nerdexam
EC-Council

312-50V13 · Question #235

A friend of yours tells you that he downloaded and executed a file that was sent to him by a coworker. Since the file did nothing when executed, he asks you for help because he suspects that he may…

The correct answer is D. Use netstat and check for outgoing connections to strange IP addresses or domains. To determine if a Trojan is installed and active, one should look for suspicious network activity, as Trojans often establish command-and-control communication.

Submitted by anjalisingh· Mar 6, 2026Malware Threats

Question

A friend of yours tells you that he downloaded and executed a file that was sent to him by a coworker. Since the file did nothing when executed, he asks you for help because he suspects that he may have installed a trojan on his computer. What tests would you perform to determine whether his computer is Infected?

Options

  • AUse ExifTool and check for malicious content.
  • BYou do not check; rather, you immediately restore a previous snapshot of the operating system.
  • CUpload the file to VirusTotal.
  • DUse netstat and check for outgoing connections to strange IP addresses or domains.

How the community answered

(26 responses)
  • A
    15% (4)
  • B
    8% (2)
  • C
    4% (1)
  • D
    73% (19)

Why each option

To determine if a Trojan is installed and active, one should look for suspicious network activity, as Trojans often establish command-and-control communication.

AUse ExifTool and check for malicious content.

ExifTool is used to read, write, and edit metadata in images, audio, video, and PDF files, not to detect active malicious processes or network connections.

BYou do not check; rather, you immediately restore a previous snapshot of the operating system.

While restoring a snapshot is a good remediation step for a confirmed infection, it does not help in determining *whether* the computer is infected in the first place, which is what the question asks.

CUpload the file to VirusTotal.

Uploading the file to VirusTotal is useful for static analysis of the file's potential maliciousness *before* execution or to confirm the nature of the file, but it doesn't directly tell you if the *currently running system* is infected by that file after execution.

DUse netstat and check for outgoing connections to strange IP addresses or domains.Correct

A Trojan, once executed, typically attempts to establish communication with a remote command-and-control (C2) server to receive instructions or exfiltrate data. Using `netstat` allows you to view active network connections and listening ports, which can reveal unauthorized outgoing connections to unusual IP addresses or domains, indicating potential compromise.

Concept tested: Trojan detection using network monitoring

Source: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat

Topics

#Malware detection#Trojan analysis#netstat#network connections

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V13 Practice