GCIH · Question #243
Adam, a novice computer user, works primarily from home as a medical professional. He just bought a brand new Dual Core Pentium computer with over 3 GB of RAM. After about two months of working on…
The correct answer is A. Computer is infected with the stealth kernel level rootkit. A kernel-level rootkit hides its presence from the OS and security tools, explaining why antivirus and anti-spyware fail to detect it while the system slows and disk space disappears.
Question
Adam, a novice computer user, works primarily from home as a medical professional. He just bought a brand new Dual Core Pentium computer with over 3 GB of RAM. After about two months of working on his new computer, he notices that it is not running nearly as fast as it used to. Adam uses antivirus software, anti-spyware software, and keeps the computer up-to-date with Microsoft patches. After another month of working on the computer, Adam finds that his computer is even more noticeably slow. He also notices a window or two pop-up on his screen, but they quickly disappear. He has seen these windows show up, even when he has not been on the Internet. Adam notices that his computer only has about 10 GB of free space available. Since his hard drive is a 200 GB hard drive, Adam thinks this is very odd. Which of the following is the mostly likely the cause of the problem?
Options
- AComputer is infected with the stealth kernel level rootkit.
- BComputer is infected with stealth virus.
- CComputer is infected with the Stealth Trojan Virus.
- DComputer is infected with the Self-Replication Worm.
How the community answered
(45 responses)- A78% (35)
- B7% (3)
- C2% (1)
- D13% (6)
Why each option
A kernel-level rootkit hides its presence from the OS and security tools, explaining why antivirus and anti-spyware fail to detect it while the system slows and disk space disappears.
A stealth kernel-level rootkit operates at the lowest level of the OS, intercepting system calls to hide files, processes, and network activity from security software. This explains why Adam's antivirus and anti-spyware tools fail to detect anything despite clear symptoms like severe performance degradation, unexplained disk space loss, and brief pop-up windows that vanish - behaviors consistent with hidden processes consuming resources.
A stealth virus typically infects executable files and is detectable by signature-based antivirus; it would not as effectively evade both antivirus and anti-spyware simultaneously.
A Stealth Trojan Virus operates in user space and is generally detectable by updated antivirus software, making it less consistent with the described evasion of all security tools.
A self-replicating worm primarily spreads across networks and would more likely generate noticeable network traffic rather than cause local disk space loss and hidden pop-ups.
Concept tested: Kernel-level rootkit symptoms and stealth evasion
Source: https://www.cisa.gov/sites/default/files/publications/Rootkits_508.pdf
Topics
Community Discussion
No community discussion yet for this question.