Wee's News: Comment on MonkeyCom

MonkeyCom

I had to look through the port number list at IANA and found this listing:

monkeycom9898/tcp    MonkeyCom
monkeycom9898/udp    MonkeyCom
#    Yuji Kuwabara <>

And I had to know what a MonkeyCom was. So I searched Google. I found a product called MonkeyCom, but the site is only in Japanese. That and the picture of the box it comes in really makes me want to buy it.

Comments for: MonkeyCom

I'm also setting up my firewall and had a number of incoming hits on port 9898. My first search resulted in:

distinct32 9998/tcp Distinct32
distinct32 9998/udp Distinct32
distinct 9999/tcp distinct
distinct 9999/udp distinct
# Anoop Tewari

I could not find any information on "Distinct" but then my second search led to MonkeyCom just as yours did. I'm blocking it until I get more info - I certainly did not solicit it!

Posted by Michael Hearne at July 17, 2004 9:04 PM

And immediately after my last post found the following at http://www.bekkoame.ne.jp/~s_ita/port/port9000-9999.html

9898 tcp/udp monkeycom MonkeyCom
9898 tcp/udp # CrashCool, W32.Dabber

So now I'm sure I'll leave it blocked. It seems to be one of those abandoned ports that have been claimed by several services in the past, and are now free for all.

Posted by Michael Hearne at July 17, 2004 9:11 PM

I found this post during a search for MonkeyCom. After some further searching, I felt I should come back and let you know what I found.

MonkeyCom is part of the "Sasser" worm that was released in May. It's called a "Dabber" - basically, you'll see that the port 9898 scan was previewd by a port 5554 scan. The 5554 scan is to check and see if you have the Sasser worm. Then the port 9898 scan is done. If you have the Sasser worm, it will put a file called "package.exe" on your computer (via port 9898) and implant a new virus on your computer.

You can read more details about it here (I know my layman's terms version of it is whacked):

http://www.lurhq.com/dabber.html

Posted by Shelly at July 18, 2004 11:37 AM

Now I really want to buy a copy of Monkeycom. Then I'll get to see what the viruses have to say...

Posted by wee at July 19, 2004 12:28 PM

Back to entry MonkeyCom | Back to Front Page