3.02 b1044 ?????

[BetaMan]

Hi

I used the latest version of FlashFXP,but now my virus Killer hit alarm(worm virus) :( Norton Anti Virus :)
I cannot join any FTP Server´s with IDENT :(

I used my old flash v3.0 b1015 works perfecly and my virus killer dont hit alram :)
Connected to all (IDENT) FTP no problems nothing

Is that a virus on the latest FlashFXP ?

[bigstar]

Which anti-virus software are you using?

Did you download FlashFXP directly from our website?

FlashFXP v3.0.2 was scanned with Norton Anti-Virus 2005 and it is not detected as a virus.

[BetaMan]

Yeah orginal from this site

My Norton hit alarm but only where i used IDENT Server port113

Normal FTP Server works fine

[BetaMan]

Now i dl again,now works perfectly,strange :)

[bigstar]

I was looking at Norton Anti-Vrus 2005...

Norton Anti-Virus 2005 has built-in worm detection which works by detecting which applications are listening on specific ports. My guess is that you have this feature enabled and it's configured to trigger on ident.

It's not saying FlashFXP is a virus but it detected worm like activity because it was acting as an ident server.

Since I use a hardware based firewall I have this feature turned off.

[covareo]

I get multiple NAV 2005 has blocked a worm intrusion attempt notifications using 3.02 build 1045. The worm name keeps changing and I cant quite pin down why it is happening. The server is clean and other systems on the network seem fine. If I use <cough> CuteFTP I dont get the message so I believe it to be FlashFXP specific. We run over 30 servers and I can connect to most of them fine - it does seem to only happen on Serv-U servers but I can connect to some Serv-U systems without the error... Thoughts?

[bigstar]

Is FlashFXP using Passive Mode (PASV) Or Active Mode (PORT)? You can tell by loooking at the ftp session status window.

I suspect CuteFTP is using PASV mode and FlashFXP is using PORT mode.

You can enable PASV mode in FlashFXP Options / Preferences / Connection Tab.

These false alarms are caused becaused FlashFXP is using the same ports as known worms by NAV.

FTP uses random local ports when using PORT mode, One solution you can try is to limit the local port range in the Preferences / Connection Tab.

I'm not sure which range of ports are blocked and which are not, but you could try a port range of say 11310 to 12310.. This is just a random range I came up with, feel free to try another range. If the range of ports is too small you'll run into problems, usually 10-20 ports per copy of FlashFXP is a good measure.

[covareo]

I bet that's it - I know for a fact that the particular server I had issues with today does NOT currently support passive mode.

I will tr enabling passive mode after hours and let you know if the issue goes away.

Thanks for the help!