| Port |
Trojans |
Notes |
| 1080 |
MyDoom.B,
MyDoom.F, MyDoom.G, MyDoom.H |
registered port for
SOCKS |
| 2283 |
Dumaru.Y |
registered port for Lotus Notes
LNVSTATUS |
| 2535 |
Beagle.W,
Beagle.X, other Beagle/Bagle variants |
registered for
MADCAP |
| 2745 |
Beagle.C
through Beagle.K |
registered port for
URBISNET |
| 3127 |
MyDoom.A |
registered port for EMC CTX-Bridge |
| 3128 |
MyDoom.B |
This port is commonly used by
the
squid proxy. |
| 3410 |
Backdoor.OptixPro.13 and variants |
This port is registered for
NetworkLens SSL Event. |
| 5554 |
Sasser
through Sasser.C, Sasser.F |
This port is commonly used by
SGI ESP HTTP. |
| 8866 |
Beagle.B |
not a registered port. within a
range 8800-8900 used by
Ultima Online
Messenger. |
| 9898 |
Dabber.A
and Dabber.B |
This port is registered for
MonkeyCom. |
| 10000 |
Dumaru.Y |
This is the registered port for
the
NDMP network
storage backup protocol. |
| 10080 |
MyDoom.B |
This is the registered port for
the
Amanda backup
software. |
| 12345 |
NetBus |
This is the registered port for
the
Italk Chat System.
TrendMicro OfficeScan antivirus also uses this port. |
| 17300 |
Kuang2 |
not a registered port. |
| 27374 |
SubSeven |
not a registered port. |
| 65506 |
various names: PhatBot, Agobot,
Gaobot |
in the dynamic/private ports
range. More info at
TCP port 65506 proxy scan
and
New Worms scanning on 1025 and others
|
MyDoom.A actually may choose in a range from port 3127 to 3198. Some of these
trojans may also use port 80 (registered HTTP port) and 8080 (common HTTP port).
