Triage a suspicious process and stop it
On a canned Windows 11 workstation, use tasklist to pair an endpoint-alerted sample image with its current PID, then use taskkill /PID with /F to stop that exact process instance. Treat the action as authorized containment only: an unusual name is not proof of malware, a PID can be reused, and a stopped process can return through a service or another persistence mechanism. Escalate confirmed or recurring activity to the full malware-removal procedure. This simulation does not inspect or stop anything on the learner's device. Practice, not exam questions. Not a score predictor. Nothing here is taken from any exam.
Steps
- 1
Run tasklist, read the Image Name and PID columns together, and locate the alert-identified sample image winupd32.exe at PID 6844 in the fresh listing.
- 2
Run taskkill /PID 6844 /F and record the SUCCESS line. Treat it as process containment only; monitor for recurrence and escalate a service-backed or otherwise persistent process to the full malware-removal runbook.
What you should see
The default tasklist table shows Image Name, PID, Session Name, Session#, and Mem Usage, including the canned winupd32.exe row at PID 6844. The stop command prints SUCCESS: The process with PID 6844 has been terminated. That line confirms the instance ended, not that its file or persistence was removed.