Ftp Server gripes 6/30/2004 10:16:06 PM SERVER: Unable to start server, port 21 may already be in use.

[TungFree]

I have no idea what is using port 21 on my computer and prevents FTP Server use.

 

[oconnect]

hmmm sounds to me like someone could be hijacking your system. Port 21 is never suppose to be in use unless you are hosting a ftp server or connected to one. I'd close off your connection & run an up to date virus scan.

 

[hompsar]

run Ad-Aware, SpyBot:Search&Destroy, and also make sure to get a firewall so you can see if anyone is accessing port 21 (or any other available port for that matter)

 

[TungFree]

before I posted this post I did the following:

Ran updated Ad-aware Pro
Ran updated spy bot
Ran spy sweeper 3.0
Ran "The Cleaner"
Ran EZ virus killer
I had been running EZ firewall
I have a hardware router firewall (With ports 20 and 21 open in it)
I went to a site calld ( Ithink ) Housekeeper or house cleaner trojan, worm tick virus finder.
I did a scan with HijackThis and had an expert look over my scan and tell me I was clean after deleting an item.

My Port 21 is still busy with something.

I will look around for a port scanner of some sort\
Is that able to detect what is using my port 21?

 

[TungFree]

I installed advanced port scanner

when I scan port 20 to 20 range, it says "Ports (0 opened, 1 closed)
When I scan 21 to 21 range it says "Ports (1 opened, 0 closed)
When I scan 20 to 21 range it says "Ports (1 opened, 1 closed) and a sublink sais "21 open (ftp)

But I am not using FTP somehow something keeps it open anyway to know what?

 

[n0cmonkey]

This isn't highly technical. There are programs out there that will tell you what is using the port. Use one.

http://www.foundstone.com/?subnav=resources/navigation.htm&subcontent=/resources/proddesc/fport.htm

 

[Sunner]

You can always try just telnet'ing to port 21 and see if whatever is running presents a banner.
This shows up on my box for example:

sunner@litovel: ~> telnet localhost 21
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 ProFTPD 1.2.9 Server (Litovel - Debian) [litovel]