Summary
This article explains why the notification username and logon username are not the same during malware detection in OSCE.
Details
When the system starts up, ntrtscan.exe starts before PccNTMon.exe and gets the username from the OSCE registry. The username in the OSCE registry is that of the previous user who logged onto the PC.
When PccNTMon.exe starts, it writes the current logon user’s name to the OSCE registry. The virus is detected before PccNTMon.exe starts, so the notification shows the user name of the previous user, not the current user.
Thus, the discrepancy.
