GIAC
GISF · Question #194
The Klez worm is a mass-mailing worm that exploits a vulnerability to open an executable attachmenteven in Microsoft Outlook's preview pane. The Klez worm gathers email addresses from the entries…
The correct answer is B. HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\Wab File Name = "file and pathname. See the full explanation below for the reasoning.
Question
The Klez worm is a mass-mailing worm that exploits a vulnerability to open an executable attachmenteven in Microsoft Outlook's preview pane. The Klez worm gathers email addresses from the entries ofthe default Windows Address Book (WAB). Which of the following registry values can be used toidentify this worm?
Options
- AHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
- BHKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\Wab File Name = "file and pathname
- CHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- DHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
How the community answered
(34 responses)- A12% (4)
- B79% (27)
- C6% (2)
- D3% (1)
Community Discussion
No community discussion yet for this question.