Nyilván, ha egy programot (vagy vírust) Windows alá írnak, akkor azon tud mûködni...
http://www.f-secure.com/v-descs/myfip_h.shtml
When run, the worm copies under %SYSTEM% directory using the name 'kernel32dll.exe'. It creates a mutex named 'Meteo/EA[DCA]'. It installs the following registry key to ensure it will be executed next time the system is started:
The worm also creates a thread that adds the above registry key again if it is deleted.
If the worm is running under Windows NT-based system, it tries to inject code in address space of Explorer.exe. The injected code re-executes worm's file if the process terminates. The implementation seems to be quite unstable and it might crash Explorer.exe.
If the worm is running on Windows NT-based computer, it tries to hide its process by manipulating kernel data structures. This works only it worm is run under administrator privileges. If the system is Win9x-based, the worm tries to hide the process by issuing Win32 API call 'RegisterServiceProcess'.
Namost ugye unixon sajnos még regisztry sincs :DDD mac-on sem... na vajon, melyik oprendszer is lehet veszélyben... hmmmmm....
Informatika és tudomány
