cancel
Showing results for 
Search instead for 
Did you mean: 

What trojan(s) run on ports 2722 and 2922?

N/A

What trojan(s) run on ports 2722 and 2922?

Hi,

I'm getting lots of scans on TCP ports 2722 and 2922 - Does anybody know what trojan/malware uses these ports?

Cheers,

Chris
5 REPLIES
N/A

What trojan(s) run on ports 2722 and 2922?

These ports are officially assigned for use by the following software:

2722 - ProActive
2723 - WatchDog NT

Both can use either TCP or UDP protocols. It may be someone with a badly configured network. If you are receiving connection attempts trace the owners using RIPE or ARIN etc and send an email to the appropriate person.

Darren.
N/A

What trojan(s) run on ports 2722 and 2922?

Any idea what 2922 is?
N/A

What trojan(s) run on ports 2722 and 2922?

Sorry,

Misread first message,

2922 - CESD Contents Delivery Data Transfer

This is another software product and could well be used in conjunction with ProActive. If you have identified the source address of the packets you should be able to guess if this is a badly configured network based upon the business type and therefore act accordingly

Darren.
N/A

What trojan(s) run on ports 2722 and 2922?

If it were one host I could understand but the probes are from multiple sources. I was wondering if any new trojan is using this [already known] port number so as not to raise suspicion?

I am getting more probes from certain addresses and I have reported those to their ISP.

Cheers,

Chris
N/A

What trojan(s) run on ports 2722 and 2922?

I can find nothing trojan like on these ports, on the many watch lists dotted around the net.

IANA Port list - These is the official list of registered ports, and the programs assigned.

2722, 2922
Both are assigned by legit programs.

It can be that the programs in question are vulnerable.

These may include the ability to perform remote scanning of a system. Where they can tell if you are up or down, or possibly vulnerable to further attack.

Nothing more that contacting the ISP of the connecting host can be done. They will likely not help, but it's worth a shot.

Links to trojan lists - These are links to sites that provide lists to well known trojans. I don't know how up to date these are.

The the "advICE" list. This is from the makers of blackice. While not as comprihensive as most, they are likely to be the most up-2-date.