GSLC · Question #218
Which of the following viruses masks itself from applications or utilities to hide itself by detection of anti-virus software?
The correct answer is B. Stealth virus. A stealth virus conceals its presence by intercepting system calls and manipulating what antivirus software and utilities see. This allows it to hide file size changes or infected sectors.
Question
Which of the following viruses masks itself from applications or utilities to hide itself by detection of anti-virus software?
Options
- AMacro virus
- BStealth virus
- CE-mail virus
- DPolymorphic virus
How the community answered
(51 responses)- A2% (1)
- B90% (46)
- C6% (3)
- D2% (1)
Why each option
A stealth virus conceals its presence by intercepting system calls and manipulating what antivirus software and utilities see. This allows it to hide file size changes or infected sectors.
A macro virus embeds itself in document macros (e.g., Microsoft Office files) and executes when the document is opened, but does not specifically mask itself from antivirus detection.
A stealth virus uses techniques such as hooking OS interrupts to intercept read requests, returning uninfected data to scanning tools while the actual infected data remains hidden. This active deception distinguishes it from other virus types that may change form but do not specifically intercept detection attempts. Its primary defining characteristic is masking itself from applications and antivirus utilities in real time.
An email virus spreads by attaching to or embedding in email messages, using email as its propagation vector rather than employing active concealment from scanners.
A polymorphic virus evades detection by mutating its own code or encryption each time it replicates, rather than by intercepting calls to hide its presence from running utilities.
Concept tested: Stealth virus detection evasion technique
Source: https://www.cisa.gov/news-events/news/understanding-hidden-threats-rootkits-and-botnets
Topics
Community Discussion
No community discussion yet for this question.