WINVNC keeps poping up?

Fred wrote:
On Sat, 5 Apr 2003 14:19:47 -0800, "Ronnie Vernon MVP"
wrote:

Fred is simply arguing semantics here which is not good when
discussing whether or not someone has been infected with a virus.

So accuracy is unimportant. More proof that MVP means absolutely
nothing. Yet you then admit later it isn't a virus but a worm. Sad.

The fact is that the Deloder Worm (w32.hllw.deloder) installs a
copy of WinVNC onto your system which makes it a part of this virus
package. There has been a recent upsurge of this worm which means
that it is highly likely that you have been infected.

No, it does not mean it is "highly likely" that he has been infected.
It is however a possibility. English wasn't taught well in your
school was it?

There is a comprehensive analysis and removal instructions he

DeLoder Worm Analysis:
http://www.klcconsulting.net/deloder_worm.htm

I urge you to take a look.

I urge you to view a responsible and accurate site instead.
http://securityresponse.symantec.com...w.deloder.html
Symantec is a trusted source for virus, worm and trojan horse
information. The individual who wrote the page at klcconsulting has
factual misrepresentations all over the place. This is like
recommending I take my bicycle to Ford instead of Schwinn for service.
Both have tools, but one knows far more about bicycles than the other.

Fred

Your still arguing semantics here and it really isn't necessary to be rude
or insulting when you disagree with someone.

From the Symantec website:

Trojan Horse
A program that neither replicates nor copies itself, but causes damage or
compromises the security of the computer. Typically, an individual emails a
Trojan Horse to you-it does not email itself-and it may arrive in the form
of a joke program or software of some sort.

Virus
A program or code that replicates; that is, infects another program, boot
sector, partition sector, or document that supports macros, by inserting
itself or attaching itself to that medium. Most viruses only replicate,
though, many do a large amount of damage as well.

Worm
A program that makes copies of itself; for example, from one disk drive to
another, or by copying itself using email or another transport mechanism.
The worm may do damage and compromise the security of the computer. It may
arrive in the form of a joke program or software of some sort.

The common word here is "damage".

My point is that they are all the same thing, code that can damage a system.
It really makes no difference how they get on the system or how they are
packaged.

George has the VNC program on his system and has no idea how it got there.
This makes it "highly likely" (a common term in my part of the world) that
he has a Virus, Trojan, Worm (take your pick) on his system.

My goal was to get him to understand that he needed to run a complete virus
scan to identify and get rid of the malicious code before it did any
unrecoverable damage.

--
Ronnie Vernon
Microsoft MVP
Windows Shell/User

Associate Expert
ExpertZone - http://www.microsoft.com/windowsxp/expertzone

Please reply only to the newsgroup so all may benefit.
Unsolicited email is not welcome.

Fred wrote:
On Sat, 5 Apr 2003 14:19:47 -0800, "Ronnie Vernon MVP"
wrote:

Fred is simply arguing semantics here which is not good when
discussing whether or not someone has been infected with a virus.

So accuracy is unimportant. More proof that MVP means absolutely
nothing. Yet you then admit later it isn't a virus but a worm. Sad.

The fact is that the Deloder Worm (w32.hllw.deloder) installs a
copy of WinVNC onto your system which makes it a part of this virus
package. There has been a recent upsurge of this worm which means
that it is highly likely that you have been infected.

No, it does not mean it is "highly likely" that he has been infected.
It is however a possibility. English wasn't taught well in your
school was it?

There is a comprehensive analysis and removal instructions he

DeLoder Worm Analysis:
http://www.klcconsulting.net/deloder_worm.htm

I urge you to take a look.

I urge you to view a responsible and accurate site instead.
http://securityresponse.symantec.com...w.deloder.html
Symantec is a trusted source for virus, worm and trojan horse
information. The individual who wrote the page at klcconsulting has
factual misrepresentations all over the place. This is like
recommending I take my bicycle to Ford instead of Schwinn for service.
Both have tools, but one knows far more about bicycles than the other.

Fred

Your still arguing semantics here and it really isn't necessary to be rude
or insulting when you disagree with someone.

From the Symantec website:

Trojan Horse
A program that neither replicates nor copies itself, but causes damage or
compromises the security of the computer. Typically, an individual emails a
Trojan Horse to you-it does not email itself-and it may arrive in the form
of a joke program or software of some sort.

Virus
A program or code that replicates; that is, infects another program, boot
sector, partition sector, or document that supports macros, by inserting
itself or attaching itself to that medium. Most viruses only replicate,
though, many do a large amount of damage as well.

Worm
A program that makes copies of itself; for example, from one disk drive to
another, or by copying itself using email or another transport mechanism.
The worm may do damage and compromise the security of the computer. It may
arrive in the form of a joke program or software of some sort.

The common word here is "damage".

My point is that they are all the same thing, code that can damage a system.
It really makes no difference how they get on the system or how they are
packaged.

George has the VNC program on his system and has no idea how it got there.
This makes it "highly likely" (a common term in my part of the world) that
he has a Virus, Trojan, Worm (take your pick) on his system.

My goal was to get him to understand that he needed to run a complete virus
scan to identify and get rid of the malicious code before it did any
unrecoverable damage.

--
Ronnie Vernon
Microsoft MVP
Windows Shell/User

Associate Expert
ExpertZone - http://www.microsoft.com/windowsxp/expertzone

Please reply only to the newsgroup so all may benefit.
Unsolicited email is not welcome.

Thank you Fred and Ronnie for all the help. I feel bad that because of my
post and I guess not being very clear that you both are arguing. I was just
seeking help and not meaning to make anyone mad.
I went to the web site you posted for me and found the Artical called
DeLoder Worm/Trojen Analysis. I followed the removal instructions finding
the files on my computer that they said should be removed and removed them.
My computer now seems free of the problem and working like it had been
before seeing that window I complained about. Most of the files was in
C:\winnt\fonts folder.
In the article it said that it was discovered on March 8, 2003 and most of
the files I found had a date of March 8, 2003 on them.
Thanks again for all the help. I appreciated you both taking the time to
reply to me.
George-NY

Thank you Fred and Ronnie for all the help. I feel bad that because of my
post and I guess not being very clear that you both are arguing. I was just
seeking help and not meaning to make anyone mad.
I went to the web site you posted for me and found the Artical called
DeLoder Worm/Trojen Analysis. I followed the removal instructions finding
the files on my computer that they said should be removed and removed them.
My computer now seems free of the problem and working like it had been
before seeing that window I complained about. Most of the files was in
C:\winnt\fonts folder.
In the article it said that it was discovered on March 8, 2003 and most of
the files I found had a date of March 8, 2003 on them.
Thanks again for all the help. I appreciated you both taking the time to
reply to me.
George-NY

George-NY wrote:
Thank you Fred and Ronnie for all the help. I feel bad that because
of my post and I guess not being very clear that you both are
arguing. I was just seeking help and not meaning to make anyone mad.
I went to the web site you posted for me and found the Artical called
DeLoder Worm/Trojen Analysis. I followed the removal instructions
finding the files on my computer that they said should be removed and
removed them. My computer now seems free of the problem and working
like it had been before seeing that window I complained about. Most
of the files was in C:\winnt\fonts folder.
In the article it said that it was discovered on March 8, 2003 and
most of the files I found had a date of March 8, 2003 on them.
Thanks again for all the help. I appreciated you both taking the
time to reply to me.
George-NY

George

Very glad you got rid of this malware. Don't worry about it, there really is
no argument, I think Fred and myself both had the same goal in mind, which
was to see you come out of this without any damage to your system.

Take care and let us know if you need anything else.
--
Ronnie Vernon
Microsoft MVP
Windows Shell/User

Associate Expert
ExpertZone - http://www.microsoft.com/windowsxp/expertzone
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

George-NY wrote:
Thank you Fred and Ronnie for all the help. I feel bad that because
of my post and I guess not being very clear that you both are
arguing. I was just seeking help and not meaning to make anyone mad.
I went to the web site you posted for me and found the Artical called
DeLoder Worm/Trojen Analysis. I followed the removal instructions
finding the files on my computer that they said should be removed and
removed them. My computer now seems free of the problem and working
like it had been before seeing that window I complained about. Most
of the files was in C:\winnt\fonts folder.
In the article it said that it was discovered on March 8, 2003 and
most of the files I found had a date of March 8, 2003 on them.
Thanks again for all the help. I appreciated you both taking the
time to reply to me.
George-NY

George

Very glad you got rid of this malware. Don't worry about it, there really is
no argument, I think Fred and myself both had the same goal in mind, which
was to see you come out of this without any damage to your system.

Take care and let us know if you need anything else.
--
Ronnie Vernon
Microsoft MVP
Windows Shell/User

Associate Expert
ExpertZone - http://www.microsoft.com/windowsxp/expertzone
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

X-Newsreader: Forte Agent 1.91/32.564
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Lines: 32
NNTP-Posting-Host: 12.251.175.13
X-Complaints-To:
X-Trace: rwcrnsc54 1049657674 12.251.175.13 (Sun, 06 Apr 2003 19:34:34 GMT)
NNTP-Posting-Date: Sun, 06 Apr 2003 19:34:34 GMT
Organization: AT&T Broadband
Date: Sun, 06 Apr 2003 19:34:34 GMT
Path: news.ultrafeed.com!news.ultrafeed.com!newsfeed-east.nntpserver.com!nntpserver.com!news-west.rr.com!news-east.rr.com!wn12feed!worldnet.att.net!204.127.198. 203!attbi_feed3!attbi.com!rwcrnsc54.POSTED!not-for-mail
Xref: 127.0.0.1 microsoft.public.windowsxp.basics:99203

On Sat, 5 Apr 2003 14:19:47 -0800, "Ronnie Vernon MVP"
wrote:

Fred is simply arguing semantics here which is not good when discussing
whether or not someone has been infected with a virus.

So accuracy is unimportant. More proof that MVP means absolutely
nothing. Yet you then admit later it isn't a virus but a worm. Sad.

The fact is that the Deloder Worm (w32.hllw.deloder) installs a copy of
WinVNC onto your system which makes it a part of this virus package. There
has been a recent upsurge of this worm which means that it is highly likely
that you have been infected.

No, it does not mean it is "highly likely" that he has been infected.
It is however a possibility. English wasn't taught well in your
school was it?

There is a comprehensive analysis and removal instructions he

DeLoder Worm Analysis:
http://www.klcconsulting.net/deloder_worm.htm

I urge you to take a look.

I urge you to view a responsible and accurate site instead.
http://securityresponse.symantec.com...w.deloder.html
Symantec is a trusted source for virus, worm and trojan horse
information. The individual who wrote the page at klcconsulting has
factual misrepresentations all over the place. This is like
recommending I take my bicycle to Ford instead of Schwinn for service.
Both have tools, but one knows far more about bicycles than the other.

X-Newsreader: Forte Agent 1.91/32.564
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Lines: 32
NNTP-Posting-Host: 12.251.175.13
X-Complaints-To:
X-Trace: rwcrnsc54 1049657674 12.251.175.13 (Sun, 06 Apr 2003 19:34:34 GMT)
NNTP-Posting-Date: Sun, 06 Apr 2003 19:34:34 GMT
Organization: AT&T Broadband
Date: Sun, 06 Apr 2003 19:34:34 GMT
Path: news.ultrafeed.com!news.ultrafeed.com!newsfeed-east.nntpserver.com!nntpserver.com!news-west.rr.com!news-east.rr.com!wn12feed!worldnet.att.net!204.127.198. 203!attbi_feed3!attbi.com!rwcrnsc54.POSTED!not-for-mail
Xref: 127.0.0.1 microsoft.public.windowsxp.basics:99203

On Sat, 5 Apr 2003 14:19:47 -0800, "Ronnie Vernon MVP"
wrote:

Fred is simply arguing semantics here which is not good when discussing
whether or not someone has been infected with a virus.

So accuracy is unimportant. More proof that MVP means absolutely
nothing. Yet you then admit later it isn't a virus but a worm. Sad.

The fact is that the Deloder Worm (w32.hllw.deloder) installs a copy of
WinVNC onto your system which makes it a part of this virus package. There
has been a recent upsurge of this worm which means that it is highly likely
that you have been infected.

No, it does not mean it is "highly likely" that he has been infected.
It is however a possibility. English wasn't taught well in your
school was it?

There is a comprehensive analysis and removal instructions he

DeLoder Worm Analysis:
http://www.klcconsulting.net/deloder_worm.htm

I urge you to take a look.

I urge you to view a responsible and accurate site instead.
http://securityresponse.symantec.com...w.deloder.html
Symantec is a trusted source for virus, worm and trojan horse
information. The individual who wrote the page at klcconsulting has
factual misrepresentations all over the place. This is like
recommending I take my bicycle to Ford instead of Schwinn for service.
Both have tools, but one knows far more about bicycles than the other.