Answer
When GFI LanGuard is installed on Microsoft Vista or later and the Firewall Service is started, TCP port 21 may be detected as 'open' on the scanned machines.GFI LanGuard's TCP port scanner uses the method called TCP Connect to determine if a TCP port is open. If GFI LanGuard is installed on Microsoft Windows Vista or later, connection attempts to TCP 21 will succeed. This is because the Firewall Service responds to such requests.