CompTIA A+ Core 2 (220-1202)Software TroubleshootingEasy
A technician is troubleshooting a Windows 11 desktop that is running extremely slowly. In Task Manager, the Details tab shows a process named 'svch0st.exe' consuming 95% of CPU. Which of the following should the technician do FIRST?
- ADisable System Restore before taking any further action
- BImmediately delete the file from the System32 folder
- CResearch the process name to determine if it is a legitimate Windows process or malware
- DReformat the hard drive and reinstall the operating system
Show answer & explanationAnswer & explanation
Correct answer: C. Research the process name to determine if it is a legitimate Windows process or malware
The malware removal best-practice procedure begins with investigating and verifying the suspicious symptom. The name 'svch0st.exe' closely mimics the legitimate 'svchost.exe' process, a common malware disguise, so it must be confirmed as malicious before any remediation steps are taken.
Why the other options are wrong
- A. Disabling System Restore happens later, only after malware is confirmed.
- B. Deleting files before verification could damage the system if the process is legitimate.
- D. Reformatting is a last resort, not a first step.
Investigate and Verify Malware Symptoms
The first step in malware remediation is to research and confirm that a suspicious process, file, or behavior is actually malicious before acting.
- Malware often disguises process names to mimic legitimate Windows files
- Verification prevents accidental damage to legitimate system components
- This is step one of the seven-step malware removal best practices
Memory trick: 'I Quit Disks, Remediate, Schedule, Enable, Educate' — Investigate first!