Err, such a virus would effectively break the machine anyway, since most of the microkernel requires the computer SSID generated by that serial key to be valid. In order to actually work, the "virus" would effectively have to "reinstall" the OS in a fashion, something that would get noticed almost immediately by even the densest of users.

Test it yourself - change the SAM registry section with a copy of one from another machine... you'll break the OS entirely. This has been a constant since at least Win2k, IIRC.

/P




[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/243/26589#26589