The list below shows default ports. Many of these programs may be configured to operate on other ports. A much more complete list can be found at the Simovits Consulting Web site at http://www.simovits.com/nyheter9902.html or at Raf Vantongerloo's page at http://home.tiscalinet.be/bchicken/trojans/trojanpo.htm.
31/tcp | Agent 31, Hackers Paradise, Masters Paradise |
1170/tcp | Psyber Stream |
1234/tcp | Ultors Trojan |
1243/tcp | SubSeven server (default for V1.0-2.0) |
1981/tcp | ShockRave |
2001/tcp | Trojan Cow |
2023/tcp | Ripper Pro |
2140/udp | Deep Throat, Invasor |
2989/tcp | Rat backdoor |
3024/tcp | WinCrash |
3150/tcp | Deep Throat, Invasor |
3700/tcp | Portal of Doom |
4950/tcp | ICQ Trojan |
6346/tcp | Gnutella |
6400/tcp | The Thing |
6667/tcp | Trinity intruder-to-master and master-to-daemon SubSeven server (default for V2.1 Icqfix and beyond) |
6670/tcp | Deep Throat |
12345/tcp | NetBus 1.x, GabanBus, Pie Bill Gates, X-Bill |
12346/tcp | NetBus 1.x |
16660/tcp | Stacheldraht intruder-to-master |
18753/udp | Shaft master-to-daemon |
20034/tcp | NetBus 2 Pro |
20432/tcp | Shaft intruder-to-master |
20433/udp | Shaft daemon-to-master |
27374/tcp | SubSeven server (default for V2.1-Defcon) |
27444/udp | Trinoo master-to-daemon |
27665/tcp | Trinoo intruder-to-master |
30100/tcp | NetSphere |
31335/udp | Trinoo daemon-to-master |
31337/tcp | Back Orifice, Baron Night, Bo Facil |
33270/tcp | Trinity master-to-daemon |
33567/tcp | Backdoor rootshell via inetd (from Lion worm) |
33568/tcp | Trojaned version of SSH (from Lion worm) |
40421/tcp | Masters Paradise Trojan horse |
60008/tcp | Backdoor rootshel via inetd (from Lion worm) |
65000/tcp | Stacheldraht master-to-daemon |