Name Number Range to Protocol Type Alias Description Link
25 TCP trojan NewApt worm
80 TCP worm Code Red worm
80 TCP worm Nimda http://www.sarc.com/avcenter/venc/data/w32.nimda.a@mm.html
445 TCP worm W32/Slanper.worm http://vil.nai.com/vil/content/v_100445.htm
445 TCP worm Sasser Worm http://isc.sans.org/diary.php?date=2004-04-30
666 TCP worm lpdw0rm shell prompt
1008 TCP worm Lion (1i0n) root shell
1338 TCP trojan Millenium Worm
SQL Server Resolution Service Port 1434 UDP worm SQLexp worm http://www.symantec.nl/avcenter/venc/data/w32.sqlexp.worm.html
3127 TCP worm MyDoom.C
3127 TCP worm Novarg a.k.a. Mydoom a.k.a. Worm.SCO.A http://www.symantec.com/avcenter/venc/data/w32.novarg.a@mm.html
5554 TCP worm Sasser Worm http://isc.sans.org/diary.php?date=2004-04-30
5556 TCP worm Netsky.V (http)
5557 TCP worm Netsky.V (ftp)
6666 TCP trojan NetBus worm
9996 TCP worm Sasser Worm http://isc.sans.org/diary.php?date=2004-04-30
10008 TCP worm cheese worm (in search of a Lion (1i0n) root shell)
10008 TCP worm Lion (1i0n) root shell
11768 TCP worm Dipnet http://www.lurhq.com/dipnet.html
12345 TCP trojan NetBus worm

Page 1 of 2

Please note: Some people seem to misunderstand the purpose of this site. ports is not a port scanner, ports will not test your host for vulnerabilities. ports is a simple database that contains known port assignments. Don't ask me whether your machine is infected by trojans, as I really don't know.