The following is an nmap-services file that can be used in conjuction with nmap to hunt for viruses on a network. It can’t find all viruses — only those ones that open a TCP or UDP port as a backdoor — so only use it as a small part of the overall defense for your network. I won’t bother explaining how to use it — if you don’t know how then you probably shouldn’t be using it. It could potentially be used for good or evil. I use it for the former.
# List of ports used by malware #
# Note: some of these have legitimate uses too. These are given
# as [bracketed] comments where known.
#
# Also, tonnes of trojans use common ports such as 21, 25, 80, etc.
# I have generally left these out as they’ll result in tonnes of
# false-positives.Blaster 69/udp # [tftp]
"
Sobig 995/udp #
Sobig 996/udp #
Sobig 997/udp #
Sobig 998/udp #
Sobig 999/udp #
MyDoom 1080/tcp # bugbear, [some proxies]
Ultor …