<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='BEDBG'/><EventID Qualifiers='24578'>257</EventID><Level>4</Level><Task>1</Task><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:56:17.000000000Z'/><EventRecordID>103662</EventRecordID><Channel>Application</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data>D:\Programme\BEDBG\BackupExec.exe_10860_0.dmp</Data></EventData><RenderingInfo Culture='de-DE'><Message>A memory dump has been captured D:\Programme\BEDBG\BackupExec.exe_10860_0.dmp</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider></Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-TerminalServices-Printers' Guid='{952773BF-C2B7-49BC-88F4-920744B82C43}' EventSourceName='UmrdpService'/><EventID Qualifiers='0'>1111</EventID><Version>0</Version><Level>2</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:55:04.000000000Z'/><EventRecordID>141191</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data>OD250 Fax Driver</Data><Data>Octopus Desk 250 Fax</Data><Binary>00000000A70E0000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Der für den Drucker Octopus Desk 250 Fax erforderliche Treiber OD250 Fax Driver ist unbekannt. Wenden Sie sich an den Administrator, um den Treiber zu installieren, bevor Sie sich erneut anmelden.</Message><Level>Fehler</Level><Task></Task><Opcode>Info</Opcode><Channel></Channel><Provider>Microsoft-Windows-TerminalServices-Printers</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-TerminalServices-Printers' Guid='{952773BF-C2B7-49BC-88F4-920744B82C43}' EventSourceName='UmrdpService'/><EventID Qualifiers='0'>1111</EventID><Version>0</Version><Level>2</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:55:04.000000000Z'/><EventRecordID>141190</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data>HP LaserJet 5000 Series PCL</Data><Data>HP LaserJet 5000 Series PCL</Data><Binary>00000000A70E0000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Der für den Drucker HP LaserJet 5000 Series PCL erforderliche Treiber HP LaserJet 5000 Series PCL ist unbekannt. Wenden Sie sich an den Administrator, um den Treiber zu installieren, bevor Sie sich erneut anmelden.</Message><Level>Fehler</Level><Task></Task><Opcode>Info</Opcode><Channel></Channel><Provider>Microsoft-Windows-TerminalServices-Printers</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:52:41.972576600Z'/><EventRecordID>141189</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='5360'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Software Protection</Data><Data Name='param2'>Beendet</Data><Binary>7300700070007300760063002F0031000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Software Protection" befindet sich jetzt im Status "Beendet".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-TerminalServices-Printers' Guid='{952773BF-C2B7-49BC-88F4-920744B82C43}' EventSourceName='UmrdpService'/><EventID Qualifiers='0'>1111</EventID><Version>0</Version><Level>2</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:52:22.000000000Z'/><EventRecordID>141188</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data>OD250 Fax Driver</Data><Data>Octopus Desk 250 Fax</Data><Binary>00000000A70E0000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Der für den Drucker Octopus Desk 250 Fax erforderliche Treiber OD250 Fax Driver ist unbekannt. Wenden Sie sich an den Administrator, um den Treiber zu installieren, bevor Sie sich erneut anmelden.</Message><Level>Fehler</Level><Task></Task><Opcode>Info</Opcode><Channel></Channel><Provider>Microsoft-Windows-TerminalServices-Printers</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-TerminalServices-Printers' Guid='{952773BF-C2B7-49BC-88F4-920744B82C43}' EventSourceName='UmrdpService'/><EventID Qualifiers='0'>1111</EventID><Version>0</Version><Level>2</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:52:19.000000000Z'/><EventRecordID>141187</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data>HP LaserJet 5000 Series PCL</Data><Data>HP LaserJet 5000 Series PCL</Data><Binary>00000000A70E0000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Der für den Drucker HP LaserJet 5000 Series PCL erforderliche Treiber HP LaserJet 5000 Series PCL ist unbekannt. Wenden Sie sich an den Administrator, um den Treiber zu installieren, bevor Sie sich erneut anmelden.</Message><Level>Fehler</Level><Task></Task><Opcode>Info</Opcode><Channel></Channel><Provider>Microsoft-Windows-TerminalServices-Printers</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-User Profiles Service' Guid='{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}'/><EventID>1542</EventID><Version>0</Version><Level>2</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:52:04.844511400Z'/><EventRecordID>103659</EventRecordID><Correlation ActivityID='{01AC1C68-F800-0005-65B8-EF533957D001}'/><Execution ProcessID='980' ThreadID='992'/><Channel>Application</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='Error'>Das System kann die angegebene Datei nicht finden.

</Data></EventData><RenderingInfo Culture='de-DE'><Message>Die Klassenregistrierungsdatei kann nicht geladen werden.

 DETAIL - Das System kann die angegebene Datei nicht finden.

</Message><Level>Fehler</Level><Task></Task><Opcode>Info</Opcode><Channel>Anwendung</Channel><Provider>Microsoft-Windows-User Profile Service</Provider><Keywords></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Winlogon'/><EventID Qualifiers='16384'>4101</EventID><Level>4</Level><Task>0</Task><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:52:06.000000000Z'/><EventRecordID>103657</EventRecordID><Channel>Application</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data>0x00000000</Data><Data>0x00000001</Data></EventData><RenderingInfo Culture='de-DE'><Message></Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider></Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Winlogon' Guid='{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}'/><EventID>7001</EventID><Version>0</Version><Level>4</Level><Task>1101</Task><Opcode>0</Opcode><Keywords>0x2000000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:52:04.828911300Z'/><EventRecordID>141186</EventRecordID><Correlation/><Execution ProcessID='2472' ThreadID='8528'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='TSId'>2</Data><Data Name='UserSid'>S-1-5-21-3965413566-3103121440-2936424094-500</Data></EventData><RenderingInfo Culture='de-DE'><Message>Benutzeranmeldebenachrichtigung für Programm zur Verbesserung der Benutzerfreundlichkeit</Message><Level>Informationen</Level><Task></Task><Opcode>Info</Opcode><Channel>System</Channel><Provider>Microsoft-Windows-Winlogon</Provider><Keywords></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-LoadPerf' Guid='{122EE297-BB47-41AE-B265-1CA8D1886D40}'/><EventID>1000</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:50:46.828774300Z'/><EventRecordID>103656</EventRecordID><Correlation/><Execution ProcessID='9916' ThreadID='9920'/><Channel>Application</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security UserID='S-1-5-18'/></System><UserData><EventXML xmlns:auto-ns2='http://schemas.microsoft.com/win/2004/08/events' xmlns='LoadPerf'><param1>WmiApRpl</param1><param2>WmiApRpl</param2><binaryDataSize>16</binaryDataSize><binaryData>FCA90000A2AA0000FDA90000A3AA0000</binaryData></EventXML></UserData><RenderingInfo Culture='de-DE'><Message>Die Leistungsindikatoren für den Dienst WmiApRpl (WmiApRpl) wurden erfolgreich geladen. Die Eintragsdaten im Datenbereich enthalten die neuen Indexwerte, die diesem Dienst zugeordnet sind.</Message><Level>Informationen</Level><Task></Task><Opcode>Info</Opcode><Channel>Anwendung</Channel><Provider>Microsoft-Windows-LoadPerf</Provider><Keywords></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-LoadPerf' Guid='{122EE297-BB47-41AE-B265-1CA8D1886D40}'/><EventID>1001</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:50:46.688374100Z'/><EventRecordID>103655</EventRecordID><Correlation/><Execution ProcessID='9916' ThreadID='9920'/><Channel>Application</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security UserID='S-1-5-18'/></System><UserData><EventXML xmlns:auto-ns2='http://schemas.microsoft.com/win/2004/08/events' xmlns='LoadPerf'><param1>WmiApRpl</param1><param2>WmiApRpl</param2><binaryDataSize>12</binaryDataSize><binaryData>FAA90000FBA9000034070000</binaryData></EventXML></UserData><RenderingInfo Culture='de-DE'><Message>Die Leistungsindikatoren für den Dienst WmiApRpl (WmiApRpl) wurden entfernt. Die Daten enthalten die neuen Werte der Registrierungseinträge "Last Counter" und "Last Help".</Message><Level>Informationen</Level><Task></Task><Opcode>Info</Opcode><Channel>Anwendung</Channel><Provider>Microsoft-Windows-LoadPerf</Provider><Keywords></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:50:41.509165000Z'/><EventRecordID>141185</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='628'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>LiveUpdate</Data><Data Name='param2'>Ausgeführt</Data><Binary>4C006900760065005500700064006100740065002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "LiveUpdate" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-HttpEvent' Guid='{7b6bc78c-898b-4170-bbf8-1a469ea43fc5}' EventSourceName='HTTP'/><EventID Qualifiers='32768'>15301</EventID><Version>0</Version><Level>3</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:49:55.114683500Z'/><EventRecordID>141184</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='84'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='DeviceObject'>\Device\Http\ReqQueue</Data><Data Name='SocketAddress'>0.0.0.0:50106</Data></EventData><RenderingInfo Culture='de-DE'><Message>Die SSL-Zertifikateinstellungen wurden von einem Administratorprozess erstellt für den folgenden Anschluss: 0.0.0.0:50106 .</Message><Level>Warnung</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-HttpEvent</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-HttpEvent' Guid='{7b6bc78c-898b-4170-bbf8-1a469ea43fc5}' EventSourceName='HTTP'/><EventID Qualifiers='32768'>15300</EventID><Version>0</Version><Level>3</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:49:55.083483500Z'/><EventRecordID>141183</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='84'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='DeviceObject'>\Device\Http\ReqQueue</Data><Data Name='SocketAddress'>0.0.0.0:50106</Data></EventData><RenderingInfo Culture='de-DE'><Message>Die SSL-Zertifikateinstellungen wurden gelöscht für den folgenden Anschluss: 0.0.0.0:50106 .</Message><Level>Warnung</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-HttpEvent</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:49:10.046204400Z'/><EventRecordID>141182</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='628'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Windows Modules Installer</Data><Data Name='param2'>Ausgeführt</Data><Binary>540072007500730074006500640049006E007300740061006C006C00650072002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Windows Modules Installer" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:48:05.602491200Z'/><EventRecordID>141181</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='628'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Windows Update</Data><Data Name='param2'>Ausgeführt</Data><Binary>770075006100750073006500720076002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Windows Update" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Windows Server Update Services'/><EventID Qualifiers='0'>501</EventID><Level>4</Level><Task>1</Task><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:47:42.000000000Z'/><EventRecordID>103654</EventRecordID><Channel>Application</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data>Der Dienst "Update Services" wurde gestartet.</Data></EventData><RenderingInfo Culture='de-DE'><Message>Der Dienst "Update Services" wurde gestartet.</Message><Level>Informationen</Level><Task></Task><Opcode>Info</Opcode><Channel></Channel><Provider></Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:47:24.387218800Z'/><EventRecordID>141180</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='6212'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Update Services</Data><Data Name='param2'>Ausgeführt</Data><Binary>570073007500730053006500720076006900630065002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Update Services" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:47:21.626013900Z'/><EventRecordID>141179</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='6212'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Software Protection</Data><Data Name='param2'>Ausgeführt</Data><Binary>7300700070007300760063002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Software Protection" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:47:20.939612700Z'/><EventRecordID>141178</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='6212'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Distributed Transaction Coordinator</Data><Data Name='param2'>Ausgeführt</Data><Binary>4D0053004400540043002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Distributed Transaction Coordinator" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:47:18.989609300Z'/><EventRecordID>141177</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='6212'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Lotus Notes-Diagnose</Data><Data Name='param2'>Ausgeführt</Data><Binary>4C006F0074007500730020004E006F00740065007300200044006900610067006E006F00730074006900630073002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Lotus Notes-Diagnose" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:47:17.772807200Z'/><EventRecordID>141176</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='6212'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>PnP-X-IP-Busenumerator</Data><Data Name='param2'>Ausgeführt</Data><Binary>4900500042007500730045006E0075006D002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "PnP-X-IP-Busenumerator" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:47:17.445206600Z'/><EventRecordID>141175</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='6212'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Funktionssuchanbieter-Host</Data><Data Name='param2'>Ausgeführt</Data><Binary>66006400500048006F00730074002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Funktionssuchanbieter-Host" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:47:11.829196700Z'/><EventRecordID>141174</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='6212'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Diagnosesystemhost</Data><Data Name='param2'>Ausgeführt</Data><Binary>570064006900530079007300740065006D0048006F00730074002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Diagnosesystemhost" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:47:11.782396600Z'/><EventRecordID>141173</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='6212'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Diagnoserichtliniendienst</Data><Data Name='param2'>Ausgeführt</Data><Binary>4400500053002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Diagnoserichtliniendienst" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:47:06.291187000Z'/><EventRecordID>141172</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='628'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Enumeratordienst für tragbare Geräte</Data><Data Name='param2'>Beendet</Data><Binary>57005000440042007500730045006E0075006D002F0031000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Enumeratordienst für tragbare Geräte" befindet sich jetzt im Status "Beendet".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:47:04.497183800Z'/><EventRecordID>141171</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='628'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Microsoft .NET Framework NGEN v4.0.30319_X64</Data><Data Name='param2'>Beendet</Data><Binary>63006C0072005F006F007000740069006D0069007A006100740069006F006E005F00760034002E0030002E00330030003300310039005F00360034002F0031000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Microsoft .NET Framework NGEN v4.0.30319_X64" befindet sich jetzt im Status "Beendet".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:47:04.497183800Z'/><EventRecordID>141170</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='628'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Microsoft .NET Framework NGEN v4.0.30319_X64</Data><Data Name='param2'>Ausgeführt</Data><Binary>63006C0072005F006F007000740069006D0069007A006100740069006F006E005F00760034002E0030002E00330030003300310039005F00360034002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Microsoft .NET Framework NGEN v4.0.30319_X64" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:47:03.358381800Z'/><EventRecordID>141169</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='628'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Adobe Acrobat Update Service</Data><Data Name='param2'>Ausgeführt</Data><Binary>410064006F0062006500410052004D0073006500720076006900630065002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Adobe Acrobat Update Service" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:47:02.718780700Z'/><EventRecordID>141168</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='6212'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Microsoft .NET Framework NGEN v4.0.30319_X86</Data><Data Name='param2'>Beendet</Data><Binary>63006C0072005F006F007000740069006D0069007A006100740069006F006E005F00760034002E0030002E00330030003300310039005F00330032002F0031000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Microsoft .NET Framework NGEN v4.0.30319_X86" befindet sich jetzt im Status "Beendet".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:47:02.718780700Z'/><EventRecordID>141167</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='6212'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Microsoft .NET Framework NGEN v4.0.30319_X86</Data><Data Name='param2'>Ausgeführt</Data><Binary>63006C0072005F006F007000740069006D0069007A006100740069006F006E005F00760034002E0030002E00330030003300310039005F00330032002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Microsoft .NET Framework NGEN v4.0.30319_X86" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:46:50.581959400Z'/><EventRecordID>141166</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='888'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Adobe Acrobat Update Service</Data><Data Name='param2'>Beendet</Data><Binary>410064006F0062006500410052004D0073006500720076006900630065002F0031000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Adobe Acrobat Update Service" befindet sich jetzt im Status "Beendet".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='49152'>7024</EventID><Version>0</Version><Level>2</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:46:41.939544200Z'/><EventRecordID>141165</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='888'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>IIS-Verwaltungsdienst</Data><Data Name='param2'>%%-2145318902</Data></EventData><RenderingInfo Culture='de-DE'><Message>Der Dienst "IIS-Verwaltungsdienst" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2145318902.</Message><Level>Fehler</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:46:41.939544200Z'/><EventRecordID>141164</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='888'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>IIS-Verwaltungsdienst</Data><Data Name='param2'>Beendet</Data><Binary>490049005300410044004D0049004E002F0031000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "IIS-Verwaltungsdienst" befindet sich jetzt im Status "Beendet".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='IIS Config'/><EventID Qualifiers='49154'>4275</EventID><Level>2</Level><Task>2</Task><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:46:41.000000000Z'/><EventRecordID>141163</EventRecordID><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data> </Data><Data>Im Textinhalt wurde ein ungültiges Zeichen gefunden.

</Data><Data></Data><Data></Data><Data>

ErrorCode           : 0xC00CE508

Interceptor         : 14

OperationType       : Populate

Table               : MBProperty

ConfigurationSource : file:///C:/Windows/system32/inetsrv/MetaBase.xml

Row                 : 1

Column              : 1</Data></EventData><RenderingInfo Culture='de-DE'><Message>Fehler beim Analysieren der XML-Datei. Grund: Im Textinhalt wurde ein ungültiges Zeichen gefunden.

 Falsches XML: 

ErrorCode           : 0xC00CE508

Interceptor         : 14

OperationType       : Populate

Table               : MBProperty

ConfigurationSource : file:///C:/Windows/system32/inetsrv/MetaBase.xml

Row                 : 1

Column              : 1</Message><Level>Fehler</Level><Task>Katalog</Task><Opcode></Opcode><Channel></Channel><Provider></Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Symantec AntiVirus'/><EventID Qualifiers='49407'>45</EventID><Level>2</Level><Task>0</Task><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:46:38.000000000Z'/><EventRecordID>103639</EventRecordID><Channel>Application</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security UserID='S-1-5-21-3965413566-3103121440-2936424094-1109'/></System><EventData><Data>



SYMANTEC MANIPULATIONSSCHUTZ WARNMELDUNG



Ziel:  C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Bin\ccSvcHst.exe

Ereignisinformationen:  Erstellen Vorgang

Durchgeführte Aktion:  Blockiert

Angreifender Prozess:  C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE\ARM\1.0\ADOBEARM.EXE (PID 8644)

Zeit:  Donnerstag, 5. März 2015  12:46:38</Data></EventData><RenderingInfo Culture='de-DE'><Message> 



SYMANTEC MANIPULATIONSSCHUTZ WARNMELDUNG



Ziel:  C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Bin\ccSvcHst.exe

Ereignisinformationen:  Erstellen Vorgang

Durchgeführte Aktion:  Blockiert

Angreifender Prozess:  C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE\ARM\1.0\ADOBEARM.EXE (PID 8644)

Zeit:  Donnerstag, 5. März 2015  12:46:38</Message><Level>Fehler</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider></Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Symantec AntiVirus'/><EventID Qualifiers='49407'>45</EventID><Level>2</Level><Task>0</Task><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:46:35.000000000Z'/><EventRecordID>103638</EventRecordID><Channel>Application</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security UserID='S-1-5-21-3965413566-3103121440-2936424094-1109'/></System><EventData><Data>



SYMANTEC MANIPULATIONSSCHUTZ WARNMELDUNG



Ziel:  C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Bin64\Smc.exe

Ereignisinformationen:  Erstellen Vorgang

Durchgeführte Aktion:  Blockiert

Angreifender Prozess:  C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE\ARM\1.0\ADOBEARM.EXE (PID 6620)

Zeit:  Donnerstag, 5. März 2015  12:46:35</Data></EventData><RenderingInfo Culture='de-DE'><Message> 



SYMANTEC MANIPULATIONSSCHUTZ WARNMELDUNG



Ziel:  C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Bin64\Smc.exe

Ereignisinformationen:  Erstellen Vorgang

Durchgeführte Aktion:  Blockiert

Angreifender Prozess:  C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE\ARM\1.0\ADOBEARM.EXE (PID 6620)

Zeit:  Donnerstag, 5. März 2015  12:46:35</Message><Level>Fehler</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider></Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Symantec AntiVirus'/><EventID Qualifiers='49407'>45</EventID><Level>2</Level><Task>0</Task><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:46:35.000000000Z'/><EventRecordID>103637</EventRecordID><Channel>Application</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security UserID='S-1-5-21-3965413566-3103121440-2936424094-1109'/></System><EventData><Data>



SYMANTEC MANIPULATIONSSCHUTZ WARNMELDUNG



Ziel:  C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Bin\ccSvcHst.exe

Ereignisinformationen:  Erstellen Vorgang

Durchgeführte Aktion:  Blockiert

Angreifender Prozess:  C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE\ARM\1.0\ADOBEARM.EXE (PID 6620)

Zeit:  Donnerstag, 5. März 2015  12:46:35</Data></EventData><RenderingInfo Culture='de-DE'><Message> 



SYMANTEC MANIPULATIONSSCHUTZ WARNMELDUNG



Ziel:  C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Bin\ccSvcHst.exe

Ereignisinformationen:  Erstellen Vorgang

Durchgeführte Aktion:  Blockiert

Angreifender Prozess:  C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE\ARM\1.0\ADOBEARM.EXE (PID 6620)

Zeit:  Donnerstag, 5. März 2015  12:46:35</Message><Level>Fehler</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider></Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:46:15.996698700Z'/><EventRecordID>141162</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='888'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Windows Installer</Data><Data Name='param2'>Ausgeführt</Data><Binary>6D00730069007300650072007600650072002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Windows Installer" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Symantec AntiVirus'/><EventID Qualifiers='49407'>45</EventID><Level>2</Level><Task>0</Task><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:46:13.000000000Z'/><EventRecordID>103632</EventRecordID><Channel>Application</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security UserID='S-1-5-21-3965413566-3103121440-2936424094-1109'/></System><EventData><Data>



SYMANTEC MANIPULATIONSSCHUTZ WARNMELDUNG



Ziel:  C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Bin\ccSvcHst.exe

Ereignisinformationen:  Erstellen Vorgang

Durchgeführte Aktion:  Blockiert

Angreifender Prozess:  C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE\ARM\1.0\ADOBEARM.EXE (PID 6620)

Zeit:  Donnerstag, 5. März 2015  12:46:13</Data></EventData><RenderingInfo Culture='de-DE'><Message> 



SYMANTEC MANIPULATIONSSCHUTZ WARNMELDUNG



Ziel:  C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Bin\ccSvcHst.exe

Ereignisinformationen:  Erstellen Vorgang

Durchgeführte Aktion:  Blockiert

Angreifender Prozess:  C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE\ARM\1.0\ADOBEARM.EXE (PID 6620)

Zeit:  Donnerstag, 5. März 2015  12:46:13</Message><Level>Fehler</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider></Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='49152'>7024</EventID><Version>0</Version><Level>2</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:46:11.659891000Z'/><EventRecordID>141161</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='628'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>IIS-Verwaltungsdienst</Data><Data Name='param2'>%%-2145318902</Data></EventData><RenderingInfo Culture='de-DE'><Message>Der Dienst "IIS-Verwaltungsdienst" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2145318902.</Message><Level>Fehler</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:46:11.659891000Z'/><EventRecordID>141160</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='628'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>IIS-Verwaltungsdienst</Data><Data Name='param2'>Beendet</Data><Binary>490049005300410044004D0049004E002F0031000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "IIS-Verwaltungsdienst" befindet sich jetzt im Status "Beendet".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='IIS Config'/><EventID Qualifiers='49154'>4275</EventID><Level>2</Level><Task>2</Task><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:46:11.000000000Z'/><EventRecordID>141159</EventRecordID><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data> </Data><Data>Im Textinhalt wurde ein ungültiges Zeichen gefunden.

</Data><Data></Data><Data></Data><Data>

ErrorCode           : 0xC00CE508

Interceptor         : 14

OperationType       : Populate

Table               : MBProperty

ConfigurationSource : file:///C:/Windows/system32/inetsrv/MetaBase.xml

Row                 : 1

Column              : 1</Data></EventData><RenderingInfo Culture='de-DE'><Message>Fehler beim Analysieren der XML-Datei. Grund: Im Textinhalt wurde ein ungültiges Zeichen gefunden.

 Falsches XML: 

ErrorCode           : 0xC00CE508

Interceptor         : 14

OperationType       : Populate

Table               : MBProperty

ConfigurationSource : file:///C:/Windows/system32/inetsrv/MetaBase.xml

Row                 : 1

Column              : 1</Message><Level>Fehler</Level><Task>Katalog</Task><Opcode></Opcode><Channel></Channel><Provider></Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='49152'>7024</EventID><Version>0</Version><Level>2</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:38.307032500Z'/><EventRecordID>141158</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='628'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>IIS-Verwaltungsdienst</Data><Data Name='param2'>%%-2145318902</Data></EventData><RenderingInfo Culture='de-DE'><Message>Der Dienst "IIS-Verwaltungsdienst" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2145318902.</Message><Level>Fehler</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:38.307032500Z'/><EventRecordID>141157</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='628'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>IIS-Verwaltungsdienst</Data><Data Name='param2'>Beendet</Data><Binary>490049005300410044004D0049004E002F0031000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "IIS-Verwaltungsdienst" befindet sich jetzt im Status "Beendet".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='IIS Config'/><EventID Qualifiers='49154'>4275</EventID><Level>2</Level><Task>2</Task><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:38.000000000Z'/><EventRecordID>141156</EventRecordID><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data> </Data><Data>Im Textinhalt wurde ein ungültiges Zeichen gefunden.

</Data><Data></Data><Data></Data><Data>

ErrorCode           : 0xC00CE508

Interceptor         : 14

OperationType       : Populate

Table               : MBProperty

ConfigurationSource : file:///C:/Windows/system32/inetsrv/MetaBase.xml

Row                 : 1

Column              : 1</Data></EventData><RenderingInfo Culture='de-DE'><Message>Fehler beim Analysieren der XML-Datei. Grund: Im Textinhalt wurde ein ungültiges Zeichen gefunden.

 Falsches XML: 

ErrorCode           : 0xC00CE508

Interceptor         : 14

OperationType       : Populate

Table               : MBProperty

ConfigurationSource : file:///C:/Windows/system32/inetsrv/MetaBase.xml

Row                 : 1

Column              : 1</Message><Level>Fehler</Level><Task>Katalog</Task><Opcode></Opcode><Channel></Channel><Provider></Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-DistributedCOM' Guid='{1B562E86-B7AA-4131-BADC-B6F3A001407E}' EventSourceName='DCOM'/><EventID Qualifiers='49152'>10010</EventID><Version>0</Version><Level>2</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:36.000000000Z'/><EventRecordID>141155</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>{A9E69610-B80D-11D0-B9B9-00A0C922E750}</Data></EventData><RenderingInfo Culture='de-DE'><Message>Der Server "{A9E69610-B80D-11D0-B9B9-00A0C922E750}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.</Message><Level>Fehler</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-DistributedCOM</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-DistributedCOM' Guid='{1B562E86-B7AA-4131-BADC-B6F3A001407E}' EventSourceName='DCOM'/><EventID Qualifiers='49152'>10016</EventID><Version>0</Version><Level>2</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:23.000000000Z'/><EventRecordID>141154</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='param1'>Anwendungsspezifisch</Data><Data Name='param2'>Lokal</Data><Data Name='param3'>Start</Data><Data Name='param4'>{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}</Data><Data Name='param5'>{344ED43D-D086-4961-86A6-1106F4ACAD9B}</Data><Data Name='param6'>NT-AUTORITÄT</Data><Data Name='param7'>SYSTEM</Data><Data Name='param8'>S-1-5-18</Data><Data Name='param9'>LocalHost (unter Verwendung von LRPC)</Data></EventData><RenderingInfo Culture='de-DE'><Message>Durch die Berechtigungseinstellungen (Anwendungsspezifisch) wird der SID (S-1-5-18) für Benutzer NT-AUTORITÄT\SYSTEM von Adresse LocalHost (unter Verwendung von LRPC) keine Berechtigung zum Start (Lokal) für die COM-Serveranwendung mit CLSID 

{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}

 und APPID 

{344ED43D-D086-4961-86A6-1106F4ACAD9B}

 gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungsprogramm für Komponentendienste geändert werden.</Message><Level>Fehler</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-DistributedCOM</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:09.228581400Z'/><EventRecordID>141153</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='628'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Windows Defender</Data><Data Name='param2'>Beendet</Data><Binary>570069006E0044006500660065006E0064002F0031000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Windows Defender" befindet sich jetzt im Status "Beendet".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:08.042979300Z'/><EventRecordID>141152</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='628'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Windows Defender</Data><Data Name='param2'>Ausgeführt</Data><Binary>570069006E0044006500660065006E0064002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Windows Defender" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:07.699778700Z'/><EventRecordID>141151</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='628'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Konfiguration für Remotedesktops</Data><Data Name='param2'>Ausgeführt</Data><Binary>530065007300730069006F006E0045006E0076002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Konfiguration für Remotedesktops" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:07.684178700Z'/><EventRecordID>141150</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='628'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Zertifikatverteilung</Data><Data Name='param2'>Ausgeführt</Data><Binary>4300650072007400500072006F0070005300760063002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Zertifikatverteilung" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:07.403378200Z'/><EventRecordID>141149</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='628'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>IPsec-Richtlinien-Agent</Data><Data Name='param2'>Ausgeführt</Data><Binary>50006F006C006900630079004100670065006E0074002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "IPsec-Richtlinien-Agent" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:07.044577500Z'/><EventRecordID>141148</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='628'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Microsoft-Softwareschattenkopie-Anbieter</Data><Data Name='param2'>Ausgeführt</Data><Binary>730077007000720076002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Microsoft-Softwareschattenkopie-Anbieter" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:06.888577300Z'/><EventRecordID>141147</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='628'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Anschlussumleitung für Remotedesktopdienst im Benutzermodus</Data><Data Name='param2'>Ausgeführt</Data><Binary>55006D0052006400700053006500720076006900630065002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Anschlussumleitung für Remotedesktopdienst im Benutzermodus" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='49152'>7024</EventID><Version>0</Version><Level>2</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:06.576576700Z'/><EventRecordID>141146</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='628'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>IIS-Verwaltungsdienst</Data><Data Name='param2'>%%-2145318902</Data></EventData><RenderingInfo Culture='de-DE'><Message>Der Dienst "IIS-Verwaltungsdienst" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2145318902.</Message><Level>Fehler</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:06.576576700Z'/><EventRecordID>141145</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='628'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>IIS-Verwaltungsdienst</Data><Data Name='param2'>Beendet</Data><Binary>490049005300410044004D0049004E002F0031000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "IIS-Verwaltungsdienst" befindet sich jetzt im Status "Beendet".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='IIS Config'/><EventID Qualifiers='49154'>4275</EventID><Level>2</Level><Task>2</Task><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:06.000000000Z'/><EventRecordID>141144</EventRecordID><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data> </Data><Data>Im Textinhalt wurde ein ungültiges Zeichen gefunden.

</Data><Data></Data><Data></Data><Data>

ErrorCode           : 0xC00CE508

Interceptor         : 14

OperationType       : Populate

Table               : MBProperty

ConfigurationSource : file:///C:/Windows/system32/inetsrv/MetaBase.xml

Row                 : 1

Column              : 1</Data></EventData><RenderingInfo Culture='de-DE'><Message>Fehler beim Analysieren der XML-Datei. Grund: Im Textinhalt wurde ein ungültiges Zeichen gefunden.

 Falsches XML: 

ErrorCode           : 0xC00CE508

Interceptor         : 14

OperationType       : Populate

Table               : MBProperty

ConfigurationSource : file:///C:/Windows/system32/inetsrv/MetaBase.xml

Row                 : 1

Column              : 1</Message><Level>Fehler</Level><Task>Katalog</Task><Opcode></Opcode><Channel></Channel><Provider></Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:06.451776500Z'/><EventRecordID>141143</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='628'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>WinHTTP-Web Proxy Auto-Discovery-Dienst</Data><Data Name='param2'>Ausgeführt</Data><Binary>570069006E0048007400740070004100750074006F00500072006F00780079005300760063002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "WinHTTP-Web Proxy Auto-Discovery-Dienst" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:06.280176200Z'/><EventRecordID>141142</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='4908'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Enumeratordienst für tragbare Geräte</Data><Data Name='param2'>Ausgeführt</Data><Binary>57005000440042007500730045006E0075006D002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Enumeratordienst für tragbare Geräte" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:06.155376000Z'/><EventRecordID>141141</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='4448'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Anwendungserfahrung</Data><Data Name='param2'>Ausgeführt</Data><Binary>410065004C006F006F006B00750070005300760063002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Anwendungserfahrung" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:06.061775800Z'/><EventRecordID>141140</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='4920'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Symantec Management Client</Data><Data Name='param2'>Ausgeführt</Data><Binary>53006D00630053006500720076006900630065002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Symantec Management Client" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7040</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:05.952575600Z'/><EventRecordID>141139</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='632'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='param1'>Intelligenter Hintergrundübertragungsdienst</Data><Data Name='param2'>Manuell starten</Data><Data Name='param3'>Automatisch starten</Data><Data Name='param4'>BITS</Data></EventData><RenderingInfo Culture='de-DE'><Message>Der Starttyp des Diensts "Intelligenter Hintergrundübertragungsdienst" wurde von Manuell starten in Automatisch starten geändert.</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:02.520569600Z'/><EventRecordID>141138</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='888'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Virtueller Datenträger</Data><Data Name='param2'>Ausgeführt</Data><Binary>7600640073002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Virtueller Datenträger" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:01.646968100Z'/><EventRecordID>141137</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='4572'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Remotedesktopdienste</Data><Data Name='param2'>Ausgeführt</Data><Binary>5400650072006D0053006500720076006900630065002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Remotedesktopdienste" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:01.537767900Z'/><EventRecordID>141136</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='4572'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Netzwerklistendienst</Data><Data Name='param2'>Ausgeführt</Data><Binary>6E0065007400700072006F0066006D002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Netzwerklistendienst" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Iphlpsvc' Guid='{66A5C15C-4F8E-4044-BF6E-71D896038977}'/><EventID>4200</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:01.444167700Z'/><EventRecordID>141135</EventRecordID><Correlation ActivityID='{01AC1C78-F800-0007-65B8-EF533957D001}'/><Execution ProcessID='980' ThreadID='5216'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='ProtocolType'>0</Data><Data Name='Interface'>LAN-Verbindung* 2</Data><Data Name='Address'>2002:8d58:9202::8d58:9202</Data></EventData><RenderingInfo Culture='de-DE'><Message>Die 6to4-Schnittstelle LAN-Verbindung* 2 mit der Adresse 2002:8d58:9202::8d58:9202 wurde hervorgebracht.</Message><Level>Informationen</Level><Task></Task><Opcode>Info</Opcode><Channel>System</Channel><Provider>Microsoft-Windows-Iphlpsvc</Provider><Keywords></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:01.178967200Z'/><EventRecordID>141134</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='4908'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Volumeschattenkopie</Data><Data Name='param2'>Ausgeführt</Data><Binary>5600530053002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Volumeschattenkopie" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Virtual Disk Service'/><EventID Qualifiers='16896'>3</EventID><Level>4</Level><Task>0</Task><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:02.000000000Z'/><EventRecordID>141133</EventRecordID><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data>@2010005</Data></EventData><RenderingInfo Culture='de-DE'><Message>Dienst wurde gestartet.</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider></Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Symantec AntiVirus'/><EventID Qualifiers='16639'>14</EventID><Level>4</Level><Task>0</Task><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:01.000000000Z'/><EventRecordID>103628</EventRecordID><Channel>Application</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data>



Start der Symantec Endpoint Protection-Dienste war erfolgreich.</Data></EventData><RenderingInfo Culture='de-DE'><Message> 



Start der Symantec Endpoint Protection-Dienste war erfolgreich.</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider></Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:00.976166900Z'/><EventRecordID>141132</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='4920'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Netzwerkverbindungen</Data><Data Name='param2'>Ausgeführt</Data><Binary>4E00650074006D0061006E002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Netzwerkverbindungen" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:00.835766600Z'/><EventRecordID>141131</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='4560'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Intelligenter Hintergrundübertragungsdienst</Data><Data Name='param2'>Ausgeführt</Data><Binary>42004900540053002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Intelligenter Hintergrundübertragungsdienst" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:00.664166300Z'/><EventRecordID>141130</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='4920'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Erkennung interaktiver Dienste</Data><Data Name='param2'>Ausgeführt</Data><Binary>5500490030004400650074006500630074002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Erkennung interaktiver Dienste" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='49152'>7026</EventID><Version>0</Version><Level>2</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:00.601766200Z'/><EventRecordID>141129</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='548'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>

cdrom</Data></EventData><RenderingInfo Culture='de-DE'><Message>Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 

cdrom</Message><Level>Fehler</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:45:00.586166200Z'/><EventRecordID>141128</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='6820'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Backup Exec Management Service</Data><Data Name='param2'>Ausgeführt</Data><Binary>4200610063006B007500700045007800650063004D0061006E006100670065006D0065006E00740053006500720076006900630065002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Backup Exec Management Service" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-HttpEvent' Guid='{7b6bc78c-898b-4170-bbf8-1a469ea43fc5}' EventSourceName='HTTP'/><EventID Qualifiers='32768'>15301</EventID><Version>0</Version><Level>3</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:44:54.455355400Z'/><EventRecordID>141127</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='88'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='DeviceObject'>\Device\Http\ReqQueue</Data><Data Name='SocketAddress'>0.0.0.0:50106</Data></EventData><RenderingInfo Culture='de-DE'><Message>Die SSL-Zertifikateinstellungen wurden von einem Administratorprozess erstellt für den folgenden Anschluss: 0.0.0.0:50106 .</Message><Level>Warnung</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-HttpEvent</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-HttpEvent' Guid='{7b6bc78c-898b-4170-bbf8-1a469ea43fc5}' EventSourceName='HTTP'/><EventID Qualifiers='32768'>15300</EventID><Version>0</Version><Level>3</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:44:54.361755300Z'/><EventRecordID>141126</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='88'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='DeviceObject'>\Device\Http\ReqQueue</Data><Data Name='SocketAddress'>0.0.0.0:50106</Data></EventData><RenderingInfo Culture='de-DE'><Message>Die SSL-Zertifikateinstellungen wurden gelöscht für den folgenden Anschluss: 0.0.0.0:50106 .</Message><Level>Warnung</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-HttpEvent</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/><EventID Qualifiers='16384'>7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:44:47.372943000Z'/><EventRecordID>141125</EventRecordID><Correlation/><Execution ProcessID='544' ThreadID='6820'/><Channel>System</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data Name='param1'>Backup Exec Job Engine</Data><Data Name='param2'>Ausgeführt</Data><Binary>4200610063006B007500700045007800650063004A006F00620045006E00670069006E0065002F0034000000</Binary></EventData><RenderingInfo Culture='de-DE'><Message>Dienst "Backup Exec Job Engine" befindet sich jetzt im Status "Ausgeführt".</Message><Level>Informationen</Level><Task></Task><Opcode></Opcode><Channel></Channel><Provider>Microsoft-Windows-Service Control Manager</Provider><Keywords><Keyword>Klassisch</Keyword></Keywords></RenderingInfo></Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Backup Exec CatErrorHandler Server'/><EventID Qualifiers='8192'>34305</EventID><Level>4</Level><Task>0</Task><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2015-03-05T11:44:47.000000000Z'/><EventRecordID>103627</EventRecordID><Channel>Application</Channel><Computer>DEIHK_LIM1.limburg.ihk.de</Computer><Security/></System><EventData><Data>D:\Programme\Catalogs\</Data><Data>0</Data><Data>0</Data><Data>5087.1</Data><Data>0.57859</Data><Data>0</Data></EventData><RenderingInfo Culture='de-DE'><Message>Die Katalogserverdatenbank wurde mit den Katalogdateien in D:\Programme\Catalogs\ synchronisiert.

Die Anzahl der zur Datenbank hinzugef