The Conficker worm can run every time Windows starts on infected machines. What tool would you use to test whether the worm will do this on a machine that you think may have been infected?

The correct answer is D. reg. reg can show the contents of any key in the registry. The command 'reg query hkcu\software\microsoft\windows\currentversion\run' shows the programs that run when Windows starts. The other tools show connections, programs that run or are currently running, but not programs that ru

Malware Analysis & Advanced Persistent Threats

Question

Options

Anetstat
Btasklist
Cipconfig
Dreg

How the community answered

(25 responses)

B
4% (1)
C
8% (2)
D
88% (22)

Explanation

reg can show the contents of any key in the registry. The command 'reg query hkcu\software\microsoft\windows\currentversion\run' shows the programs that run when Windows starts. The other tools show connections, programs that run or are currently running, but not programs that run at startup.

Topics

#Conficker worm#registry persistence#reg command#malware startup mechanisms

Community Discussion

No community discussion yet for this question.

Full GCIH Practice