Virus attack when Ultra VNC is activated

[Eric]

I have been using Ultra VNC quite frequently and everytime I use Ultra VNC on port 5900 I get virus attacking some of the windows\system32 files on my Windows 2000 Server PC.
When the 5900 port is removed when I am not using Ultra VNC, the virus problem do not appear.
Is there any way to prevent this virus problem ?

[Rudi De Vos]

Any idea what files...are attacked

There are some driver files vncdrv.dll and vnchelp.dll
in that directory if the driver is installed.

Is it a real attack, or your virus scanner is just dedecting
the access to thoose files....

You could use an other port then the default 5900 for testing

[Eric]

The virus name that constantly appears when Ultra VNC is activated is W32.Randex.gen and the file that is constantly attacked is c:\winnt\system32\msgfix.exe.
Sometimes other files in this folder are attacked too.

My internet and email access seems to be also affected by this virus.

My Norton Anti-virus software is able to detect and kill this virus but the virus keeps coming back.

When I disable the VNC port, the virus attack stop.

[prandal]

Install good antivirus on all your PCs, make sure they are up to date. Fully patch all your boxes. And firewall your internet connection. Problem solved.

It is NOT UtraVNC's fault.

[mbrown]

Did you try to eliminate the virus? Always check some authority on viruses when you are given a virus name. I use the Symantec Anti-virus Research center. www.sarc.com

Check out the page below on your virus. I would bet it keeps coming back because there are registry entries in the Run key that activates the virus files again upon login. Read this document and follow the instructions for manual removal:

http://securityresponse.symantec.com/av ... x.gen.html

[donem]

There is a free online virus scanner available hereif you do not have one.