Need Some help Guys ( Please)

Cartalas · Post by **Cartalas** » March 10, 2003, 10:53 am

Last Week I Reformated my Pc's with Windows 2000 Pro and Reinstalled EQ. Now there are 2 seperate problems.

1st Computer Athalon 1800 512 Ram Geforce 2
2nd Comp Athalon 700 512 Ram Geforce 2

Now on the First Computer Running Direct X 9 Everything Runs Fine with the exception that a WinVNC Client Box Comes up on boot up ( I did not install WinVNC)

On the 2nd Computer EQ drops to Desktop Randomly and The WinVNC box is there too.

Any help would be appreciated.

Fairweather Pure · Post by **Fairweather Pure** » March 10, 2003, 11:03 am

I wish I could help Cart, but I know dick about 2000

I was under the impresion that 2k wasn't very good for gaming anyway.

Krimson Klaw · Post by **Krimson Klaw** » March 10, 2003, 11:04 am

I have no idea what winVNC is, but I would assume if it's giving you problems to check and see if its a service you can disable, and also remove it from your startup in msconfig (you can install msconfig). Also check your actual startup FOLDER on your start menu, make sure if it's listed there or in add/remove programs that you delete/remove it. Did a google search and it looks like some sort of freeware.

Cartalas · Post by **Cartalas** » March 10, 2003, 11:05 am

Krimson Klaw wrote:I have no idea what winVNC is, but I would assume if it's giving you problems to check and see if its a service you can disable, and also remove it from your startup in msconfig. Did a google search and it looks like some sort of freeware.

WinVNC is Like PcAnywhere

I left my PC Drves Shared one night to transfer some files

Sabek · Post by **Sabek** » March 10, 2003, 11:05 am

I believe WinVNC is a remote desktop control program like Microsoft Terminal services. Like Krimson said, I would deinstall it via add/remove programs, or look in the services tool and turn it off.

Krimson Klaw · Post by **Krimson Klaw** » March 10, 2003, 11:07 am

I edited my post a little, but yea services should take it out if it's like pcAnywhere

Cartalas · Post by **Cartalas** » March 10, 2003, 11:10 am

Sabek wrote:I believe WinVNC is a remote desktop control program like Microsoft Terminal services. Like Krimson said, I would deinstall it via add/remove programs, or look in the services tool and turn it off.

Cant Uninstall it its not on add/remove programs

Krimson Klaw · Post by **Krimson Klaw** » March 10, 2003, 11:12 am

Should be in services then, check services man!

Cartalas · Post by **Cartalas** » March 10, 2003, 11:15 am

Krimson Klaw wrote:Should be in services then, check services man!

Not there either!! The window that comes up ask me to set a password which I dont.

I did once for shits and giggles and DL and installed Winvnc and it says it was running but it was not in servecies.

Krimson Klaw · Post by **Krimson Klaw** » March 10, 2003, 11:17 am

ok, last place, check the startup folder on your start menu. If its not there either, I see a format/reinstall in your future!

Cartalas · Post by **Cartalas** » March 10, 2003, 11:28 am

Ah Hell Found the problem

itial Assessment: RED HOT
Date: March 10, 2003
Time: 0200 UTC

On March 8th, TruSecure became aware of a probable new worm spreading
via port 445. The worm is currently known as W32/Deloder, and appears
to spread only by exploiting shares with null passwords, or with weak
passwords. The worm has a list of about 50 passwords, such as
'admin', 'root','1','12','123','1234' etc. The worm installs a
backdoor, and puts itself in the startup path.

While no corporate networks should have 445 exposed to the Internet,
two scenarios exist that need to be addressed.

The first scenario concerns computers connected to the corporate
network via VPN. If these machines become infected, then the worm
can probably infect the corporate LAN.

The second scenario is laptops becoming infected over the weekend,
and then being plugged into the corporate LAN on Monday morning.

While TruSecure could not reproduce it in our testing, it appears
that the code may be capable of enumerating windows networking shares
on local networks, as well as by probing remote IP addresses.

If this is correct, then there is considerable potential for
corporate infections on Monday morning.

Current Assessment: RED HOT

Threat: Low - For enterprises implementing TruSecure Essential
Practices. However the threat could become High - If laptops are
infected and brought into the corporate LAN, third-party connections
to infected hosts or home-office to VPN infections.

Vulnerability Prevalence: Medium to High - Laptops are likely to be
trusted. Windows 2000 and XP hosts with open shares or shares with
weak passwords are vulnerable.

Cost: Potentially High - The worm creates a VNC (Virtual Network
Computer) as a backdoor, something that won't be detected by anti
virus software, so even if infections are cleared up, the back door
might be left there. The VNC uses TCP ports 5800 and 5900.

Bubba Grizz · Post by **Bubba Grizz** » March 10, 2003, 11:32 am

We use winvnc here. It doesn't interfere with anything we use though. We are running primarily a 2kpro setup over 40 computers. The program should be in services under VNC.

Did you download any service packs or updates? That may clean things up for you. And this may sound odd but check the drivers for your sound card. I remember having a bitch of a time with EQ in underwater zones and it all came down to my sound blaster live value card.

If you didn't install VNC then that is a very odd problem. It is a freeware kind of thing put out by AT&T. If all else fails, do like Krim said and re-format and re-install.

Aabidano · Post by **Aabidano** » March 10, 2003, 11:37 am

Win2K isn't bad for gaming, but 98 or XP are much better IMO.

2K wasn't really designed for home use, as it's basically NT4.0 that was "fixed".

Deward · Post by **Deward** » March 10, 2003, 11:37 am

VNC is a decent program if you can't install Terminal services for some reason. Has very low overhead and allows you to take over a machine very easily. Just do a search for vnc and you should find an executable or two and then rename, reboot, and delete. If you didn't install it then someone else did which means there could be all sorts of problems on your machine.

Bubba Grizz · Post by **Bubba Grizz** » March 10, 2003, 1:51 pm

Oofta. Hates the virus's. Would love to bitchslap virus creators.

Cartalas · Post by **Cartalas** » March 10, 2003, 1:53 pm

Bubba Grizz wrote:Oofta. Hates the virus's. Would love to bitchslap virus creators.

I agree looks like 5 pc's are being reformated tonight.