Current Backdoors List ---------------------- By klemster (klemster@weed5.org) Visit http://www.weed5.org/ Weed5 Computer Security Group for more First Written On: 16th September, 2002. 7:20 PM Last Modified On: 16th September, 2002. 7:32 PM ==================================================================== Contents -------- Introduction List of Backdoors/Ports/Forms Disclaimer ==================================================================== INTRODUCTION This is the list of trojans as of sometime around Dec 2001. If you're wondering how I had the patience to do this stuff, I wrote a portscanner, and modified the program to automatically generate this list. ;) List of trojans obtained from various sources on the internet. If you've written a trojan list, or something about a specific trojan, some of the trojan names might have been taken from there, so, thanks! I obviously didn't search the internet for trojans and make this list, but added up smaller lists. Read the Disclaimer at the end of the text.. ==================================================================== List of Backdoors 1. Back Orifice Port(s) used: 31337 / 6001 2. Netbus 1.x Port(s) used: 12345 / 12346 Forms: Whackamole(game), the real trojan. 3. Netbus Pro 2.1 Port(s) used: 20034 4. Transcout 1.x Port(s) used: 1999 5. Sub Seven 1.x Port(s) used: 1243 Forms: The real trojan. Can be compiled in different forms(1.7+) 6. Deep Throat Port(s) used: 6670 7. Ugly FTP Port(s) used: 23456 8. NetSphere Port(s) used: 30100 9. Der Spaeher 3 Port(s) used: 1000 10. Silencer Port(s) used: 1001 11. Trojan Cow Port(s) used: 2001 12. Devil 1.03 Port(s) used: 65000 13. Senna Spy Trojan Port(s) used: 11000 14. Streaming Audio Trojan Port(s) used: 1170 15. Socket23 Port(s) used: 30303 16. Gatecrasher Net Control Port(s) used: 6969 17. Telecommando Port(s) used: 61466 18. Psyber Streaming Server Port(s) used: 1509 19. IcqTrojan Port(s) used: 4950 20. Priority Port(s) used: 16969 21. VooDoo Port(s) used: 1245 22. Wincrash Port(s) used: 5742 23. Wincrash2 Port(s) used: 2583 24. NetSpy Port(s) used: 1033 25. ShockRave Port(s) used: 1981 26. Stealth Spy Port(s) used: 555 27. Pass Ripper Port(s) used: 2023 28. Attack FTP Port(s) used: 666 29. GirlFriend Port(s) used: 21554 30. Fore, Schwindler Port(s) used: 50766 31. Tiny Telnet Server Port(s) used: 34324 32. Kuang Port(s) used: 30999 33. NetMonitor Port(s) used: 7306 34. Backdoor Port(s) used: 1999 35. Xtcp 2.x Port(s) used: 5550 36. BladeRunner Port(s) used: 5400 37. iNiKiller Port(s) used: 9989 38. Portal Of Doom Port(s) used: 9875 39. BackConstruction 1.2 Port(s) used: 5400 40. Prosiak 0.47 Port(s) used: 22222 41. Prosaik Port(s) used: 44444 42. Trojan Spirit 2001 Port(s) used: 33911 43. Striker Port(s) used: 2565 44. The Spy Port(s) used: 40412 45. Millennium Port(s) used: 20000 46. TCPShell.c Port(s) used: 6666 47. Phineas Port(s) used: 2801 48. Gjamer Port(s) used: 12076 49. Indoctrination Port(s) used: 6939 50. Hackers Paradise Port(s) used: 456 51. RoboHack Port(s) used: 5569 52. Solero Port(s) used: 14456 53. FTP99CMP Port(s) used: 1492 54. ShivaBurka Port(s) used: 1600 55. Remote Windows Shutdown Port(s) used: 53001 56. BigGluck Port(s) used: 34324 57. NetSpy DK Port(s) used: 31339 58. Hack '99 KeyLogger Port(s) used: 12223 59. FakeFTP Port(s) used: 1966 60. ICQKiller Port(s) used: 7789 61. Firehotcker Port(s) used: 5321 62. Master Paradise Port(s) used: 40423 / 31 63. BO jammerkillahV Port(s) used: 121 64. AOL Trojan 1.1 Port(s) used: 30029 65. Hack'a'tack Port(s) used: 31787 66. The Invasor Port(s) used: 2140 67. SpySender Port(s) used: 1807 68. The Unexplained Port(s) used: 29891 69. Coma Port(s) used: 10607 70. FileNail Port(s) used: 4567 71. ShitHeep Port(s) used: 6912 72. Bla Port(s) used: 20331 73. Bla 1.1 Port(s) used: 1042 74. HVL Rat 5 Port(s) used: 2283 75. SoftWar Port(s) used: 1207 76. Kuang2 theVirus Port(s) used: 17300 77. Infector 1.x Port(s) used: 146 / 17569 78. Doly Trojan 1.35 Port(s) used: 1010 79. Doly Trojan 1.5 Port(s) used: 1015 80. Doly Trojan 1.0 Port(s) used: 1011 81. DeltaSource Port(s) used: 6883 82. Yet Another Trojan Port(s) used: 37651 83. Mavericks Matrix Port(s) used: 1269 / 1025 84. Total Exlypse 1.0 Port(s) used: 3791 85. Eclipse 2000 Port(s) used: 12701 86. OOTLT + OOTLT Cart Port(s) used: 5011 87. NetMetro 1.0 Port(s) used: 5301 88. Illusion Mailer Port(s) used: 5521 89. InCommand Port(s) used: 9400 / 1029 90. Freak 88 Port(s) used: 7001 91. Logged! Port(s) used: 20203 92. SchoolBus 1.x, 2.x Port(s) used: 54321 93. CrazyNet Port(s) used: 17490 / 17500 94. AimSpy Port(s) used: 777 95. NetMetropolitan 1.04 Port(s) used: 5032 / 5031 96. Asylum 0.x Port(s) used: 23432 97. NetTrash Port(s) used: 23005 98. Ambush Port(s) used: 10666 99. SSFS 1.0/Traitor 2.1 Port(s) used: 21 100. Progenic Trojan Port(s) used: 11223 101. Insane Network Port(s) used: 2000 102. The Prayer 1.x Port(s) used: 9999 / 2716 103. Connection Port(s) used: 60411 104. NetDemon 1.0 Port(s) used: 15000 105. NetRaider Port(s) used: 57341 106. PC Crasher Port(s) used: 5638 / 5637 107. MiniCommand 1.2 Port(s) used: 1050 108. Mosucker Port(s) used: 16484 109. Rat 1.2 Port(s) used: 2989 110. BIONET Port(s) used: 12349 111. Intruse Pack 1.27b Port(s) used: 30947 112. Snid X2 Port(s) used: 3586 / 1784 / 7609 113. The Thing 1.6 Port(s) used: 6000 114. Host Control 1.0 Port(s) used: 6669 115. Host Control 1.0 Port(s) used: 11050 116. Host Control 2.6 Port(s) used: 7424 / 11051 / 10528 / 10592 117. RUX.Psw Port(s) used: 2208 118. RUX.Tick Port(s) used: 22222 119. RUX.Backdoor Port(s) used: 9876 / 4245 120. Y3k 1.3 Port(s) used: 5889 / 5888 / 5882 121. Evil FTP Port(s) used: 23456 122. Whackjob Port(s) used: 23456 123. Vampire Port(s) used: 6669 124. ChupaCarba Port(s) used: 20203 125. Der Spaeher 3 Port(s) used: 1001 / 2001 126. Webex Port(s) used: 1001 127. Phase0 Port(s) used: 555 128. NeTadmin Port(s) used: 555 129. Satans Backdoor 1,2 Port(s) used: 666 130. Schwindler 1.82 Port(s) used: 21554 ==================================================================== DISCLAIMER There is no guarantee on the accurateness of this text and this is subject to change anytime. This text is meant only for educational purposes. Following or reading this text is entirely at the choice and risk of the user. I will not be responsible for any damages caused because of reading this directly or indirectly, or abuse/misinterpretation of this paper. ==================================================================== - klemster | klemster@weed5.org Copyright 2002 Weed5 Security Group and it's members http://www.weed5.org/