To tie a bow around this thread, ZoneAlarm was denying active FTP connections from Hijack.