I just went to have a look through some router settings today and found an unknown new entry in the NAT table, forwarding UDP port 1052 to the same port on a host which runs both Windows 7 and Linux. I disabled the rule and have asked the ISP if they have added it, which is unlikely because of the name of the NAT rule. I've looked around and could find only two references to this name which seem relevant (possibly NSFW): a Reddit post (referring to port 1057) and a decompiled binary with no context. I also checked
netstat on both OSes and found no service listening on UDP port 1052 (although a sophisticated hack could of course hide itself). I had a quick look in Wireshark as well but found no traffic to that port.
The router an ISP-provided NetComm Wireless NF4V. It doesn't get firmware updates.
Is this a known virus/worm? Is there anything else I should do?