I have been monitoring some suspicous activity on our network in our
organization in the last 24 hours. We have numeours systems and
departments to go through. I have rounded the activity to around 200
systems (out of 3000) that could be the culprit. I belive there is an
FTP server running on a system and the server is using a port other
than port 21. Is there a port scanner out there that will scan all
ports and say weather its an open FTP, HTTP, or what ever type of port.
I know there are numerous port scanners in existance but all I have
seen, for example lets say port 21 is open it states "port 21 (FTP)"
where the FTP port may exist on port 2300 and if the scanner runs over
that it just states "Port 2300" well I want to know what port 2300 is,
if it is a common protocol. Also is there a port scanner that will
state what virusus, backdoors, spyware, etc. would be associated with
any open port as they are found.

Thank You

Don't think there is a single definitive answer, but this might help:

http://www.iana.org/assignments/port-numbers

As for FTP, that can in principle take place on any port, although
telnetting to a suspicious open-port may get a response that tells you what
program is 'behind' the port.

telnet computername:21 might be revealing.

BTW, port 21 is purely the FTP control port, data goes on a separate port
established when the connection is made.