We've probably all run msconfig.exe before, and then on the Services tab checked "Hide all Microsoft services" so as to look at more "suspicious" services. But, what criteria does that checkbox use? Is there some certificate or other kind of trusted identity that makes the "Microsoft services" trustworthy? Or does it just look at the metadata for the file, which can be easily forged?