Ace Your Exams with Our Notes and Mock Tests!

EC-Council: Computer Hacking Forensic Investigator(CHFI-V10)
Module 14 : Malware Forensics
Questions available : 29		You are not logged in. Please Login for track your learning progress

Q. No: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 |
		Go to Question No.

Question No 0

---

If you want to share the link of this question, please click here to "Copy Question Link" and share that generated link. Link from URL may change in future.

 

---

Bookmark this Question		QID: 557
Which of the following statements is TRUE with respect to the Registry settings in the user start-up folder HKEY_CURRENT_USER∖Software∖Microsoft∖Windows∖CurrentVersion∖RunOnce∖.
A:    All the values in this subkey run when specific user logs on, as this setting is user-specific
B:    The string specified in the value run executes when user logs on
C:    All the values in this key are executed at system start-up
D:    All values in this subkey run when specific user logs on and then the values are deleted
Explanation: Refer EC-Council study material page 1371 Some of the Windows AutoStart registry keys targeted by malicious programs are discussed below: ▪ Run/RunOnce Keys Malware often modifies the below-mentioned registry keys to continue running on the system whenever the user logs in: o HKEY_CURRENT_USER∖Software∖Microsoft∖Windows∖CurrentVersion∖Run o HKEY_CURRENT_USER∖Software∖Microsoft∖Windows∖CurrentVersion∖RunOnce A malicious program can also modify the following system-related keys: o HKEY_LOCAL_MACHINE∖SOFTWARE∖Microsoft∖Windows∖CurrentVersion∖Run o HKEY_LOCAL_MACHINE∖SOFTWARE∖Microsoft∖Windows∖CurrentVersion∖RunOnce o HKEY_LOCAL_MACHINE∖Software∖Microsoft∖Windows∖CurrentVersion∖Policies∖Expl orer∖Run Startup Keys Malware authors also try to place their malicious executable file within the startup directory of the compromised system and create a shortcut entry on the location pointed by the Startup subkey which is set to execute the service automatically on each logon/reboot. These startup locations are found both at the user level and system level: o HKEY_LOCAL_MACHINE∖SOFTWARE∖Microsoft∖Windows∖CurrentVersion∖Explorer∖S hell Folders, Common Startup o HKEY_LOCAL_MACHINE∖SOFTWARE∖Microsoft∖Windows∖CurrentVersion∖Explorer∖ User Shell Folders, Common Startup o HKEY_CURRENT_USER∖SOFTWARE∖Microsoft∖Windows∖CurrentVersion∖Explorer∖Sh ell Folders, Startup o HKEY_CURRENT_USER∖SOFTWARE∖Microsoft∖Windows∖CurrentVersion∖Explorer∖Us er Shell Folders, Startup

Diffence opinion in Correct Answer or any comment?
Vote / Comment for correct Answer

Voting and comment option is available only for Logged in Users.
Please Login

Chosen Answer: A    B    C    D

Comment on this Answer:

Nickname to be shown:

Comunity Comments:

Chhavi Kaushik on 27/01/2025
Opted Answer: D

D is the correct answer. The value in runonce subkey will be deleted.

1	0			Reply / response option is available only for Logged in Users. Please Login.    Registration is free!!
Your Comment / Reply Nickname to be shown
Reason for Report

yassine on 08/09/2024
Opted Answer: D

The HKEY_CURRENT_USER∖Software∖Microsoft∖Windows∖CurrentVersion∖RunOnce registry subkey contains values that are executed only once when the user logs on. After the specified programs or commands are run, the corresponding entries are automatically deleted from the subkey

2	0			Reply / response option is available only for Logged in Users. Please Login.    Registration is free!!
Your Comment / Reply Nickname to be shown
Reason for Report

Go to Modules