'Another instance of RealVNC is already running.'

Seak, Teng-Fong tfseak "at" futurmaster.com
Tue Apr 20 13:06:00 2004


	When the dialog window pops up again, don't close it.  Open task manager, sort the list by CPU time and move the dialog window around so that the corresponding process climbs up the list.  With this, you should see if the process is called winvnc.exe or anything else.  You could then do a search of the exe file in the disk as well as in the registry.  Search the name inside any bat or ini files (esp win.ini).  It might be launched there.

	If this doesn't help, you have to use Process Explorer from SysInternal.  But this requires a bit more expertise and the manipulation would be even longer to explain (and I'm not sure to be clear enough), so I'm not going to describe here unless necessary.

> -----Message d'origine-----
> De : David Broadwell [mailto:dbroadwell "at" mindspring.com]
> Envoyi : mardi 20 avril 2004 09:01
> @ : VNC-List "at" realvnc.com
> Objet : 'Another instance of RealVNC is already running.'
> 
> This error message 'Another instance of RealVNC is already running,' would
> not bug me in the least, save for one disturbing fact, I already have VNC
> open. This message pops up out of the blue when my system is idle, making me
> suspect that either someone has scheduled VNC to run (which is not the
> case), or a trojan/spyware variant has installed itself aside my legit
> RealVNC install.
> 
> To try to eliminate the later, I've run the most updated spybot search and
> destroy, adaware, and my 'symantec client security' anti-virus at it's most
> recent update.
> 
> That I have seen this is only happening once per boot, that I can tell. It
> hasn't been watched for long enough for me to really know yet. So, for any
> spyware to dial home, it has to be known by my firewall, unless it's using
> the open 5900 VNC port I'm at a loss to pinpoint it.
> 
> Relevant software versions;
> Windows 2k Server SP4+ PII450/386mb/20gb
> Zone Alarm Pro 4.5
> WinVNC 3.3.6
> 
> As an idea, I did a complete uninstall of 3.3.6 as well as all registry
> entries for ORL and VNC. Reinstalled the newest 3.3.7, set a solid password.
> 
> After the upgrade, I left WinVNC not running for three hours, at that time I
> checked the task list and WinVNC had automatically spawned and I think I
> have a captive copy of some exploit or other.
> 
> Suggestions?
> 
> --
> 
> David Broadwell
> _______________________________________________
> VNC-List mailing list
> VNC-List "at" realvnc.com
> To remove yourself from the list visit:
> http://www.realvnc.com/mailman/listinfo/vnc-list