Windows 10: System event 7023 quasar rat ?

Recently my pc been infected with malware, i did multiple scans using multiple AVs and anti malware tools, cleaned the detections i’ve had and now everything seem clean, but recently i decided to check the event viewer under system logs and under event id 7023 it says : secure boot debug logging quasar, did google it found nothing but about quasar related to this for a windows Remote access trojan RAT named quasar and it got paranoid, this event is under netwtw10 which is a wifi driver i think, can someone help with is ? I rescanned my pc in both normal and safe mode, did some anti rootkits li

:)

 

How do I repair event ID 7023 in Windows 10?

Hi earpimenta,

I am Sumit here to assist you with this question.

What is the name of the service listed that is crashing?

Event ID 7023 — Service Stop Operations

https://docs.microsoft.com/en-us/previous-versi...(v=ws.10)?redirectedfrom=MSDN

 

Event ID 7023 Error. Computer keeps crashing

I had this same problem about three weeks ago, and ran all of the steps you listed here. That seemed to have worked for 20 days, until just now, when the PC suddenly crashed and rebooted again. This always happens during gaming sessions, but with different
games each time.

According to Event Viewer, the last event right before the system shut down was ID 7023, "The User Data Access_8a7dac6 service terminated with the following error: Unable to complete the requested operation because of either a catastrophic media failure
or a data structure corruption on the disk."

Then right before that, there are a TON of Event 10016s:

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}

and APPID

{56BE716B-2F76-4DFA-8702-67AE10044F0B}

to the user LEGION\tophe SID (S-1-5-21-351257817-424074498-2417062170-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative
tool.

I saved the log as a file and can provide it if needed. Any help you can offer would be greatly appreciated - I've never seen a crash like this before.

 

Event IDs 10016, 1014, and 7023

Unfortunately it does not give a file name. The full event log data for the error is:

Log Name: System

Source: Service Control Manager

Date: 11/11/2019 2:18:13 PM

Event ID: 7023

Task Category: None

Level: Error

Keywords: Classic

User: N/A

Computer:

Description:

The Software Protection service terminated with the following error:

Cannot create a file when that file already exists.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />

<EventID Qualifiers="49152">7023</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x8080000000000000</Keywords>

<TimeCreated SystemTime="2019-11-11T20:18:13.349459600Z" />

<EventRecordID>1197</EventRecordID>

<Correlation />

<Execution ProcessID="736" ThreadID="6708" />

<Channel>System</Channel>

<Computer></Computer>

<Security />

</System>

<EventData>

<Data Name="param1">Software Protection</Data>

<Data Name="param2">%%183</Data>

<Binary>7300700070007300760063000000</Binary>

</EventData>

</Event>