No replies to this topic

[AplusWebMaster]

FYI...from the Internet Storm Center:

- http://isc.sans.org/...date=2004-06-23
Updated June 23rd 2004 22:30 UTC
"------------------
Scanning for Dabber
-------------------
Over the past couple of days there has been a large rise in port 9898 activity reported ( http://www.dshield.o...t.php?port=9898 ). The Dabber worm (which rides in on the coattails of Sasser) opens a listener on port 9898, which is then probed by the attacking system to confirm its success. We're unaware of any "counter-counter" worm that is looking for Dabber backdoors, but I have seen a significant rise in scanning for it, as well...Likely, someone is harvesting lists for later use..."