Re: TightVNC Trojan?

[Ryan S. <st...@ag...>]

Simon Renshaw wrote:
> I run 1.3.8 on Windows. I downloaded it from Sourceforge.
>
> It never registered as a virus on any of my AV.
>   

I don't think it is a virus.  I think it is a Trojan.  It sets up a 
Net::Listen to some IP from Amsterdam (77.62.171.113:42353, to be exact) 
when I start up the TightVNC Viewer executable.  As I've stated, I now 
block that IP address and no longer invoke the executable, but I think 
there's a serious problem that needs to be addressed here; until such 
time, I will not make my machine susceptible by running the TightVNC Viewer.

Best,
Ryan

> Windows Defender told me that it was potentially unsafe since someone
> could have installed it without my knowledge and use it to take remote
> control of my machine.
>
> So, no worries.
>
> -----Original Message-----
> From: vnc...@li...
> [mailto:vnc...@li...] On Behalf Of Ryan
> Steele
> Sent: 15 janvier, 2007 14:19
> To: Neal Hartgrove; vnc...@li...
> Subject: Re: TightVNC Trojan?
>
> Neal Hartgrove wrote:
>   
>> suggestion.....
>>
>> try www.tightvnc.com
>> and download your version from there and see what you see.
>>
>>     
>
>  From there, you click the "download page" link, from which you can 
> select a platform, file, etc., all of which link to Sourceforge.  I 
> still think something is gravely wrong with whatever is being provided 
> on SourceForge, and until someone can convince me that the Win32 version
>
> provided with the installer isn't Trojaned, I'm certainly not going to 
> be using TightVNC.
>
> Best,
> Ryan
>
>   
>> Ryan Steele wrote:
>>
>>     
>>> Folks,
>>>
>>> I was wondering why, when launching the TightVNC viewer, it invokes a
>>>       
>
>   
>>> Net::Listen from 77.62.171.113:42353?  My watchdog, WinPooch, picked 
>>> up on that (and I subsequently rejected any traffic from there).  It 
>>> seriously worries me that some IP from Amsterdam is trying to connect
>>>       
>
>   
>>> the instant I launch the viewer.  I grabbed this from the superb-east
>>>       
>
>   
>>> servers on SourceForge... is this copy poisoned?
>>>
>>> Best,
>>> Ryan
>>>
>>>  
>>>
>>>       
>>     
>
> ------------------------------------------------------------------------
> -
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share
> your
> opinions on IT & business topics through brief surveys - and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDE
> V
> ___________________________________________________________
> TightVNC mailing list, VNC...@li...
> To change your subscription or to UNSUBSCRIBE, please visit
> https://lists.sourceforge.net/lists/listinfo/vnc-tight-list
>