Ultra VNC works fine but can't get SC to work

[Gary Williams]

Hi All,

I can use Ultra VNC (server and viewer) through my firewall from the outside and behind my firewall perfectly. What I can't do is get SC correctly configured (yes, I have been through the setup post many times but am missing something).

My main pc that will run viewer is on 192.168.0.2. My laptop will run the SC version and is on 192.168.0.4.

Please, what is the correct connection string for a copy of SC on the laptop?

When I run viewer on the main pc, it asks for a server. What server should i give it? Any answer gives an error report of "Failed to connect to server" so how can this just sit there listening for SC connection attempts?

Regards

Gary

[Claymon]

Try running "vncviewer /listen".

[Guest]

Hi Claymon,

I found this line of code (in another post) to be used via Start/Run.

D:\UltraVNC\vncviewer.exe -listen 5500

This correctly fires up vnc viewer and it sits in the status bar which, when you hover over its' icon, reports it's listening on port 5500. So far, so good. But I still cannot get the 'remote_server.exe' on the laptop to activate vnc listener on the mail pc.

Regards

Gary

[Claymon]

Do you have a software firewall on the laptop?

[Guest]

Hi Claymon,

Yes, I have zone alarm and Norton anti virus. This sometimes gives a "blocked trojan horse" message but even with norton disabled I still can't connect with sc.

I think I'll have to try this with another external pc.

Regards

Gary

[Claymon]

Zone Alarm is probably blocking the incoming connection. Try disabling it for the test. Remember that with SC the server connects into the client.

[Guest]

The problem is Norton Anti Virus on the PC running UNC Viewer. It thinks that the Viewer is a "Blade Runner Trojan Horse" worm as it is attempting to open a port. Disabling the protection for this particular threat solves the problem and SC works fine.

I guess that "Blade Runner Trojan Horse" targets port 5500 so the solution is to use another port for SC?

Regards

Gary

[Claymon]

It is great that you got it working. It looks like Blade Runner uses 5400, 5401 and 5402. This actually makes sense because the Viewer in listen mode opens up port 5500 and 5400 by default.

The port 5400 feature is rarely used anymore. Telnetting into that port and then hitting enter will flash the border of the screen. See this URL:

http://www.realvnc.com/pipermail/vnc-li ... 24946.html

From my brief testing it looks like VNC subtracts 100 from the regular port for the flasher port. So setting VNC to listen on 5503, or so, should work around the Blade Runner issue.

Cheers,
Claymon

[Claymon]

I did some more goofball testing.

Setting the viewer to 55 caused the flasher to use 65491. ???

Using port 100 set flasher to 3853. ?

Using 101 set flasher to port 1.

I then used 545, knowing that my machine was already listening on 445 and I got the following:

Error Creating listening daemon
(Error creating Flasher socket)
Perhaps another VNCviewer is already running?

I then tried 239 also knowing that my PC listens on 139 but, to my surprise, it worked. I double-checked the output of NetStat and noticed that my three network adapters are explicitly listening to 139, but not the 0.0.0.0 or 127.0.0.1 addresses, whereas 445 listens on the all zeroes address. Here's the output.

0.0.0.0:135
0.0.0.0:445
0.0.0.0:3389
127.0.0.1:1027
192.168.16.100:139
192.168.58.1:139
192.168.217.1:139

So, as mentioned, using 239 didn't fire an error and the flasher still worked. I couldn't believe it. Here are the two additional lines that were added:

0.0.0.0:139
0.0.0.0:239

However, adding 100 to any of the 0.0.0.0 ports or the 127.0.0.1 would fail. So this does make a little bit of sense.

Well, this is all probably more than you wanted to know now, but it may be of use in the future.

I doubt it would be worthe the time, but maybe a /noflash switch could be added... or even, at the risk of breaking compatibility, remove the flasher functionality altogether. It should also save a few bytes in the compiled exe.

Cheers,
Claymon

[pgmoney]

I doubt it would be worthe the time, but maybe a /noflash switch could be added... or even, at the risk of breaking compatibility, remove the flasher functionality altogether. It should also save a few bytes in the compiled exe.

Cheers,
Claymon

I've been using the viewer without the flasher socket for a long time now with no obvious side effects... other than closing a security hole. Making it an option is a good idea.

[Claymon]

I've been using the viewer without the flasher socket for a long time now with no obvious side effects... other than closing a security hole. Making it an option is a good idea.

Yes, it can also avoid some confusion with 'interesting' error messages. The flasher socket is not a well known feature. Actually, it could cause more than confusion. Let's say that someone launches the Viewer in Listen mode and then later launches a program that needs the port that the flasher is using. Well, I've seen software banned from the premises for lesser infractions.

Just curious, what is the size difference between an exe with the flasher feature and the size without? If it isn't too much trouble, could you also tell us what modifications were made to the source to remove this functionality?

Thank you very much,
Claymon

[pgmoney]

Just curious, what is the size difference between an exe with the flasher feature and the size without? If it isn't too much trouble, could you also tell us what modifications were made to the source to remove this functionality?

Thank you very much,
Claymon

Compiled with Advantig C#+ it saved about 3k (probably due to the conversion), with MS Visual Studio 2003.net enterprise architect it saved 5k or 6k, with MS Visual Studio 6 enterprise it was a bit more (maybe 10k or 15k). C#+ produced a smaller exe than VS2003.net which is smaller than VS6 so it depends on how well the compiler optimizes the code. I didn't try any Borland or Watcom compilers on it. If you're doing it to save space, it's not really worth the work. I just basically removed all the bmpflasher, flasher & FLASH_PORT_OFFSET references. I didn't dig very deep so I probably missed something, but it was enough to keep the port closed and not cause any instability which was my goal so I left well enough alone.

[Claymon]

pgmoney:

Thank you very much for this information. I'll post it as a feature request, though it isn't a hight priority.

Cheers,
Claymon

[pgmoney]

pgmoney:

Thank you very much for this information. I'll post it as a feature request, though it isn't a hight priority.

Cheers,
Claymon

When I get some spare time I'll add a -noflash switch to the viewer and make it (& vc6 source) available for download but it may be a few weeks. The changes may not be compatible with the new viewer code so it might be a bit short lived.

[pgmoney]

Ok, so I can't stand unfinished projects looming over my head....
Here is the vnc viewer .exe with the -noflash switch and vc6 source.
(256k download)

http://www.advantig.com/files/vncviewer101a4.zip

Usual disclaimer: Use at your own risk, took 10 minutes to modify and has not had much testing...

[redge]

flasher do this with only 1 colons for viewer and winvnc have different behavior (bug or feature ?):

winvnc
display == port
55 == 6289
101 == 6001

now happen too to the viewer ?

flasher is it display ?
port == display
100 ==3853 ?
101 == 1
545 == 445 ?


explanation applicable for any vnc flavor:

:display (0 - 99 == accept only 5800 to 5899(for http) and 5900 to 5999(RFB protocol)
example: port 5901 == display N° 1
::port (any port outside of standard port need double colons)
examples:
::443 (SingleClick connecting to repeater as non standard port)
::6789 (viewer connecting to repeater as non standard port)

[redge]

viewer without the flasher socket for a long time now with no obvious side effects... other than closing a security hole.

what is flasher ? what usage with only Daemon(for *nix OS ?) ?
any related to IPv6 or nothing ?
http://jungla.dit.upm.es/~acosta/paginas/vncIPv6.html

stop security hole ? Mean stoppen "Blade Runner Trojan Horse" worm ?
not yet tested your vncviewer101a4.exe with NAV2005

pgmoney, thank you again for your new fix for Ultra vncviewer
and thank you too for Claymon relevant the problem of worm detection happy by flasher of vncviewer.

that happen too for classic winvnc 1.0.1 detected as "Blade Runner Trojan Horse" worm !!! used with standard port.
hope you can fix this too
checked with an friend have Norton Anti-Virus 2005

(anyway sorry for english)

[pgmoney]

what is flasher ? what usage with only Daemon(for *nix OS ?) ?

stop security hole ? Mean stoppen "Blade Runner Trojan Horse" worm ?
not yet tested your vncviewer101a4.exe with NAV2005

The flasher is best described here
http://www.realvnc.com/pipermail/vnc-li ... 24946.html

About a year ago there were messages floating around on other sites about exploiting the flasher port but I couldn't find the links or the websites were gone.

I consider any open port a security concern, if it's not needed or being used, it shouldn't be open. The -noflash switch has nothing to do with Blade Runner, it's just a way to prevent exploitation of the open port whether using it simply to irritate your friends or for more malicious purposes.