GCIH: GIAC Certified Incident HandlerDemo

By GIAC · Question Mode

QuestionQ469

Detecting Evasive and Post-Exploitation Techniques

While copying files from the C:\WINDOWS\system32 directory to a USB memory stick, you see the pop-up shown.

What does this indicate?

Question Image

  • A The system has not been scanned for rootkits
  • B The java.exe executable cannot be run from the memory USB stick
  • C The filesystem on the USB memory stick is not NTFS
  • D There is a virus embedded inside the java executable
  • E Java is being used on the system and there is a resource conflict
Explanation

java.exe:$DATA is an NTFS alternate data stream. The destination cannot preserve that named stream, so Windows warns that the extra information will be lost while the executable’s main file content is copied. NTFS supports named streams, whereas FAT and FAT32 do not; therefore, the USB memory stick is not formatted as NTFS.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!