Viruses via FTP ?

[SanJose239]

Hi everyone,

I have a Windows 2000 Professional PC running WS FTP server software.
I have a static IP address set up thru DSL. My Norton Antivirus 2003 is up
to date with its virus list. I believe my DSL provider opens up only port 21
for my FTP server software to work. I allow only 1 user to log on via FTP to
send me data. I used "Windows Update" at microsoft.com to download all the
patches for this OS, including the one for the Blaster worm virus. I called
the FTP software tech support, and they told me my setup for my FTP server is
correct. This PC was just set up last week, after repeated security breaches on
my previous PC.

I even turned off email access, and I do not use floppy disks on this PC.

Here's the problem:

Viruses still can penetrate thru this new PC. If the floppy drive is not used,
email access is not allowed, Norton Antivirus is up to date, FTP software
properly configured, and all the Microsoft OS patches have been installed, how
can viruses still hit this computer?

By the way, I read up on the viruses that I got hit with, and they happen to be
the
ones that penetrate via FTP ports, etc.

Your comments on how to fix this problem would be greatly appreciated.

 

[Karl Levinson [x y] mvp]

I'm not aware of any common viruses that spread via FTP ports. [Some spread
via TFTP, but that doesn't use TCP 20 and is completely different from FTP.]
What were the virus names that you are receiving? And how do you know the
name of the viruses? Either NAV is catching them and protecting you, or it
is not.

I strongly doubt your DSL provider is "only" opening up port 21. For one
thing, FTP also requires either TCP 20 or a randomly negotiated port number
to work, NOT just TCP 21. 21 is only for the first FTP connection, which is
the control channel.

You need a firewall.

Also, make sure the anonymous FTP user never has both read and write
permission to any one folder. If your FTP provider didn't tell you that,
then they aren't security experts and you have to wonder what else they
aren't remembering to tell you.

Securing your computer is ALWAYS the same, your setup is no different from
anyone else. See the regular things to do to secure your computer here,
from the FAQ:

http://securityadmin.info/faq.asp#harden