Debbie from finance called to tell you that she downloaded and installed a free wallpaper program that sets the
wallpaper on her computer to match the current weather outside but now her computer runs slowly and the disk
drive activity light is always on. You take a closer look and when you do a simple port scan to see which ports
are open on her computer, you notice that TCP/80 is open. You point a web browser at her computer’s IP
Address and port and see a site selling prescription drugs.
Apart from the wallpaper changing software, what did Debbie install without her knowledge?

A.
Trojan horse

B.
Network mobile code

C.
Virus

D.
Logic Bomb

Explanation:
A Trojan horse is code that is disguised as a useful application but contains code that has a malicious or
harmful purpose imbedded in it. The Trojan horse can then set up a back door, install keystroke loggers,
implement rootkits, upload files from the victim’s system, install bot software, and perform many other types of
malicious acts.
Incorrect Answers:
B: Network mobile code is usually called a worm, which is malicious software that infects adjacent hosts which
are unpatched against the vulnerability the worm exploits.
C: A virus is a segment of code that attaches itself to a host program by embedding a copy of itself in that
program. A virus would not open a port on Debbie’s computer and install a site selling prescription drugs.
D: A logic bomb executes a set of instructions when specific conditions are met.

Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, pp. 1199-1201, 1202,
1206
http://en.wikipedia.org/wiki/Trojan_horse_(computing)