In this week’s TR Dojo video, I demonstrate how MSCONFIG can be used to troubleshoot Windows XP boot problems. After seeing my description of the MSCONFIG Startup tab, several members asked about a blank entry they saw on my example. Member tech@… wrote:

Bill, Thanks for a very good, concise, overview of the MSCONFIG utility. The screenshots were great. One in particular, the 2nd shot of the startup tab, shows a line item (checked) without a name, command or location. Now that is real “Geek fun” trying to figure out what is loading – is it good, bad, necessary, a virus? I’ve always seen these items, and occasionally gambled on turning them off to see what happened. Most of the time that was a very bad idea causing problems of its own – even on a clean system. Could you offer an article or report on these “rogue” line items and if there’s any way to identify them?

I responded in the original blog post’s discussion thread, but thought a separate post was also warranted.

The entries shown on the MSCONFIG Startup tab correspond to registry entries located within keys that are shown in the Startup tab’s Location column. Most of the entries can be found in one of the following keys:

  • HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  • HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  • HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

Blank MSCONFIG entries occur when a registry value exists but contains no data. This can occur when a application install or uninstall fails, or if a pieces of malware has modified the registry.

In the case of the system shown in the video, the blank entry on the MSCONFIG Startup tab (as shown in Figure A) was caused by a registry value named MSWheel (as shown in Figure B)–the software for Microsoft Intellipoint mice.

I deleted the registry value and the blank entry on the MSCONFIG Startup tab disappeared (as shown in Figure C).