Right, for a start I certainly don't like the look of this entry;
O4 - HKLM\..\RunServices: [msconfig38] mssvcc.exe
That relates to a "worm" known as
W32/Rbot-BJV - W32/Rbot-BJV is a network worm with backdoor functionality for the Windows platform. W32/Rbot-BJV spreads using a variety of techniques including exploiting weak passwords on computers and exploiting operating system vulnerabilities (including DCOM-RPC, LSASS, WKS and ASN.1).
W32/Rbot-BJV can be controlled by a remote attacker over IRC channels. The backdoor component of W32/Rbot-BJV can be instructed by a remote user to perform the following functions:
start an FTP server
start a Proxy server
take part in distributed denial of service (DDoS) attacks
log keypresses
port scanning
download/execute arbitrary files
start a remote shell (RLOGIN)
The worm copies itself to a file named mssvcc.exe in the Windows system folder and creates the following registry entries to run on system startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
msconfig38
mssvcc.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Services
msconfig38
mssvcc.exe
But alas all is not lost! Patches for the operating system vulnerabilities exploited by W32/Rbot-BJV can be obtained from Microsoft at:
http://www.microsoft.com/technet/sec.../ms04-011.mspx
http://www.microsoft.com/technet/sec.../MS04-012.mspx
http://www.microsoft.com/technet/sec.../MS03-049.mspx
http://www.microsoft.com/technet/sec.../MS04-007.mspx