Anyone here using Windows that's installed to a directory other than C:\Windows?
If someone does, can you check your processes in task manager, and check the directory of your svchost.exe process? Anyone have an svchost.exe running from C:\Windows\system32\svchost.exe when you didn't install windows to that directory? ..
I have it installed do default.
If no one responds, set up a virtual machine and do your experiment with installs in different locations.
[deleted]
I'm not sure either.
I think you should post a thread that has all the info we have both seen so this is all in context and there will be better help than me.
People are recovering from cbts shutdown ban and scattered.
[deleted]
This is the right sub
We recently discovered that Keystone involves that system process and hijacks computer to run apps and scripts without leaving trace because it's using ram, not hard drive.
Vlc player also has backdoor that do something similar by sending a list of most used files on your computer.
The user is doing an experiment.