John works as a Network Administrator for We-are-secure Inc. He finds that TCP port 7597 of the Weare- secure server is open. He suspects that it may be open due to a Trojan installed on the server. He presents a report to the company describing the symptoms of the Trojan. A summary of the report is given below:

Once this Trojan has been installed on the computer, it searches Notpad.exe, renames it Note.com, and then copies itself to the computer as Notepad.exe. Each time Notepad.exe is executed, the Trojan executes and calls the original Notepad to avoid being noticed. Which of the following Trojans has the symptoms as the one described above?

Question

John works as a Network Administrator for We-are-secure Inc. He finds that TCP port 7597 of the Weare- secure server is open. He suspects that it may be open due to a Trojan installed on the server. He presents a report to the company describing the symptoms of the Trojan. A summary of the report is given below:

Once this Trojan has been installed on the computer, it searches Notpad.exe, renames it Note.com, and then copies itself to the computer as Notepad.exe. Each time Notepad.exe is executed, the Trojan executes and calls the original Notepad to avoid being noticed. Which of the following Trojans has the symptoms as the one described above?

Accepted Answer

B. Qaz Qaz is a documented backdoor Trojan that specifically targets the Windows Notepad application - it renames the legitimate notepad.exe to note.com and copies itself in its place so that every invocation of Notepad silently executes the Trojan before calling the real editor. It opens TCP port 7597 to allow remote access, matching every symptom described in the scenario.

Answer

A. NetBus NetBus is a remote access Trojan that communicates on TCP ports 12345 and 12346 and does not perform the Notepad.exe hijacking or port 7597 behavior described.

Answer

C. eBlaster eBlaster is commercial monitoring and spyware software used to log user activity - it does not rename or replace system executables like Notepad.exe and does not use port 7597.

Answer

D. SubSeven SubSeven (Sub7) is a remote administration Trojan that typically operates on port 27374 and does not exhibit the Notepad.exe renaming and self-substitution behavior described in the scenario.

John works as a Network Administrator for We-are-secure Inc. He finds that TCP port 7597 of the Weare- secure server is open. He suspects that it may be open due to a Trojan installed on the server…

Question

Options

How the community answered

Why each option

Topics

Community Discussion