A) It overwrites unused areas of executable files to infect them without increasing their size. B) It modifies the last modified date of the host file to match the original. C) It deletes system processes to avoid detection. D) It encrypts the entire host file to prevent unauthorized access.
A) The CIH virus B) The W32/Simile virus C) The Conficker virus D) The polymorphic engine virus
A) Automatically rebooting the system to trigger encryption. B) Hiding the virus by preventing it from appearing on the system process list. C) Encrypting the virus code to bypass signature scanning. D) Increasing the file size to hide malicious code within gaps.
A) Because once an infection occurs, the integrity of the system cannot be guaranteed. B) Because Windows files are too large to be scanned. C) Because antivirus software is incapable of deleting files. D) Because viruses automatically reinstall themselves through the internet.
A) By intercepting the request and returning an uninfected version of the file. B) By encrypting the entire NTFS file system. C) By changing the system time to expire the antivirus license. D) By deleting the antivirus software before it starts.
A) Updating the operating system to the latest version. B) Disabling all read requests to the hard drive. C) Using a faster processor for scanning. D) Booting from a medium known to be clear.
A) Manual file inspection by users B) Deleting all executable files C) Virus signatures D) Hardware keyloggers
A) By encoding the body of the virus so the scanner cannot see it directly. B) By using polymorphic engines exclusively. C) By renaming the file extension. D) By deleting the decryption module.
A) They only infect non-executable files. B) The decryption module itself is modified on each infection. C) They are always larger in file size. D) They do not use encryption.
A) To encrypt files for ransom purposes. B) To hide the virus in the system registry. C) To speed up the system's boot time. D) To rewrite the virus code completely each time it infects a new executable.
A) Because it is entirely written in a high-level language. B) Because it uses a simple XOR operation for decryption. C) Because it resides entirely in the system memory. D) Because it consists of over 14,000 lines of code.
A) It prevents the virus from being deleted by the user. B) It reduces the CPU usage of the virus. C) It allows the virus to spread faster across networks. D) It makes obtaining representative samples for researchers more difficult.
A) By checking the file creation date. B) By searching for a single static signature. C) By using an emulator or statistical pattern analysis. D) By ignoring the decryption module entirely.
A) To bypass the NTFS file system. B) To speed up file system access. C) To avoid detection by users. D) To prevent the virus from self-replicating.
A) The virus becomes visible to the user. B) The operating system crashes immediately. C) The virus is automatically deleted. D) The System File Checker may incorrectly report altered files as authentic.
A) Propagation unit B) Logic bomb C) Resident module D) Infection vector
A) Executing malicious activity B) Replicating the virus code C) Determining the activation time D) Scanning the hard drive
A) Four B) Three C) Two D) Five
A) Execution phase B) Dormant phase C) Propagation phase D) Triggering phase
A) Dormant phase B) Triggering phase C) Execution phase D) Propagation phase
A) RAM B) External storage devices only C) The CPU cache D) The BIOS chip
A) Microsoft Word macros B) RAM address space C) Master Boot Record D) System binary files
A) Email attachments B) Physical media C) System updates D) Downloading web pages
A) Microsoft Excel B) Microsoft Outlook C) Microsoft Notepad D) Microsoft Paint
A) Infection mechanism B) Execution handler C) Propagation module D) Trigger
A) Yes B) Only boot sector viruses C) No D) Only macro viruses
A) A virus is an independent program. B) A worm cannot replicate itself. C) A worm does not require a host program. D) A worm is always less dangerous than a virus.
A) Richard Skrenta B) John von Neumann C) Fred Cohen D) Bob Thomas
A) WinVir B) Creeper C) Brain D) Elk Cloner
A) Leonard Adleman B) Fred Cohen C) Jürgen Kraus D) John von Neumann
A) Elk Cloner B) (c)Brain C) WinVir D) SCA virus
A) Creeper B) WinVir C) Win32.Cabanas D) Bizatch
A) Via email attachments. B) Via network cable. C) Via floppy disk. D) Via the internet.
A) Improving system performance. B) Seeking profit. C) Personal amusement only. D) Testing antivirus software.
A) 1949 B) 1971 C) 1986 D) 1981
A) TENEX B) Apple DOS 3.3 C) Windows 95 D) MS-DOS
A) Win32.Cabanas B) Creeper C) Bizatch D) WinVir |