220-1102 · Question #556
A technician has been unable to remediate a persistent malware infection on a user's workstation. After the technician reinstalled the OS, the malware infection returned later that day. Which of the f
The correct answer is B. Boot sector virus. If malware consistently returns after an operating system reinstallation, the most probable source is a boot sector virus that persists outside the standard OS partitions.
Question
A technician has been unable to remediate a persistent malware infection on a user's workstation. After the technician reinstalled the OS, the malware infection returned later that day. Which of the following is the most likely source?
Options
- ATrojan
- BBoot sector virus
- CSpyware
- DRootkit
How the community answered
(49 responses)- A10% (5)
- B69% (34)
- C14% (7)
- D6% (3)
Why each option
If malware consistently returns after an operating system reinstallation, the most probable source is a boot sector virus that persists outside the standard OS partitions.
A Trojan is typically an application-layer malware that would be wiped with a full OS reinstallation.
A boot sector virus infects the master boot record (MBR) or volume boot records (VBRs) of a disk, meaning it can survive a typical operating system reinstallation if the boot sector itself is not completely overwritten or cleaned during the process. When the system boots, the boot sector code executes before the OS loads, reinfecting the newly installed operating system.
Spyware is an application-layer malware designed to collect information and would be removed with an OS reinstallation.
A rootkit hides its presence within the operating system but a full OS reinstallation typically overwrites the system files it depends on, making a boot sector virus a more direct explanation for persistence after an OS reinstall in the boot process.
Concept tested: Malware types and persistence mechanisms
Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/intelligence/virus-and-threat-definitions-update-versions
Topics
Community Discussion
No community discussion yet for this question.