endellion.me.uk

Navigate This Site

• the virus pages
• the rogue wireless pages
• the useless information pages
• the gratuitous network pages
• Photo Albums
• Personalised Virus Removal

 

Read about Other Malware:

• Laurent Phisheriau, the Haxor from Paris
• DNS Amplification Attack
• 9.exe running as dllhost.exe
• 9.exe running as rtvcscan.exe
• htndhooh.exe
• lqby.exe
• nt.exe and execpyd.exe
• msconfig.exe, courtesty of Fr0zen and R4v3r1n
• winsec.exe
• kj.exe running as ms-java, userlist.exe and msscvc.exe
• Kangozip
• The Symantec AntiVirus server vulnerability
• Web Server Vulnerabilities
• Postcards from Friendly People!
• Click Fraud
• The Hebrew Botnet
• "Video Access Codec Install"
• Video Codec Revisited; I remain completely baffled though...
• A Phisherman writes...
• SystemUpgrade.exe
• Storm Worm
• The Hacker Dude from Morocco
• The Hacking Gambler from China
• svohost
• Web Server Attacks (but pretty ones!)

 

• Related Links

Why have I got DOS boxes popping up on the Desktop?

Plenty of PC users have been asking this question.
The answer is simple: you are running the VNC server program. More specifically, version 4.1.1 of the VNC program.
They made a mistake with that one. When it asks a user for the password, and the user responds that he’d rather not give a password, it connects this user anyway. The “user” is another computer infected with whatever malware is set to spread through it, and is going to offload a nice little virus onto yours too. This is what the commands that appear in the DOS box are set to do.
Get an up-to-date version of VNC installed as like, now!, and perhaps you might want to look into making it serve on a different port too, so that you won’t be affected by future scans on the standard port, which is TCP 5900. There’s a nice little options menu where this can be set.
After that, you’ll have to connect on that new port of course. This takes the form of  computername:1234 (or something along the lines of 192.168.0.x:1234) where 1234 is your new port. Previously you might have just typed “computername” or just the IP address of the server.