It could be someone running nmap searching for a port opened by that virus/backdoor