There's a couple worms that have been banging on TCP port **7 with an originating port in the low temp range, around *025, for the past 6 months or so.