What Type of Malware Mimics svchost.exe and Lacks Digital Signature?
During a penetration test, you discover a process named 'svch0st.exe' running on a Windows server with high CPU usage. The file is not digitally signed. Which type of malware is MOST likely present?
Quick Answer
The answer is a Trojan. This is correct because the process name ‘svch0st.exe’ uses a zero in place of the letter ‘o’ to masquerade as the legitimate Windows system process svchost.exe, a classic Trojan tactic to evade casual inspection. The absence of a digital signature combined with abnormally high CPU usage further confirms malicious intent, as legitimate Windows core processes are always signed by Microsoft and do not typically consume excessive resources without cause. On the Certified Ethical Hacker CEH exam, this scenario tests your ability to recognize social engineering through filename obfuscation and to differentiate between malware types—Trojans rely on deception to gain initial access, unlike worms or viruses that self-replicate. A common trap is mistaking this for a rootkit, but rootkits hide processes entirely rather than mimicking them. Memory tip: “Zero in the name, zero trust—if it’s not signed, it’s a Trojan in disguise.”
⚠ Common exam trap
It's easy for candidates to confuse a process name mimicking a legitimate service with a worm or virus, but the key differentiator is the lack of self-replication or code mutation, making it a Trojan that relies on user deception.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Trojan
The process name 'svch0st.exe' mimics the legitimate Windows service host 'svchost.exe' but uses a zero instead of 'o', a common masquerading technique. The lack of a digital signature and high CPU usage indicate malicious activity, and because it appears to be a standalone executable disguised as a system process, it fits the definition of a Trojan—malware that deceives users into running it by appearing legitimate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Polymorphic virus
Why it's wrong here
Polymorphic viruses change their code, but the indicator here is masquerading, not mutation.
- ✗
Ransomware
Why it's wrong here
Ransomware typically displays ransom notes and encrypts files, not just high CPU usage.
- ✓
Trojan
Why this is correct
The process masquerades as a legitimate service (svchost.exe) to avoid detection, typical of a Trojan or backdoor.
- ✗
Worm
Why it's wrong here
Worms self-replicate and spread without a host file, but this process masquerades as a legitimate process characteristic of a Trojan.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a forensic investigation, you find a file named 'svch0st.exe' in the startup folder. The file has a suspicious icon and was downloaded from an untrusted source. Analysis shows it opens a backdoor on port 4444 and sends system information to a remote server. Which THREE best describe this malware and its characteristics?
hard- ✓ A.It functions as a remote access Trojan (RAT)
- ✓ B.It is classified as a Trojan horse
- C.It is a polymorphic virus that changes its signature each time it runs
- D.It is a worm that replicates across the network automatically
- ✓ E.It is capable of exfiltrating data to a remote server
Why A: The malware opens a backdoor on port 4444 and allows remote control, which is the defining behavior of a Remote Access Trojan (RAT). The file's deceptive name ('svch0st.exe') and origin from an untrusted source, combined with its malicious payload, classify it as a Trojan horse. It also sends system information to a remote server, confirming its ability to exfiltrate data and provide unauthorized remote access to the attacker.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.