GSLC · Question #491
Mark works as a Network Administrator for We-are-secure Inc. He finds that the We-are-secure server has been infected with a virus. He presents to the company a report that describes the symptoms of…
The correct answer is B. Chernobyl. The Chernobyl virus (CIH) is uniquely identified by its dual destructive payload targeting the hard drive MBR and the flash BIOS, affecting Windows 9x PE-format executables.
Question
Mark works as a Network Administrator for We-are-secure Inc. He finds that the We-are-secure server has been infected with a virus. He presents to the company a report that describes the symptoms of the virus. A summary of the report is given below:
- This virus has a dual payload, as the first payload of the virus
changes the first megabyte of the hard drive to zero. Due to this, the contents of the partition tables are deleted and the computer hangs.
- The second payload replaces the code of the flash BIOS with garbage
values. This virus spreads under the Portable Executable File Format under Windows 95, Windows 98, and Windows ME. Which of the following viruses has the symptoms as the one described above?
Options
- ANimda
- BChernobyl
- CI Love You
- DMelissa
How the community answered
(35 responses)- A6% (2)
- B91% (32)
- D3% (1)
Why each option
The Chernobyl virus (CIH) is uniquely identified by its dual destructive payload targeting the hard drive MBR and the flash BIOS, affecting Windows 9x PE-format executables.
Nimda is a multi-vector network worm that spreads via email, IIS exploits, and network shares and does not carry MBR-zeroing or BIOS-corrupting payloads.
The Chernobyl virus, also known as CIH after its creator Chen Ing-hau, carries two payloads: the first zeros out the first megabyte of the hard drive, destroying the MBR and partition tables and halting the system, while the second overwrites the flash BIOS chip with garbage data, potentially causing permanent motherboard damage. It specifically spread by infecting Portable Executable files under Windows 95, 98, and ME, consistent with every symptom described.
ILOVEYOU is a VBScript worm that propagates via email attachments and overwrites user files such as images and audio, with no capability to corrupt the MBR or flash BIOS.
Melissa is a Word macro virus that replicates by emailing infected documents to Outlook contacts and has no destructive payload targeting partition tables or BIOS firmware.
Concept tested: Identifying historical virus payloads from behavioral symptoms
Topics
Community Discussion
No community discussion yet for this question.