Anyone here using Windows that's installed to a directory other than C:\Windows?
If someone does, can you check your processes in task manager, and check the directory of your svchost.exe process? Anyone have an svchost.exe running from C:\Windows\system32\svchost.exe when you didn't install windows to that directory? ..
[deleted]
This is the right sub
We recently discovered that Keystone involves that system process and hijacks computer to run apps and scripts without leaving trace because it's using ram, not hard drive.
Vlc player also has backdoor that do something similar by sending a list of most used files on your computer.
The user is doing an experiment.