Certified Incident Handler (CIH) Practice Ecam

Which of the following signs can be considered as an indication of virus attacks?

1. Files and folders are missing

2. System performance is unusually fast

3. No new software installations

4. All antivirus checks pass

The correct answer is: Files and folders are missing

Files and folders being missing is a strong indication of possible virus activity. A virus can corrupt or delete files as part of its malicious action, potentially causing significant data loss and system instability. When files and folders suddenly disappear without user intervention, it raises red flags about the presence of malware or unauthorized access. This behavior contrasts sharply with the other options. For instance, an unusually fast system performance can often be attributed to various benign factors, such as routine maintenance or optimization, rather than a viral attack. Similarly, if no new software installations are taking place, it does not correlate directly with virus activity—often, infections occur alongside legitimate applications rather than as a result of new installations. Lastly, passing all antivirus checks generally suggests that the system is healthy, at least at the time of the check, and does not indicate an ongoing viral threat. Thus, identifying missing files and folders effectively highlights a concerning symptom of a potential virus attack.