hi,
using Trojan Defense systems3 knock utility today. not sure if indicates active rat server. the tool scanned known ports for servers and indicates udp 31337 with a reply/result of zero (as opposed to forcefully rejected) and response for deep throat1 on udp 60000 reply/result of zero.

does anyone know where i can get a list of commands for both programs so i can interrogate this trojan/rat further??? all help appreciated.

grumpy in Los Angeles