GIACCertified Forensics Analyst GCFA Question # 10 Topic 2 Discussion

GIACCertified Forensics Analyst GCFA Question # 10 Topic 2 Discussion

GCFA Exam Topic 2 Question 10 Discussion:
Question #: 10
Topic #: 2

The Klez worm is a mass-mailing worm that exploits a vulnerability to open an executable attachment even in Microsoft Outlook's preview pane. The Klez worm gathers email addresses from the entries of the default Windows Address Book (WAB). Which of the following registry values can be used to identify this worm?


A.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run


B.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices


C.

HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\Wab File Name = "file and pathname of the WAB file"


D.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run


Get Premium GCFA Questions

Contribute your Thoughts:


Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.