Does the list of known good and bad ports get updated with new ports that are found to be malicious?

Answer

The list of good and bad ports is quite static. The ports are updated, but not too often (e.g. GFI updated them 3-4 times in last 6 years, last time 2-3 years ago). The most commonly used ports do not change often. GFI LanGuard only highlights some major ports used by known Trojans and other intrusions. Keeping up with the list used by current threats is a job better done by Anti-virus programs. Adding all the ports used by current trojans and other intrusions would increase the list tremendously, thus taking longer to scan and generating too many false positives.