anti-trojan.org

"It's a dangerous business going out your front door."
~ J. R. R. Tolkien

The Fellowship of the Ring

---

Trojan Port List

HOW YOUR COMPUTER COMMUNICATES WITH THE OUTSIDE WORLD

For your computer to be able to connect to the Internet and surf the web, download information and files, to run software updates and send and receive emails and messages you have to connect to the ‘outside world’.

You already knew that, so pretty simple so far.

Without getting too technical, this connection mechanism in a computer is called an ‘IP Port’ and most of us are aware that our computers have a unique ‘IP address’ so that we can receive information across the internet. Because there are a large number of processes that potentially may need to be running simultaneously, the IP (Internet Protocol) system has some 65535 available ports.

This may seem like an excessively large number but it ensures that channel conflicts are unlikely to arise particularly as new applications, programs and services continue to evolve, and as each process usually requires at least one unique sending and receiving port for each function and more if you are part of a network.

Each port is known by its port number with certain key ports being reserved for particular functions. IANA is the governing body that issues registrations for use of IP ports which are divided into three ranges;

• Ports 0 to 1023 are known as the ‘Well Known Ports’ used for the most common functions,
• Ports 1024 to 49151 designated as Registered Ports and
• Ports in the range 49152 to 65535 are defined as Dynamic or Private Ports.

Network Sorcery's IP Port Assignment page is for the real geeks among you to check out what applications or functions, if any, are allocated to which ports.

Actually, it can be a useful reference if a suspicious connection is detected using a certain port and you want to determine if the connection may be part of a valid process.

IP PORT VULNERABILITIES

So an IP port is a gateway from your computer to the outside world and access from the outside world into your computer. These are the ‘city gates’ to your fortress and someone decided that you needed 65000 of them to guard !

With so many trojans and spyware around and so many doors to get thru it is not difficult to see that at some point in time you may potentially be hacked.

If some of your bandwidth ever is hijacked and is being used as a thru-channel to attack other unsuspecting users then the most common symptom will be excessive internet activity that does not appear to correspond to traffic generated by any legitimate processes that you have running.

One tool you use to check this quickly is Microsoft's built-in Task Manager, (Control Alt & Delete then select Task Manager). Use the tabs to navigate to see what processes are running and which ones are using your system resources.





Look at system resources being used and applications running.

Check your internet connection Icon and see what the internet send/receive activity levels are after closing all unnecessary programs. Note any suspicious applications for further investigation.

If a Trojan does penetrate your Firewall/Scanner security shield and attempts to download some spyware to send information back to the hacker host it will need to open two ports on your machine to do so. IP Ports then are a vulnerability but as any traffic must pass thru these they can also become a detection point with the right monitoring software.


Return to top

USEFUL MONITORING AND DETECTION TOOLS

The following are useful detection tools for determining what processes are accessing the internet from your computer.

Process Explorer V11.21 (FREEWARE)

This utility is like a beefed up Task Manager.

Process Explorer can be used to find out program has a particular file or directory open and shows you information about which handles and DLLs processes have opened or loaded.

The top display frame of Process Explorer lists all the active processes, including the master application names and the lower frame shows dependant information for any process selected. Another setting identifies what applications are accessing which DLLs, Dynamic Linked Libraries, - mini program directory lists which are accessed by active applications periodically to allow them run on your computer.

Process Explorer is compatible with Windows 2000 SP4 and Windows XP.

---

Fport (FREEWARE)

Fport V2.0

Fport identifies unknown open ports and their associated applications. It reports all open TCP/IP and UDP ports and maps them to the owning application.

This is the same information you would see using the 'netstat -a' or 'netstat –n' commands, but it also maps those ports to running processes with the PID, process name and path.

Fport can be used to quickly identify unknown open ports and their associated applications.

Fport is compatible with Windows NT4, Windows 2000 and Windows XP Copyright 2002 (c) by Foundstone, Inc. www.foundstone.com

---

FreePortScanner V2.7 (FREEWARE)

Free Port Scanner is a small, fast, robust port scanner for the Win32 platform and the display panel is simple but easy to use.

Scans can be done in a few seconds and can be on predefined port ranges. This tool uses TCP packets to determine available hosts, open ports and service associated with the port and other important characteristics.

Copyright by NSAUDITOR.COM

Compatible with Windows2000,WinXP,Windows2003


Return to top

TROJAN PORT ARCHIVE LIST

The following Trojan Port list compiled by Jonathan Read was current circa 2004 before the Trojan/Spyware/Malware explosion. It shows which ports known trojans open to exchange information with the remote hacker host. The information is posted here as an archival list for reference purposes.

anti-trojan.org Disclaimer

Home    What is a Trojan?   Adware ? Spyware ? Trojan ? Virus ? Protection & Control   Have I got a Trojan?   Help I′ve been Hacked    Hoaxes   Phishing Scams   Why target me ?    Trojan Archives  10 Simple Anti-Trojan Rules   Trojan Port List   FAQ    Technical Assistance Forums   Software Reviews   Rogue Software    Software Downloads   Link to Us   Internet Security Sites    Contact Us    About Anti-Trojan.org  Other Helpful Stuff   Recommended Reading   Disclaimer