The simplest explanation is most likely true. Since your software firewall stopped anything from happening on the connection right after the TCP handshake, it isn't possible that the VNC handshake even took place. Unless your software firewall is exceptionally strange.