Ports can be divided into 3 categories.
1. Well known ports - from 0 to 1023
These ports are closely bundled with some system services. For example, port 80 is the primary port used by HTTP.
2. Registered ports - from 1024 to 49151
They loosely bundled with some system services. That means many services use these ports, however, these ports can be used for other purposes as well.
3. Dynamic and/or private ports - from 49152 to 65535
Theoretically, no services should be allocated to these ports. But there are exceptions: Sun RPC ports start from 32768
In general, viruses, Trojans do not use the ports of first category, namely 0-1023 ports. However, exception always exists. Therefore, we cannot say a certain port is absolutely bundled with certain viruses or Trojans in general terms. Trojans can be designed or customized to use any ports and this brings difficulties to identify these Trojans as well.
