Windows Security · 2.5
⚙️ Services & Task Manager
Stop malicious processes and disable dangerous services⏱ ~3 min
Services are programs that run invisibly in the background. Some are essential to Windows; others are unnecessary security risks. Task Manager lets you see everything running right now.
Task Manager — Know Your Tabs
| Tab | What It Shows | Competition Use |
|---|---|---|
| Processes | Every running app and background process | Find and kill suspicious or unauthorized processes |
| Performance | CPU, RAM, disk, network usage | Spot unusual resource consumption (mining malware uses 100% CPU) |
| Services | All Windows services (running and stopped) | Quick-disable a service; see its name to look it up |
| Users | Logged-in users | Spot unauthorized active sessions; disconnect them |
| Startup | Programs that auto-start at login | Disable malicious or unwanted startup programs |
Services Manager (services.msc)
- •Startup Types: Automatic (starts at boot), Manual (started on demand), Disabled (never starts)
- •Dangerous services to disable if not needed: Remote Desktop Services (RDP), Telnet, FTP Publishing Service, SNMP Service
- •Right-click a service → Properties → change Startup type to Disabled → OK → right-click → Stop
Remote Desktop Protocol (RDP) — A Common Vulnerability
⚠ WarningRDP (port 3389) allows remote control of a Windows machine. If the competition scenario does NOT require remote access, disable it: secpol.msc → or Win+R → sysdm.cpl → Remote tab → 'Don't allow remote connections'. Also disable the RDP service in services.msc.
Finding Suspicious Processes
- •Look for processes with generic names hiding in system folders (svchost.exe is legitimate; svch0st.exe is not)
- •Right-click any suspicious process → 'Open file location' — legitimate Windows processes live in C:\Windows\System32
- •High CPU usage from an unknown process = possible cryptocurrency miner or malware
- •Use netstat -ano in Command Prompt to see which process (PID) is using each network port
cmd
# See all open ports and the PID using eachnetstat -ano # Find the process name for PID 1234tasklist | findstr 1234 # Kill a process by PIDtaskkill /PID 1234 /F🧠Quick Checkfirst try = +5 XP
A service you don't recognize is running. Best first step?
🎮 Practice what you learned
⭐ 0 XP🔥 0 days