312-50V13 · Question #16
Which of the following viruses tries to hide from anti-virus programs by actively altering and corrupting the chosen service call interruptions when they are being run?
The correct answer is B. Stealth/Tunneling virus. A stealth/tunneling virus attempts to evade antivirus detection by actively manipulating or corrupting operating system service call interruptions when they are being executed.
Question
Options
- AMacro virus
- BStealth/Tunneling virus
- CCavity virus
- DPolymorphic virus
How the community answered
(19 responses)- A5% (1)
- B89% (17)
- C5% (1)
Why each option
A stealth/tunneling virus attempts to evade antivirus detection by actively manipulating or corrupting operating system service call interruptions when they are being executed.
A macro virus infects documents and templates, using macro programming languages, but does not primarily focus on altering service call interruptions for stealth.
A stealth virus actively hides its presence by intercepting requests from the operating system or antivirus programs and returning clean, uninfected information instead. A tunneling virus can also bypass antivirus software by installing itself into the interrupt handler chain, thereby 'tunneling' under the operating system to intercept disk read requests.
A cavity virus attempts to hide by installing itself into empty areas or 'cavities' within a legitimate program's file structure without increasing the file size, rather than corrupting service calls.
A polymorphic virus changes its own code (mutation engine) with each infection to avoid signature-based detection, but its primary method isn't to alter service call interruptions.
Concept tested: Virus evasion techniques (Stealth/Tunneling)
Source: https://learn.microsoft.com/en-us/previous-versions/tn-archive/cc782672(v=technet.10)
Topics
Community Discussion
No community discussion yet for this question.