Anti/Trojan ports.htm

The Following is a List of Trojan Horse Ports that are Known

you can test to see what ports are active on your system using the following

In an MS DOS prompt Window:

C:\WINDOWS\>NETSTAT -a

this will give you a listing something like the following

TCP win98:domain WIN98:0 LISTENING
TCP win98:67 WIN98:0 LISTENING
TCP win98:1537 WIN98:1588 ESTABLISHED

Explanation of the result :-  

TCP is the Type of Data Port

win98 is the local computer net bios name

followed by the local port address

then the Remote net bios computer name in capitals

followed by the active remote port

Finally the Port  status (LISTENING - ESTABLISHED) 

PORT # - TROJAN Name/Type

 2  - Death
 21 - Back Construction, Blade Runner, Doly Trojan, Fore, FTP trojan, 
         Invisible FTP, Larva, MBT, Motiv, 
         Net Administrator, Senna Spy FTP Server, WebEx, WinCrash
 23 - Tiny Telnet Server, Truva Atl
 25 - Aji, Antigen, Email Password Sender, Gip, Happy 99, I Love You, Kuang 2,
         Magic Horse, Moscow Email Trojan,         Naebi, NewApt, ProMail trojan,      
         Shtrilitz, Stealth, Tapiras, Terminator, WinPC, WinSpy
 31 - Agent 31, Hackers Paradise, Masters Paradise
 41 - DeepThroat
 48 - DRAT
 50 - DRAT
 59 - DMSetup
 79 - Firehotcker
 80 - Back End, Executor, Hooker, RingZero
 99 - Hidden 
 110 - ProMail trojan
 113 - Invisible Identd Deamon, Kazimas
 119 - Happy 99
 121 - JammerKillah
 123 - Net Controller
 133 - Farnaz,  146 - Infector
 146 - (UDP) - Infector
 170 - A-trojan
 421 - TCP Wrappers
 456 - Hackers Paradise
 531 - Rasmin
 555 - Ini-Killer, NeTAdministrator, Phase Zero, Stealth Spy
 606 - Secret Service
 666 - Attack FTP, Back Construction, NokNok, Cain & Abel, Satanz Backdoor, 
           ServeU, Shadow Phyre
 667 - SniperNet
 669 - DP Trojan
 692 - GayOL
 777 - Aim Spy
 808 - WinHole
 911 - Dark Shadow
 999 - DeepThroat, WinSatan
 1000 - Der Spacher 3
 1001 - Der Spacher 3, Le Guardien, Silencer, WebEx
 1010 - Doly Trojan
 1011 - Doly Trojan
 1012 - Doly Trojan
 1015 - Doly Trojan
 1016 - Doly Trojan
 1020 - Vampire
 1024 - NetSpy
 1042 - Bla
 1045 - Rasmin
 1050 - MiniCommand
 1080 - WinHole
 1081 - WinHole
 1082 - WinHole
 1083 - WinHole
 1090 - Xtreme
 1095 - RAT
 1097 - RAT
 1098 - RAT
 1099 - BFevolution, RAT
 1170 - Psyber Stream Server, Streaming Audio trojan, Voice
 1200 - (UDP) - NoBackO
 1201 - (UDP) - NoBackO
 1207 - SoftWAR
 1212 - Kaos
 1225 - Scarab
 1234 - Ultors Trojan
 1243 - BackDoor-G, SubSeven, SubSeven Apocalypse, Tiles
 1245 - VooDoo Doll
 1255 - Scarab
 1256 - Project nEXT
 1269 - Mavericks Matrix
 1313 - NETrojan
 1338 - Millenium Worm
 1349 - (UDP) - BO DLL
 1492 - FTP99CMP
 1509 - Psyber Streaming Server
 1524 - Trinoo
 1600 - Shivka-Burka
 1777 - Scarab
 1807 - SpySender
 1966 - Fake FTP
 1969 - OpC BO
 1981 - Shockrave
 1999 - BackDoor, TransScout
 2000 - Der Spaeher 3, Insane Network, TransScout
 2001 - Der Spaeher 3, TransScout, Trojan Cow
 2002 - TransScout
 2003 - TransScout
 2004 - TransScout
 2005 - TransScout
 2023 - Ripper
 2080 - WinHole
 2115 - Bugs
 2140 - Deep Throat, The Invasor
 2155 - Illusion Mailer
 2283 - HVL Rat5
 2300 - Xplorer
 2565 - Striker
 2583 - WinCrash
 2600 - Digital RootBeer
 2716 - The Prayer
 2773 - SubSeven
 2801 - Phineas Phucker
 3000 - Remote Shutdown
 3024 - WinCrash
 3128 - RingZero
 3129 - Masters Paradise
 3150 - Deep Throat, The Invasor
 3456 - Teror Trojan
 3459 - Eclipse 2000, Sanctuary
 3700 - Portal of Doom
 3791 - Eclypse
 3801 - (UDP) - Eclypse
 4000 - Skydance
 4092 - WinCrash
 4242 - Virtual hacking Machine
 4321 - BoBo
 4444 - Prosiak, Swift remote
 4567 - File Nail
 4590 - ICQTrojan
 5000 - Bubbel, Back Door Setup, Sockets de Troie
 5001 - Back Door Setup, Sockets de Troie
 5010 - Solo
 5011 - One of the Last Trojans (OOTLT)
 5031 - NetMetropolitan
 5031 - NetMetropolitan
 5321 - Firehotcker
 5343 - wCrat
 5400 - Blade Runner, Back Construction
 5401 - Blade Runner, Back Construction
 5402 - Blade Runner, Back Construction
 5550 - Xtcp
 5512 - Illusion Mailer
 5555 - ServeMe
 5556 - BO Facil
 5557 - BO Facil
 5569 - Robo-Hack
 5637 - PC Crasher
 5638 - PC Crasher
 5742 - WinCrash
 5882 - (UDP) - Y3K RAT
 5888 - Y3K RAT
 6000 - The Thing
 6006 - The Thing
 6272 - Secret Service
 6400 - The Thing
 6667 - Schedule Agent
 6669 - Host Control, Vampyre
 6670 - DeepThroat, BackWeb Server, WinNuke eXtreame
 6711 - SubSeven
 6712 - Funny Trojan, SubSeven
 6713 - SubSeven
 6723 - Mstream
 6771 - DeepThroat
 6776 - 2000 Cracks, BackDoor-G, SubSeven
 6838 - (UDP) - Mstream
 6912 - Shit Heep (not  69123!)
 6939 - Indoctrination
 6969 - GateCrasher, Priority, IRC 3, NetController
 6970 - GateCrasher
 7000 - Remote Grab, Kazimas, SubSeven
 7001 - Freak88
 7215 - SubSeven
 7300 - NetMonitor
 7301 - NetMonitor
 7306 - NetMonitor
 7307 - NetMonitor
 7308 - NetMonitor
 7424 - Host Control
 7424 - (UDP) - Host Control
 7789 - Back Door Setup, ICKiller
 7983 - Mstream
 8080 - RingZero
 8787 - Back Orifice 2000
 8897 - HackOffice
 8988 - BacHack
 8989 - Rcon
 9000 - Netministrator
 9325 - (UDP) - Mstream
 9400 - InCommand
 9872 - Portal of Doom
 9873 - Portal of Doom
 9874 - Portal of Doom
 9875 - Portal of Doom
 9876 - Cyber Attacker, RUX
 9878 - TransScout
 9989 - iNi-Killer
 9999 - The Prayer
 10067 - (UDP) - Portal of Doom
 10085 - Syphillis
 10086 - Syphillis
 10101 - BrainSpy
 10167 - (UDP) - Portal of Doom
 10528 - Host Control
 10520 - Acid Shivers
 10607 - Coma
 10666 - (UDP) - Ambush
 11000 - Senna Spy
 11050 - Host Control
 11051 - Host Control
 11223 - Progenic trojan, Secret Agent
 12076 - Gjamer
 12223 - Hack´99 KeyLogger
 12345 - GabanBus, My Pics, NetBus, Pie Bill Gates, Whack Job, X-bill
 12346 - GabanBus, NetBus, X-bill
 12349 - BioNet
 12361 - Whack-a-mole
 12362 - Whack-a-mole
 12623 - (UDP) - DUN Control
 12624 - Buttman
 12631 - WhackJob
 12754 - Mstream
 13000 - Senna Spy
 13010 - Hacker Brazil
 15092 - Host Control
 15104 - Mstream
 16660 - Stacheldracht
 16484 - Mosucker
 16772 - ICQ Revenge
 16969 - Priority
 17166 - Mosaic
 17300 - Kuang2 The Virus
 17777 - Nephron
 18753 - (UDP) - Shaft
 19864 - ICQ Revenge
 20001 - Millennium
 20002 - AcidkoR
 20034 - NetBus 2 Pro, NetRex, Whack Job
 20203 - Chupacabra
 20331 - Bla
 20432 - Shaft
 20432 - (UDP) - Shaft
 21544 - GirlFriend, Kidterror, Schwindler, WinSp00fer
 22222 - Prosiak
 23023 - Logged
 23432 - Asylum
 23456 - Evil FTP, Ugly FTP, Whack Job
 23476 - Donald Dick
 23476 - (UDP) - Donald Dick
 23477 - Donald Dick
 26274 - (UDP) - Delta Source
 26681 - Spy Voice
 27374 - SubSeven
 27444 - (UDP) - Trinoo
 27573 - SubSeven
 27665 - Trinoo
 29104 - Host Control
 29891 - (UDP) - The Unexplained
 30001 - TerrOr32
 30029 - AOL Trojan
 30100 - NetSphere
 30101 - NetSphere
 30102 - NetSphere
 30103 - NetSphere
 30103 - (UDP) - NetSphere
 30133 - NetSphere
 30303 - Sockets de Troie
 30947 - Intruse
 30999 - Kuang2
 31335 - (UDP) - Trinoo
 31336 - Bo Whack, ButtFunnel
 31337 - Baron Night, BO client, BO2, Bo Facil
 31337 - (UDP) - BackFire, Back Orifice, DeepBO, Freak>
 31338 - NetSpy DK, ButtFunnel
 31338 - (UDP) - Back Orifice, DeepBO
 31339 - NetSpy DK
 31666 - BOWhack
 31785 - Hack´a´Tack
 31787 - Hack´a´Tack
 31788 - Hack´a´Tack
 31789 - (UDP) - Hack´a´Tack
 31791 - (UDP) - Hack´a´Tack
 31792 - Hack´a´Tack
 32100 - Peanut Brittle, Project nEXT
 32418 - Acid Battery
 33333 - Blakharaz, Prosiak
 33577 - PsychWard
 33777 - PsychWard
 33911 - Spirit 2001a
 34324 - BigGluck, TN
 34555 - (UDP) - Trinoo (Windows)
 35555 - (UDP) - Trinoo (Windows)
 37651 - YAT
 40412 - The Spy
 40421 - Agent 40421, Masters Paradise
 40422 - Masters Paradise
 40423 - Masters Paradise
 40426 - Masters Paradise
 41666 - Remote Boot
 41666 - (UDP) - Remote Boot
 44444 - Prosiak
 47262 - (UDP) - Delta Source
 50505 - Sockets de Troie
 50766 - Fore, Schwindler
 51996 - Cafeini
 52317 - Acid Battery 2000
 53001 - Remote Windows Shutdown
 54283 - SubSeven
 54320 - Back Orifice 2000
 54321 - School Bus
 54321 - (UDP) - Back Orifice 2000
 57341 - NetRaider
 58339 - ButtFunnel
 60000 - Deep Throat
 60068 - Xzip 6000068
 60411 - Connection
 61348 - Bunker-Hill
 61466 - Telecommando
 61603 - Bunker-Hill
 63485 - Bunker-Hill
 65000 - Devil, Stacheldracht
 65432 - The Traitor
 65432 - (UDP) - The Traitor
 65535 - RC

Up