How do they check services running in the background? Task Manager?
No way to do it if the machine is compromised.