SANS SEC504: Hacker Tools, Techniques and Incident Handling — Question 7

You have inserted a Trojan on your friend's computer and you want to put it in the startup so that whenever the computer reboots the Trojan will start to run on the startup. Which of the following registry entries will you edit to accomplish the task?

Answer options

• A. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Startup
• B. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Auto
• C. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
• D. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Start

Correct answer: C

Explanation

The correct answer is C, as the RunServices registry entry is designed to allow services to start at boot time. The other options, while related to startup, do not specifically cater to services which is essential for a Trojan to run in the background as desired.