Thanks to both id10t and Franz for their suggestions.
The problem turned out to be Firestarter. I had installed it before attempting remote desktop, then I "turned it off". The catch was that it didn't actually turn off. To unblock port 5900 I had to remove it. Since the computer is behind a router, a firewall isn't actually necessary.
I am up and running using Ultra VNC on the Windows machine.
I think Franz overlooked something in his suggestion. On the login line on a typical VNC viewer, the form 192.168.2.nnn:w does not specify the port in the w value. It specifies a screen number. If I were specifying the port the form would be 192.168.2.nnn::5900, with two colons.