CompTIA A+ Core 2 Domain 3: Software Troubleshooting

Startup Repair runs from WinRE and automatically rebuilds corrupted Boot Configuration Data and other boot files, the least invasive fix that targets the exact 0xc0000034 cause described.

• AThis option jumps to a destructive reinstall when a non-destructive repair of the boot files would very likely restore the system, so it needlessly risks the user's data and time.
• CBoot errors feel hardware-related, but a missing BCD entry is a software boot-store problem and there is no SMART warning or POST evidence that the drive itself has actually failed.
• DThe trap is forgetting the machine cannot reach the desktop at all, so an in-Windows command can never launch; any system-file repair would have to run from the recovery environment instead.

Safe Mode loads minimal drivers so the system boots, letting the tech roll back the third-party driver that caused the bug check, the leading root cause of stop errors per Microsoft analysis.

• AMemory faults can cause stop errors, but the crashes began immediately after a specific driver install, so swapping hardware first ignores the obvious recent software change that triggered them.
• BReinstalling the whole operating system would eventually help but needlessly destroys the existing configuration when a targeted rollback of one driver in Safe Mode is far less invasive.
• DShowing the stop code aids diagnosis, yet on its own it only reveals information and never removes the offending driver, so the boot loop and repeated crashes would simply continue unabated.

Microsoft attributes slow performance to too many startup apps and limited storage, so reducing the startup load and reclaiming drive space targets both observed causes directly.

• AThis is classic mechanical-drive advice and the trap here, because defragmenting a solid-state drive provides no meaningful speed gain and is not what Microsoft recommends for modern storage.
• BExtra memory can help some workloads, but jumping to a hardware upgrade skips the obvious, free fixes of trimming startup apps and freeing the nearly full disk that clearly explain the slowdown.
• CA full operating-system reinstall is a heavy, time-consuming last resort that risks data loss when the slowdown is already explained by too many startup apps and an almost-full drive.

A service marked Disabled cannot run; changing its startup type to Automatic and starting it, along with any dependencies, restores the spooler, which is exactly what service management provides.

• BReinstalling a driver is the reflex when printing fails, but it does nothing about a service that was deliberately set to Disabled and wastes time on an unrelated component of the print stack.
• CHand-editing the registry to rebuild a built-in service is risky and unnecessary when the Services console exposes a supported setting to re-enable and start the service safely.
• DFreeing disk space is healthy maintenance, yet it has no bearing on a service whose startup type was switched to Disabled, so the Print Spooler would remain stopped afterward.

A temporary profile signals the original user profile is corrupted, so repairing it or creating a new profile and copying the user's files restores access without rebuilding the PC.

• AReimaging guarantees a clean start but is overkill that wipes the whole machine when only one user's profile is corrupt and other accounts on the same device sign in normally.
• CA corrupt profile feels like data loss, but there is no SMART warning or read error here, so swapping the drive mistakenly treats a software profile problem as a hardware failure.
• DResetting credentials is the habit for sign-in trouble, yet the user already authenticated successfully; the failure is loading their profile, which a new password does nothing at all to repair.

The process calls for disabling System Restore right after quarantine so infected restore points are removed and cannot resurrect the malware once remediation and scanning begin.

• AThis is a genuine step, but it belongs near the end after cleaning; doing it now would preserve restore points that may already be infected and could later reintroduce the same malware.
• BUser education is part of the process, yet it is the final step; performing it before the system is even cleaned skips the technical remediation the infected machine still urgently needs.
• DUpdated definitions are needed, but reconnecting breaks quarantine and risks spreading the infection; updates should be obtained without rejoining the production network until the system is clean.

Apple's guidance is to check for an app or iOS update and then delete and redownload the app, which replaces corrupted app files that cause the repeated crash on launch.

• AA full factory reset is a drastic, data-wiping last resort that is wildly disproportionate when only a single app misbehaves and the rest of the device continues to work normally.
• CA worn battery affects runtime, not whether one app launches, so blaming hardware ignores the clear evidence that every other app opens fine on the very same device.
• DCycling the radios fixes connectivity hiccups, but a code-level crash on launch is not a network problem, so the app would keep closing immediately after the toggle is performed.

Battery settings reveal which app consumes the most power, often through background activity, so the user can reduce that app's background refresh or usage to curb the excessive drain.

• BAging batteries do lose capacity, but the drain started right after installing one app, so swapping hardware ignores the obvious software change that should be investigated and ruled out first.
• CThis confuses charging speed with battery consumption; a charger has nothing to do with how quickly an installed app discharges the battery while the phone is actively in use.
• DTurning off Wi-Fi can push traffic to more power-hungry cellular data and cripples normal use, a blunt change that fails to target the specific app actually causing the drain.

Both Apple and Google tie low free storage to sluggish, crash-prone behavior, so offloading or uninstalling unused apps and clearing caches directly relieves the constraint slowing the phone.

• AA reset can clear space but erases everything, an extreme step when simply removing unused apps and cached files would reclaim storage and restore speed without any data loss.
• BBuying new hardware sidesteps the real, fixable cause; the warnings point squarely at full storage, which can be cleared in minutes far more cheaply than a full device replacement.
• DThis is a common myth; force-closing apps constantly does not improve speed or storage and the makers advise against it, so the underlying full-storage problem would simply remain.

The changing homepage, redirects, and a toolbar that returns are classic hijacker/PUP signs, so removing the unwanted software, resetting the browser, and scanning with anti-malware clears it.

• BRedirects can feel network-related, but a router swap cannot explain a reappearing toolbar and altered browser settings, which live on the PC inside the browser, not on the network gear.
• CDismissing it as harmless and only clearing history leaves the underlying unwanted program installed, so the homepage hijack and redirects will return immediately the next time the browser opens.
• DReplacing the whole machine to avoid adware is enormously wasteful when the unwanted software can be removed and the browser reset in just a few minutes on the existing PC.

Browsers compare a certificate's validity dates against the device clock, so a wildly wrong date makes valid certificates appear invalid; fixing the clock resolves the error across every site.

• AClicking through is the tempting shortcut, but bypassing certificate validation one site at a time is unsafe and never corrects the underlying clock error that is generating all the warnings.
• BReinstalling the browser is a common reflex, yet the certificates are valid and the browser is fine; the device's date mismatch, not the software, is causing every page to be rejected.
• CAn expired certificate is a real cause for one site, but assuming many unrelated sites all expired simultaneously is implausible and instead points clearly to the wildly wrong device clock.

The fake alert is scareware/tech-support fraud that exploits urgency, so ignoring the number, closing the browser, and scanning with legitimate software is the safe and correct response.

• AThis is exactly the scam's goal; the number reaches fraudsters, and genuine Microsoft error messages never include a phone number to call for support, so calling it walks straight into the trap.
• CPaying for the pushed 'antivirus' funds the scammers and often installs malware itself, since the alarming alert is fabricated and the rogue product is harmful, not protective software.
• DHanding over credentials or remote access to an unsolicited pop-up's contact lets criminals seize the machine and its data, which is precisely the social-engineering trap being set here.

Microsoft says to run DISM before SFC so the repaired image gives SFC a healthy source to restore protected files from.

• AThis trap stops at SFC alone; when the component store image is itself damaged, SFC cannot pull a clean copy and corruption remains unfixed.
• CThis jumps to a destructive rebuild that wipes apps and data before trying the supported, non-destructive repair tools that fix corrupt system files in place.
• DThis misattributes missing DLL errors to file-system or disk faults; chkdsk repairs volume metadata, not the protected operating-system files that are actually corrupt.

Low storage causes update failures; clearing temporary and unneeded files restores the room the installer needs.

• AThis trap blames hardware; 0x800f0922 is documented as an inability to install due to insufficient disk space, not a TPM or board failure requiring replacement.
• BCutting the network prevents the update from downloading at all and does nothing about the low free space that is actually blocking installation.
• DA full factory rollback is destructive overkill and is unrelated to activation; the error points squarely at a lack of free disk space.

The commit limit is RAM plus all page files; restoring the page file lets committed memory grow so apps stop being denied memory.

• BDisplay hardware does not extend system commit memory; adding a monitor cannot relieve a low-memory condition caused by a missing page file.
• CScaling changes UI sizing, not committed memory; it will not stop the low-memory warnings that stem from an absent paging file.
• DThis confuses disk fragmentation with RAM; defragmenting (and on an SSD, unnecessary) does not recover physical memory or raise the commit limit.

Ransomware encrypts files and demands payment; CISA guidance is to isolate affected systems immediately and restore from clean offline backups.

• ARenamed files that demand crypto payment are encryption, not profile corruption; rebuilding the account leaves the encrypted data and infection untouched.
• BUpdates do not rename files and post ransom notes; uninstalling one ignores the active threat and will not decrypt the affected files.
• CA ransom demand is not a storage problem; deleting temp files cannot reverse encryption and wastes time while the malware may still spread.

If the problem does not occur in Safe Mode, default settings and basic drivers are cleared as causes, narrowing the source.

• AA full reinstall is a last resort that destroys configuration before confirming the cause; it skips the simple diagnostic that isolates drivers and services.
• BSwapping hardware first assumes a fault not yet proven; the crash began right after software was installed, pointing to drivers rather than the card.
• DRunning a file scan in the failing environment ignores the crash and does not isolate whether basic drivers and services are the cause.

System Restore reverts system files, registry, and installed programs to an earlier point without affecting personal files.

• AReset with Remove everything wipes personal files, apps, and settings, which violates the requirement to preserve the prior working configuration.
• CReinstalling from media typically removes files and apps and is far more disruptive than reverting a single recent change with a restore point.
• DFormatting destroys everything the user must keep; it is the most extreme action when a targeted restore point would undo the change.

Connecting directly with the device's own cable removes the hub and cable as variables, isolating whether the dock is at fault.

• BOther USB use likely still works, so a wholesale controller failure is unproven; replacing the board skips simple isolation of the hub and cable.
• CReinstalling the OS is disproportionate for one drive that fails only through a dock and works fine on other machines.
• DReformatting destroys data and is illogical because the drive is recognized elsewhere, indicating the local dock or port, not the drive, is the issue.

When a PC misbehaves right after an update, the documented fix is to uninstall that update or go back to the previous build.

• AResetting and reinstalling all apps is heavy-handed for a single regression that a targeted update rollback would resolve in minutes.
• BDisabling the service is a workaround that abandons the app rather than addressing the update that introduced the crash.
• CThe crash correlates exactly with the update, not random memory faults; swapping RAM treats an unproven hardware cause first.

Apps that auto-run at startup slow boot time; disabling the ones the user does not need reduces that overhead.

• AEnlarging virtual memory does not stop unneeded programs from launching at boot, which is what the high-impact startup entries reveal.
• CAdding displays does nothing to reduce the number of programs launching at boot and will not shorten the slow startup.
• DDisabling updates harms security and is not the cause; the bottleneck is the many high-impact startup applications, not update checks.

Issues caused by a recent driver update can be reverted, returning the device to its last good driver while keeping files.

• AA media reinstall risks personal files and is excessive when a single recent driver change can be reverted directly.
• BDisk Cleanup removes temporary files, not installed drivers, so it cannot revert the update that caused the flicker.
• DChanging resolution only masks symptoms and leaves the faulty new driver in place instead of reverting the change that caused the failure.

Vendors recommend pausing/resuming the download and restarting the device to clear a temporary glitch on a single stuck update.

• BA factory reset wipes the whole device for one stuck update; it is a last resort, not a sensible first troubleshooting step.
• CBattery health does not freeze a single app's update; swapping hardware ignores the simple retry that usually clears a stuck download.
• DAirplane Mode disables the connectivity the update needs; keeping it on permanently guarantees the download can never complete.

OS updates need free space; both vendors say to clear room by removing apps or content, then install the update.

• AAn out-of-space message indicates a full volume, not failed hardware; replacing the storage chip misreads a routine capacity problem.
• BPulling the SIM affects cellular service, not free space; the update is blocked by storage, so a network change will not help.
• CDisabling updates merely hides the problem and leaves the OS outdated; it does nothing about the lack of space that blocks installation.

Devices limit functions and dim when too hot; stopping resource-heavy apps and removing heat sources lets the phone cool and recover.

• ANothing here indicates a swollen battery; the symptoms match normal thermal protection, so condemning the battery overstates the problem.
• CHeat from a demanding app in a hot car is environmental, not OS corruption; a factory reset is unnecessary and will not change the thermal physics.
• DHeavy app use and ambient heat drive the warming; a faster charger can add heat, so this misidentifies the cause and may worsen it.

Both platforms list battery used per app, so checking usage pinpoints the newly installed app draining the device before removing it.

• AA sudden drop tied to a new app points to software, not a battery that failed overnight; replacing hardware skips the available diagnostic.
• BMaxing brightness wastes power and does not identify a rogue app; the gauge does not need that kind of recalibration.
• DA factory reset before diagnosis is destructive and unnecessary; per-app battery data can identify the offender without wiping the phone.

Event ID 1000 records the faulting application and module, and Reliability Monitor's timeline links the failures to recent changes, pinpointing the cause without a rebuild.

• AThis guesses at disk faults with no evidence; a single app repeatedly crashing while everything else is stable points to that app or its modules, not the volume.
• CThis is a heavy, time-consuming OS rebuild done before any diagnosis; it may not touch a single misbehaving application and skips the quick evidence the logs already hold.
• DFailing memory tends to crash many processes randomly, not one program predictably; swapping hardware before reading the crash logs wastes parts and time.

The commit charge cannot exceed RAM plus page files, so enlarging the paging file (and adding RAM) raises the limit and stops the out-of-virtual-memory errors.

• ARemoving the page file lowers the commit limit to roughly installed RAM, so the system runs out of committable memory sooner and the allocation failures get worse.
• CA removable flash drive is slow, may be disconnected, and does not raise the commit limit meaningfully; the warnings stem from too small a commit limit, not disk location.
• DThe scenario states disk space is plentiful, so freeing files does nothing; the shortage is committable memory governed by RAM and the paging file, not free disk space.

Selective suspend powers down idle USB devices to save battery; disabling it stops Windows from suspending the drive and reader, which is exactly the described idle-drop pattern.

• BA failing controller would not recover instantly on access and would not reproduce identically across several laptops; the consistent idle-then-drop behavior points to a power policy.
• CA file-system mismatch causes read/write or mount errors, not a fingerprint reader and drive both vanishing after identical idle periods across machines.
• DRolling back a driver is a blind change when a documented power-management feature explains the symptom; selective suspend, not the chipset driver version, is suspending the devices.

Idle SMB sessions are dropped to save resources and reconnect on demand; adjusting the server's autodisconnect timeout changes how soon the red X appears.

• ACorrupt credentials would block reconnection, but here the share reconnects instantly on access; recreating profiles is destructive overkill for a normal idle-timeout behavior.
• BAdapter power saving would also break other traffic and not reconnect transparently on a click; the symptom is the file server dropping idle sessions, not the NIC sleeping.
• DA letter conflict prevents the mapping from forming at all; it does not produce a working share that simply goes idle and reconnects on access.

Long delays after the credentials are accepted come from post-authentication processing; the Group Policy Operational log times each component so you can find the slow one.

• AA failing drive would also slow the fast local login and general use; the local account logging in quickly shows the disk is fine and the delay is account-specific.
• CCutting the network only confirms the offline path is fast; it does not identify which networked logon component is slow and leaves the user unable to reach resources.
• DThe fast local logon shows memory is adequate; a slow domain logon points to profile, policy, and script processing, not a virtual-memory shortage.

An in-place upgrade reinstalls the OS over itself and repairs components while the Keep personal files and apps option retains both installed programs and user data.

• AReset with Keep my files preserves documents but deletes installed desktop applications, so it fails the explicit requirement to retain all programs.
• BA clean install erases applications, settings, and files on the partition, which is the opposite of keeping everything and is far more disruptive than needed here.
• DA new profile works around user-specific corruption but does not repair damaged OS components, so the system-wide search and component errors would persist.

Kerberos rejects tickets when the clock skew is too large, so resyncing the Windows Time service back to the domain hierarchy restores authentication directly.

• BDomain rejoin is a disruptive fix for a secure-channel problem; here the trust failures stem from clock skew exceeding Kerberos tolerance, which resyncing time resolves.
• CA dead CMOS battery usually shows after power-off; a battery swap may be warranted later but does not by itself resync the running clock or restore Kerberos now.
• DTurning off Kerberos weakens security and is not user-configurable for the domain; the proper fix is correcting the clock so Kerberos works as designed.

Low free internal storage blocks installs, so reclaiming space by clearing caches and removing or archiving unused apps and files lets the new app fit and install.

• AA factory reset erases all data and apps for a routine space shortage; it is a last resort, not the first step, and loses the user's content unnecessarily.
• CThe OS and system apps cannot be relocated to an SD card, and modern Android keeps installed apps in internal storage; this does not free the needed space.
• DTurning off security updates harms the device's safety and reclaims little space; the install fails because usable free storage is low, not because updates are queued.

An incorrect clock breaks the secure connection the store uses for authentication, so fixing date/time (and clearing the store cache) is the quickest, least invasive fix.

• BBrowser and email working over Wi-Fi prove general connectivity is fine, so a SIM swap targets the wrong layer; the store-specific failure points to the device's secure-connection settings.
• CWiping the device for a store connection error is destructive and premature; simple checks such as the clock and store cache usually restore access without data loss.
• DPermanently disabling protections is poor practice, and the symptom after a long power-off most often traces to a drifted clock, not a firewall; toggling a VPN temporarily would suffice.

An accessory absent from the list usually is not discoverable, so placing it in pairing mode near the phone makes it appear so it can be selected and paired.

• AA network-settings reset wipes working Wi-Fi and Bluetooth pairings for one stubborn accessory; it is heavy-handed when the headset has simply not been put into discovery mode.
• COther accessories pair fine, so the Bluetooth stack works; updating the OS does not address a headset that was never placed in discoverable mode.
• DDeclaring it defective skips the basic step of entering pairing mode; many accessories only become discoverable after holding a button, so the unit is likely fine.

If device location is off or the app lacks precise-location permission it cannot position the user; enabling these and improved accuracy restores reliable fixes.

• AHardware replacement is premature on a working new phone; a location fix is almost always a settings or permission issue, which costs nothing to check first.
• BCutting data removes the Wi-Fi and cellular assistance that improves accuracy and speed; it makes positioning slower and less reliable, not better.
• DA full reset is excessive for a location issue and erases the user's data; toggling Location Services and the app's permission resolves it far more simply.

Safe Mode disables downloaded apps, so if reboots stop a recently installed app is to blame; updating first and removing suspects one by one finds the offender without data loss.

• AUnvetted booster apps can themselves cause instability or malware and mask the real culprit; they add risk rather than isolating which installed app triggers the reboots.
• CA factory reset erases the user's data and does not identify the offending app; if they reinstall it afterward the reboots return, so it is premature here.
• DThe reboots started right after installing apps and the phone charges normally, pointing to software; swapping the battery ignores that timing and may not change anything.

Per-app data usage names the heavy consumer, and restricting its background data or removing a rogue sideloaded app directly stops the drain while keeping the phone usable.

• ADisabling all mobile data cripples legitimate apps and never identifies the offender; it hides the symptom instead of locating and restricting the app responsible.
• CPaying for more data rewards the abusive app and ignores a likely security problem; the goal is to find and stop the rogue app, not to fund its traffic.
• DCycling Airplane mode only briefly drops connections; a misbehaving app resumes transmitting immediately, so this neither identifies nor contains the responsible app.

An extension that returns is usually re-added by an installed program, so removing that program, clearing the extension, resetting the browser, and scanning eliminates the source.

• BRe-entering settings treats the symptom while the underlying program keeps resetting them; the hijacker persists, so the redirects return every session.
• CThe redirection is driven by a local extension or program rewriting requests, not by DNS, so changing resolvers leaves the hijacking software in place and active.
• DA full OS reinstall is far more drastic than needed; removing the unwanted program, resetting the browser, and scanning resolves browser hijacks without rebuilding the PC.

Scanning from outside the running Windows shell means the malware cannot defend itself, letting an offline scan reach viruses and rootkits that disable in-Windows tools.

• BIf active malware is killing the scanner, reinstalling the same tool inside the infected session lets the malware disable it again; the engine must run where the malware cannot.
• CTurning off updates and the firewall lowers defenses and does nothing to stop malware that is actively terminating the scanner; it makes the situation worse.
• DThe scanner already runs with sufficient rights; elevating the user does not stop malware that re-disables protection, and broader rights can help the infection spread.

Ransomware encrypts files and can move laterally, so isolating the host first limits damage while evidence is preserved and clean offline backups drive recovery.

• APaying funds criminals, offers no guarantee of recovery, and is discouraged by guidance; it also skips containment, allowing the ransomware to keep spreading to other systems.
• CThe files are encrypted by malware, not corrupted by the file system, so disk-repair tools cannot restore them and the running ransomware continues encrypting in the meantime.
• DWiping immediately destroys forensic evidence and any chance of decryption, and it skips network isolation, so the threat may persist elsewhere on the network.

These scare pop-ups are scams, not real alerts; force-closing the browser, clearing data, and scanning removes the page safely without ever contacting the scammers.

• ALegitimate Microsoft errors never include phone numbers; calling reaches scammers who request remote access and payment, which is exactly the trap this pop-up is built to spring.
• BInstalling the tool grants scammers control of the machine to plant malware and steal data; the warning is fake, so no remote verification through it is trustworthy.
• DA hard power cut risks data loss and does not address the scam page, which can simply reappear; closing the browser and clearing data is the proper, safer response.

Browsers validate a certificate's dates against the system clock, so a clock reset by the new battery flags every site; correcting the time clears the errors across all sites.

• ABypassing certificate warnings habitually defeats HTTPS protection and can expose the user to interception; the proper move is to fix the cause, not ignore every warning.
• CManually adding certificates is risky and unnecessary, and it ignores the obvious shared cause; the errors hit every site because of the local clock, not missing trust anchors.
• DThe phone on the same network loads the sites fine, so the router is not at fault; the desktop-only failure right after a battery swap points squarely at its wrong clock.

Compatibility mode makes Windows present older API and version behavior to the app, which is exactly what a Windows 7-era program that refuses to launch on Windows 11 needs.

• AA repair install rebuilds Windows components, but the program runs everywhere else, so the OS is not corrupt; this heavy step ignores the obvious version-compatibility cause.
• CDowngrading the whole PC to fix one legacy app sacrifices security updates and every modern app, when a per-program compatibility setting solves it without touching the OS.
• DA clean 'can't run on your PC' close at launch is a version block, not a memory exhaustion symptom, which would instead produce low-memory warnings across many programs.

Windows flags repeated failed boots and fails over to WinRE, giving access to Startup Repair, System Restore, and other tools without any installation media.

• ARemote registry editing needs the target to be booted and reachable on the network, which a machine stuck before sign-in is not, so this approach cannot even begin.
• BThat Settings path only works when Windows actually loads; this laptop never reaches the desktop, so the in-Windows route to Advanced startup is unavailable here.
• DSwapping the drive and reinstalling destroys data and assumes hardware failure with no evidence; WinRE can often repair a boot problem the bad shutdown caused.

The troubleshooter automatically resets common update components and clears stuck states, resolving many failed-update loops before any manual command-line work is needed.

• BThe connection works for everything else and the update downloads before failing, so a flaky NIC is not indicated; this targets the wrong subsystem entirely.
• CThis manual component reset can work, but it is exactly the command-line repair the question says to defer; the automated troubleshooter should be attempted first.
• DA full reset removes installed apps and is far too drastic for a single failed update; lighter, targeted fixes have not yet been exhausted.

A clean boot keeps full drivers and networking while stopping third-party services and startups, letting the technician selectively re-enable to pinpoint the conflict.

• ASafe Mode loads only minimal Microsoft drivers and services, not 'every program except one,' so it cannot single out which third-party app is responsible.
• BThese tools repair protected OS files, but the freezes began right after adding utilities, pointing at third-party software, not Windows component corruption.
• CMass uninstall and slow reinstall is disruptive and time-consuming; a clean boot isolates the conflict in one session without removing the user's software.

A restore point snapshots system files, settings, and drivers and can be reverted later without affecting personal files, exactly fitting a risky driver install.

• AYou cannot reliably copy a live Windows folder back over a running OS; this leaves the registry and protected files inconsistent and will not cleanly restore the state.
• CA full image works but is slow and heavyweight for undoing one driver change; the built-in restore point captures the needed system state far more quickly.
• DFile History only versions personal files; it does not capture or restore system files, drivers, or the registry that a faulty driver would corrupt.

Disabling the rogue proxy stops the redirect immediately, and scanning removes the malware that configured it so it cannot simply re-enable the setting.

• AOnly this PC is affected while others on the same network are clean, which points at a local setting on this machine, not the shared router.
• BThe redirect comes from a system-wide proxy that all browsers obey, so reinstalling individual browsers leaves the malicious proxy in place and the problem returns.
• DThe evidence shows a manual proxy, not DNS poisoning; changing DNS ignores the visible cause and leaves the malicious proxy redirecting traffic.

Corrupted cached data commonly makes a single app crash or render blank; clearing only the cache fixes that without removing the user's accounts or app settings.

• BOnly one app misbehaves while everything else works, so the system is healthy; wiping the whole phone is grossly disproportionate to a single-app glitch.
• CSafe Mode disables all third-party apps and is only a diagnostic state, not a permanent fix; the user needs the app working in normal mode.
• DOther apps and the browser load fine on the same Wi-Fi, so the network is not blocking content; the fault is isolated to this one app.

Resetting network settings wipes the corrupted Wi-Fi, VPN/APN, and Bluetooth data the user introduced while leaving photos and apps intact, restoring connectivity.

• AA full erase deletes all data and is far heavier than needed; the symptoms point to corrupted network configuration, which has its own targeted reset.
• BThe SIM and carrier control cellular service, not Wi-Fi joins or Bluetooth pairing, so swapping it will not address these connectivity failures.
• CManually redoing each connection is tedious and may not clear the corrupted VPN, APN, and network state the user introduced; one reset handles all of it.

Play Protect flags harmful apps for removal, uninstalling the rogue app eliminates the adware, and updates close the hole that let it in.

• AStacking multiple real-time scanners causes conflicts and slowdowns without added benefit; the device already includes Play Protect to scan for harmful apps.
• CTurning off Play Protect removes your main defense, and deleting random system files risks bricking the phone while likely missing the actual malicious app.
• DAds on the Home screen come from an installed app, not cached web pages, so clearing the browser cache leaves the malicious app running.

Sticking to the vetted store avoids the unvetted APKs that carried the malware, and leaving Play Protect on keeps scanning apps regardless of install source.

• ADisabling Play Protect removes the scanning that catches harmful apps from any source, making reinfection from sideloaded files far more likely, not less.
• BRooting weakens the security model and voids protections; it adds risk and complexity rather than preventing malicious sideloaded apps from running.
• DMalware in a sideloaded package can run and persist offline and reconnect later, so installing without a connection does not make a malicious APK safe.

When malware survives scanning and removal, a factory reset wipes the persistent infection, and restoring only trusted data avoids reintroducing the threat.

• BThe malware is an installed app, not something carried by the SIM, so removing it changes only connectivity and leaves the persistent infection running.
• CReappearing apps are a software persistence mechanism, not a hardware fault, so swapping the battery and screen does nothing to remove the malware.
• DCache clearing removes temporary files, not the malicious app's code or its persistence, so the infection keeps re-creating itself no matter how often you clear.

The update broke the boot, so the WinRE Uninstall Updates tool reverses just that change and restores startup while preserving the user's files and apps.

• ARemoving everything erases the user's files and apps, violating the requirement to keep them, and is far more drastic than reversing one update.
• BAn old image would discard everything added since it was made, losing recent apps and documents, when only the latest update needs to be removed.
• CHand-deleting update files and rebuilding the BCD is error-prone and does not cleanly remove an installed update; a built-in option does this safely.