TCP Port 2745

Common Use

Used by a number of the Bagle / Beagle / Tanx viruses as a backdoor port.

Inbound Traffic

Bagle is mass-mailing email that besides using your address book, and other information on your computer to email copies of itself too, opens a backdoor on port 2745 which allows a hacker to upload a file and execute it automatically.  Bagle also attempts to contact a number of web sites informing them of the infection.  TCP port 2745 should be blocked by your firewall.

Outbound Traffic

Outbound scans especially if occurring in volume should be considered an indication of a possible infection or compromise on the source computer and should be investigated immediately.

Additional Information

Port Peeker Capture of Bagle exploit attempt

Symantec Beagle.H write up

McAfee Bagle.J write up

F-Secure Bagle.K write up

Page last updated on May 13, 2004