CompTIA A+ Core 2 (220-1202)SecurityHard
A technician is troubleshooting a Windows 11 workstation that is exhibiting severe performance degradation, frequent crashes, and network connectivity issues. After running a full scan with antivirus software, no threats are detected. However, a process named 'svch0st.exe' (with a '0' instead of 'o') is consuming 90% of the CPU and network bandwidth. What is the MOST likely cause of these symptoms?
- ARootkit infection
- BCorrupted Windows system files
- CMalware disguised as a legitimate process
- DHardware failure
Show answer & explanationAnswer & explanation
Correct answer: C. Malware disguised as a legitimate process
The key indicator here is the misspelled process name 'svch0st.exe' (with a zero instead of an 'o') consuming excessive resources, combined with antivirus software failing to detect it. This is a classic tactic used by malware to camouflage itself as a legitimate Windows process (svchost.exe) to evade detection and analysis. The excessive resource consumption leads to performance degradation and network issues.
Why the other options are wrong
- A. While a rootkit is a type of malware designed to hide its presence, the explicit misspelled process name consuming resources is a more direct and common indicator of general malware masquerading, rather than just a hidden rootkit.
- B. Corrupted system files could cause crashes, but the specific misspelled process consuming high resources points away from simple corruption.
- D. Hardware failure might cause crashes and performance issues but wouldn't typically involve a specific, misspelled process consuming resources.
Process Masquerading
A malware technique where a malicious process is named similarly to a legitimate system process to avoid detection by users and sometimes security software.
- Often involves subtle misspellings (e.g., 'svch0st.exe' for 'svchost.exe').
- Aims to blend in with legitimate system activity.
- Can consume high resources, cause instability, or exfiltrate data.
Memory trick: Malware hides by looking like legit, or staying low.