Almost sounds like a FTP phishing Trojan. Check the machine for virii with a couple of up to date scanners as well. I have noticed a marked increase in port 21 attack traffic as of late. There are any number of Trojans that can accomplish this as well.
Likewise, do you allow any anonymous uploading? Better check the logs to see what kind of activity is happening on that machine. A few more details as Al suggested will be most helpful as well. Brent Eads Employee Technology Solutions, Inc. Office: (312) 762-9224 Fax: (312) 762-9275 The contents contain privileged and/or confidential information intended for the named recipient of this email. ETSI (Employee Technology Solutions, Inc.) does not warrant that the contents of any electronically transmitted information will remain confidential. If the reader of this email is not the intended recipient you are hereby notified that any use, reproduction, disclosure or distribution of the information contained in the email in error, please reply to us immediately and delete the document. Viruses, Malware, Phishing and other known and unknown electronic threats: It is the recipient/client's duties to perform virus scans and otherwise test the information provided before loading onto any computer system. No warranty is made that this material is free from computer virus or any other defect. Any loss/damage incurred by using this material is not the sender's responsibility. Liability will be limited to resupplying the material. "Al Mulnick" <[EMAIL PROTECTED]> Sent by: [EMAIL PROTECTED] 01/22/2007 07:40 PM Please respond to ActiveDir@mail.activedir.org To ActiveDir@mail.activedir.org cc Subject Re: [ActiveDir] ftp access Can you provide some more details? What are they using to access their shares? (client?) What are you using to provide ftp access? (IIS?) How did you prove that this is the case? Log files? Trial and error? Anything else that's relevant? Al On 1/22/07, Antonio Aranda <[EMAIL PROTECTED]> wrote: I've setup ftp access to users' network drives so they have access to them remotely. I recently notice some thing very peculiar. Their ftp access stops working when they start getting warnings that their password is going to expire. I don't know if this just a coincidence but once they change their password it starts working again. If any one knows anything about this, I would appreciate any advice. Antonio Aranda Network Analyst UT-Permian Basin 432-552-2413 Message scanned by TrendMicro Message scanned by TrendMicro
