New nasty?

[Evo]

Over the last couple of days, port 9898 on my firewall has started to take a hammering (nearly 500 hits last night). A bit of searching shows I'm not alone, with comments like


Over the past couple of days there has been a large rise in port 9898 activity reported http://www.dshield.org/port_report.php?port=9898 . The Dabber worm (which rides in on the coattails of Sasser) opens a listener on port 9898, which is then probed by the attacking system to confirm its success. We're unaware of any "counter-counter" worm that is looking for Dabber backdoors, but I have seen a significant rise in scanning for it, as well.


Any more info? I've seen this sort of thing before (e.g. a large number of 5554 scans with the Sasser worm), so I presume something is about to hit?

Probably a good time to make sure everything is up to date folks :ok:

[E-Liam]

Hi Evo,

http://securityresponse.symantec.com/avcenter/venc/data/w32.dabber.a.html

Discovered May 14th

and

http://securityresponse.symantec.com/avcenter/venc/data/w32.dabber.b.html

Discovered June 4th

It's been out a while now, and the big AVs will certainly have it under control, so updating your NAV, AVG etc is all that is required. I'd definitely suggest for those that are either using out of date AVs, little known ones off of a magazine cover disc etc. or don't have one at all (GET ONE)to do an online virus check, just to be sure.

Cheers

Liam