|
|
|
|
Hacker Ports
Note: A U following the port number means that it is a UDP port - all the other ports are TCP ports. Be on the look out for probes to oddball port numbers. Note that the probe in itself is not a breach of your system. However, if a hacker trojan has been installed on your system, one of these uncommon ports might be listening for a hacker program to establish a connection. Doing a "netstat -an" will tell you which ports on your system are listening for a connection, and also which ports have already established a connection.
| Port No. |
Hacker Programs |
| 1 U |
Breach.2001, Sockets des Troie, SocketsDeTroie.230, SocketsDeTroie.250 |
| 2 |
Death Trojan |
| 5 |
Midnight Commander |
| 15 |
B2 Trojan |
| 20 |
Senna Spy FTP server |
| 21 |
Back Construction, Blade Runner, Cattivik FTP Server, CC Invader, Dark FTP, Doly Trojan, Fore, Invisible FTP, Juggernaut 42, Larva, MotIv FTP, Net Administrator, Ramen, Senna Spy FTP server, The Flu, Traitor 21, WebEx, WinCrash |
| 22 |
Shaft |
| 23 |
ADM Worm, Fire HacKer, RTB 666, Back Orifice 2000 Control Port, Tiny Telnet Server - TTS, Truva Atl |
| 21 |
Doly Trojan |
| 25 |
Ajan, Antigen, Barok, Email Password Sender - EPS, EPS II, Gip, Gris, Happy99, Hpteam mail, Hybris, I love you, Kuang2, Magic Horse, MBT (Mail Bombing Trojan), Moscow Email trojan, Naebi, NewApt worm, ProMail trojan, Shtirlitz, Stealth, Tapiras, Terminator, WinPC, WinSpy |
| 28 |
Amanda.200 |
| 30 |
Agent 40421 |
| 31 |
Agent 31, Hackers Paradise, Masters Paradise |
| 39 |
SubSARI Trojan |
| 41 |
Deep Throat, Foreplay |
| 44 |
Arctic |
| 48 |
DRAT |
| 50 |
DRAT |
| 53 |
ADM Worm, Lion |
| 58 |
DMSetup |
| 59 |
DMSetup |
| 68 |
Subseven.100 |
| 69 |
BackGate |
| 79 |
CDK, Firehotcker |
| 80 |
711 trojan (Seven Eleven), AckCmd, Back End, Back Orifice 2000 Plug-Ins, Cafeini, CGI Backdoor, Executor, God Message, God Message Creator, Hooker, IISworm, MTX, NCX, Reverse WWW Tunnel Backdoor, RingZero, Seeker, WAN Remote, Web Server CT, WebDownloader |
| 81 |
RemoConChubo |
| 99 |
Hidden Port, Hidden, Mandragore, NCX |
| 109 |
Sekure SDI, b00ger |
| 110 |
ProMail Trojan |
| 113 |
Invisible Identd Deamon, Kazimas |
| 119 |
Happy99 |
| 121 |
Attack Bot, God Message, Jammer Killah |
| 123 |
Net Controller |
| 133 |
Farnaz |
| 135 |
NetBios exploits |
| 135 U |
NetBios exploits |
| 137 |
Chode, NetBios exploits |
| 137 U |
Msinit |
| 138 |
Chode |
| 139 |
Chode, Conficker, God Message Worm, Msinit, Netlog, Network, Qaz, Sadmind |
| 142 |
NetTaxi |
| 143 |
NetTaxi |
| 146 |
Infector |
| 146 U |
Infector |
| 170 |
A-trojan |
| 170 |
ATrojan.200 |
| 285 |
WCTrojan.100 |
| 286 |
WCTrojan.100 |
| 334 |
Backage |
| 370 |
NeuroticKat.210, NeuroticKat.130 |
| 382 |
W32.Rotor virus |
| 411 |
Backage |
| 413 |
Coma.109 |
| 420 |
W32.Kibuv.b worm, Breach, Incognito |
| 421 |
TCPwrappers Trojan |
| 445 |
Conficker |
| 455 |
Fatal Connections |
| 456 |
Hackers Paradise |
| 513 |
Grlogin |
| 514 |
RPC Backdoor |
| 531 |
Net666, Rasmin |
| 555 |
711 trojan (Seven Eleven), Ini-Killer, Net Administrator, Phase Zero, Phase-0, Stealth Spy |
| 605 |
Secret Service |
| 666 |
Attack FTP, Back Construction, BLA trojan, Cain & Abel, NokNok, Satans Back Door - SBD, ServU, Shadow Phyre, th3r1pp3rz (= Therippers) |
| 666 U |
Bla.200, Bla.400, Bla.503, Noknok.820 |
| 667 |
SniperNet |
| 669 |
DP trojan |
| 692 |
GayOL |
| 777 |
AimSpy, Undetected |
| 808 |
WinHole |
| 911 |
Dark Shadow |
| 999 |
Deep Throat, Foreplay, WinSatan |
| 1000 |
Der Späher / Der Spaeher, Direct Connection |
| 1001 |
Der Späher / Der Spaeher, Le Guardien, SK Silencer, WebEx |
| 1010 |
Doly Trojan |
| 1011 |
Doly Trojan |
| 1012 |
Doly Trojan |
| 1015 |
Doly Trojan |
| 1016 |
Doly Trojan |
| 1020 |
Vampire |
| 1024 |
Jade, Latinus, NetSpy |
| 1025 |
Remote Storm |
| 1025 U |
Remote Storm |
| 1035 |
Multidropper |
| 1042 |
BLA trojan |
| 1045 |
Rasmin |
| 1049 |
/sbin/initd |
| 1050 |
MiniCommand |
| 1053 |
The Thief |
| 1054 |
AckCmd |
| 1080 |
MyDoom.B, MyDoom.F, MyDoom.G, MyDoom.H, WinHole |
| 1081 |
WinHole |
| 1082 |
WinHole |
| 1083 |
WinHole |
| 1090 |
Xtreme |
| 1095 |
Remote Administration Tool - RAT |
| 1097 |
Remote Administration Tool - RAT |
| 1098 |
Remote Administration Tool - RAT |
| 1099 |
Blood Fest Evolution, Remote Administration Tool - RAT |
| 1130 U |
U NokNok.800, Noknok.820 |
| 1150 |
Orion |
| 1151 |
Orion |
| 1170 |
Psyber Stream Server - PSS, Streaming Audio Server, Voice |
| 1200 U |
NoBackO |
| 1201 U |
NoBackO |
| 1207 |
SoftWAR |
| 1208 |
Infector |
| 1212 |
Kaos |
| 1234 |
SubSeven Java client, Ultor's Trojan |
| 1243 |
BackDoor-G, Sub-7, SubSeven Apocalypse, Tiles |
| 1245 |
VooDoo Doll |
| 1255 |
Scarab |
| 1256 |
Project nEXT |
| 1269 |
Matrix |
| 1272 |
The Matrix |
| 1313 |
NETrojan |
| 1338 |
Millenium Worm |
| 1349 |
Bo dll |
| 1394 |
GoFriller, Backdoor G-1 |
| 1441 |
Remote Storm |
| 1492 |
FTP99CMP |
| 1505 |
FunkProxy |
| 1524 |
Trinoo |
| 1568 |
Remote Hack |
| 1600 |
Direct Connection, Shivka-Burka |
| 1703 |
Exploiter |
| 1777 |
Scarab |
| 1807 |
SpySender |
| 1966 |
Fake FTP |
| 1967 |
WM FTP Server |
| 1969 |
OpC BO |
| 1981 |
Bowl, ShockRave |
| 1999 |
BackDoor, SubSeven, TransScout |
| 2000 |
Der Späher / Der Spaeher, Insane Network, Last 2000, Remote Explorer 2000, Senna Spy Trojan Generator |
| 2001 |
Der Späher / Der Spaeher, The Trojan Cow |
| 2002 |
TransScout |
| 2003 |
TransScout |
| 2023 |
Ripper Pro, HackCity |
| 2080 |
WinHole |
| 2115 |
Bugs, Illusion Mailer |
| 2130 U |
Mini Backlash |
| 2140 |
Deep Throat, The Invasor |
| 2140 U |
Deep Throat, Foreplay |
| 2255 |
Nirvana |
| 2283 |
Hvl RAT, Dumaru.Y |
| 2300 |
Xplorer |
| 2311 |
Studio 54 |
| 2330 |
Contact |
| 2331 |
Contact |
| 2332 |
Contact, SilentSpy.202 |
| 2333 |
Contact |
| 2334 |
Contact |
| 2335 |
Contact |
| 2336 |
Contact |
| 2337 |
Contact |
| 2338 |
Contact |
| 2339 |
Contact, Voice Spy |
| 2339 U |
Voice Spy |
| 2345 |
Doly Trojan |
| 2565 |
Striker trojan |
| 2583 |
WinCrash |
| 2589 |
Dagger.140 |
| 2600 |
Digital RootBeer |
| 2716 |
The Prayer |
| 2745 |
Beagle.C through Beagle.K |
| 2773 |
SubSeven, SubSeven 2.1 Gold |
| 2774 |
SubSeven, SubSeven 2.1 Gold |
| 2801 |
Phineas Phucker |
| 2989 |
Remote Administration Tool - Rat |
| 2989 U |
Remote Administration Tool - RAT, Rat.200 |
| 3000 |
Remote Shut |
| 3024 |
WinCrash |
| 3031 |
Microspy |
| 3127 |
MyDoom.A |
| 3128 |
MyDoom.B, Reverse WWW Tunnel Backdoor, RingZero |
| 3129 |
Master Paradise |
| 3150 |
DeepThroat, The Invaser |
| 3150 U |
DeepThroat, Deep Throat, Foreplay, Mini Backlash, The Invaser |
| 3456 |
Terror trojan |
| 3459 |
Eclipse 2000, Sanctuary |
| 3505 |
AutoSpy.130, AutoSpy.140 |
| 3586 |
Snid.120, Snid.212 |
| 3700 |
Portal of Doom |
| 3777 |
PsychWard |
| 3791 |
Total Solar Eclypse |
| 3801 |
Total Solar Eclypse |
| 4000 |
SkyDance |
| 4092 |
WinCrash |
| 4242 |
Virtual Hacking Machine - VHM |
| 4321 |
BoBo |
| 4444 |
Prosiak, Swift Remote |
| 4567 |
File Nail |
| 4590 |
ICQ Trojan |
| 4751 |
Beagle.U |
| 4820 |
Backdoor.tuxder |
| 4950 |
ICQ Trojan, ICQ Trogen (Lm) |
| 5000 |
Back Door Setup, Blazer5, Bubbel, ICKiller, Ra1d, Sockets des Troie |
| 5001 |
Back Door Setup, Sockets des Troie |
| 5002 |
cd00r, Shaft |
| 5010 |
Solo |
| 5011 |
One of the Last Trojans - OOTLT, One of the Last Trojans - OOTLT, modified |
| 5025 |
WM Remote KeyLogger |
| 5031 |
Net Metropolitan |
| 5032 |
Net Metropolitan |
| 5321 |
BackDoorz, Firehotchker |
| 5333 |
Backage, NetDemon |
| 5343 |
wCrat - WC Remote Administration Tool |
| 5400 |
Back Construction, Blade Runner |
| 5401 |
Back Construction, Blade Runner |
| 5402 |
Back Construction, Blade Runner |
| 5512 |
Illusion Mailer |
| 5534 |
The Flu |
| 5550 |
Xtcp |
| 5554 |
Sasser through Sasser.C, Sasser.F |
| 5555 |
ServeMe |
| 5556 |
BO Facil |
| 5557 |
BO Facil |
| 5568 |
Robo-Hack |
| 5569 |
Robo-Hack |
| 5637 |
PC Crasher |
| 5638 |
PC Crasher |
| 5714 |
WinCrash |
| 5741 |
WinCrash |
| 5742 |
WinCrash |
| 5760 |
Portmap Remote Root Linux Exploit |
| 5880 |
Y3K RAT |
| 5882 |
Y3K RAT |
| 5882 U |
Y3K RAT |
| 5888 |
Y3K RAT |
| 5888 U |
Y3K RAT |
| 5889 |
Y3K RAT |
| 6000 |
The Thing |
| 6006 |
Bad Blood |
| 6272 |
Secret Service |
| 6400 |
The Thing |
| 6661 |
TEMan, Weia-Meia |
| 6666 |
Dark Connection Inside, NetBus worm |
| 6667 |
Dark FTP, ScheduleAgent, SubSeven, Subseven 2.1.4 DefCon 8, Trinity, WinSatan |
| 6669 |
Host Control, Vampire |
| 6670 |
BackWeb Server, Deep Throat, Foreplay, WinNuke eXtreame |
| 6711 |
Sub-7, DeepThroat, BackDoor-G, SubSeven, VP Killer |
| 6711 |
Funny trojan, SubSeven |
| 6711 |
Funny trojan, SubSeven |
| 6713 |
SubSeven |
| 6723 |
Mstream |
| 6771 |
Deep Throat, Foreplay |
| 6776 |
2000 Cracks, BackDoor-G, SubSeven, VP Killer |
| 6838 U |
Mstream |
| 6883 |
Delta Source DarkStar |
| 6912 |
Shit Heep |
| 6939 |
Indoctrination |
| 6969 |
GateCrasher, IRC 3, Net Controller, Priority |
| 6970 |
GateCrasher |
| 7000 |
Exploit Translation Server, Kazimas, Remote Grab, SubSeven, SubSeven 2.1 Gold |
| 7001 |
Freak88, Freak2k |
| 7215 |
SubSeven, SubSeven 2.1 Gold |
| 7300 |
NetMonitor |
| 7301 |
NetMonitor |
| 7306 |
NetMonitor |
| 7307 |
NetMonitor |
| 7308 |
NetMonitor |
| 7424 |
Host Control |
| 7424 U |
Host Control |
| 7597 |
Qaz |
| 7626 |
Glacier |
| 7777 |
God Message, Tini |
| 7789 |
Back Door Setup, ICKiller |
| 7891 |
The ReVeNgEr |
| 7983 |
Mstream |
| 8080 |
Brown Orifice, RemoConChubo, Reverse WWW Tunnel Backdoor, RingZero |
| 8787 |
Back Orifice 2000 |
| 8866 |
Beagle.B |
| 8988 |
BacHack |
| 8989 |
Rcon, Recon, Xcon |
| 9000 |
Netministrator |
| 9325 U |
Mstream |
| 9400 |
InCommand |
| 9872 |
Portal of Doom |
| 9873 |
Portal of Doom |
| 9874 |
Portal of Doom |
| 9875 |
Portal of Doom |
| 9876 |
Cyber Attacker, Rux |
| 9878 |
TransScout |
| 9898 |
Dabber.A, Dabber.B |
| 9989 |
Ini-Killer |
| 9999 |
The Prayer |
| 10000 |
OpwinTRojan |
| 10005 |
OpwinTRojan |
| 10067 U |
Portal of Doom |
| 10085 |
Syphillis |
| 10086 |
Syphillis |
| 10100 |
Control Total, Gift trojan |
| 10101 |
BrainSpy, Silencer |
| 10167 U |
Portal of Doom |
| 10520 |
Acid Shivers |
| 10528 |
Host Control |
| 10607 |
Coma |
| 10529 |
Acid Shivers |
| 10666 U |
Ambush |
| 11000 |
Senna Spy Trojan Generator |
| 11050 |
Host Control |
| 11051 |
Host Control |
| 11223 |
Progenic trojan, Secret Agent |
| 12076 |
Gjamer |
| 12223 |
Hack'99 KeyLogger |
| 12345 |
Ashley, cron / crontab, Fat Bitch trojan, GabanBus, GirlFriend, icmp_client.c, icmp_pipe.c, Mypic, NetBus, NetBus Toy, NetBus worm, Pie Bill Gates, Whack Job, X-bill |
| 12346 |
Fat Bitch trojan, GabanBus, NetBus, X-bill |
| 12349 |
BioNet |
| 12361 |
Whack-a-mole |
| 12362 |
Whack-a-mole |
| 12363 |
Whack-a-mole |
| 12389 U |
KheSanh.210 |
| 12623 U |
DUN Control |
| 12624 |
ButtMan |
| 12631 |
Whack Job |
| 12754 |
Mstream |
| 13000 |
Senna Spy Trojan Generator, Senna Spy Trojan Generator |
| 13010 |
Hacker Brasil - HBR |
| 13013 |
PsychWard |
| 13014 |
PsychWard |
| 13223 |
Hack'99 KeyLogger |
| 13473 |
Chupacabra |
| 14500 |
PC Invader |
| 14501 |
PC Invader |
| 14502 |
PC Invader |
| 14503 |
PC Invader |
| 15000 |
NetDemon |
| 15092 |
Host Control |
| 15104 |
Mstream |
| 15382 |
SubZero |
| 15858 |
CDK |
| 16484 |
Mosucker |
| 16660 |
Stacheldraht |
| 16772 |
ICQ Revenge |
| 16959 |
SubSeven, Subseven 2.1.4 DefCon 8 |
| 16969 |
Priority |
| 17166 |
Mosaic |
| 17300 |
Kuang2 |
| 17449 |
Kid Terror |
| 17499 |
CrazzyNet |
| 17500 |
CrazzyNet |
| 17569 |
Infector |
| 17593 |
Audiodoor |
| 17777 |
Nephron |
| 18753 U |
Shaft |
| 19864 |
ICQ Revenge |
| 19932 |
DropChute |
| 20000 |
Millenium |
| 20001 |
Millenium, Millenium (Lm) |
| 20002 |
AcidkoR |
| 20005 |
Mosucker |
| 20023 |
VP Killer |
| 20034 |
NetBus 2.0 Pro, NetBus 2.0 Pro Hidden, NetRex, Whack Job |
| 20203 |
Chupacabra |
| 20331 |
BLA trojan |
| 20432 |
Shaft |
| 20433 U |
Shaft |
| 21544 |
GirlFriend, Exploiter, Kid Terror, NetBus, Schwindler, Winsp00fer |
| 22222 |
Donald Dick, Prosiak, Ruler, RUX The TIc.K |
| 23005 |
NetTrash |
| 23006 |
NetTrash |
| 23023 |
Logged |
| 23032 |
Amanda |
| 23432 |
Asylum |
| 23456 |
Evil FTP, Ugly FTP, Whack Job |
| 23476 |
Donald Dick |
| 23476 U |
Donald Dick |
| 23477 |
Donald Dick |
| 23477 U |
Donald Dick |
| 23777 |
InetSpy |
| 24000 |
Infector |
| 25685 |
Moonpie |
| 25686 |
Moonpie |
| 25982 |
Moonpie |
| 26274 |
Delta Source |
| 26274 U |
Delta Source |
| 26681 |
Voice Spy |
| 27374 |
Bad Blood, Ramen, Seeker, SubSeven, SubSeven 2.1 Gold, Subseven 2.1.4 DefCon 8, SubSeven Muie, Ttfloader |
| 27444 U |
Trinoo |
| 27573 |
Sub-7 2.1 |
| 27665 |
Trinoo |
| 28678 |
Exploiter |
| 29104 |
NetTrojan |
| 29369 |
ovasOn |
| 29891 |
The Unexplained |
| 30000 |
Infector |
| 30001 |
ErrOr32 |
| 30003 |
Lamers Death |
| 30029 |
AOL trojan |
| 30100 |
NetSphere |
| 30101 |
NetSphere |
| 30102 |
NetSphere |
| 30103 |
NetSphere |
| 30103 U |
NetSphere |
| 30133 |
NetSphere |
| 30303 |
Sockets des Troie |
| 30947 |
Intruse |
| 30999 |
Kuang2 |
| 31335 |
Trinoo |
| 31336 |
Bo Whack, Butt Funnel |
| 31337 |
Back Fire, Back Orifice 1.20 patches, Back Orifice (Lm), Back Orifice russian, Baron Night, Beeone, BO client, BO Facil, BO spy, BO2, cron / crontab, Freak88, Freak2k, icmp_pipe.c, Sockdmini |
| 31337 U |
Back Orifice, Deep BO |
| 31338 |
Back Orifice, Butt Funnel, NetSpy (DK) |
| 31338 U |
Deep BO |
| 31339 |
NetSpy (DK) |
| 31666 |
BOWhack |
| 31785 |
Hack'a'Tack |
| 31787 |
Hack'a'Tack |
| 31788 |
Hack'a'Tack |
| 31789 |
Hack'a'Tack |
| 31337 U |
BackOrifice |
| 31338 |
NetSpy |
| 31338 U |
Deep BO |
| 31339 |
NetSpy |
| 31789 U |
Hack'a'Tack |
| 31790 |
Hack'a'Tack |
| 31791 U |
Hack'a'Tack |
| 31792 |
Hack'a'Tack |
| 32001 |
Donald Dick |
| 32100 |
Peanut Brittle, Project nEXT |
| 32418 |
Acid Battery |
| 33270 |
Trinity |
| 33333 |
Blakharaz, Prosiak |
| 33577 |
Son of PsychWard |
| 33777 |
Son of PsychWard |
| 33911 |
Spirit 2000, Spirit 2001 |
| 34324 |
Big Gluck, TN |
| 34444 |
Donald Dick |
| 34555 U |
Trinoo (for Windows) |
| 35555 U |
Trinoo (for Windows) |
| 37237 |
Mantis |
| 37651 |
Yet Another Trojan - YAT |
| 40412 |
The Spy |
| 40421 |
Agent 40421, Masters Paradise |
| 40422 |
Master's Paradise |
| 40423 |
Master's Paradise |
| 40425 |
Master's Paradise |
| 40426 |
Master's Paradise |
| 41337 |
Storm |
| 41666 |
Remote Boot Tool - RBT, Remote Boot Tool - RBT |
| 44444 |
Prosiak |
| 44575 |
Exploiter |
| 44575 |
Exploiter |
| 47262 |
Delta Source |
| 47262 U |
Delta Source |
| 49301 |
OnLine KeyLogger |
| 49683 U |
HolzPferd.210 |
| 50130 |
Enterprise |
| 50505 |
Sockets de Troie |
| 50766 |
Fore, Schwindler |
| 51966 |
Cafeini |
| 52317 |
Acid Battery 2000 |
| 53001 |
Remote Windows Shutdown - RWS |
| 54283 |
SubSeven, SubSeven 2.1 Gold |
| 54320 |
Back Orifice 2000 |
| 54321 U |
Back Orifice 2000, School Bus |
| 55165 |
File Manager trojan, File Manager trojan, WM Trojan Generator |
| 55166 |
WM Trojan Generator |
| 57341 |
NetRaider Trojan |
| 58339 |
Butt Funnel |
| 60000 |
DeepThroat, Foreplay, Sockets des Troie |
| 60000 U |
MiniBacklash.100 |
| 60001 |
Trinity |
| 60068 |
Xzip 6000068 |
| 60411 |
Connection |
| 61348 |
Bunker-Hill Trojan |
| 61466 |
TeleCommando |
| 61603 |
Bunker-Hill |
| 63485 |
Bunker-Hill |
| 64101 |
Taskman |
| 65000 |
Devil, Sockets des Troie, Stacheldraht |
| 65390 |
Eclypse |
| 65421 |
Jade |
| 65432 |
The Traitor (th3tr41t0r) |
| 65432 U |
The Traitor (th3tr41t0r) |
| 65506 |
Phatbot, Agobot, Gaobot
|
| 65534 |
RC1 Trojan, /sbin/initd |
| 65535 |
RC1 Trojan |
|
|
