The list below shows default ports. Many of these programs may be configured to operate on other ports. A much more complete list can be found at the Simovits Consulting Web site at http://www.simovits.com/nyheter9902.html or at Raf Vantongerloo's page at http://home.tiscalinet.be/bchicken/trojans/trojanpo.htm.
| 31/tcp | Agent 31, Hackers Paradise, Masters Paradise |
| 1170/tcp | Psyber Stream |
| 1234/tcp | Ultors Trojan |
| 1243/tcp | SubSeven server (default for V1.0-2.0) |
| 1981/tcp | ShockRave |
| 2001/tcp | Trojan Cow |
| 2023/tcp | Ripper Pro |
| 2140/udp | Deep Throat, Invasor |
| 2989/tcp | Rat backdoor |
| 3024/tcp | WinCrash |
| 3150/tcp | Deep Throat, Invasor |
| 3700/tcp | Portal of Doom |
| 4950/tcp | ICQ Trojan |
| 6346/tcp | Gnutella |
| 6400/tcp | The Thing |
| 6667/tcp | Trinity intruder-to-master and master-to-daemon SubSeven server (default for V2.1 Icqfix and beyond) |
| 6670/tcp | Deep Throat |
| 12345/tcp | NetBus 1.x, GabanBus, Pie Bill Gates, X-Bill |
| 12346/tcp | NetBus 1.x |
| 16660/tcp | Stacheldraht intruder-to-master |
| 18753/udp | Shaft master-to-daemon |
| 20034/tcp | NetBus 2 Pro |
| 20432/tcp | Shaft intruder-to-master |
| 20433/udp | Shaft daemon-to-master |
| 27374/tcp | SubSeven server (default for V2.1-Defcon) |
| 27444/udp | Trinoo master-to-daemon |
| 27665/tcp | Trinoo intruder-to-master |
| 30100/tcp | NetSphere |
| 31335/udp | Trinoo daemon-to-master |
| 31337/tcp | Back Orifice, Baron Night, Bo Facil |
| 33270/tcp | Trinity master-to-daemon |
| 33567/tcp | Backdoor rootshell via inetd (from Lion worm) |
| 33568/tcp | Trojaned version of SSH (from Lion worm) |
| 40421/tcp | Masters Paradise Trojan horse |
| 60008/tcp | Backdoor rootshel via inetd (from Lion worm) |
| 65000/tcp | Stacheldraht master-to-daemon |