MENU
John works as a Professional Ethical Hacker for NetPerfect Inc. The company has a Linux-based network. All client computers are running on Red Hat 7.0 Linux. The Sales Manager of the company complains to John that his system contains an unknown package named as tar.gz and his documents are exploited. To resolve the problem, John uses a Port scanner to enquire about the open ports and finds out that the HTTP server service port on 27374 is open. He suspects that the other computers on the network are also facing the same problem. John discovers that a malicious application is using the synscan tool to randomly generate IP addresses.
Which of the following worms has attacked the computer?
Suggested Answer: B
Get Premium GCIH Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
36 comments · newest first
JU
Justine
10 months ago
I think it’s definitely Nimda, too many signs pointing there.
SH
Sharee
11 months ago
Wait, are we sure it’s not a false alarm?
LA
Lachelle
11 months ago
Ramen is more about DoS, not this.
RO
Roy
11 months ago
Definitely Code Red vibes here!
GA
Gayla
11 months ago
Sounds like a classic Nimda attack.
DE
Deangelo
11 months ago
If I recall correctly, Code Red was notorious for targeting IIS servers, so I don't think it's that one. Nimda seems more likely based on the symptoms described.
AH
Ahmed
12 months ago
I practiced a similar question on worms last week, and I think Ramen was mentioned in that context, but I don't recall the details.
KA
Karol
12 months ago
I think it might be Nimda since it was known for exploiting vulnerabilities in web servers, but I'm not completely confident.
SU
Susana
12 months ago
I remember studying about different types of worms, but I'm not entirely sure which one specifically uses synscan.
LU
Luis
12 months ago
This seems like a tricky one, but I think I've got a strategy. I'll start by reviewing the characteristics of the major Linux worms - Code Red, Ramen, LoveLetter, and Nimda. Then I'll match up the details in the question to see which one fits best. Methodical elimination is key here.
AN
Angelyn
12 months ago
I'm a little confused by all the technical details in this question. The port scanning, the synscan tool, and the different worm names - it's a lot to keep track of. I'll need to read through it a few times and try to break down the key evidence before I can make a solid guess.
LA
Layla
12 months ago
Okay, let's see here. The Linux-based network, the open HTTP port, and the random IP address scanning - that sounds a lot like the Nimda worm to me. I'm pretty confident that's the right answer, but I'll double-check the other options just to be sure.
JA
Jamal
1 year ago
Hmm, I'm a bit unsure about this one. The details about the open port and the malicious application are clear, but I'm not totally sure which specific worm it could be. I'll need to think through the different worm characteristics carefully to make the right call.
AM
Amie
1 year ago
This seems like a classic case of a worm attack. The open HTTP server port, the tar.gz file, and the random IP address generation all point to a specific type of worm. I think I've got a good handle on the key details here.
ER
Erick
1 year ago
Upgrading the CPU sounds like the logical choice here. If the system is struggling with multiple applications, that's likely a CPU bottleneck.
CR
Cristina
2 years ago
Wait, there's a worm called the 'LoveLetter'? That's a pretty cheesy name for a cybersecurity threat. I wonder if it's as harmless as it sounds.
RA
Raelene
2 years ago
Hmm, I'm not sure about this one. I'll have to think it over. Maybe I should ask the person sitting next to me for a second opinion.
KA
Kati
2 years ago
This question is a piece of cake! Anyone who's been paying attention in class would know that the answer is B) Ramen.
AL
Albert
2 years ago
D) Nimda
RO
Roosevelt
2 years ago
C) LoveLetter
LI
Lili
2 years ago
B) Ramen
RO
Rodrigo
2 years ago
A) Code red
TA
Tanesha
2 years ago
I'm not sure, but I think Ramen could also be a possibility.
BA
Barney
2 years ago
D) Nimda is the correct answer. The synscan tool used to generate random IP addresses is a telltale sign of the Nimda worm.
DY
Dylan
2 years ago
Nimda is the correct answer. The synscan tool used to generate random IP addresses is a telltale sign of the Nimda worm.
MA
Margot
2 years ago
D) Nimda
ZE
Zena
2 years ago
C) LoveLetter
SH
Shawna
2 years ago
B) Ramen
TR
Trinidad
2 years ago
A) Code red
HI
Hildred
2 years ago
I think the answer is B) Ramen. The tar.gz file and the open HTTP server port on 27374 are clear signs of a Ramen worm attack.
OS
Osvaldo
2 years ago
D) Nimda
MA
Margot
2 years ago
C) LoveLetter
LO
Lottie
2 years ago
B) Ramen
PA
Pauline
2 years ago
A) Code red
DA
Daren
2 years ago
I agree with Allene, Nimda seems like the most likely culprit.
AL
Allene
2 years ago
I think the worm that attacked the computer is Nimda.