Below is a list of ports used by common trojans. A port is used by your computer to connect to other computers, and accept incoming connections. Note that the ports I am talking about here are not actual physical ports like your serial ports (com), parallel ports (lpt), or universal bus ports (usb). Your computer has several thousand ports. Your browser uses port 80 to connect to load web pages. Note that many trojans allow the script kiddie to change the port to something completely different.
21 - standard for ftp (not a trojan)
31 - Master Paradise
80 - used by your web browser
139 - commonly used by nukes (a nuke is not a trojan, and only
works on computers running the earliest version of Win 95 or Win
3x)
1010 - Doly 1.3
1011 - Doly Trojan 1.1 + 1.2
1015 - Doly 1.5
1033 - Netspy
1080 - Wingate, also used by SOCKS proxies (not a trojan)
1170 - Psyber Stream
1243 - Sub 7 version 2.0 and earlier
1999 - Backdoor
2155 - Illusion Mailer
2583 - Wincrash 2
3128 - commonly used by http proxies (not a trojan)
4950 - ICQ Trojen
5400 - Back Construction
5512 - Illusion Mailer
5742 - Wincrash
5880 - Y3KRat
6400 - The Thing
6670 - Deep Throat
6969 - Gatecrasher
8000 - commonly used by http proxies (not a trojan)
8080 - commonly used by http proxies (not a trojan)
12346 - Netbus 1.x
20034 - Netbus Pro
21554 - Girlfriend
22222 - Prosiak 0.47
27374 - Sub 7 version 2.1 and later
30100 - Netsphere
31337 - Back Orifice
31787 - Hack 'a' tack
40423 - Master Paradise
61466 - Telecommando
This list will be updated in a few days.