Old 10-29-2004, 02:09 PM   #1
BetaMan
Junior Member
FlashFXP Registered User
 
Join Date: Jan 2002
Posts: 24
Angry 3.02 b1044 Virus ?????

Hi

I used the latest version of FlashFXP,but now my virus Killer hit alarm(worm virus) Norton Anti Virus
I cannot join any FTP Server´s with IDENT

I used my old flash v3.0 b1015 works perfecly and my virus killer dont hit alram
Connected to all (IDENT) FTP no problems nothing

Is that a virus on the latest FlashFXP ?
BetaMan is offline  
Old 10-29-2004, 02:22 PM   #2
bigstar
FlashFXP Developer
FlashFXP Administrator
ioFTPD Beta Tester
 
bigstar's Avatar
 
Join Date: Oct 2001
Posts: 8,012
Default

Which anti-virus software are you using?

Did you download FlashFXP directly from our website?

FlashFXP v3.0.2 was scanned with Norton Anti-Virus 2005 and it is not detected as a virus.
bigstar is offline  
Old 10-29-2004, 02:39 PM   #3
BetaMan
Junior Member
FlashFXP Registered User
 
Join Date: Jan 2002
Posts: 24
Default

Yeah orginal from this site

My Norton hit alarm but only where i used IDENT Server port113

Normal FTP Server works fine
BetaMan is offline  
Old 10-29-2004, 02:47 PM   #4
BetaMan
Junior Member
FlashFXP Registered User
 
Join Date: Jan 2002
Posts: 24
Default

Now i dl again,now works perfectly,strange
BetaMan is offline  
Old 10-29-2004, 03:40 PM   #5
bigstar
FlashFXP Developer
FlashFXP Administrator
ioFTPD Beta Tester
 
bigstar's Avatar
 
Join Date: Oct 2001
Posts: 8,012
Default

I was looking at Norton Anti-Vrus 2005...

Norton Anti-Virus 2005 has built-in worm detection which works by detecting which applications are listening on specific ports. My guess is that you have this feature enabled and it's configured to trigger on ident.

It's not saying FlashFXP is a virus but it detected worm like activity because it was acting as an ident server.

Since I use a hardware based firewall I have this feature turned off.
bigstar is offline  
Old 03-07-2005, 10:54 AM   #6
covareo
Junior Member
FlashFXP Registered User
 
Join Date: Mar 2005
Posts: 2
Default Same issue here

I get multiple NAV 2005 has blocked a worm intrusion attempt notifications using 3.02 build 1045. The worm name keeps changing and I cant quite pin down why it is happening. The server is clean and other systems on the network seem fine. If I use <cough> CuteFTP I dont get the message so I believe it to be FlashFXP specific. We run over 30 servers and I can connect to most of them fine - it does seem to only happen on Serv-U servers but I can connect to some Serv-U systems without the error... Thoughts?
covareo is offline  
Old 03-07-2005, 11:47 AM   #7
bigstar
FlashFXP Developer
FlashFXP Administrator
ioFTPD Beta Tester
 
bigstar's Avatar
 
Join Date: Oct 2001
Posts: 8,012
Default

Is FlashFXP using Passive Mode (PASV) Or Active Mode (PORT)? You can tell by loooking at the ftp session status window.

I suspect CuteFTP is using PASV mode and FlashFXP is using PORT mode.

You can enable PASV mode in FlashFXP Options / Preferences / Connection Tab.

These false alarms are caused becaused FlashFXP is using the same ports as known worms by NAV.

FTP uses random local ports when using PORT mode, One solution you can try is to limit the local port range in the Preferences / Connection Tab.

I'm not sure which range of ports are blocked and which are not, but you could try a port range of say 11310 to 12310.. This is just a random range I came up with, feel free to try another range. If the range of ports is too small you'll run into problems, usually 10-20 ports per copy of FlashFXP is a good measure.
bigstar is offline  
Old 03-07-2005, 04:19 PM   #8
covareo
Junior Member
FlashFXP Registered User
 
Join Date: Mar 2005
Posts: 2
Default

I bet that's it - I know for a fact that the particular server I had issues with today does NOT currently support passive mode.

I will tr enabling passive mode after hours and let you know if the issue goes away.

Thanks for the help!
covareo is offline  
 

Tags
flashfxp, ftp, hit, ident, virus

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Deleted Profile On Flash rouil General Discussion 0 04-02-2005 09:03 PM


All times are GMT -5. The time now is 09:30 AM.

Parts of this site powered by vBulletin Mods & Addons from DragonByte Technologies Ltd. (Details)