Is it a Virus?
NO - Safe
Located in C:\Windows\System32\ftpsvc.exe and signed by Microsoft
Warning
Normal for FTP server activity
Multiple FTP connections and data transfers can spike usage briefly
Can I Disable?
YES
Disabling disables the IIS FTP server feature; proceed via Windows Features or IIS Manager
What is ftpsvc.exe?
ftpsvc.exe is the FTP Publishing Service executable used by Internet Information Services (IIS) to run an FTP server on Windows. It operates as a Windows service, handles FTP commands, authenticates users, and manages file transfers. When IIS FTP is enabled, ftpsvc.exe may run multiple worker threads and data channels.
ftpsvc.exe implements the FTP server logic, including control connection handling, user authentication, and data channel setup for file transfers. It works with IIS, supports passive data connections, and may be configured for FTPS with TLS to secure credentials.
Quick Fact: FTPSVC is integral to IIS FTP; it coordinates control and data channels and can be secured with TLS for FTPS.
Types of FTP Server Processes
- FTPSVC (Service Process): Main FTP server service handling control connections
- Worker Process: Handles individual FTP sessions and data transfers
- Data Channel Handler: Manages data connections for file transfers in passive/active mode
Is ftpsvc.exe Safe?
Yes, ftpsvc.exe is safe when it is the legitimate Windows FTP Publishing Service executable from Microsoft and located in the System32 folder.
Is ftpsvc.exe a Virus or Malware?
The real ftpsvc.exe is not a virus. Malware can masquerade as system files; verify location and signature to confirm legitimacy.
How to Tell if ftpsvc.exe is Legitimate or Malware
- File Location:: Must be at
C:\Windows\System32\ftpsvc.exe. Any ftpsvc.exe elsewhere is suspicious.
- Digital Signature:: Right-click the file -> Properties -> Digital Signatures. Should show a signature from Microsoft Corporation.
- Resource Usage:: As a service, it should have modest idle CPU/memory, with spikes during FTP transfers.
- Behavior:: Runs as a Windows service named FTPSVC. If it isn’t listed as a service or behaves oddly, investigate.
Red Flags: ftpsvc.exe located outside C:\Windows\System32, missing a Microsoft signature, or showing persistent unusual network activity on FTP ports warrants a security scan.
Why Is ftpsvc.exe Running on My PC?
ftpsvc.exe runs to support IIS-hosted FTP services. It starts when an FTP site is configured and remains running to manage authentication, control commands, and data transfers for active sessions.
Reasons it's running:
- Active FTP Site or Sessions: An IIS FTP site is configured and accepting connections, so ftpsvc.exe handles login, commands, and transfers.
- Background FTP Transfers: Ongoing file uploads/downloads or directory listings keep the service active to service clients.
- Startup and Auto-Start: The FTP service is set to start automatically on system boot or user login.
- Passive Data Connections: Data channel setup for passive mode opens dynamic ports in the firewall; activity increases briefly during transfers.
- FTPS/TLS Negotiation: If FTPS is enabled, TLS handshakes occur for secure file transfers, contributing to occasional CPU usage during negotiations.
Can I Disable or Remove ftpsvc.exe?
Yes, you can disable ftpsvc.exe. Disabling stops the FTP server functionality; you can remove the FTP Server role/feature if you no longer need IIS FTP.
How to Stop ftpsvc.exe
- Stop the FTP Service: Open Services (services.msc), locate <strong>FTPSVC</strong>, and click Stop.
- Disable Startup: In Services, set Startup Type to Disabled for FTPSVC.
- Disable FTP Feature: Server Manager -> Remove Roles and Features -> uncheck <strong>FTP Server</strong> under Roles and restart.
- Disable FTP Sites: Open IIS Manager and remove or disable FTP sites to stop session handling.
- Adjust Firewall: If you plan to keep the OS FTP feature disabled, close ports 21 and any passive data ports in the firewall.
How to Uninstall FTP Server
- ✔ Server Manager -> Manage -> Remove Roles and Features -> uncheck <FTP Server> under Roles
- ✔ Restart the server when prompted
- ✔ Verify that FTPSVC is no longer present and FTP ports are closed
Common Problems: FTP Server Performance and Connectivity
If ftpsvc.exe is not behaving as expected, review these common FTP server issues and fixes related to IIS FTP service.
Common Causes & Solutions
- Too many concurrent FTP connections: Limit connections per FTP site in IIS Manager under FTP Site -> Connections; consider increasing or distributing load with a DAG.
- Passive mode firewall ports not opened: Open the FTP passive port range in Windows Firewall and any network firewall; configure Passive Port Range in IIS FTP: e.g., 50000-50100.
- TLS/FTPS not configured: Enable FTPS in FTP site bindings and install/associate a valid certificate; enforce TLS1.2+ for secure transfers.
- Incorrect NTFS permissions on FTP root: Grant appropriate read/write permissions to the FTP user accounts on the root and subfolders; avoid broad permissions.
- Obsolete IIS FTP feature: Update to a supported Windows Server version or enable a supported FTP server feature; apply latest Windows updates.
- Logging or auditing heavy I/O: Reduce verbose logging, rotate logs, or direct logs to a dedicated drive to prevent disk I/O spikes.
Quick Fixes:
1. Quick Fixes:
2. 1. Open IIS Manager and review the FTP Site settings for connections and data channel configuration
3. Enable TLS/FTPS and assign a valid certificate under the FTP Site bindings
4. Configure the firewall to allow port 21 and the configured Passive Port Range
5. Limit concurrent connections per site and consider enabling connection throttling
6. Restart FTPSVC after applying changes and monitor with Event Viewer
Frequently Asked Questions
What is ftpsvc.exe?
ftpsvc.exe is the file for the FTP Publishing Service used by IIS to run an FTP server on Windows. It handles login, command processing, and file transfers for configured FTP sites.
Is ftpsvc.exe safe to run on Windows Server?
Yes, when ftpsvc.exe is located in C:\Windows\System32 and signed by Microsoft. Ensure FTP is enabled only if you need an FTP server and keep it secured with TLS.
Where is ftpsvc.exe located on a typical system?
The legitimate file is located at C:\Windows\System32\ftpsvc.exe. If you find it elsewhere or without a Microsoft signature, investigate for malware.
Can I disable the FTP service without breaking Windows?
Yes. You can stop the FTPSVC service and disable its startup, or uninstall the FTP Server feature via Server Manager. This will disable IIS FTP functionality but not the entire OS.
What ports does FTP/FTPS use and how do I configure them?
FTP uses port 21 for control and a passive data port range you configure in IIS FTP settings. Open these ports in the firewall and forward them if behind NAT.
How do I secure FTP with FTPS on Windows?
Enable FTPS in the FTP Site bindings, install a valid certificate, and enforce TLS 1.2+. This protects credentials and data during transfer.