locked
IIS 8.5 FTP File Upload Error RRS feed

  • Question

  • User-1508491276 posted

    Hello,

    I'm trying figure out why I can't upload files to the FTP.
    I can create folders, move around the files, delete, but I can't upload them!

    The thing I thought may could be... permissions!! 
    I setup "Full Control" to "Everyone" on my FTP root folder.
    On IIS FTP Authorization Rules the setup is Allow All Users Read and Write
    Nothing!

    I will post some log files below...
    Maybe someone can help me find a solution!

    FileZilla

    Estado: A resolver o endereço de ftp.contoso.com
    Estado: Conectando 192.168.0.10:21...
    Estado: Conexão estabelecida, esperando mensagem de boas-vindas...
    Estado: A iniciar o TLS...
    Estado: Verificando certificado...
    Estado: Conexão TLS estabelecida.
    Estado: Identificado
    Estado: Obtendo lista de pastas...
    Estado: Calculando o fuso horário do servidor...
    Estado: Fuso horário do servidor é de -7200 segundos.
    Estado: Listagem do diretório "/" bem sucedida
    Estado: A resolver o endereço de ftp.contoso.com 
    Estado: Conectando 192.168.0.10:21...
    Estado: Conexão estabelecida, esperando mensagem de boas-vindas...
    Resposta: 220 Microsoft FTP Service
    Comando: AUTH TLS
    Resposta: 234 AUTH command ok. Expecting TLS Negotiation.
    Estado: A iniciar o TLS...
    Estado: Verificando certificado...
    Estado: Conexão TLS estabelecida.
    Comando: USER contoso\FTPUser
    Resposta: 331 Password required
    Comando: PASS *********
    Resposta: 230 User logged in.
    Comando: OPTS UTF8 ON
    Resposta: 200 OPTS UTF8 command successful - UTF8 encoding now ON.
    Comando: PBSZ 0
    Resposta: 200 PBSZ command successful.
    Comando: PROT P
    Resposta: 200 PROT command successful.
    Estado: Identificado
    Estado: Iniciando o envio de C:\Users\User\Desktop\File.txt
    Comando: CWD /
    Resposta: 250 CWD command successful.
    Comando: PWD
    Resposta: 257 "/" is current directory.
    Comando: TYPE I
    Resposta: 200 Type set to I.
    Comando: PASV
    Resposta: 227 Entering Passive Mode (192,168,0,10,19,39).
    Comando: STOR File.txt
    Resposta: 150 Opening BINARY mode data connection.
    Resposta: 550
    Erro: Transferência do arquivo falhou
    Estado: Iniciando o envio de C:\Users\User\Desktop\File.txt
    Estado: Recuperando listagem do diretório de "/"...
    Comando: PASV
    Resposta: 227 Entering Passive Mode (192,168,0,10,19,40).
    Comando: LIST
    Resposta: 150 Opening BINARY mode data connection.
    Resposta: 226 Transfer complete.
    Comando: PASV
    Resposta: 227 Entering Passive Mode (192,168,0,10,19,41).
    Comando: STOR File.txt
    Resposta: 150 Opening BINARY mode data connection.
    Resposta: 550
    Erro: Transferência do arquivo falhou
    Estado: Iniciando o envio de C:\Users\User\Desktop\File.txt
    Estado: Recuperando listagem do diretório de "/"...
    Comando: PASV
    Resposta: 227 Entering Passive Mode (192,168,0,10,19,42).
    Comando: LIST
    Resposta: 150 Opening BINARY mode data connection.
    Resposta: 226 Transfer complete.
    Comando: PASV
    Resposta: 227 Entering Passive Mode (192,168,0,10,19,43).
    Comando: STOR File.txt
    Resposta: 150 Opening BINARY mode data connection.
    Resposta: 550
    Erro: Transferência do arquivo falhou
    Estado: Recuperando listagem do diretório de "/"...
    Comando: PASV
    Resposta: 227 Entering Passive Mode (192,168,0,10,19,44).
    Comando: LIST
    Resposta: 150 Opening BINARY mode data connection.
    Resposta: 226 Transfer complete.
    Estado: Listagem do diretório "/" bem sucedida

    ProcessMonitor

    "Time of Day","Process Name","PID","Operation","Path","Result","Detail"
    "21:24:44,3372203","svchost.exe","1224","TCP Accept","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 0, mss: 1460, sackopt: 1, tsopt: 0, wsopt: 1, rcvwin: 65700, rcvwinscale: 8, sndwinscale: 8, seqnum: 0, connid: 0"
    "21:24:44,3377930","svchost.exe","1224","CreateFile","C:\inetpub\logs\LogFiles\FTPSVC7\u_ex161118.log","SUCCESS","Desired Access: Generic Write, Read Attributes, Disposition: OpenIf, Options: Non-Directory File, Disallow Exclusive, Attributes: n/a, ShareMode: Read, AllocationSize: 0, OpenResult: Opened"
    "21:24:44,3378658","svchost.exe","1224","QueryStandardInformationFile","C:\inetpub\logs\LogFiles\FTPSVC7\u_ex161118.log","SUCCESS","AllocationSize: 176.128, EndOfFile: 175.662, NumberOfLinks: 1, DeletePending: False, Directory: False"
    "21:24:44,3398812","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 27, startime: 114292, endtime: 114292, seqnum: 0, connid: 0"
    "21:24:44,3398979","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 10, seqnum: 0, connid: 0"
    "21:24:44,3416564","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 49, startime: 114292, endtime: 114292, seqnum: 0, connid: 0"
    "21:24:44,3416705","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 246, seqnum: 0, connid: 0"
    "21:24:44,3440483","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 5592, startime: 114292, endtime: 114292, seqnum: 0, connid: 0"
    "21:24:44,3485502","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 523, seqnum: 0, connid: 0"
    "21:24:44,3485763","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 6, seqnum: 0, connid: 0"
    "21:24:44,3485882","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 85, seqnum: 0, connid: 0"
    "21:24:44,3850553","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 91, startime: 114292, endtime: 114292, seqnum: 0, connid: 0"
    "21:24:44,3850733","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 85, seqnum: 0, connid: 0"
    "21:24:44,3865524","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 85, startime: 114292, endtime: 114292, seqnum: 0, connid: 0"
    "21:24:44,3865618","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 85, seqnum: 0, connid: 0"
    "21:24:44,3869827","svchost.exe","1224","CreateFile","E:\contoso\FTPUser","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, Impersonating: CONTOSO\FTPUser, OpenResult: Opened"
    "21:24:44,3870323","svchost.exe","1224","QueryInformationVolume","E:\contoso\FTPUser","BUFFER OVERFLOW","VolumeCreationTime: 18/11/2016 16:27:45, VolumeSerialNumber: A876-D6FA, SupportsObjects: True, VolumeLabel: ftp̔"
    "21:24:44,3870473","svchost.exe","1224","QueryAllInformationFile","E:\contoso\FTPUser","BUFFER OVERFLOW","CreationTime: 18/11/2016 17:24:28, LastAccessTime: 18/11/2016 21:12:18, LastWriteTime: 18/11/2016 21:12:18, ChangeTime: 18/11/2016 21:12:18, FileAttributes: D, AllocationSize: 0, EndOfFile: 0, NumberOfLinks: 1, DeletePending: False, Directory: True, IndexNumber: 0x1000000000029, EaSize: 0, Access: Generic Read, Position: 0, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Byte"
    "21:24:44,3870640","svchost.exe","1224","CloseFile","E:\contoso\FTPUser","SUCCESS",""
    "21:24:44,3897938","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 85, startime: 114292, endtime: 114292, seqnum: 0, connid: 0"
    "21:24:44,3898087","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,3910141","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 117, startime: 114292, endtime: 114292, seqnum: 0, connid: 0"
    "21:24:44,3910316","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,3921840","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 85, startime: 114292, endtime: 114292, seqnum: 0, connid: 0"
    "21:24:44,3921977","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,4422098","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 85, startime: 114292, endtime: 114293, seqnum: 0, connid: 0"
    "21:24:44,4422338","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,4424635","svchost.exe","1224","CreateFile","E:\contoso\FTPUser","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, Impersonating: CONTOSO\FTPUser, OpenResult: Opened"
    "21:24:44,4424994","svchost.exe","1224","QueryInformationVolume","E:\contoso\FTPUser","BUFFER OVERFLOW","VolumeCreationTime: 18/11/2016 16:27:45, VolumeSerialNumber: A876-D6FA, SupportsObjects: True, VolumeLabel: ftp̔"
    "21:24:44,4425135","svchost.exe","1224","QueryAllInformationFile","E:\contoso\FTPUser","BUFFER OVERFLOW","CreationTime: 18/11/2016 17:24:28, LastAccessTime: 18/11/2016 21:12:18, LastWriteTime: 18/11/2016 21:12:18, ChangeTime: 18/11/2016 21:12:18, FileAttributes: D, AllocationSize: 0, EndOfFile: 0, NumberOfLinks: 1, DeletePending: False, Directory: True, IndexNumber: 0x1000000000029, EaSize: 0, Access: Generic Read, Position: 0, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Byte"
    "21:24:44,4425302","svchost.exe","1224","CloseFile","E:\contoso\FTPUser","SUCCESS",""
    "21:24:44,4453088","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 85, startime: 114293, endtime: 114293, seqnum: 0, connid: 0"
    "21:24:44,4453199","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,4470638","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 85, startime: 114293, endtime: 114293, seqnum: 0, connid: 0"
    "21:24:44,4470732","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,4490104","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 101, startime: 114293, endtime: 114293, seqnum: 0, connid: 0"
    "21:24:44,4490245","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,4492020","svchost.exe","1224","CreateFile","E:\contoso\FTPUser\File.txt","SUCCESS","Desired Access: Generic Write, Read Attributes, Disposition: OverwriteIf, Options: Non-Directory File, Disallow Exclusive, Attributes: n/a, ShareMode: Delete, AllocationSize: 0, Impersonating: CONTOSO\FTPUser, OpenResult: Created"
    "21:24:44,4525551","svchost.exe","1224","TCP Accept","ftpserver.contoso.com:4904 -> DESKTOP-RV8RNHB:59911","SUCCESS","Length: 0, mss: 1460, sackopt: 1, tsopt: 0, wsopt: 1, rcvwin: 65700, rcvwinscale: 8, sndwinscale: 7, seqnum: 0, connid: 0"
    "21:24:44,4532279","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4904 -> DESKTOP-RV8RNHB:59911","SUCCESS","Length: 274, seqnum: 0, connid: 0"
    "21:24:44,4552340","svchost.exe","1224","TCP Send","ftpserver.contoso.com:4904 -> DESKTOP-RV8RNHB:59911","SUCCESS","Length: 177, startime: 114293, endtime: 114293, seqnum: 0, connid: 0"
    "21:24:44,4552464","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4904 -> DESKTOP-RV8RNHB:59911","SUCCESS","Length: 6, seqnum: 0, connid: 0"
    "21:24:44,4553401","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4904 -> DESKTOP-RV8RNHB:59911","SUCCESS","Length: 85, seqnum: 0, connid: 0"
    "21:24:44,4603287","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4904 -> DESKTOP-RV8RNHB:59911","SUCCESS","Length: 138, seqnum: 0, connid: 0"
    "21:24:44,4604729","svchost.exe","1224","CloseFile","E:\contoso\FTPUser\File.txt","SUCCESS",""
    "21:24:44,4606376","svchost.exe","1224","CreateFile","E:\contoso\FTPUser\File.txt","SUCCESS","Desired Access: Read Attributes, Delete, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: CONTOSO\FTPUser, OpenResult: Opened"
    "21:24:44,4606799","svchost.exe","1224","QueryAttributeTagFile","E:\contoso\FTPUser\File.txt","SUCCESS","Attributes: A, ReparseTag: 0x0"
    "21:24:44,4606945","svchost.exe","1224","SetDispositionInformationFile","E:\contoso\FTPUser\File.txt","SUCCESS","Delete: True"
    "21:24:44,4607099","svchost.exe","1224","CloseFile","E:\contoso\FTPUser\File.txt","SUCCESS",""
    "21:24:44,4609644","svchost.exe","1224","CreateFile","C:\Windows\System32\KernelBase.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
    "21:24:44,4610088","svchost.exe","1224","QueryBasicInformationFile","C:\Windows\System32\KernelBase.dll","SUCCESS","CreationTime: 28/10/2016 12:14:37, LastAccessTime: 28/10/2016 12:14:37, LastWriteTime: 06/03/2014 07:02:35, ChangeTime: 31/10/2016 17:32:50, FileAttributes: A"
    "21:24:44,4610225","svchost.exe","1224","CloseFile","C:\Windows\System32\KernelBase.dll","SUCCESS",""
    "21:24:44,4612338","svchost.exe","1224","CreateFile","C:\Windows\System32\netmsg.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
    "21:24:44,4612967","svchost.exe","1224","QueryBasicInformationFile","C:\Windows\System32\netmsg.dll","SUCCESS","CreationTime: 22/08/2013 09:44:08, LastAccessTime: 22/08/2013 09:44:08, LastWriteTime: 22/08/2013 09:44:05, ChangeTime: 28/10/2016 12:22:27, FileAttributes: A"
    "21:24:44,4613104","svchost.exe","1224","CloseFile","C:\Windows\System32\netmsg.dll","SUCCESS",""
    "21:24:44,4632143","svchost.exe","1224","TCP Disconnect","ftpserver.contoso.com:4904 -> DESKTOP-RV8RNHB:59911","SUCCESS","Length: 0, seqnum: 0, connid: 0"
    "21:24:44,4647237","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 101, startime: 114293, endtime: 114293, seqnum: 0, connid: 0"
    "21:24:44,4647331","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, startime: 114293, endtime: 114293, seqnum: 0, connid: 0"
    "21:24:44,4927755","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,4944450","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 85, startime: 114293, endtime: 114294, seqnum: 0, connid: 0"
    "21:24:44,4944595","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,4963899","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 101, startime: 114293, endtime: 114294, seqnum: 0, connid: 0"
    "21:24:44,4964049","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,4966132","svchost.exe","1224","CreateFile","E:\contoso\FTPUser","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: CONTOSO\FTPUser, OpenResult: Opened"
    "21:24:44,4966431","svchost.exe","1224","QueryDirectory","E:\contoso\FTPUser\*","SUCCESS","Filter: *, 1: ."
    "21:24:44,4966696","svchost.exe","1224","QueryDirectory","E:\contoso\FTPUser","SUCCESS","0: .., 1: Nova pasta, 2: Nova pasta2"
    "21:24:44,4966902","svchost.exe","1224","QueryDirectory","E:\contoso\FTPUser","NO MORE FILES",""
    "21:24:44,4967043","svchost.exe","1224","CloseFile","E:\contoso\FTPUser","SUCCESS",""
    "21:24:44,5004080","svchost.exe","1224","TCP Accept","ftpserver.contoso.com:4905 -> DESKTOP-RV8RNHB:59912","SUCCESS","Length: 0, mss: 1460, sackopt: 1, tsopt: 0, wsopt: 1, rcvwin: 65700, rcvwinscale: 8, sndwinscale: 7, seqnum: 0, connid: 0"
    "21:24:44,5012276","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4905 -> DESKTOP-RV8RNHB:59912","SUCCESS","Length: 274, seqnum: 0, connid: 0"
    "21:24:44,5034454","svchost.exe","1224","TCP Send","ftpserver.contoso.com:4905 -> DESKTOP-RV8RNHB:59912","SUCCESS","Length: 177, startime: 114293, endtime: 114294, seqnum: 0, connid: 0"
    "21:24:44,5034561","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4905 -> DESKTOP-RV8RNHB:59912","SUCCESS","Length: 6, seqnum: 0, connid: 0"
    "21:24:44,5035468","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4905 -> DESKTOP-RV8RNHB:59912","SUCCESS","Length: 85, seqnum: 0, connid: 0"
    "21:24:44,5060020","svchost.exe","1224","TCP Send","ftpserver.contoso.com:4905 -> DESKTOP-RV8RNHB:59912","SUCCESS","Length: 165, startime: 114294, endtime: 114294, seqnum: 0, connid: 0"
    "21:24:44,5060140","svchost.exe","1224","TCP Send","ftpserver.contoso.com:4905 -> DESKTOP-RV8RNHB:59912","SUCCESS","Length: 69, startime: 114294, endtime: 114294, seqnum: 0, connid: 0"
    "21:24:44,5060268","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 101, startime: 114293, endtime: 114294, seqnum: 0, connid: 0"
    "21:24:44,5060332","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 85, startime: 114294, endtime: 114294, seqnum: 0, connid: 0"
    "21:24:44,5102430","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4905 -> DESKTOP-RV8RNHB:59912","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,5102823","svchost.exe","1224","TCP Disconnect","ftpserver.contoso.com:4905 -> DESKTOP-RV8RNHB:59912","SUCCESS","Length: 0, seqnum: 0, connid: 0"
    "21:24:44,5127739","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,5145126","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 85, startime: 114294, endtime: 114294, seqnum: 0, connid: 0"
    "21:24:44,5145242","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,5195236","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 101, startime: 114294, endtime: 114294, seqnum: 0, connid: 0"
    "21:24:44,5195360","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,5197558","svchost.exe","1224","CreateFile","E:\contoso\FTPUser\File.txt","SUCCESS","Desired Access: Generic Write, Read Attributes, Disposition: OverwriteIf, Options: Non-Directory File, Disallow Exclusive, Attributes: n/a, ShareMode: Delete, AllocationSize: 0, Impersonating: CONTOSO\FTPUser, OpenResult: Created"
    "21:24:44,5227316","svchost.exe","1224","TCP Accept","ftpserver.contoso.com:4906 -> DESKTOP-RV8RNHB:59913","SUCCESS","Length: 0, mss: 1460, sackopt: 1, tsopt: 0, wsopt: 1, rcvwin: 65700, rcvwinscale: 8, sndwinscale: 7, seqnum: 0, connid: 0"
    "21:24:44,5234104","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4906 -> DESKTOP-RV8RNHB:59913","SUCCESS","Length: 274, seqnum: 0, connid: 0"
    "21:24:44,5259781","svchost.exe","1224","TCP Send","ftpserver.contoso.com:4906 -> DESKTOP-RV8RNHB:59913","SUCCESS","Length: 177, startime: 114294, endtime: 114294, seqnum: 0, connid: 0"
    "21:24:44,5259909","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4906 -> DESKTOP-RV8RNHB:59913","SUCCESS","Length: 6, seqnum: 0, connid: 0"
    "21:24:44,5261171","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4906 -> DESKTOP-RV8RNHB:59913","SUCCESS","Length: 85, seqnum: 0, connid: 0"
    "21:24:44,5326354","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4906 -> DESKTOP-RV8RNHB:59913","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,5327098","svchost.exe","1224","WriteFile","E:\contoso\FTPUser\File.txt","SUCCESS","Offset: 0, Length: 10, Priority: Normal"
    "21:24:44,5328300","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4906 -> DESKTOP-RV8RNHB:59913","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,5329532","svchost.exe","1224","CloseFile","E:\contoso\FTPUser\File.txt","SUCCESS",""
    "21:24:44,5331033","svchost.exe","1224","CreateFile","E:\contoso\FTPUser\File.txt","SUCCESS","Desired Access: Read Attributes, Delete, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: CONTOSO\FTPUser, OpenResult: Opened"
    "21:24:44,5331470","svchost.exe","1224","QueryAttributeTagFile","E:\contoso\FTPUser\File.txt","SUCCESS","Attributes: A, ReparseTag: 0x0"
    "21:24:44,5331615","svchost.exe","1224","SetDispositionInformationFile","E:\contoso\FTPUser\File.txt","SUCCESS","Delete: True"
    "21:24:44,5331773","svchost.exe","1224","CloseFile","E:\contoso\FTPUser\File.txt","SUCCESS",""
    "21:24:44,5334584","svchost.exe","1224","CreateFile","C:\Windows\System32\KernelBase.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
    "21:24:44,5335041","svchost.exe","1224","QueryBasicInformationFile","C:\Windows\System32\KernelBase.dll","SUCCESS","CreationTime: 28/10/2016 12:14:37, LastAccessTime: 28/10/2016 12:14:37, LastWriteTime: 06/03/2014 07:02:35, ChangeTime: 31/10/2016 17:32:50, FileAttributes: A"
    "21:24:44,5335178","svchost.exe","1224","CloseFile","C:\Windows\System32\KernelBase.dll","SUCCESS",""
    "21:24:44,5337189","svchost.exe","1224","CreateFile","C:\Windows\System32\netmsg.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
    "21:24:44,5338442","svchost.exe","1224","QueryBasicInformationFile","C:\Windows\System32\netmsg.dll","SUCCESS","CreationTime: 22/08/2013 09:44:08, LastAccessTime: 22/08/2013 09:44:08, LastWriteTime: 22/08/2013 09:44:05, ChangeTime: 28/10/2016 12:22:27, FileAttributes: A"
    "21:24:44,5338630","svchost.exe","1224","CloseFile","C:\Windows\System32\netmsg.dll","SUCCESS",""
    "21:24:44,5349631","svchost.exe","1224","TCP Disconnect","ftpserver.contoso.com:4906 -> DESKTOP-RV8RNHB:59913","SUCCESS","Length: 0, seqnum: 0, connid: 0"
    "21:24:44,5363268","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 101, startime: 114294, endtime: 114294, seqnum: 0, connid: 0"
    "21:24:44,5363366","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, startime: 114294, endtime: 114294, seqnum: 0, connid: 0"
    "21:24:44,5703703","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,5724307","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 85, startime: 114294, endtime: 114294, seqnum: 0, connid: 0"
    "21:24:44,5724452","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,5740107","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 101, startime: 114294, endtime: 114294, seqnum: 0, connid: 0"
    "21:24:44,5740287","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,5742524","svchost.exe","1224","CreateFile","E:\contoso\FTPUser","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: CONTOSO\FTPUser, OpenResult: Opened"
    "21:24:44,5742853","svchost.exe","1224","QueryDirectory","E:\contoso\FTPUser\*","SUCCESS","Filter: *, 1: ."
    "21:24:44,5743140","svchost.exe","1224","QueryDirectory","E:\contoso\FTPUser","SUCCESS","0: .., 1: Nova pasta, 2: Nova pasta2"
    "21:24:44,5743354","svchost.exe","1224","QueryDirectory","E:\contoso\FTPUser","NO MORE FILES",""
    "21:24:44,5743499","svchost.exe","1224","CloseFile","E:\contoso\FTPUser","SUCCESS",""
    "21:24:44,5773030","svchost.exe","1224","TCP Accept","ftpserver.contoso.com:4907 -> DESKTOP-RV8RNHB:59914","SUCCESS","Length: 0, mss: 1460, sackopt: 1, tsopt: 0, wsopt: 1, rcvwin: 65700, rcvwinscale: 8, sndwinscale: 7, seqnum: 0, connid: 0"
    "21:24:44,5780259","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4907 -> DESKTOP-RV8RNHB:59914","SUCCESS","Length: 274, seqnum: 0, connid: 0"
    "21:24:44,5798472","svchost.exe","1224","TCP Send","ftpserver.contoso.com:4907 -> DESKTOP-RV8RNHB:59914","SUCCESS","Length: 177, startime: 114294, endtime: 114294, seqnum: 0, connid: 0"
    "21:24:44,5798664","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4907 -> DESKTOP-RV8RNHB:59914","SUCCESS","Length: 6, seqnum: 0, connid: 0"
    "21:24:44,5799807","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4907 -> DESKTOP-RV8RNHB:59914","SUCCESS","Length: 85, seqnum: 0, connid: 0"
    "21:24:44,5819649","svchost.exe","1224","TCP Send","ftpserver.contoso.com:4907 -> DESKTOP-RV8RNHB:59914","SUCCESS","Length: 165, startime: 114294, endtime: 114294, seqnum: 0, connid: 0"
    "21:24:44,5819756","svchost.exe","1224","TCP Send","ftpserver.contoso.com:4907 -> DESKTOP-RV8RNHB:59914","SUCCESS","Length: 69, startime: 114294, endtime: 114294, seqnum: 0, connid: 0"
    "21:24:44,5820441","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 101, startime: 114294, endtime: 114294, seqnum: 0, connid: 0"
    "21:24:44,5820518","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 85, startime: 114294, endtime: 114294, seqnum: 0, connid: 0"
    "21:24:44,5848923","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4907 -> DESKTOP-RV8RNHB:59914","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,5849219","svchost.exe","1224","TCP Disconnect","ftpserver.contoso.com:4907 -> DESKTOP-RV8RNHB:59914","SUCCESS","Length: 0, seqnum: 0, connid: 0"
    "21:24:44,5857936","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,5883211","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 85, startime: 114294, endtime: 114294, seqnum: 0, connid: 0"
    "21:24:44,5883331","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,5898117","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 101, startime: 114294, endtime: 114294, seqnum: 0, connid: 0"
    "21:24:44,5898301","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,5900051","svchost.exe","1224","CreateFile","E:\contoso\FTPUser\File.txt","SUCCESS","Desired Access: Generic Write, Read Attributes, Disposition: OverwriteIf, Options: Non-Directory File, Disallow Exclusive, Attributes: n/a, ShareMode: Delete, AllocationSize: 0, Impersonating: CONTOSO\FTPUser, OpenResult: Created"
    "21:24:44,5939775","svchost.exe","1224","TCP Accept","ftpserver.contoso.com:4908 -> DESKTOP-RV8RNHB:59915","SUCCESS","Length: 0, mss: 1460, sackopt: 1, tsopt: 0, wsopt: 1, rcvwin: 65700, rcvwinscale: 8, sndwinscale: 7, seqnum: 0, connid: 0"
    "21:24:44,5947397","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4908 -> DESKTOP-RV8RNHB:59915","SUCCESS","Length: 274, seqnum: 0, connid: 0"
    "21:24:44,5973707","svchost.exe","1224","TCP Send","ftpserver.contoso.com:4908 -> DESKTOP-RV8RNHB:59915","SUCCESS","Length: 177, startime: 114294, endtime: 114295, seqnum: 0, connid: 0"
    "21:24:44,5973869","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4908 -> DESKTOP-RV8RNHB:59915","SUCCESS","Length: 6, seqnum: 0, connid: 0"
    "21:24:44,5974639","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4908 -> DESKTOP-RV8RNHB:59915","SUCCESS","Length: 85, seqnum: 0, connid: 0"
    "21:24:44,6022195","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4908 -> DESKTOP-RV8RNHB:59915","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,6022755","svchost.exe","1224","WriteFile","E:\contoso\FTPUser\File.txt","SUCCESS","Offset: 0, Length: 10, Priority: Normal"
    "21:24:44,6024282","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4908 -> DESKTOP-RV8RNHB:59915","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,6025335","svchost.exe","1224","CloseFile","E:\contoso\FTPUser\File.txt","SUCCESS",""
    "21:24:44,6026862","svchost.exe","1224","CreateFile","E:\contoso\FTPUser\File.txt","SUCCESS","Desired Access: Read Attributes, Delete, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: CONTOSO\FTPUser, OpenResult: Opened"
    "21:24:44,6027302","svchost.exe","1224","QueryAttributeTagFile","E:\contoso\FTPUser\File.txt","SUCCESS","Attributes: A, ReparseTag: 0x0"
    "21:24:44,6027452","svchost.exe","1224","SetDispositionInformationFile","E:\contoso\FTPUser\File.txt","SUCCESS","Delete: True"
    "21:24:44,6027610","svchost.exe","1224","CloseFile","E:\contoso\FTPUser\File.txt","SUCCESS",""
    "21:24:44,6030232","svchost.exe","1224","CreateFile","C:\Windows\System32\KernelBase.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
    "21:24:44,6030694","svchost.exe","1224","QueryBasicInformationFile","C:\Windows\System32\KernelBase.dll","SUCCESS","CreationTime: 28/10/2016 12:14:37, LastAccessTime: 28/10/2016 12:14:37, LastWriteTime: 06/03/2014 07:02:35, ChangeTime: 31/10/2016 17:32:50, FileAttributes: A"
    "21:24:44,6030831","svchost.exe","1224","CloseFile","C:\Windows\System32\KernelBase.dll","SUCCESS",""
    "21:24:44,6032859","svchost.exe","1224","CreateFile","C:\Windows\System32\netmsg.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
    "21:24:44,6033397","svchost.exe","1224","QueryBasicInformationFile","C:\Windows\System32\netmsg.dll","SUCCESS","CreationTime: 22/08/2013 09:44:08, LastAccessTime: 22/08/2013 09:44:08, LastWriteTime: 22/08/2013 09:44:05, ChangeTime: 28/10/2016 12:22:27, FileAttributes: A"
    "21:24:44,6033526","svchost.exe","1224","CloseFile","C:\Windows\System32\netmsg.dll","SUCCESS",""
    "21:24:44,6049305","svchost.exe","1224","TCP Disconnect","ftpserver.contoso.com:4908 -> DESKTOP-RV8RNHB:59915","SUCCESS","Length: 0, seqnum: 0, connid: 0"
    "21:24:44,6063429","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 101, startime: 114294, endtime: 114295, seqnum: 0, connid: 0"
    "21:24:44,6063544","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, startime: 114295, endtime: 114295, seqnum: 0, connid: 0"
    "21:24:44,6520388","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,6536154","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 85, startime: 114295, endtime: 114295, seqnum: 0, connid: 0"
    "21:24:44,6536270","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,6552357","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 101, startime: 114295, endtime: 114295, seqnum: 0, connid: 0"
    "21:24:44,6552515","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,6554436","svchost.exe","1224","CreateFile","E:\contoso\FTPUser","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: CONTOSO\FTPUser, OpenResult: Opened"
    "21:24:44,6554731","svchost.exe","1224","QueryDirectory","E:\contoso\FTPUser\*","SUCCESS","Filter: *, 1: ."
    "21:24:44,6555009","svchost.exe","1224","QueryDirectory","E:\contoso\FTPUser","SUCCESS","0: .., 1: Nova pasta, 2: Nova pasta2"
    "21:24:44,6555223","svchost.exe","1224","QueryDirectory","E:\contoso\FTPUser","NO MORE FILES",""
    "21:24:44,6555514","svchost.exe","1224","CloseFile","E:\contoso\FTPUser","SUCCESS",""
    "21:24:44,6589403","svchost.exe","1224","TCP Accept","ftpserver.contoso.com:4909 -> DESKTOP-RV8RNHB:59916","SUCCESS","Length: 0, mss: 1460, sackopt: 1, tsopt: 0, wsopt: 1, rcvwin: 65700, rcvwinscale: 8, sndwinscale: 7, seqnum: 0, connid: 0"
    "21:24:44,6595802","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4909 -> DESKTOP-RV8RNHB:59916","SUCCESS","Length: 274, seqnum: 0, connid: 0"
    "21:24:44,6639688","svchost.exe","1224","TCP Send","ftpserver.contoso.com:4909 -> DESKTOP-RV8RNHB:59916","SUCCESS","Length: 177, startime: 114295, endtime: 114295, seqnum: 0, connid: 0"
    "21:24:44,6639923","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4909 -> DESKTOP-RV8RNHB:59916","SUCCESS","Length: 6, seqnum: 0, connid: 0"
    "21:24:44,6640509","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4909 -> DESKTOP-RV8RNHB:59916","SUCCESS","Length: 85, seqnum: 0, connid: 0"
    "21:24:44,6677688","svchost.exe","1224","TCP Send","ftpserver.contoso.com:4909 -> DESKTOP-RV8RNHB:59916","SUCCESS","Length: 165, startime: 114295, endtime: 114295, seqnum: 0, connid: 0"
    "21:24:44,6677808","svchost.exe","1224","TCP Send","ftpserver.contoso.com:4909 -> DESKTOP-RV8RNHB:59916","SUCCESS","Length: 69, startime: 114295, endtime: 114295, seqnum: 0, connid: 0"
    "21:24:44,6678432","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 101, startime: 114295, endtime: 114295, seqnum: 0, connid: 0"
    "21:24:44,6678509","svchost.exe","1224","TCP Send","ftpserver.contoso.com:ftp -> DESKTOP-RV8RNHB:59910","SUCCESS","Length: 85, startime: 114295, endtime: 114295, seqnum: 0, connid: 0"
    "21:24:44,6688103","svchost.exe","1224","TCP Receive","ftpserver.contoso.com:4909 -> DESKTOP-RV8RNHB:59916","SUCCESS","Length: 69, seqnum: 0, connid: 0"
    "21:24:44,6688411","svchost.exe","1224","TCP Disconnect","ftpserver.contoso.com:4909 -> DESKTOP-RV8RNHB:59916","SUCCESS","Length: 0, seqnum: 0, connid: 0"

    Friday, November 18, 2016 11:34 PM

All replies