Winvnc . . help.

[ricpinto]

I've notice one of my user, Winvnc will pop up and ask user to configgure it. If you untick some of the settings it will tell you that it's dangerous to leave the password blank. I've not yet really go thru it because i'm busy of something but can anyone tell me how does this program just pops up and where it comes from. User said it's just pops up and he never did anything lately.

Thanks

 

[lunatic23]

does it pop up when the machine is first turned on/logged on?

if it does, then its probably in your "startup" folder, & the fact that there is no password set it will automatically open each time you log on & ask you to provide a password.

if you don't use the program at all:

just remove the shortcut from the "startup" folder: found at "Start/Programs/Startup",

or uninstall the whole program

or alternatively if you plan to use it set a password & it will never pop up again [unless you prompt it manually]

thanx
luni

someone once told me to shut up...

 

[ricpinto]

Maybe i post it in a very simple way. This program is an application that can control your PC remotely (WInVNC). So the password is needed as an authentication when somebody tries to control your PC. it pops up after login.

It's not in the startup, it's not registered in ADD/Removed program. Nobody installed it.. it's just come out of nowhere. Inside the registry you can find it inside the folder Netscape but they never install any netscape browser.

Looks like somebody is trying to hack .. so I did put a password.

Anyway I will be going there on Monday so I can update you and see if I can removed this program. Currently i turned off the PC.

 

[SoulAssassin]

It's probably started as a service. If the viewer pops up and asks for a password, then it's in the startup/registry as a startup item. Otherwise if it's the server, then that's a problem.

 

[MontrealSoft]

Is that computer directly on the internet w/o any router/firewall ? If so, maybe someone is trying to hack (pretty stupid to try to hack this way but...) you...
and installed the service but forgot to configure it to allow blank passwords...

Better check out your security ! (use a router and never, ever, leave your administrator password "blank" under win2000)

MontrealSoft.com

http://www.montrealsoft.com

 

[raquetman75]

Thanks for suggestions . . The user of the PC is on leave so I'm taking my time. I'll keep you posted.

 

[Angelfish2702]

This could very well be the result of a new virus W32/Deloder-A which drops init.exe and psexec.exe onto a target PC, adds an entry to startup folders and then inserts entries to HKLM\Software\Microsoft\Windows\CurrentVersion\Run
the entries will be "explorer" "TaskMan" and "messnger" (note spelling).
I found this on my Mother's PC an hour ago, fortunately it had been present less than 24 hours. She is about to get a firewall installed!
See Sophos Anti Virus for details at;

http://www.sophos.com/virusinfo/analyses/w32delodera.html

Hope this helps.