312-50V11 · Question #79
A virus that attempts to install itself inside the file it is infecting is called?
The correct answer is B. Cavity virus. A cavity virus (also called a spacefiller virus) installs its code into unused or null-padded regions within the host file, keeping the file size unchanged to evade size-based integrity detection.
Question
A virus that attempts to install itself inside the file it is infecting is called?
Options
- ATunneling virus
- BCavity virus
- CPolymorphic virus
- DStealth virus
How the community answered
(57 responses)- A4% (2)
- B89% (51)
- C5% (3)
- D2% (1)
Why each option
A cavity virus (also called a spacefiller virus) installs its code into unused or null-padded regions within the host file, keeping the file size unchanged to evade size-based integrity detection.
A tunneling virus intercepts low-level OS interrupt handlers and antivirus hooks to write directly to disk, bypassing security software - it does not target internal file cavities.
A cavity virus identifies and overwrites empty cavities or null-padded sections within a host executable's structure, such as unused gaps between code sections. Because the virus occupies pre-existing free space rather than appending or prepending data, the infected file's total size remains identical to the original, making the infection invisible to tools that detect malware by monitoring file size changes.
A polymorphic virus mutates its own code signature with each replication cycle to evade signature-based antivirus detection - this mutation behavior is unrelated to physically fitting inside file cavities.
A stealth virus intercepts system I/O calls to return falsified original file data when read, hiding changes from the OS - it conceals modifications rather than installing itself within the file's internal spaces.
Concept tested: Cavity virus spacefilling infection technique
Topics
Community Discussion
No community discussion yet for this question.