm at a loss to pinpoint it.

Relevant software versions;
Windows 2k Server SP4+ PII450/386mb/20gb
Zone Alarm Pro 4.5
WinVNC 3.3.6

As an idea, I did a complete uninstall of 3.3.6 as well as all registry
entries for ORL and VNC. Reinstalled the newest 3.3.7, set a solid password.

After the upgrade, I left WinVNC not running for three hours, at that time I
checked the task list and WinVNC had automatically spawned and I think I
have a captive copy of some exploit or other.



David Broadwell