1) When they say that a virus like Mydoom opens port 3127, does it mean that an infected machine will receive packet on that port (incoming) or that it will send the virus on that port (outgoing). http://securityresponse.symantec.com/avcenter/venc/data/w32.novarg.a@mm.html 2) They don't mention either if its TCP or UDP...I suppose its TCP? 3) On our hardware firewall, I receive a lot of requests on port 3127: Deny tcp src outside:200.35.87.71/7620 dst inside:XXX.XX.XX.XXX/3127 by access-group "acl_out" 4) Now, I know that my firewall denies de request, but does it mean that a computer in my network is infected. I did run a scan on all computers with the latest virus def and none of them reports being infected. 5) Granted, a scan on port 3127 doesn’t necessarily mean that one of my computers is infected, but I just find it odd… is it possible that its people trying to take advantage the backdoor open by the mydoom virus?