msc

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	*MSConfig32	aecache.exe	"Detected by F-Secure as the OBFUSCATED.GP TROJAN!"
X	.mscdr	lassa.exe	"Added by the WEBUS.C TROJAN!"
X	.mscdr	lsvchost.exe	"Added by the WEBUS.D TROJAN!"
X	.mscdsr	lsvchost.exe	"Added by the BDOOR-CR BACKDOOR!"
X	.mscsbl	svhost.exe	"Added by the CMQ TROJAN!"
X	Bcvsrv32	msc32.exe	"Added by the AGOBOT.AKD WORM!"
X	CashToolbar	MSCStat.exe	"Added by the DOWNLOADER-MY TROJAN!"
X	Checkdisk	mscas.exe	"Added by the VAGON-A TROJAN!"
X	Client for Microsoft Networks	msclient32.exe	"Added by the SDBOT-BXQ WORM!"
X	ClientMan1	mscman.exe	"ClientMan parasite variant"
X	COM Service	mscom32.com	"Added by the BEASTY.H TROJAN!"
X	Compaq32 Service Drivers	msconfig32.exe	"Added by the SDBOT-ADC WORM!"
X	CPCmscl0ck	CPCmsclock.ExE	"Added by the IRCFLOOD.BF TROJAN!"
X	Desktop	"rundll32.exe msconfd.dll	Restore ControlPanel"
U	DriverMagicLogon	dmschedule.exe	"Part of DriverMagic - ""the easiest way to locate device drivers"""
X	EventApplicationCmd	smschk.exe	"Added by the IRCBOT-AO TROJAN!"
X	Generic Host Process for Win Services	mscvs.exe	"Added by a variant of the SDBOT WORM!"
U	ImScInst	ImScInst.exe	"Microsoft's Input Method Editor which is used to both display and enable the input of characters from East Asian and Right-to-left (e.g. Arabic) languages in e-mails
U	ImScInst.exe	ImScInst.exe	"Microsoft's Input Method Editor which is used to both display and enable the input of characters from East Asian and Right-to-left (e.g. Arabic) languages in e-mails
X	Intel Service Drivers	msconfig16.exe	"Added by the MSCONFIG16 TROJAN!"
X	MemScanner	MemScanner.exe	"Part of Enigma SpyHunter - not recommended
X	Microsoft Client	msclient.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Config	msconf.exe	"Added by the RBOT.PV WORM!"
X	Microsoft Config	MSCONF.EXE	"Added by the RBOT-LG WORM!"
X	Microsoft Config 32	msconfigx32.exe	Reported as the MSCONFIGX32 TROJAN! Possible Rbot variant
X	Microsoft Config 32bit	mscnfg32.exe	"Added by the RBOT-Z WORM!"
X	Microsoft Config Loader	msconfig32.exe	"Added by the AGOBOT.XX WORM!"
X	Microsoft Config Loader	msconf32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Configoration Service	msconfigs.exe	"Added by the RBOT-ETT WORM!"
X	Microsoft Configuewe	msconfiguwe.exe	"Added by the SDBOT-BPK WORM!"
X	Microsoft Configuration	msconfig32.exe	"Added by the SDBOT.MQ WORM!"
X	Microsoft CSRSS Service	nsmscrs.exe	"Added by the RBOT-BPT WORM!"
X	Microsoft Cvrt	mscvrt32.exe	"Added by an unidentified VIRUS
X	Microsoft Device Manager	mscmtl32.exe	"Added by the AGENT.BMQ BACKDOOR!"
X	Microsoft Digital Clock	msclock.exe	"Added by the NACKBOT-D WORM!"
X	Microsoft DLL Verifier	mscon.exe	"Added by the SDBOT.EAH WORM!"
X	Microsoft Java Virtual Machine	MsConfiG.exe	"Added by the FORBOT-DV WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting"
N	Microsoft System Configuration Utility	msconfig.exe	Entry that appears when you uncheck an item in the MSConfig Startup group and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup mode. Located in %System% (98/Me/Vista) or %Windir%\PCHealth\HelpCtr\Binaries (XP)
X	Microsoft Update	msconfg.exe	"Added by the RBOT.H WORM!"
X	Microsoft Update 32	mscnfg.exe	"Added by the RBOT-ALM WORM!"
X	Microsoft Updater	msconsole.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows Client Firewall	msclt.exe	"Added by the VANEBOT-F WORM!"
X	MicroSoftRun	MSCOMM.dll	"Added by the AGENT-DJG TROJAN!"
U	MPSExe	mscifapp.exe	McAfee.com Privacy Service - "combines personal identifiable information (PII) protection with online advertisement blocking and content filtering"
X	MS Config v12	mscfg12.exe	"Added by the AGOBOT.YP WORM!"
X	MS Config v13	mscfg13.exe	"Added by the AGOBOT.YQ WORM!"
X	Ms configsu	msconfigsu.exe	"Added by a variant of the SDBOT WORM!"
X	MS Configuration Utility	msconfig32.exe	"Added by the WOOTBOT.DY WORM!"
X	Ms System Config	Mscfg.exe	"Added by the SDBOT-CCR WORM!"
X	MS Updates	mscache.exe	Spyware web downloader
X	MS-patch	msconfig32.exe	"Added by the RBOT-AUF WORM!"
X	msc	msc.exe	"MaCatte Antivirus 2009 rogue security software - not recommended
X	msccrt	msccrt.exe	"Added by the PWS-ALA TROJAN!"
X	mscheck	rundll32.exe wincheck071008.dll mymain	"Added by the AGENT.ADXI TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""wincheck071008.dll"" file is located in %System%"
X	mschkdf.exe	mschkdf.exe	"Added by a variant of the SDBOT WORM!"
X	MSChoExE	suge.exe	"Added by a variant of the RBOT WORM!"
?	msci	mcinfo.exe	"McAfee Internet Security related. What does it do and is it required?"
X	msclac	msclac.exe	"Added by the SDBOT-JM WORM!"
X	msclean	msvchost.exe	"Added by the OPANKI-Q WORM!"
X	mscman	mscman.exe	"ClientMan parasite variant"
X	mscms	mscms.exe	"Added by the AGENT-MS TROJAN!"
U	mscn	mscn.exe	Part of the SafeChildNet internet filtering program - required if you use it
X	Mscnt	mscnt.exe	"Added by the DLUCA-C TROJAN!"
X	Mscolour	mscolour.exe	"Added by the GEMA TROJAN!"
X	MSCommX	mscommx.exe	"Added by a variant of the RBOT WORM!"
X	Msconf32	Msconf32.exe	"Added by the AGOBOT-NR WORM!"
X	MSCONFG32.EXE	MSCONFG32.EXE	"Added by the OPTIX.04.C TROJAN!"
N	MSConfig	msconfig.exe	Entry that appears when you uncheck an item in the MSConfig Startup group and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup mode. Located in %System% (98/Me/Vista) or %Windir%\PCHealth\HelpCtr\Binaries (XP)
X	MSConfig	MSCONFIG32.EXE	"Added by the SPYBOT.B WORM!"
X	msconfig	msconfig.exe	"CoolWebSearch MSConfig parasite variant. Note - this overwrites the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting"
X	msconfig	msconfig.exe	"Added by the WINUR WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting. This one is located in c:\winrun"
X	msconfig	wins.exe	"Added by the RBOT.PF WORM!"
X	MSConfig	MSCONFIG35.EXE	"Added by a variant of the SPYBOT WORM!"
X	msconfig	scvhost.exe	"Added by the AGENT-DSF TROJAN!"
X	msconfig	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
X	Msconfig	icpldrvx.exe	"Added by the BANLOAD.BFT TROJAN!"
X	msconfig	msconfig.com	"Added by the IRCBOT-SM WORM!"
X	msconfig	msconfig.bat	"Added by the PAHATIA.B WORM!"
X	MSConfig	lssas.exe	"Added by the AUTORUN.CEY WORM!"
X	MSConfig	xwpwqf.exe	"Added by the AGENT-NEW TROJAN!"
X	Msconfig lptt01	msconfig.exe	"RapidBlaster variant (in a ""msconfig"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Windows Msconfig which has the same executable name"
X	MSConfig Manager	msupdate.exe	"CoolWebSearch parasite variant"
X	Msconfig ml097e	msconfig.exe	"RapidBlaster variant (in a ""msconfig"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Windows Msconfig which has the same executable name"
X	msconfig service	MSupdate32.exe	"Added by a variant of the SPYBOT WORM!"
X	msconfig.	msconf.exe	"Added by the BUZUS-AY WORM!"
X	msconfig.exe	proxy.exe	Added by a variant of the AGENT.AH downloader TROJAN!
X	msconfig.exe	uline.exe	Added by a variant of the AGENT.AH downloader TROJAN!
X	msconfig38	mssvcc.exe	"Added by the RBOT-BJV WORM!"
X	MSConfig45	MSConfig45.exe	"Added by the SDBOT.OJ TROJAN!"
X	MSConfigr	jdbgmrg.exe	"Added by the DASMIN.C TROJAN! Note - this is not the valid JDBGMGR.EXE file - see here"
N	MSConfigReminder	msconfig.exe	Entry that appears when you uncheck an item in the MSConfig Startup group and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup mode. This particular entry is specific only to 98/Me and is located in %System%
X	MsConfigs	MsConfigs.exe	"Added by the ALCAN.A WORM!"
X	MSConfigs	RUNDLL64.dll.vbs	"Added by the WEKODE-B WORM!"
X	msconfigurator	ctfsdk.exe	"Added by the DELF-ALS TROJAN!"
X	MSControl28	crsss.exe	"Added by the SPYBOT.AJX WORM!"
X	MSControl31	winnsyst.exe	"Added by the RBOT.CFY WORM!"
X	MSControl3d1	isasse.exe	"Added by the RBOT.CGU WORM!"
X	MSCORE	syscnfg.exe	"Added by an unidentified VIRUS
?	MSCRMStartup	Microsoft.Crm.Application.Hoster.exe	"Related to Microsoft Dynamics CRM integrated solutions for Financial
X	Mscsgs	MSCSGS.EXE	"Added by the ZEZER WORM!"
X	Mscsgs32	MSCSGS32.EXE	"Added by the ZEZER WORM!"
X	mscsvc.exe	mscsvc.exe	"Added by the BANCOS.T TROJAN!"
X	msctfg32	msctfg32.exe	"Added by the RBOT-TJ WORM!"
X	msctrl.exe	msctrl.exe	"Microsoft Security Adviser rogue security software - not recommended"
X	Msctrl32	Msctrl32.scr	"Added by the REDIST WORM!"
X	MSCVT	MSCVT.exe	"Added by the SLIDESHOW WORM!"
X	msdev	msconfig.exe	"Added by the AGOBOT.AAU WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting"
X	msmc	mscpbo.exe	"ClientMan parasite variant"
X	MSN Manager	mscmgr.exe	Unidentified malware - causes multiple browser windows to open
X	MSN Update	mscon.exe	"Added by the RBOT-QA WORM!"
X	msnmsg.exe	mscmd32.exe	Added by a variant of the AGENT.AH TROJAN!
U	MSPY2002	ImScInst.exe	"Microsoft's Input Method Editor which is used to both display and enable the input of characters from East Asian and Right-to-left (e.g. Arabic) languages in e-mails
X	mssoul	msmscc2.exe	"Added by the DAPIZL.A banker WORM! (A ""banker worm"" is designed to pillage banking information and send it back to the perpetrators!)"
X	mssoul	msmscc.exe	"Added by the BANCOS.HKT TROJAN!"
X	MSWindows SysCl	mscl32.exe	"Added by the RBOT.AHI WORM!"
X	NvCplScan	msc32.exe	"Added by the FORBOT-DD WORM!"
X	scan	mscman.exe	"ClientMan parasite variant"
X	Shell	smsc.exe	"Added by the BANCBAN-OY TROJAN!"
X	Sonic RecordNow!	smsc.exe	"Added by a variant of the SDBOT WORM!"
X	Sysctrls	mscntrl.exe	"Added by the KOLABC.BB WORM!"
X	System Efficiency Monitor	mscedit32.exe	"Added by the SDBOT.P TROJAN!"
X	System Efficiency Monitor	mscommand.exe	"Added by the KWBOT.P WORM!"
X	System Management Service	smsc.exe	"Added by the RBOT-ANN WORM!"
X	System MScvb	mscvb32.exe	"Added by the SOBIG.C WORM!"
X	System Tray	msccn32.exe	"Added by the SOBIG.B WORM! Warning - spreading via infected E-mail attachments with the sender address faked as support@microsoft.com! Note - this is not the legitimate systray.exe process"
X	systemscroot	systembin.exe	"Added by a variant of the RBOT WORM!"
X	vcmicrec	msccsed.exe	"Added by the MAILBOT-CE TROJAN!"
X	Video Processor	msconfsys88.exe	"Added by the AGOBOT-QG WORM!"
?	VirusScanMSC	VsStat.exe	"Part of McAfee VirusScan. System Tray application as with previous versions (were also VsStat.exe)
X	Win startup	mscfg32.exe	"Added by the SPYBOT-AE WORM!"
X	Win32 Cnfg32	msconfgh.exe	"Added by the MYTOB.NB WORM!"
X	Win32 Secure	msconfigsvc.exe	"Added by a variant of the SDBOT WORM!"
X	Win32 USB2 Driver	smsc.exe	"Added by the SDBOT.FO WORM!"
X	Windows Dcom2 Fix	mscom32.exe	"Added by the RBOT-QT WORM!"
X	Windows MSConfig Startup Logger	winlog.exe	"Added by the RBOT.BCU WORM!"
X	Windows Network Service	Msconf32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Performance Monitor	wmscupd.exe	"Added by the IRCBOT_GEN WORM!"
X	Windows Scheduler	wmscheduler.exe	"Added by a variant of the SDBOT WORM! See here"
X	Windows Service Agent	wmscc.exe	"Added by the RBOT-GQP WORM!"
X	Windows Services	smsc.exe	"Added by a variant of the SDBOT WORM!"
X	windows shellext.32	mschost.exe	"Added by the BLASTER.K WORM!"
X	WINDOWS SYSTEM	smsc.exe	"Added by the MYTOB-BR WORM!"
X	Windows System Manager	smsc.exe	"Added by a variant of the RBOT WORM!"
X	WINDOWS SYSTEM mscdvvs	mscdvvs.exe	"Added by the MYTOB.MD WORM!"
X	Windows Update	msconfig32.exe	"Added by a variant of the SPYBOT WORM! See here"
X	winrun	msconfig.exe	"Added by the WINUR WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting. This one is located in c:\winrun"
X	WSSVC	smsc.exe	"Added by the AUTORUN-AGA WORM!"
X	zsmscc	rundll32.exe zsmscc071001.dll mymain	"Added by the GENETIK.KQ TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""zsmscc071001.dll"" file is found in %System%"
X	zsmscc	rundll32.exe mycc071208.dll mymain	"Added by the AGENT.FZK TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""mycc071208.dll"" file is found in %System%"
X	[random characters]	rsbmsc.exe	"Detected by AntiVir antivirus as the BDS/Agent.adt TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.