GISP: GIAC Information Security Professional CertificationDemo

Question

John is a Network Administrator for We-are-secure Inc., where the company's server runs Windows Server 2003. While reviewing network security, he encounters an error message stating that Kernel32.exe has encountered a problem.

Which of the following steps should John take as a countermeasure in this situation?

Choose three

A He should upgrade his antivirus program.
B He should restore his Windows settings.
C He should observe the process viewer (Task Manager) to see whether any new process is running on the computer or not. If any new malicious process is running, he should kill that process.
D He should download the latest patches for Windows Server 2003 from the Microsoft site, so that he can repair the kernel.

Explanation

An error referencing Kernel32.exe frequently indicates that malware (a worm, Trojan, or virus) is interfering with this critical Windows system file. Appropriate countermeasures include updating the antivirus software so it can detect and remove the offending malware, checking Task Manager for unfamiliar or malicious processes and terminating them, and downloading and applying the latest Microsoft security patches for Windows Server 2003 to close the vulnerability the malware may be exploiting. Simply restoring Windows settings does not address the underlying malicious cause and therefore is not a valid corrective action in this context.

GISP: GIAC Information Security Professional CertificationDemo

AstroTutor

Notes

Readiness

QuestionQ8

Community Discussion