There appears to be a new virus going around that looks for RealVNC servers and rootkits the machine hosting the VNC. Thereafter it spreads throughout the system. This has shown up on our test labs. I really don't like the idea of having to wander all over the labs to chase down data or make changes so I use VNC a lot. Windows only, this is a typical work environment.
Does anybody know of a really cheap replacement* for VNC.

*The hardware kids are doing N radios and all the version spins are killing our budget, so free is the preferred level of cheapness :(

Thanks,
Hugh

I'll look into it.
Are there any gotchas about Remote Desktop that I should know about setting up?

I had to go around and allow remote access and add allowed people, which is not a big deal, because for administrative purposes, most of the machines are administered by admin/password. We only put fictional users on with varying privilege for test purposes.

I can VPN in from home and still get to the lab through my usual proxies so that is pretty good.

The interesting thing is that when I log on remotely, it closes an open console session until I log off. VNC would allow somebody sitting at the console to steal the mouse back or change focus to a different window. It was a standard game when there wasn't enough to be irritated about.

It turns out that the virus only targets RealVNC 4.1.1 and they have a 4.1.2 version out that deals with the vulnerability so some people are going with that. There is also other VNC products from other companies that are not effected as well. So now we have competing remote access methods. Interesting times.

Thanks for the suggestion.
Hugh

This is what we got from company security:

Subject:Virus Outbreak (RealVNC)
Message:GTRC,
Forwarding case to Site Support to have the system reimaged and cleaned.
To summarize, the worm looks for any systems running RealVNC versions
4.1.1 and below, and if it finds one it uses an exploit to log into the system without a
username or password. Once on the system it downloads a rootkit, and begins to spread to other systems.

Once the system is infected, the new rootkit disables any AV scan running, and makes it very difficult to remove. We recommend that the machines be rebuilt if they are infected, until a proven method is discovered to remove the rootkit.

Infosec has blackholed the command and control server at this point, so no systems are under remote control, however if the DNS record changes, the machines will reconnect to the c&c server.

Infosec is in the process of scanning the network and identifying all systems with this virus signature. As a result, cases will be generated for remediation and assigned to On Site Services.

Type Trojan

W32/Tilebot-JS is a backdoor worm for the Windows platform which allows a remote intruder to gain access and control over the computer.

RealVNC

A flaw exists RealVNC server v4.1.1 and older which allows an attacker to override RealVNC server-side authentication. This could result in the attacker gaining remote control over systems running RealVNC server.

[link|http://www.purdue.edu/securepurdue/steam/newsDetail.cfm?NewsID=59|http://www.purdue.ed...ail.cfm?NewsID=59]

* RealVNC is currently not a "company" Supported application. We recommend removing or upgrading to the latest secure version.

This link also talks about it:
[link|http://www.symantec.com/avcenter/attack_sigs/s21641.html|http://www.symantec...._sigs/s21641.html]

HTH