Ataque por puerto TCP(1029) ????

[@tzi!]

efectivamente,
port 1029 (TCP)
Troyanos: Clandestine, KWM, Litmus, SubSARI

port 1029 (UDP)
Troyanos: SubSARI

Clandestine
Name: Clandestine
Aliases: TrojanDropper.Win32.Small.f, Backdoor.RSC,
Ports: 1027, 1029, 3006, 22456, 23456
Files: Clandestine1.5.1.zip - Remoto.exe - Update.exe - Win32.exe - Control.exe -
Created:
Requires:
Actions:
Registers: HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run\
Notes: Works on Windows.
Country:
Program:

Name: KWM
Aliases: Backdoor.KWM,
Ports: 21, 1028, 1029, 1030, 1031, 1032, 1033, 1034, 1035, 1036, 1037
Files: Netcfgh.exe - [69 kb]Photo.scr - Photo.jpg - Sponsors_pay_wm.exe - Contract.txt - Body.lg - List.cmd - Heak.exe - Teen1.exe - Teen2.exe - Teen3.exe -
Created:
Requires:
Actions: Remote Access / Keylogger / Steals passwords / Downloading trojan
Registers: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion
HKEY_USERS\.Default\Software\Microsoft\Windows\Cur rentVersion\Internet Settings
Notes: Works on Windows.
Country:
Program:

Name: Litmus
Aliases: Backdoor.Litmus, Backdoor.JZ, LTM,
Ports: 1028, 1029, 30005
Files: Litmus2.03.zip - Winup.exe - Msgorv32.exe - Msgsrv16.exe - Msgsrv32.exe - Msgsrv320.exe - Litdevia.exe - Litkeqan.exe - Traywnd.exe - - 7,680 bytes - 15,904 bytes - 17,440 bytes - 36,384 bytes
Created: Jan 2001
Requires:
Actions: Remote Access / IRC trojan
Registers: HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run
HKEY_USERS\.DEFAULT\Software\Microsoft\ Windows\CurrentVersion\Run\
Notes: Works on Windows, together with an IRC software.
Country:
Program:

Name: SubSARI
Aliases: Backdoor.SubSARI,
Ports: 39, 1028, 1028 (UDP), 1029, 1029 (UDP), 3131, 6711, 35600, 40308, 50000 (ports can not be changed)
Files: Subsari1.0.zip - Subsari1.2.zip - 647,285 bytes Subsari1.3.zip - 717,568 bytes Subsari1.4.zip - Subsari 12.exe - 256,512 bytes Subsari 13.exe - 283,136 bytes Server 12.exe - 204,800 bytes Server13.exe - 239,104 bytes Sduzen.exe - 141,312 bytes Runexec.exe - Winexec.exe - Kuusbffc..exe - Icqinet.dll - Zimbirti.exe - Ayar.kip - 5,860 bytes Ayar.kip - 5,875 bytes Ayar.kip - 5,897 bytes Dosya.kip - 96 bytes Tools.kip - 46 bytes Yedek.kip - 5,760 bytes
Created: Jun 2000
Requires:
Actions: Remote Access / Keylogger / Steals passwords / FTP server
Registers: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\
Notes: Works on Windows 95, 98 and ME.
Country: written in Turkey
Program:

espero que te sirva.