CLAN can be configured to use several services, it can be a telnet port for ASA (SAT Service - typically port 5xxx and not the standard Telnet port), it can be CMS interface, it can be a CTI link for co-resident DLG (DLG Service - port 5678) and it can be TAPI interface for IP Softphones (DAPI), and others as well.
Display IP-Services will display services you already have configured, and ports in use. All use TCP/IP for the carrier and tunnel the respective protocols within TCP/IP packets.
Theoretically, a virus is possible on any computer using any service.
Best to use ACL on routers and keep the Telephony network separate from corporate LAN. Some services may proxy through a server (DLG) requiring only the server have access to the CLAN. Others may require numerous users (DAPI) but will be limited to specific ports. Most of the application ports are for reporting information or call control, not terminal functions, so SAT may be your most critical port to restrict.