rpcss virus? over 3k event security logs


ListChkdskResult by SleepyDude v0.1.7 Beta | 21-09-2013

 

——< Log generate on 5/3/2021 12:50:04 PM >——

Category: 0

Computer Name: DESKTOP-43483AH

Event Code: 1001

Record Number: 259

Source Name: Microsoft-Windows-Wininit

Time Written: 05-03-2021 @ 13:30:17

Event Type: Information

User: 

Message: 

 

Checking file system on C:

The type of the file system is NTFS.

Volume label is Windows.

 

 

One of your disks needs to be checked for consistency. You

may cancel the disk check, but it is strongly recommended

that you continue.

Windows will now check the disk.                         

 

Stage 1: Examining basic file system structure …

  488704 file records processed.                                                        

 

 

File verification completed.

 Phase duration (File record verification): 4.44 seconds.

  24933 large file records processed.                                   

 

 

 Phase duration (Orphan file record recovery): 0.00 milliseconds.

  0 bad file records processed.                                     

 

 

 Phase duration (Bad file record checking): 0.76 milliseconds.

 

Stage 2: Examining file name linkage …

The object id in file 0x28d8a does not appear in the object

id index in file 0x19.

Inserting an index entry into index $O of file 19.

The object id in file 0x29cea does not appear in the object

id index in file 0x19.

Inserting an index entry into index $O of file 19.

  142 reparse records processed.                                      

 

 

The file reference 0x600000000212c of index entry 61e2becc-cbaa-4583-a494-a6cc163bac2b.tmp of index $I30

with parent 0x11e is not the same as 0xa00000000212c.

Deleting index entry 61e2becc-cbaa-4583-a494-a6cc163bac2b.tmp in index $I30 of file 11E.

The file reference 0x600000000212c of index entry 61E2BE~1.TMP of index $I30

with parent 0x11e is not the same as 0xa00000000212c.

Deleting index entry 61E2BE~1.TMP in index $I30 of file 11E.

The file reference 0x8000000001d06 of index entry b15faa41-5c29-4891-85b4-1a8e347471f0.tmp of index $I30

with parent 0x11e is not the same as…

Source…