Config

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	*MSConfig32	aecache.exe	"Detected by F-Secure as the OBFUSCATED.GP TROJAN!"
?	.NET config	sysmon32.exe	"??"
Y	36X Raid Configurer	JMRaidSetup.exe	"JMB36x series RAID configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers"
X	Adobe	sysconfig.exe	Added by an unidentified WORM or TROJAN!
X	Aol Configuration Loader	aimsng.exe	"Added by the SDBOT-XE WORM!"
X	AolCon	config.com	"Added by the TAPLAK WORM!"
X	Bluetooth Config	btwindin32.exe	"Added by the SDBOT-DFN WORM!"
X	Boot Config	bootconfig.exe	"Added by the FLOOD-EV TROJAN!"
X	Cli Confg	cliconfig.exe	"Added by a variant of the SPYBOT WORM! See here"
X	cmd32	configs.exe	"Hijacker
X	Compaq32 Service Drivers	msconfig32.exe	"Added by the SDBOT-ADC WORM!"
X	Confg	bootconfig.exe	"Added by the VB-ERB WORM!"
X	Config	service.exe	"Added by the ISRAZ.B WORM!"
X	Config	WinService32.exe	"Added by the CRUTCHA-A TROJAN!"
X	Config	winconfig.exe	"Added by the GIP.113.B1 TROJAN!"
X	Config	CONFIG.EXE	"Added by the PSWGIP.B TROJAN!"
X	Config	TaskUpdate.exe	"Added by the MDROP-BRO TROJAN!"
X	Config Loadation	iEEexplore.exe	"Added by the SDBOT.H TROJAN!"
X	Config Loadatiorin	I3Explorer.exe	"Added by the SDBOT.H TROJAN!"
X	Config Loader	svchosl.exe	"Added by the GAOBOT.P WORM!"
X	Config Loader	sysldr32.exe	"Added by the GAOBOT WORM!"
X	Config Loader	scvhost.exe	"Added by the GAOBOT.AE or GAOBOT.AO WORMS!"
X	Config Loader	svhost.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Config Loader	svchost2.exe	"Added by the AGOBOT.XE WORM!"
X	Config Loader	[worm filename]	"Added by the AGOBOT-AE WORM!"
X	Config Loader	SYSMGR.EXE	"Added by the AGOBOT.C WORM!"
X	Config Loader	wincrt32.exe	"Added by the AGOBOT-AW WORM!"
X	Config Loader for Microsoft Windows	mwincfg32.exe	"Added by the AGOBOT.BD WORM!"
X	Config Loader2	explores.exe	"Added by the GAOBOT.BT WORM!"
X	Config Loadr	winsys32.exe	"Added by the AGOBOT-HN WORM!"
X	Config33.exe	Config33.exe	"Added by the SDBOT.T TROJAN!"
X	ConfiggLoader	cart322.exe	"Added by the GAOBOT.DJ WORM!"
U	ConfigSafe	CFGSAFE.EXE	"ConfigSafe - lets you identify changes to the registry
U	ConfigSafe	AUTOCHK.EXE	"ConfigSafe - lets you identify changes to the registry
N	ConfigServices	Config.exe	Part of initial setup on a Compaq PC
X	configsetup	configsetup32.exe	"Added by the AGOBOT-AFP WORM!"
X	Configuration	explorer32.exe	"Added by the SDBOT-ML WORM!"
X	configuration	apphost.exe	"Added by the SDBOT-VP WORM!"
X	Configuration	ntsys32.exe	"Added by the SDBOT-LN WORM!"
X	Configuration	msgfixs.exe	"Added by the SDBOT-NN WORM!"
X	Configuration Default	Wuxat.exe	"Added by the SPYBOT-CA WORM!"
X	Configuration Driver	scghost.exe	"Added by the SDBOT-DLA WORM!"
X	Configuration File	Winset32.exe	Added by the FLUX.101 TROJAN!
X	Configuration Loaded	wupdated.exe	"Added by the MOEGA or MOEGA.AG or MOEGA.AP WORMS!"
X	Configuration Loaded	lssas.exe	"Added by a variant of the SDBOT WORM!"
X	Configuration Loaded	iexploree.exe	"Added by the SDBOT-KC WORM!"
X	Configuration Loader	aim95.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	cmd32.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	syscfg32.exe	"Added by the SDBOT.B BACKDOOR!"
X	Configuration Loader	service5.exe	"Added by the GAOBOT.AF WORM!"
X	Configuration Loader	lfass.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	sycfg34.exe	"Added by the GAOBOT.AN WORM!"
X	Configuration Loader	wincrt32.exe	"Added by the GAOBOT.BF WORM!"
X	Configuration Loader	windex.exe	"Added by the GAOBOT.BZ WORM!"
X	Configuration Loader	dosrun32.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Service.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Servicess.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	sw32.exe	"Added by the AGOBOT.BQ WORM!"
X	Configuration Loader	System.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Winreg.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	sysinfo.exe	"Added by the GAOBOT.FQ WORM!"
X	Configuration Loader	microsoft.exe	"Added by the GAOBOT.JB WORM!"
X	Configuration Loader	confgldr.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	configuration loader	winicfg32.exe	"Added by the GAOBOT.RQ WORM!"
X	Configuration Loader	svhst.exe	"Added by the GAOBOT.YC WORM!"
X	Configuration Loader	msgfix.exe	"Added by the GAOBOT.AUS or SDBOT.J or SDBOT-QG WORMS!"
X	Configuration Loader	msnss.exe	"Added by the GAOBOT.AUS WORM!"
X	Configuration Loader	IEXPL0RE.EXE	"Added by the SDBOT BACKDOOR! Note the number ""0"" in the filename"
X	Configuration Loader	loadcfg32.exe	"Added by the SDBOT BACKDOOR! Note the number ""0"" in the filename"
X	Configuration Loader	MSTasks.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	systemry.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	ccSort.exe	"Added by the AGOBOT.SR WORM!"
X	Configuration Loader	smss32.exe	"Added by the AGOBOT.MB WORM!"
X	Configuration Loader	wincffg.exe	"Added by the AGOBOT.A3 WORM!"
X	Configuration Loader	seru32.exe	"Added by the SDBOT-VR WORM!"
X	Configuration Loader	botss.exe	"Added by the SDBOT-XS WORM!"
X	Configuration Loader	ldasp.exe	"Added by the AGOBOT.BH WORM!"
X	Configuration Loader	msgcfgsrv.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	smsai.exe	"Added by the SDBOT-YE WORM!"
X	Configuration Loader	svupdate.exe	"Added by the RANDEX.DXP WORM!"
X	Configuration Loader	crcss.exe	"Added by the AGOBOT.ADG WORM!"
X	Configuration Loader	lexplore.exe	"Added by the RBOT-AGX WORM! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
X	Configuration Loader	scvhost.exe	"Added by the AGOBOT-AAE and SDBOT.AR WORMS!"
X	Configuration Loader	svchost.exe	"Added by the PARADROP-A WORM! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Configuration Loader	svchost2.exe	"Added by the AGOBOT.JR WORM!"
X	Configuration Loader	dezi.exe	"Added by the SDBOT-OB WORM!"
X	Configuration Loader	mouse.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	msg.exe	"Added by the SDBOT.BT WORM!"
X	Configuration Loader	WinHelper.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	extrac.exe	"Added by the SDBOT-AFP WORM!"
X	Configuration Loader	DVD-Player.exe	"Added by a variant of the SDBOT WORM!"
X	Configuration Loader	IEXPLORE.EXE	"Added by the SDBOT-KW WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Configuration Loader	wincore.exe	"Added by the SDBOT.BHE WORM!"
X	Configuration Loader	configldr.exe	"Added by the AGOBOT-PP TROJAN!"
X	Configuration Loader	ahnhst.exe	"Added by the AGOBOT.MX WORM!"
X	Configuration Loader	ntdm.exe	"Added by the AGOBOT.RV WORM!"
X	Configuration Loader	msnmsgr.exe	"Added by the SDBOT-SO WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Configuration Loader	svschost.exe	"Added by the SDBOT-NS WORM!"
X	Configuration Loader	wump.exe	"Added by the AGOBOT-BU BACKDOOR!"
X	Configuration Loader	WinSys32ys.exe	"Added by the SDBOT.BCS WORM!"
X	Configuration Loader	cvcd.exe	"Added by the AGOBOT-DH BACKDOOR!"
X	Configuration Loader	asnclt32.exe	"Added by the AGOBOT-EB BACKDOOR!"
X	Configuration Loader	soundconf.exe	"Added by the AGOBOT-MH WORM!"
X	Configuration Loader	win32exec.exe	"Added by the SDBOT-LA WORM!"
X	Configuration Loader	mservs.exe	"Added by the SDBOT-NM WORM!"
X	Configuration Loader	update.exe	"Added by the SDBOT-OS WORM!"
X	Configuration Loader	FILENAME.EXE	"Added by the AGOBOT-DQ WORM!"
X	Configuration Loader	explore.exe	"Added by the GAOBOT.GW WORM!"
X	Configuration Loader	msgfixy.exe	"Added by the SLINBOT.QW BACKDOOR!"
X	Configuration Loader	winfix.exe	"Added by the SDBOT-MA WORM!"
X	Configuration Loader	scvh0st.exe	"Added by the AGOBOT-AX WORM!"
X	Configuration Loader	msrun.exe	"Added by the AGOBOT-Y WORM!"
X	Configuration Loader 2	confuldr.exe	"Added by the AGOBOT-FC WORM!"
X	Configuration Loader Service	Winsys32.exe	"Added by the RBOT-YV WORM!"
X	Configuration Loader Service	devl32.exe	"Added by the SDBOT-XY WORM!"
X	Configuration Loader10	ip7.exe	"Added by the AGOBOT-ANZ WORM!"
X	Configuration Loading	svchos1.exe	"Added by the GAOBOT.DK WORM!"
X	Configuration Loading	configldr.exe	"Added by the AGOBOT-EC WORM!"
X	Configuration Loading Service	wscel.exe	"Added by the SDBOT-WJ WORM!"
X	Configuration Loadr	iexplore.exee	Added by an unidentified WORM or TROJAN!
X	Configuration Manager	CNFGLD32.EXE	"Added by the SDBOT TROJAN!"
X	Configuration Manager	Cnfgldr.exe	"Added by the SDBOT TROJAN!"
X	Configuration Manager	cfg32.exe	"BookedSpace parasite. Note - the ""cfg32.exe"" file is located in %Windir%"
X	Configuration Servecie	sewins.exe	"Added by the SDBOT-COH WORM!"
X	Configuration Service	suchost.exe	"Added by the TREB TROJAN!"
X	Configuration Services	mswords.exe	"Added by the SDBOT-YM WORM!"
X	Configuration Update	UPDT32V2.EXE	"Added by the SPYBOT-AA BACKDOOR!"
N	Configuration Utility	CONFIG.EXE	Controls linksys wireless connection. Available from the Desktop
U	Configuration Utility	wlanutil.exe	"NetGear Wireless LAN configuration utility for the MA311 802.11b (and maybe other cards)"
X	Configuration Wizard	Cfgwiz32.exe	"Added by a variant of the HACKTACK TROJAN! Not to be confused with the legitimate MS ""ISDN Configuration Wizard"" (Cfgwiz32.exe)"
X	Configuration32 Loader32	winamp32.exe	"Added by the SDBOT-BIC WORM!"
X	Configurations Asclt	asclt.exe	"Added by the SDBOT-MX WORM!"
X	CONFIGUREv	antivir62.exe	"Added by the AGOBOT-ZD BACKDOOR!"
U	ConfigUtility	ConfigUtility.exe	"Wireless management utility for the HWC54G Hi-Speed Wireless-G CardBus Card from Hawking Technologies
X	ConfigVir	services.exe	"Added by the AUTORUN-DV WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
N	Creative PCI Audio Configuration Utility	starter.exe	"System Tray icon to configure a Creative Soundblaster PCI soundcard. Not required and re-instates itself when un-checked. Try one of the solutions on this special page. Similar to EnsoniqMixer"
X	ctfmoon	microsoftconfigurator.exe	"Added by the DELF-ALS TROJAN!"
X	Current Security Config	csecure.exe	"Added by the RBOT-AMO WORM!"
N	DACONFIGEXE	daconfig.exe	3Com NIC Diagnostics. Available via Start -> Programs
X	DefaultConfiguration	defaultconfh.exe	"Added by the AGOBOT-JC WORM!"
X	Device Configuration Loader	msdvc32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Disk Panel Configuration	dpcsvc.exe	"Added by the IRCBOT.BSQ BACKDOOR!"
X	DNS Config service	win32.exe	"Added by the RBOT-TL WORM!"
N	DPConfig	DPConfig.exe	"Compuware DevPartner Studio Configuration Utility
X	Explorer	config_.com	"Added by the FLOPPY-D WORM!"
X	Explorer5	config_.com	"Added by the VB.CBG WORM!"
X	file laoder configuration	rnd32.exe	"Added by the RBOT.BQJ WORM!"
X	Firewall config	ReadMe.exe	"Added by the SILLYFDC.BBT WORM!"
U	Fortis Secure Layer Config	cseinst.exe	Fortis Bank Home Banking part. Installed during the installation of the software necessary to run the Home Banking. According to Fortis Bank this will not in any way be harmful to the system or relay system information
Y	HPLJ Config	SetConfig.exe	Connects system to networked HP printer.
N	Iconfig.exe	Iconfig.exe	Icon for LS-120 "Superdisk"
X	iConfigLoader	DIIhost.exe	"Added by the GAOBOT.AO WORM!"
X	icrosoft Windows DLL Services Configuration	poker3.exe	"Added by the SDBOT-AER WORM!"
X	IE configure	explorer.exe	"Added by the LINEAGE-C TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually!"
U	Instant Wireless Configuration Utility	WUSB11cfg.exe	"Utility used by the LINKSYS LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration"
U	Instant Wireless Configuration Utility	WPC11Cfg.exe	"Utility used by the LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration"
X	Intel Service Drivers	msconfig16.exe	"Added by the MSCONFIG16 TROJAN!"
U	IntelZeroConfig	ZCfgSvc.exe	"Zero Config MFC Application
X	Internet Config	svchosts.exe	"Added by the SDBOT TROJAN!"
X	Internet Explorer Configuration	IEXPLORE.EXE	"Added by the SDBOT-UL WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Internet Protocol Configuration Loader	ipcl32.exe	"Added by the SDBOT TROJAN!"
X	Inters Configuration Loader	RCL0ADERS.exe	"Added by the SDBOT-KX WORM!"
X	IPConfig	svcxnv32.exe	"Added by the HACARMY.E TROJAN!"
X	IPConfig	svcxnw32.exe	"Added by a variant of the HACARMY.E TROJAN!"
X	IPConfig	ipconfigs.exe	"Added by the HACARMY.C BACKDOOR!"
X	IPSEC Configuration	wsupdate.exe	"Added by the AGOBOT-IQ WORM!"
X	IPTable Configuration	Winipcfgs.exe	"Added by a variant of the RBOT WORM!"
X	JA Config 32	Awesome32.exe	"Added by a variant of the SDBOT WORM!"
X	Java32 Configuration Loader	msnmesgr.exe	"Added by a variant of the RBOT WORM!"
U	JMB36X Configure	JMRaidTool.exe	"JMB36x series RAID configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers"
Y	JMB36X Configure	JMRaidSetup.exe	"JMB36x series RAID configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers"
X	KernelConfig	destiny32.exe	"Added by the AGOBOT.AMB WORM!"
?	LCIDConfig	lcidchng.exe	"??"
X	M1cr0s0ft S3rcurity	systemconfig.exe	"Added by the RBOT.BKB WORM!"
X	MemConfig	SetupIE.com	"Added by the TAPLAK WORM!"
X	Microsft Confige 32	msaconfigurez.exe	"Added by the RBOT.CLC WORM!"
X	Microsoft (R) Windows Configuration Backup Service	svchost.exe	"Added by the RANKY.X TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in either a ""config""
X	Microsoft Config	msconf.exe	"Added by the RBOT.PV WORM!"
X	Microsoft Config	MSCONF.EXE	"Added by the RBOT-LG WORM!"
X	Microsoft Config 32	msconfigx32.exe	Reported as the MSCONFIGX32 TROJAN! Possible Rbot variant
X	Microsoft Config 32bit	mscnfg32.exe	"Added by the RBOT-Z WORM!"
X	Microsoft Config File	config.exe	Added by the KILLFILES.GR TROJAN! This is malware that will attempt to delete all system dlls!
X	Microsoft Config Loader	msconfig32.exe	"Added by the AGOBOT.XX WORM!"
X	Microsoft Config Loader	msrun32.exe	"Added by the AGOBOT-DY WORM!"
X	Microsoft Config Loader	msconf32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Configoration Service	msconfigs.exe	"Added by the RBOT-ETT WORM!"
X	Microsoft Configs 32	msgconfigrs.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Configuewe	msconfiguwe.exe	"Added by the SDBOT-BPK WORM!"
X	Microsoft Configuration	msconfig32.exe	"Added by the SDBOT.MQ WORM!"
X	Microsoft Configuration 35	microsot1.exe	"Added by an unidentified TROJAN!"
X	Microsoft Configuration Wizard	taskmrg.exe	"Added by the SDBOT-MX TROJAN!"
X	Microsoft Configure 32	msgconfigre.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Java Virtual Machine	MsConfiG.exe	"Added by the FORBOT-DV WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting"
N	Microsoft System Configuration Utility	msconfig.exe	Entry that appears when you uncheck an item in the MSConfig Startup group and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup mode. Located in %System% (98/Me/Vista) or %Windir%\PCHealth\HelpCtr\Binaries (XP)
X	Microsoft System DLL Services Configuration	windir32.exe	"Added by the SDBOT-ACY TROJAN!"
X	Microsoft System Restore Configuration	CBRSS.EXE	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Task Messenger Config	taskmgsr.exe	"Added by the SDBOT-JK WORM!"
X	Microsoft Update Clinic	svsipconfig.exe	"Added by the RBOT.BR WORM!"
X	MICROSOFT UPDATE CONFIGURATION	WIN32SNC.EXE	"Added by the RBOT-AI WORM!"
X	Microsoft Updaters	sysconfigs.exe	"Added by the RBOT-DF TROJAN!"
X	Microsoft Windows Config 32	win32conf.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows DLL Services Configuration	newdll.exe	"Added by the SDBOT-ZR WORM!"
X	Microsoft Windows DLL Services Configuration	newdll2.exe	"Added by the SDBOT-ABD WORM!"
X	Microsoft Windows DLL Services Configuration	poker.exe	"Added by the SDBOT-ZY WORM!"
X	Microsoft Windows DLL Services Configuration	poker3.exe	"Added by the SDBOT-AAH WORM!"
X	Microsoft Windows DLL Services Configuration	proxy.exe	"Added by the SDBOT-ZL WORM!"
X	Microsoft Windows DLL Services Configuration	windir32.exe	"Added by the SDBOT.BHF WORM!"
X	Microsoft Windows DLL Services Configuration	windir32a.exe	"Added by a variant of the SDBOT.BHF WORM!"
X	Microsoft Windows DLL Services Configuration	windll32.exe	"Added by the SDBOT.BHD WORM!"
X	Microsoft Windows DLL Services Configuration	winDSL.exe	"Added by the SDBOT-ZG WORM!"
X	Microsoft Windows DLL Services Configuration	dllmanager32.exe	"Added by the SDBOT-BTU WORM!"
U	Microsoft Windows Media Player Network Sharing Service Configuration Application	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	Microsoft Windows XP Configuration Loader	m32svco.exe	"Added by the SDBOT.WORM!.48548 WORM!"
X	Mircrosoft Windows Config DLL	rundllc32b.exe	"Added by the RBOT-ZY WORM!"
X	ModularConfig	syscnfg.exe	"Added by an unidentified VIRUS
X	Motherboard Config	Ati2xxx.exe	"Added by the RBOT-AIK WORM!"
U	Motorola Desktop Suite mRouter Config	mRouterConfig.exe	"Configuration for Motorola's version of Intuwave's m-Router - ""that enables easy connectivity between mobile devices and PCs across Bluetooth
U	mRouterConfig	mRouterConfig.exe	"Configuration for Intuwave's m-Router - ""that enables easy connectivity between mobile devices and PCs across Bluetooth
X	MS Config	msdconfig.exe	"Added by the RBOT-CZH WORM!"
X	MS Config Loader	svchos1.exe	"Added by the AGOBOT.R WORM!"
X	MS Config Loader	MSWin32bck.exe	"Added by the GAOBOT.AA WORM!"
X	MS Config Loader	svcrhost.exe	"Added by a variant of the RBOT WORM!"
X	MS Config Service	Msloader32.exe	"Added by the RBOT-KJ WORM!"
X	MS Config Stream	msasm.exe	"Added by the AGOBOT-BA WORM!"
X	MS Config v12	mscfg12.exe	"Added by the AGOBOT.YP WORM!"
X	MS Config v13	lrbz32.exe	"Added by the GAOBOT.AOL WORM!"
X	MS Config v13	mscfg13.exe	"Added by the AGOBOT.YQ WORM!"
X	Ms configsu	msconfigsu.exe	"Added by a variant of the SDBOT WORM!"
X	MS Configuration	MSFramer.exe	"Added by the RANDEX.OL WORM!"
X	Ms Configuration	microsoftsa32.exe	"Added by the KELVIR.X WORM!"
X	MS Configuration Utility	msconfig32.exe	"Added by the WOOTBOT.DY WORM!"
X	MS Sound Config 16bit	sndcfg16.exe	"Added by the SDBOT.MB TROJAN!"
X	Ms System Config	Mscfg.exe	"Added by the SDBOT-CCR WORM!"
X	Ms System Config	pcedit.exe	"Added by a variant of the SDBOT WORM!"
X	MS-patch	msconfig32.exe	"Added by the RBOT-AUF WORM!"
N	MSConfig	msconfig.exe	Entry that appears when you uncheck an item in the MSConfig Startup group and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup mode. Located in %System% (98/Me/Vista) or %Windir%\PCHealth\HelpCtr\Binaries (XP)
X	MSConfig	MSCONFIG32.EXE	"Added by the SPYBOT.B WORM!"
X	msconfig	msconfig.exe	"CoolWebSearch MSConfig parasite variant. Note - this overwrites the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting"
X	msconfig	msconfig.exe	"Added by the WINUR WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting. This one is located in c:\winrun"
X	msconfig	wins.exe	"Added by the RBOT.PF WORM!"
X	MSConfig	MSCONFIG35.EXE	"Added by a variant of the SPYBOT WORM!"
X	msconfig	scvhost.exe	"Added by the AGENT-DSF TROJAN!"
X	msconfig	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
X	Msconfig	icpldrvx.exe	"Added by the BANLOAD.BFT TROJAN!"
X	msconfig	msconfig.com	"Added by the IRCBOT-SM WORM!"
X	msconfig	msconfig.bat	"Added by the PAHATIA.B WORM!"
X	MSConfig	lssas.exe	"Added by the AUTORUN.CEY WORM!"
X	MSConfig	xwpwqf.exe	"Added by the AGENT-NEW TROJAN!"
X	Msconfig lptt01	msconfig.exe	"RapidBlaster variant (in a ""msconfig"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Windows Msconfig which has the same executable name"
X	MSConfig Manager	msupdate.exe	"CoolWebSearch parasite variant"
X	Msconfig ml097e	msconfig.exe	"RapidBlaster variant (in a ""msconfig"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Windows Msconfig which has the same executable name"
X	msconfig service	MSupdate32.exe	"Added by a variant of the SPYBOT WORM!"
X	msconfig.	msconf.exe	"Added by the BUZUS-AY WORM!"
X	msconfig.exe	proxy.exe	Added by a variant of the AGENT.AH downloader TROJAN!
X	msconfig.exe	uline.exe	Added by a variant of the AGENT.AH downloader TROJAN!
X	msconfig38	mssvcc.exe	"Added by the RBOT-BJV WORM!"
X	MSConfig45	MSConfig45.exe	"Added by the SDBOT.OJ TROJAN!"
X	MSConfigr	jdbgmrg.exe	"Added by the DASMIN.C TROJAN! Note - this is not the valid JDBGMGR.EXE file - see here"
N	MSConfigReminder	msconfig.exe	Entry that appears when you uncheck an item in the MSConfig Startup group and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup mode. This particular entry is specific only to 98/Me and is located in %System%
X	MsConfigs	MsConfigs.exe	"Added by the ALCAN.A WORM!"
X	MSConfigs	RUNDLL64.dll.vbs	"Added by the WEKODE-B WORM!"
X	msconfigurator	ctfsdk.exe	"Added by the DELF-ALS TROJAN!"
X	msdev	msconfig.exe	"Added by the AGOBOT.AAU WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting"
X	MSFTP Service Config	r3grun.exe	"Added by a variant of the SDBOT WORM!"
X	MSI Configuration	msiconf.exe	"Added by the AGENT.AKSZ TROJAN!"
X	Msn Config	msngf.exe	"Added by the RBOT-QG WORM!"
X	MSN Configuration	msnconfig.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Msn Configuration Loader	msngms.exe	"Added by the KELVIR.T WORM!"
X	MSN Configuration Loader	msmsncfg.exe	"Added by the AGOBOT-KX BACKDOOR!"
X	MSN File Configuration	msnfilecfg.exe	"Added by a variant of the IRCBOT BACKDOOR!"
N	NAV Configuration Wizard	cfgwiz.exe	"Introduced with Norton Anti-Virus 2002
X	netconfig	netconfig.exe	"Added by the NETWARE TROJAN!"
X	Networks Configurator	NetConfs.exe	"Added by the RBOT-OX WORM!"
U	ODSPConfig	ODSPConfig.exe	"DsktopSurveil surveillance software. Uninstall this software if you did not install it yourself"
X	OS Boot Configuration	bootconfig.exe	"Added by the IRCBOT.HJ WORM!"
X	OS Boot Configuration!	bootconf.exe	"CoolWebSearch BootConf adware"
X	Outlook Express Config	****.exe [ = random char]	"Added by a variant of the RBOT WORM!"
?	Palm MultiUser Config	Configtool.exe	"MultiUser configuration for a Palm PDA device?. Is it required?"
X	PC-Config32	corona.exe	"Added by the CORONEX.A WORM!"
U	pop3 Server	config.cfg	"Part of HTML2POP3 - ""Convert Webmail to POP3.Is also included a SMTP/POP3 tunneling system that allow send and receive email in a private network HTTP PROXY based. All connection are plugin based. Over 250 email server supported and tested"""
N	RaConfig2500	RaConfig2500.exe	"RaLink wireless LAN configuration utility"
X	Reg Service	WinnConfig.exe	"Added by the AGOBOT-PF WORM!"
X	RegistryConfig	rundll.exe	"Added by the AGOBOT-KN WORM! Note - this is NOT the Win9x/Me system file of the same name as described here"
X	run=	mouse_configurator.win	"Added by the GAGGLE.E WORM!"
U	SaitekAutoConfigure	saicnfig.exe	"Configuration for Saitek game controllers"
U	ServiceConfig	ispbeg.exe	"Comcast Transition Wizard. On June 30th
X	Sevice	winconfig.exe	"Added by the GIP.113.B1 TROJAN!"
X	SPOOL Configuration	spoolsvc.exe	"Added by the SDBOT-KD WORM!"
X	SQConfigChecker	cc.exe	"Xupiter SQWire toolbar related. Use Spybot S&D
X	Startup Configuration	[six character filename]	"Added by the RBOT-ARV WORM!"
X	Startup Configuration	wztoid.exe	"Added by the RBOT-ASD WORM!"
X	stratas	xmconfig.exe	"Added by the RBOT-AHR WORM!"
X	Symantec Configuration Loader	ccApp32.exe	"Added by the AGOBOT-EE WORM!"
X	sysconfig	iexplorer.exe	"Added by the CULT.C WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	SysConfig	syscfg35.exe	"Added by the KAZMOR.C WORM!"
X	SysConfig	wincfg32.exe	"Added by the SDBOT.ZD WORM!"
U	Sysconfig	Stealth KeySpy.exe	"StealthKeySpy - keystroke logger/monitoring program - remove unless you installed it yourself!"
X	sysconfig32	sysconfig32.exe	"Added by the AGENT-MSP TROJAN!"
X	System Config	BF3.EXE	"Added by the SPYBOT-DT WORM!"
X	System Config	sysloadcnf.exe	"Added by a variant of the SDBOT WORM! See here"
X	System Config Boot	syscgboot.exe	"Added by the AGENT.VWU TROJAN!"
X	System Config Manager	crss.exe	"Added by the AGOBOT.GH WORM!"
X	System Config Manager	smssl.exe	"Added by the AGOBOT-ZJ WORM!"
X	System Configuration	iexplore.exe	"Added by the RANDEX.AD WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	System Configuration	syscfg32.exe	"Added by the MYTOB.EA WORM!"
X	System Configurator32	SYSTEMCFG.EXE	"Added by the AGOBOT-KS WORM!"
X	system configure	svchost.exe	"Added by the LINEAGE-C TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	System-Config	msptmf32.com	"Added by the LIOTEN.FA WORM!"
N	ThinkPad Configuration Utility	TP98TRAY.EXE	"System Tray access to the ThinkPad Configuration utility for IBM/Lenovo ThinkPad notebooks. ""The ThinkPad Configuration utility is a control center to configure your ThinkPad hardware. With this utility
U	U.S.Robotics WLAN Adapter Configuration Utility	USRWLAN.exe	"U.S.Robotics LAN Adapter - wireless LAN (WLAN) configuration utility"
X	Update32	configs.exe	"Hijacker
X	USBConfigration2	wmmndir.exe	"Added by the AGOBOT-SV WORM!"
U	Venturi Configurator	ventcfg.exe	"Venturi Wireless mobile broadband configuration utility"
X	Volume Shadow Configuration	vbmsvc.exe	"Added by the SLENFBOT.DH WORM!"
X	Welcome	winconfig.exe	"Added by the GIP.113.B1 TROJAN!"
X	Welcome	CONFIG.EXE	"Added by the PSWGIP.B TROJAN!"
X	Wifi Configuration	wificonfig.exe	"Added by the IRCBOT.AWB BACKDOOR!"
X	Wifi Configuration!	wificonfigs.exe	"Added by the IRCBOT.AWB BACKDOOR!"
X	Win Config	winconfig.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Win32 Configuration	videosd32.exe	"Added by the SDBOT.TT WORM!"
X	Win32 Configuration	dllhelp.exe	"Added by the SDBOT.UL WORM!"
X	Win32 Configuration	mplayer.exe	"Added by the FORBOT-BZ WORM!"
X	Win32 Secure	msconfigsvc.exe	"Added by a variant of the SDBOT WORM!"
X	Win32 Services Config	winwkys.exe	"Added by the RBOT.BKY WORM!"
X	WinConfig9324	wincfgkop9.exe	"Added by the RBOT.BVD WORM!"
X	Windows Backup Configuration	IEXPLORER.exe	"Added by the GAOBOT.AZ WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Windows Config	SSYS.EXE	"Added by the SPYBOT-DA WORM!"
X	Windows Config	wins.exe	"Added by the SPYBOT.JR WORM!"
X	Windows Config	RUNDLL.EXE	"Added by the SPYBOT-DX WORM! Note - this is NOT the Win9x/Me system file of the same name as described here"
X	Windows Config	pvphost.exe	"Added by a variant of the SLAPER TROJAN!"
X	Windows Config	winconfig.exe	"Added by the IRCBOT.BAP BACKDOOR!"
X	Windows Config	ZANBOR.EXE	"Added by the SPYBOT-MH WORM!"
X	Windows Config Connection	msicll.exe	"Added by the RBOT-EXQ WORM!"
X	Windows Config Loader	Wincfg32.exe	"Added by the SILVERFTP TROJAN!"
X	Windows Config Manager	winconf.exe	"Added by the RBOT-AIT WORM!"
X	Windows Config Manager	Wincfgman32.exe	"Added by the AGOBOT-AL BACKDOOR!"
X	Windows Config System	config.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Configuration	wsys32.exe	"Added by the GAOBOT.FB WORM!"
X	Windows Configuration	wincfg32.exe	"Added by the MYTOB.ED WORM!"
X	Windows Configuration	WINHUB.EXE	"Added by the SPYBOT-CG WORM!"
X	Windows Configuration Loader	asclt.exe	"Added by the SDBOT-OA WORM!"
X	Windows Configuration Loader	msgfix.exe	"Added by the SDBOT-NP WORM!"
X	Windows Configuration System	IExplore.exe	"Added by the RBOT-DDG WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows Configuration Utility	winxupdate.exe	"Added by the AGOBOT.LW WORM!"
X	Windows Configurator	winconf.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Default Configuration	svchost.exe	"Added by the DLOADER-U TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Windows driver update	Ipconfig32.exe	"Added by the SDBOT-JV WORM!"
X	Windows Installer 1	msnconfig.exe	"Added by the PURITYSCN.B TROJAN!"
X	Windows MSConfig Startup Logger	winlog.exe	"Added by the RBOT.BCU WORM!"
X	Windows Service Layer	config.exe	"Added by the RBOT.DDJ WORM!"
X	Windows System Configuration	SYSCFG16.EXE	"Added by the WISDOOR-K TROJAN!"
X	Windows System Configuration	Passcfg16.exe	"Added by the DOMWIS-E TROJAN!"
X	Windows System Configuration	Winfrw.exe	"Added by the SOLUFINA TROJAN or the DOMWIS-J WORM!"
X	Windows System Configuration	wincfg.exe	"Added by the AGOBOT.OP WORM!"
X	Windows System Configuration	WINCFG32.EXE	"Added by the AGOBOT-TE WORM!"
X	Windows System Configuration	WinNeth.exe	"Added by the RETHE-A WORM!"
X	Windows System Configuration	nether.exe	"Added by the OPANKI-AB WORM!"
X	Windows System Configuration	WINSYS32.exe	"Added by the SDBOT.AXK WORM!"
X	Windows System Restore Configuration	Sblhost.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Update	msconfig32.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows update config	svhost.exe	"Added by the SDBOT-PF WORM!"
X	windows update configurator	svghost.exe	"Added by a variant of the SPYBOT WORM!"
X	windows update configurator	explore.exe	"Added by the SDBOT.RY BACKDOOR!"
X	Windows32 Configuration Loader	msrf32.exe	"Added by the SDBOT-ABX WORM!"
X	WinDriver Configuration	windrvconf.exe	"Added by the AGOBOT-LX TROJAN!"
X	Windws Configuration Loader	LEXPLORE.exe	"Added by the SODABOT WORM!"
X	winrun	msconfig.exe	"Added by the WINUR WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting. This one is located in c:\winrun"
X	WIP Config GUI	Winipcfgs.exe	"Added by the RBOT-CN WORM!"
U	Wireless PCI Card Configuration Utility	WMP11Cfg.exe	"Utility used by the LINKSYS wireless PCI card (WMP11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration"
X	WSAConfiguration	wmon32.exe	"Added by the GAOBOT.BAJ WORM!"
X	WSAConfiguration	svchostt.exe	"Added by the AGOBOT.ZT WORM!"
X	WSAConfiguration	rpcxmn32.exe	"Added by the AGOBOT.ABG WORM!"
X	WSAConfiguration	win32upd.exe	"Added by a variant of the RBOT WORM!"
X	WSAConfiguration	drrss.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	WSAConfiguration	winlogon32.exe	"Added by the AGOBOT-WC WORM!"
X	WSAConfiguration	ntguard32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	WSAConfiguration	csrsvcs.exe	"Added by the AGOBOT.VI WORM!"
X	WSAConfiguration	winmx32.exe	"Added by the AGOBOT-JE WORM!"
X	WSAConfiguration	kernel32.exe	"Added by the AGOBOT-KV WORM!"
X	WSAConfiguration	winmon32.exe	"Added by the AGOBOT.TM WORM!"
X	WSAConfiguration	msnote30.exe	"Added by the AGOBOT-KF BACKDOOR!"
X	WSAConfiguration	syxtem32.exe	"Added by the AGOBOT-MF BACKDOOR!"
X	WSAConfiguration	svchostx.exe	"Added by the AGOBOT-JV BACKDOOR!"
X	WSAConfiguration1	csass.exe	"Added by the AGOBOT.WH WORM!"
X	WSConfiguration	spoolsc.exe	"Added by the AGOBOT-HY WORM!"
U	WSEP Status+Configuration	controldGUI.exe	"User interface for the WatchGuard Security Event Processor (WSEP) Status/Configuration dialog box associated with the Firebox series of security products from Watchguard"
X	WSSAConfiguration	wmmon32.exe	"Added by the AGOBOT-KC WORM!"
?	ZDConfig	ZDConfig.exe	"Related to various brands of Wireless USB LAN Adapter - what does it do and is it required?"
X	[random name]	m?config.exe	"PurityScan adware"
X	[Randomly chosen existing folder name]	_config.exe	"Added by the ANTINNY-L WORM!"
X	[username] config	[path to trojan]	"Added by the MOSUCK-H TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.