cfig50wnt service event?????
1,753 views
Skip to first unread message
infiniteMPG
Jun 8, 2009, 5:13:19 PM6/8/09
to Computer Tech Support
Every day here at work at exactly 12:44:00PM my hard drive starts
clunking away, my DVD drive spins up (even if nothing is in the
drive), my keyboard and mouse start hesitating badly, and then 11
seconds later it all settles down and runs normal. In checking the
service event log I see seven (7) entries stating :
The cfig50wnt service was successfully sent a start control
And it happens that seven times between 12:44:00PM and 12:44:11PM.
Every day. I.T. claims they don't know what it is (we are part of an
international corp so I.T. structure is pretty convaluted). I also
couldn't find anything about it thru web searches.
Found that a couple other engineers shows sevem of these same events
occurring but one was at 12:08, another at 12:19 and another at
12:49. And even though we're all supposed to be the same template
workstation, several engineers didn't show this event at all. I only
checked a handful of workstations and not the whole department or
anyone outside our department.
Our question is, what the heck is cfig50wnt service and what the heck
is happening when it gets the "start control"?????
Any help?
clunking away, my DVD drive spins up (even if nothing is in the
drive), my keyboard and mouse start hesitating badly, and then 11
seconds later it all settles down and runs normal. In checking the
service event log I see seven (7) entries stating :
The cfig50wnt service was successfully sent a start control
And it happens that seven times between 12:44:00PM and 12:44:11PM.
Every day. I.T. claims they don't know what it is (we are part of an
international corp so I.T. structure is pretty convaluted). I also
couldn't find anything about it thru web searches.
Found that a couple other engineers shows sevem of these same events
occurring but one was at 12:08, another at 12:19 and another at
12:49. And even though we're all supposed to be the same template
workstation, several engineers didn't show this event at all. I only
checked a handful of workstations and not the whole department or
anyone outside our department.
Our question is, what the heck is cfig50wnt service and what the heck
is happening when it gets the "start control"?????
Any help?
The KwikOne
Jun 10, 2009, 2:37:45 PM6/10/09
to Computer Tech Support
Have you gone to services and check to see if there was a description
attached to this service? - in services the service name could be
something like "My Service" so you won't necessarily see cfig50wnt as
the service name. You could also go into the registry (HKLM/System/
CurrentControlSet/Services) and do a search from that point on to see
what the service freindly name is and any description of it. I did
find 1 occurrance of this being reported as a virus/trojan. but the
person reporting knew nothing (other that it's name being
cfig50wnt.sys in Windows\System32) so I do not know whether it truly
is or not. Also, since what you are reporting always occurs at the
same time it is must be some other program causing the service to
start. That other program could also be started by windows scheduler.
attached to this service? - in services the service name could be
something like "My Service" so you won't necessarily see cfig50wnt as
the service name. You could also go into the registry (HKLM/System/
CurrentControlSet/Services) and do a search from that point on to see
what the service freindly name is and any description of it. I did
find 1 occurrance of this being reported as a virus/trojan. but the
person reporting knew nothing (other that it's name being
cfig50wnt.sys in Windows\System32) so I do not know whether it truly
is or not. Also, since what you are reporting always occurs at the
same time it is must be some other program causing the service to
start. That other program could also be started by windows scheduler.
Srinivasan Karunanithi
Jun 11, 2009, 2:49:52 AM6/11/09
to computer-t...@googlegroups.com
May be its a trojan. try to clear it by using superantisypware, combofix and other virus/trojan scanners. Also, if possible do a online scan. it ll help u to clear....
Miran
Jun 11, 2009, 3:36:57 PM6/11/09
to computer-t...@googlegroups.com
Who are you gona call? Ghost busters....--
---------------------------------------
Miran O.
Phantom Design Labs
---------------------------------------
---------------------------------------
Miran O.
Phantom Design Labs
---------------------------------------
infiniteMPG
Jun 15, 2009, 12:55:29 PM6/15/09
to Computer Tech Support
This service runs on several PC's in our department but not on all of
them (supposed to be all the same template for our workstations....
not quite the way it seems to be). As far as looking up services,
there is no service by the name cfig50wnt and with hundreds of
services listed, how would I know what this one is? There is nothing
with a generic name like "my service" and if I need to nail this when
it's being sent a start control, that only lasts for 11 seconds.
I did a search in my registry and found HKEY_LOCAL_MACHINE\SYSTEM
\ControlSet001\Enum\Root\LEGACY_ADVCFIG50WNT\0000\Control
which lists the Service as advcfig50wnt
All I can find for advcfig50wnt shows as a potential hijacker or virus
but the thing is, more then half the computers in our department are
running this and when we run AdAware and MalwareBytes they come up
clean.
So just delete the keys from the registry????
them (supposed to be all the same template for our workstations....
not quite the way it seems to be). As far as looking up services,
there is no service by the name cfig50wnt and with hundreds of
services listed, how would I know what this one is? There is nothing
with a generic name like "my service" and if I need to nail this when
it's being sent a start control, that only lasts for 11 seconds.
I did a search in my registry and found HKEY_LOCAL_MACHINE\SYSTEM
\ControlSet001\Enum\Root\LEGACY_ADVCFIG50WNT\0000\Control
which lists the Service as advcfig50wnt
All I can find for advcfig50wnt shows as a potential hijacker or virus
but the thing is, more then half the computers in our department are
running this and when we run AdAware and MalwareBytes they come up
clean.
So just delete the keys from the registry????
Ceresia
Jun 16, 2009, 10:29:22 AM6/16/09
to Computer Tech Support
Seems you are already having issues with your PC, I would download a
program called StartupList
Check out the logs that StartupList creates and make sure there are no
entries pointing to that specific path or file name. Also check
StartupList for running programs and make sure everything is correct.
If you find nothing there then I would delete the reg entries, you can
always do a "last known good configuration" on your system if it
messes something up.
program called StartupList
Check out the logs that StartupList creates and make sure there are no
entries pointing to that specific path or file name. Also check
StartupList for running programs and make sure everything is correct.
If you find nothing there then I would delete the reg entries, you can
always do a "last known good configuration" on your system if it
messes something up.
The KwikOne
Jun 18, 2009, 12:51:50 PM6/18/09
to Computer Tech Support
StartupList download page is at http://majorgeeks.com/Startup_List_d4926.html
You could also get thsysinternale SysInternals suite of tools (the
Sysinternals page is at http://technet.microsoft.com/en-us/sysinternals/),
one of which is Autoruns which would allow you to disable the service
You could also get thsysinternale SysInternals suite of tools (the
Sysinternals page is at http://technet.microsoft.com/en-us/sysinternals/),
one of which is Autoruns which would allow you to disable the service
The KwikOne
Jun 18, 2009, 4:37:59 PM6/18/09
to Computer Tech Support
I just found some interesting info - go to
http://www.archivum.info/microsoft.public.windowsxp.general/2009-03/msg04325.html
or at http://www.pcreview.co.uk/forums/thread-3768869.php
There are a number of links to other resources and things to check
(the info was written by a MS MVP)
If you google ADVCfig50wnt you get 124 hits
http://www.archivum.info/microsoft.public.windowsxp.general/2009-03/msg04325.html
or at http://www.pcreview.co.uk/forums/thread-3768869.php
There are a number of links to other resources and things to check
(the info was written by a MS MVP)
If you google ADVCfig50wnt you get 124 hits
Ken Ringsen
Jun 28, 2009, 12:28:38 PM6/28/09
to Computer Tech Support
That is CA Unicenter Asset Management agent. It's doing a hardware &
software inventory scan as configured by the administrators of your
CA Unicenter system. It is usually configured to run once per day,
but the schedule can be custom configured. It runs as a background
task and should never interfere with normal processing.
software inventory scan as configured by the administrators of your
CA Unicenter system. It is usually configured to run once per day,
but the schedule can be custom configured. It runs as a background
task and should never interfere with normal processing.
> Every day here at work at exactly 12:44:00PM my hard drive starts
> clunking away, my DVD drive spins up (even if nothing is in the
> drive), my keyboard and mouse start hesitating badly, and then 11
> seconds later it all settles down and runs normal. In checking the
> service event log I see seven (7) entries stating :
>
> Thecfig50wntservice was successfully sent a start control
> clunking away, my DVD drive spins up (even if nothing is in the
> drive), my keyboard and mouse start hesitating badly, and then 11
> seconds later it all settles down and runs normal. In checking the
> service event log I see seven (7) entries stating :
>
>
> And it happens that seven times between 12:44:00PM and 12:44:11PM.
> Every day. I.T. claims they don't know what it is (we are part of an
> international corp so I.T. structure is pretty convaluted). I also
> couldn't find anything about it thru web searches.
>
> Found that a couple other engineers shows sevem of these same events
> occurring but one was at 12:08, another at 12:19 and another at
> 12:49. And even though we're all supposed to be the same template
> workstation, several engineers didn't show this event at all. I only
> checked a handful of workstations and not the whole department or
> anyone outside our department.
>
> Our question is, what the heck iscfig50wntservice and what the heck
> And it happens that seven times between 12:44:00PM and 12:44:11PM.
> Every day. I.T. claims they don't know what it is (we are part of an
> international corp so I.T. structure is pretty convaluted). I also
> couldn't find anything about it thru web searches.
>
> Found that a couple other engineers shows sevem of these same events
> occurring but one was at 12:08, another at 12:19 and another at
> 12:49. And even though we're all supposed to be the same template
> workstation, several engineers didn't show this event at all. I only
> checked a handful of workstations and not the whole department or
> anyone outside our department.
>
The KwikOne
Jun 30, 2009, 11:45:39 AM6/30/09
to Computer Tech Support
Ken...
Thanks so much for letting everyone else know what this service is. As
in my previous postings you can see that throughout the net people are
thinking it is some sort of trojan/virus/malware/spyware.
Thanks so much for letting everyone else know what this service is. As
in my previous postings you can see that throughout the net people are
thinking it is some sort of trojan/virus/malware/spyware.
Reply all
Reply to author
Forward
0 new messages