Event ID - 9900

Port No9900
Service Nameiua
RFC Doc0
ProtocolTCP
DescriptionUDP port 9900 uses the Datagram Protocol, a communications protocol for the Internet network layer, transport layer, and session layer. This protocol when used over PORT 9900 makes possible the transmission of a datagram message from one computer to an application running in another computer. Like TCP (Transmission Control Protocol), UDP is used with IP (the Internet Protocol) but unlike TCP on Port 9900, UDP Port 9900 is connectionless and does not guarantee reliable communication; it's up to the application that received the message on Port 9900 to process any errors and verify correct delivery.
Reference LinkMore Information
AttackName:W32.Dabber.A
W32.Dabber.A is a worm. This worm propagates by exploiting vulnerability in the FTP server component of W32.Sasser.Worm and its variants. This worm based on available exploit code. W32.Dabber.A installs a backdoor on infected hosts listening on port 9898. If the attempt fails, W32.Dabber.A tries to listen on ports 9899 through 9999 in sequence until it finds an open port

Removal:
The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

1. Disable System Restore (Windows Me/XP).
2. Update the virus definitions.
3. Do one of the following:
Windows 95/98/Me: Restart the computer in Safe mode.
Windows NT/2000/XP: End the malicious process.

4. Run a full system scan and delete all the files detected as W32.Dabber.A. Reverse the changes made to the registry.

Catch threats immediately

We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.

See what we caught

Did this information help you to resolve the problem?

Yes: My problem was resolved.
No: The information was not helpful / Partially helpful.