--- a/virus.rst	Tue Dec 15 23:16:08 2015 +0200
+++ b/virus.rst	Tue Dec 15 23:18:08 2015 +0200
@@ -35,9 +35,11 @@
 
 Use HijackThis to detect malware registration in system.
 
-Use Sysinternals procexp.exe to find which process lock file and path to
+Use Sysinternals ``procexp.exe`` to find which process lock file and path to
 executable images for removing unwanted software.
 
+Use ``msconfig.exe`` to investigate startup processes registration.
+
 Antivirus software.
 ===================