FYI - I was looking at my firwall logs and noticed an incremental scan of each of my IP addresses on port 27374 - apparently the sub-7 trojan. Is this thing always out there looking around, or is it making a return?