GCIH · Question #21
Which of the following is a network worm that exploits the RPC sub-system vulnerability present in the Microsoft Windows operating system?
The correct answer is C. Win32/Conflicker. Win32/Conficker is a network worm that specifically targets the MS08-067 vulnerability in the Windows RPC subsystem to propagate across networks automatically.
Question
Which of the following is a network worm that exploits the RPC sub-system vulnerability present in the Microsoft Windows operating system?
Options
- AWin32/Agent
- BWMA/TrojanDownloader.GetCodec
- CWin32/Conflicker
- DWin32/PSW.OnLineGames
How the community answered
(61 responses)- A2% (1)
- B2% (1)
- C93% (57)
- D3% (2)
Why each option
Win32/Conficker is a network worm that specifically targets the MS08-067 vulnerability in the Windows RPC subsystem to propagate across networks automatically.
Win32/Agent is a generic trojan family that performs actions such as downloading additional malware, but does not exploit the RPC sub-system vulnerability for network worm propagation.
WMA/TrojanDownloader.GetCodec is a trojan downloader that disguises itself as a media codec to trick users into installing malware, and is not a network worm exploiting RPC vulnerabilities.
Win32/Conficker exploits the MS08-067 vulnerability in the Windows Server Service RPC subsystem, enabling remote code execution and self-propagation across networks without user interaction. It was discovered in 2008 and infected millions of Windows systems by spreading via the RPC exploit, network shares, and removable drives. Its defining characteristic as a network worm is this automated propagation through the RPC vulnerability.
Win32/PSW.OnLineGames is a password-stealing trojan designed to harvest credentials from online games, not a network worm that exploits RPC sub-system vulnerabilities.
Concept tested: Identifying Win32/Conficker as an RPC-exploiting worm
Source: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32%2FConficker
Topics
Community Discussion
No community discussion yet for this question.