Three commands that can play a major role in system security

Some basic commands can often play a big role in protecting network security. The following commands are very prominent.

Check network connection
If you suspect that someone has installed a Trojan horse on your computer, or is infected with a virus, but there is no perfect tool in your hand to detect whether this is the case, then you can use the network command that comes with Windows to see who is in Connect your computer. The specific command format is: netstat -an This command can see all the IPs that establish a connection with the local computer. It contains four parts-proto (connection method), local address (local connection address), foreign address (and local establishment Connected address), state (current port state). Through the detailed information of this command, we can completely monitor the connection on the computer, so as to achieve the purpose of controlling the computer.

Disable unknown services
Many friends will find that the computer slows down after the system restarts one day, no matter how optimized it is, and no problems can be found with antivirus software. At this time, it is likely that someone has opened a special one for you after invading your computer. Certain services, such as IIS information services, etc., so that your antivirus software cannot be found. But don't worry, you can use "net start" to see what services are open in the system. If you find a service that is not open by yourself, we can disable this service in a targeted manner. The method is to directly enter "net start" to view the service, and then use "net stop server" to prohibit the service.

Check your account easily
For a long time, malicious attackers like to use clone account method to control your computer. The method they used is to activate a default account in the system, but this account is not often used, and then use the tool to elevate this account to administrator permissions. On the surface, this account is still the same as the original, but this clone Account is the biggest security risk in the system. Malicious attackers can arbitrarily control your computer through this account. In order to avoid this situation, you can use a very simple method to detect the account.

First enter net user at the command line to see what users are on the computer, and then use "net user + user name" to see what permissions this user belongs to, generally except that the Administrator is in the Administrators group, nothing else! If you find one The users built into the system belong to the administrators group, which is almost certainly you have been hacked, and someone else has cloned the account on your computer. Use "net user username / del" to delete this user!