DisplayName : SATA bus driver. Parts of spyware TR_Spy_Haxspy_AP.
Default path: C:\WINDOWS\system32\satau325.sys C:\Windows\System32\satau320.dll
Registry items: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\satau325 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\satau325 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\satau320 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\satau325 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SATAU325 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SATAU325 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SATAU325
|