I am learning how to analyze what a Windows system is doing based on looking at processes and network connections. One system I just ran across has Process ID zero with multiple connections to external IP addresses (most Yahoo registered) on port 80. This has me suspicious as I assume process ID...
What process do you think may have the maximum number of children? What is its PID? Can you divide its children into two categories ?