CHFI Malware Forensics Practice Question
Exhibit
Refer to the exhibit. C:\Users\Admin> sc query | findstr /i "service" SERVICE_NAME: WinDefend DISPLAY_NAME: Windows Defender Antivirus Service STATE: 4 RUNNING C:\Users\Admin> tasklist /svc Image Name PID Services ================= ======== ============================================ svchost.exe 1234 WinDefend svchost.exe 5678 BFE, MpsSvc services.exe 4321 C:\Users\Admin> netstat -ano | findstr :4444 TCP 0.0.0.0:4444 0.0.0.0:0 LISTENING 4321
Based on the exhibit, what is the most likely indication of malware persistence?
⚠ Common exam trap
EC-Council often tests the misconception that any process named 'services.exe' or 'svchost.exe' is automatically malicious, when in fact the key indicator is abnormal behavior (like listening on a non-standard port) that deviates from the process's legitimate function.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
services.exe is listening on TCP port 4444, indicating possible code injection
Services.exe (the Service Control Manager) should not normally listen on any TCP port. When it is found listening on TCP port 4444—a port commonly associated with Metasploit and reverse shells—it strongly indicates that malware has injected code into the legitimate services.exe process, hijacking it to establish a persistent backdoor listener. This is a classic sign of process hollowing or reflective DLL injection, where the malware hides its network activity under a trusted system process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
services.exe PID 4321 is a known malware process
Why it's wrong here
services.exe is the Windows Service Control Manager, a legitimate system process responsible for managing services, and its PID is assigned dynamically at boot. There is no known malware variant called 'services.exe' that can be identified by PID alone; malware authors frequently reuse the same file name to blend in, so the PID does not constitute a threat indicator.
- ✗
Windows Defender service is stopped, allowing malware to run
Why it's wrong here
The exhibit displays a service state of 4, which corresponds to SERVICE_RUNNING in the Windows SCM, not a stopped state. When a service is stopped, the state code is 1 (SERVICE_STOPPED), so Windows Defender is demonstrably active in this output. Even a running antivirus does not guarantee the system is clean, but the specific assertion that Defender is stopped is contradicted by the evidence.
- ✓
services.exe is listening on TCP port 4444, indicating possible code injection
Why this is correct
services.exe is the Windows Service Control Manager and should never expose listening TCP endpoints on its own; its normal IPC is via a named pipe used by subprocesses, not a network socket. Port 4444 is a well-known default payload port for Metasploit's meterpreter and is frequently used by backdoors, so an established listening socket on services.exe is a classic sign of injected shellcode. Because services.exe runs as SYSTEM, attackers often inject code into it to steal its high privileges and evade detection.
- ✗
svchost.exe hosting BFE and MpsSvc indicates a firewall bypass
Why it's wrong here
svchost.exe is a shared host process that loads dozens of Windows services from DLLs, and BFE (Base Filtering Engine) plus MpsSvc (Windows Firewall) are expected residents in a standard svchost instance. Their presence simply reflects normal service hosting, not a firewall bypass. A real bypass would require evidence such as disabled firewall rules, a tampered filter driver, or a malicious DLL injected into the service host, none of which appears in this exhibit.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.