A rchive Date
[ 28-10-2000 ]
Category
[ Information Technologies ]
sub-Categoy
[ Networking ]
|
[http://www.glocksoft.com/trojan_port.htm
The table shows some examples of existing Trojans and their corresponding default ports.
Using Network Status from AATools, you may see what ports are in use on your local PC for connection with remote systems (LAN/Internet). If you register port probes directed against ports that are normally not used, it is possible that someone is trying to connect to a Trojan inside your network. Check the table below to see if any of these known Trojans are possibly being accessed on your network. If you find that a Trojan is being accessed on your network, use antiviral program to check your system in detail. Using Port Scanner (Trojan port set) from AATools, you may check the remote PC in a LAN or via Internet.
NOTE: Ports of low range are often used by Trojans to steal your passwords and send them to an attackers via e-mail, or to hide them deeply in FTP servers. Ports of higher range are using to unauthorized access to your PC.
We hope this list will somehow be helpful for you.
Default ports | Known Trojan horses |
2 - Death
21 - Back Construction, Blade Runner, Doly Trojan, Fore, FTP trojan, Invisible FTP, Larva, MBT, Motiv, Net Administrator, Senna Spy FTP Server, WebEx, WinCrash
23 - Tiny Telnet Server, Truva Atl
25 - Aji, Antigen, Email Password Sender, Gip, Happy 99, I Love You, Kuang 2, Magic Horse, Moscow Email Trojan, Naebi, NewApt, ProMail trojan, Shtrilitz, Stealth, Tapiras, Terminator, WinPC, WinSpy
31 - Agent 31, Hackers Paradise, Masters Paradise
41 - DeepThroat
48 - DRAT
50 - DRAT
59 - DMSetup
79 - Firehotcker
80 - Back End, Executor, Hooker, RingZero
99 - Hidden
110 - ProMail trojan
113 - Invisible Identd Deamon, Kazimas
119 - Happy 99
121 - JammerKillah
123 - Net Controller
133 - Farnaz, 146 - Infector
146 (UDP) - Infector
170 - A-trojan
421 - TCP Wrappers
456 - Hackers Paradise
531 - Rasmin
555 - Ini-Killer, NeTAdministrator, Phase Zero, Stealth Spy
606 - Secret Service
666 - Attack FTP, Back Construction, NokNok, Cain & Abel, Satanz Backdoor, ServeU, Shadow Phyre
667 - SniperNet
669 - DP Trojan
692 - GayOL
777 - Aim Spy
808 - WinHole
911 - Dark Shadow
999 - DeepThroat, WinSatan
1000 - Der Spacher 3
1001 - Der Spacher 3, Le Guardien, Silencer, WebEx
1010 - Doly Trojan
1011 - Doly Trojan
1012 - Doly Trojan
1015 - Doly Trojan
1016 - Doly Trojan
1020 - Vampire
1024 - NetSpy
1042 - Bla
1045 - Rasmin
1050 - MiniCommand
1080 - WinHole
1081 - WinHole
1082 - WinHole
1083 - WinHole
1090 - Xtreme
1095 - RAT
1097 - RAT
1098 - RAT
1099 - BFevolution, RAT
1170 - Psyber Stream Server, Streaming Audio trojan, Voice
1200 (UDP) - NoBackO
1201 (UDP) - NoBackO
1207 - SoftWAR
1212 - Kaos
1225 - Scarab
1234 - Ultors Trojan
1243 - BackDoor-G, SubSeven, SubSeven Apocalypse, Tiles
1245 - VooDoo Doll
1255 - Scarab
1256 - Project nEXT
1269 - Mavericks Matrix
1313 - NETrojan
1338 - Millenium Worm
1349 (UDP) - BO DLL
1492 - FTP99CMP
1509 - Psyber Streaming Server
1524 - Trinoo
1600 - Shivka-Burka
1777 - Scarab
1807 - SpySender
1966 - Fake FTP
1969 - OpC BO
1981 - Shockrave
1999 - BackDoor, TransScout
2000 - Der Spaeher 3, Insane Network, TransScout
2001 - Der Spaeher 3, TransScout, Trojan Cow
2002 - TransScout
2003 - TransScout
2004 - TransScout
2005 - TransScout
2023 - Ripper
2080 - WinHole
2115 - Bugs
2140 - Deep Throat, The Invasor
2155 - Illusion Mailer
2283 - HVL Rat5
2300 - Xplorer
2565 - Striker
2583 - WinCrash
2600 - Digital RootBeer
2716 - The Prayer
2773 - SubSeven
2801 - Phineas Phucker
3000 - Remote Shutdown
3024 - WinCrash
3128 - RingZero
3129 - Masters Paradise
3150 - Deep Throat, The Invasor
3456 - Teror Trojan
3459 - Eclipse 2000, Sanctuary
3700 - Portal of Doom
3791 - Eclypse
3801 (UDP) - Eclypse
4000 - Skydance
4092 - WinCrash
4242 - Virtual hacking Machine
4321 - BoBo
4444 - Prosiak, Swift remote
4567 - File Nail
4590 - ICQTrojan
5000 - Bubbel, Back Door Setup, Sockets de Troie
5001 - Back Door Setup, Sockets de Troie
5010 - Solo
5011 - One of the Last Trojans (OOTLT)
5031 - NetMetropolitan
5031 - NetMetropolitan
5321 - Firehotcker
5343 - wCrat
5400 - Blade Runner, Back Construction
5401 - Blade Runner, Back Construction
5402 - Blade Runner, Back Construction
5550 - Xtcp
5512 - Illusion Mailer
5555 - ServeMe
5556 - BO Facil
5557 - BO Facil
5569 - Robo-Hack
5637 - PC Crasher
5638 - PC Crasher
5742 - WinCrash
5882 (UDP) - Y3K RAT
5888 - Y3K RAT
6000 - The Thing
6006 - The Thing
6272 - Secret Service
6400 - The Thing
6667 - Schedule Agent
6669 - Host Control, Vampyre
6670 - DeepThroat, BackWeb Server, WinNuke eXtreame
6711 - SubSeven
6712 - Funny Trojan, SubSeven
6713 - SubSeven
6723 - Mstream
6771 - DeepThroat
6776 - 2000 Cracks, BackDoor-G, SubSeven
6838 (UDP) - Mstream
6912 - Shit Heep (not 69123!)
6939 - Indoctrination
6969 - GateCrasher, Priority, IRC 3, NetController
6970 - GateCrasher
7000 - Remote Grab, Kazimas, SubSeven
7001 - Freak88
7215 - SubSeven
7300 - NetMonitor
7301 - NetMonitor
7306 - NetMonitor
7307 - NetMonitor
7308 - NetMonitor
7424 - Host Control
7424 (UDP) - Host Control
7789 - Back Door Setup, ICKiller
7983 - Mstream
8080 - RingZero
8787 - Back Orifice 2000
8897 - HackOffice
8988 - BacHack
8989 - Rcon
9000 - Netministrator
9325 (UDP) - Mstream
9400 - InCommand
9872 - Portal of Doom
9873 - Portal of Doom
9874 - Portal of Doom
9875 - Portal of Doom
9876 - Cyber Attacker, RUX
9878 - TransScout
9989 - iNi-Killer
9999 - The Prayer
10067 (UDP) - Portal of Doom
10085 - Syphillis
10086 - Syphillis
10101 - BrainSpy
10167 (UDP) - Portal of Doom
10528 - Host Control
10520 - Acid Shivers
10607 - Coma
10666 (UDP) - Ambush
11000 - Senna Spy
11050 - Host Control
11051 - Host Control
11223 - Progenic trojan, Secret Agent
12076 - Gjamer
12223 - Hack´99 KeyLogger
12345 - GabanBus, My Pics, NetBus, Pie Bill Gates, Whack Job, X-bill
12346 - GabanBus, NetBus, X-bill
12349 - BioNet
12361 - Whack-a-mole
12362 - Whack-a-mole
12623 (UDP) - DUN Control
12624 - Buttman
12631 - WhackJob
12754 - Mstream
13000 - Senna Spy
13010 - Hacker Brazil
15092 - Host Control
15104 - Mstream
16660 - Stacheldracht
16484 - Mosucker
16772 - ICQ Revenge
16969 - Priority
17166 - Mosaic
17300 - Kuang2 The Virus
17777 - Nephron
18753 (UDP) - Shaft
19864 - ICQ Revenge
20001 - Millennium
20002 - AcidkoR
20034 - NetBus 2 Pro, NetRex, Whack Job
20203 - Chupacabra
20331 - Bla
20432 - Shaft
20432 (UDP) - Shaft
21544 - GirlFriend, Kidterror, Schwindler, WinSp00fer
22222 - Prosiak
23023 - Logged
23432 - Asylum
23456 - Evil FTP, Ugly FTP, Whack Job
23476 - Donald Dick
23476 (UDP) - Donald Dick
23477 - Donald Dick
26274 (UDP) - Delta Source
26681 - Spy Voice
27374 - SubSeven
27444 (UDP) - Trinoo
27573 - SubSeven
27665 - Trinoo
29104 - Host Control
29891 (UDP) - The Unexplained
30001 - TerrOr32
30029 - AOL Trojan
30100 - NetSphere
30101 - NetSphere
30102 - NetSphere
30103 - NetSphere
30103 (UDP) - NetSphere
30133 - NetSphere
30303 - Sockets de Troie
30947 - Intruse
30999 - Kuang2
31335 (UDP) - Trinoo
31336 - Bo Whack, ButtFunnel
31337 - Baron Night, BO client, BO2, Bo Facil
31337 (UDP) - BackFire, Back Orifice, DeepBO, Freak>
31338 - NetSpy DK, ButtFunnel
31338 (UDP) - Back Orifice, DeepBO
31339 - NetSpy DK
31666 - BOWhack
31785 - Hack´a´Tack
31787 - Hack´a´Tack
31788 - Hack´a´Tack
31789 (UDP) - Hack´a´Tack
31791 (UDP) - Hack´a´Tack
31792 - Hack´a´Tack
32100 - Peanut Brittle, Project nEXT
32418 - Acid Battery
33333 - Blakharaz, Prosiak
33577 - PsychWard
33777 - PsychWard
33911 - Spirit 2001a
34324 - BigGluck, TN
34555 (UDP) - Trinoo (Windows)
35555 (UDP) - Trinoo (Windows)
37651 - YAT
40412 - The Spy
40421 - Agent 40421, Masters Paradise
40422 - Masters Paradise
40423 - Masters Paradise
40426 - Masters Paradise
41666 - Remote Boot
41666 (UDP) - Remote Boot
44444 - Prosiak
47262 (UDP) - Delta Source
50505 - Sockets de Troie
50766 - Fore, Schwindler
51996 - Cafeini
52317 - Acid Battery 2000
53001 - Remote Windows Shutdown
54283 - SubSeven
54320 - Back Orifice 2000
54321 - School Bus
54321 (UDP) - Back Orifice 2000
57341 - NetRaider
58339 - ButtFunnel
60000 - Deep Throat
60068 - Xzip 6000068
60411 - Connection
61348 - Bunker-Hill
61466 - Telecommando
61603 - Bunker-Hill
63485 - Bunker-Hill
65000 - Devil, Stacheldracht
65432 - The Traitor
65432 (UDP) - The Traitor
65535 - RC
If you have any questions or information about ports used by Trojans not listed above, please contact us at report@glocksoft.com
Questions or problems regarding this web site should be mailed to webmaster@glocksoft.com
Copyright © 1999-2000 G-Lock Software. All product and company names are trademarks or registered trademarks of their respective owners.
All rights reserved. Privacy statement. ]
|