its really weird that they would belong to vnc. some process must be changing that, just which one :( what vnc related packages are installed? rpm -qvla|grep "vnc " ?