Unexpected Message-Remote Connection Could Not Connect to xx.xx.xx.xx

I have recently finished a clean re-install of Windows 7 Home Premium from the original MS disc. Since the re-install, I have noticed an occasional pop-up with the subject message.

I have run AVG scan multiple times with no threats found and don't see anything running that would explain the message. I have done a trace on a couple of the IPs and they almost seem random - no correlation that I can see.

Questions:
- can someone confirm, does the message indicate something is trying to establish a remote connection (remote desktop connection?) from my computer to the IP in the message
- any suggestions on how to track / trace? I've installed process monitor based on an older thread in this forum but don't see how it can be used to log events and tie back to the pop up (especially given the pop up is on my computer when I walk up - hence, no way for me to know for sure when the event occurred)

Any suggestions on how to get to the root of this would be appreciated. Since I have just done a fresh / clean install, I'm not enthusiastic about doing that again without some idea it might help.

Thanks

The next time that the popup happens, leave it there, start Process Explorer* and drag this little icon and "drop" it on to the popup.



It might show you the app that made the popup - or the app might call another app to make the popup, then things get a bit harder to trace.

Process Monitor has the same icon and it works in sort of the same way. When you drag/drop that icon, it will add a filter to Process Monitor using the PID of the app that made the popup.

*edit:
Download the zipped (compressed) file
Open the zipped (compressed) file (folder)
Copy the files somewhere
Run the exe as admin
Agree to the EULA

Thanks - I finally captured the initiating program with process monitor. Looks like probes at vnc. I do have a vnc port open in my router (always have, not sure why I'm just now seeing the pop-ups). However, I have vnc password protected and it looks like all probes are failing.

Thanks again for the pointer to process monitor - very helpful tool

Which flavor of VNC are you using? Tight? Ultra? Tiny? Real?

UsernameIssues: I'm using UltraVNC - have been using it since going from XP to Win7. As I mentioned, I don't recall seeing the prompt before. Not only have I recently done a clean install of Win 7 (hard drive failure) but I also replaced my old Linksys/Cisco with a Netgear 6300 and I began seeing the pop-ups.

I'm experimenting right now by adding each IP I see to a blocked IP list in the firewall. Assuming I shouldn't see any repeats of the same IP once in the blocked list.

I have used UltraVNC for many years.

I am currently using version 1.1.8.6 (64bit), but I see that 1.1.8.8 (64bit) is out.

Download UltraVNC 1.1.8.8 - UltraVNC - VNC - Remote Support Software - Remote Desktop Control - VNC - Free - OpenSource
(ignore the v1180 in the description)

What version are you using?

I'm currently on 1.0.9.5 - like you, I've been using Ultra for quite some time. Not sure an upgrade will change this particular situation but it's time to upgrade any way - thanks for the heads up.

Another update for the forum readers - when I replaced my router, I apparently set "respond to ping". It is my suspicion that is the reason for the high level of probing the VNC port (which is the origin of the pop-up messages I've been seeing). Have turned off respond to ping and expect to see a dramatic drop in that message frequency.