W32.Dabber.A

W32.Dabber.A is a worm. This worm propagates by exploiting vulnerability in the FTP server component of W32.Sasser.Worm and its variants. This worm based on available exploit code. W32.Dabber.A installs a backdoor on infected hosts listening on port 9898. If the attempt fails, W32.Dabber.A tries to listen on ports 9899 through 9999 in sequence until it finds an open port.

This threat is written in C++ and packed with UPX.

Protection

• Initial Rapid Release version May 14, 2004
• Latest Rapid Release version July 19, 2008 revision 019
• Initial Daily Certified version May 14, 2004
• Latest Daily Certified version January 20, 2009 revision 048
• Initial Weekly Certified release date May 19, 2004

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: High

Distribution

• Distribution Level: Low