Image

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
U	Acronis True Image	TimounterMonitor.exe	"Part of Acronis True Image backup software. Monitor for the backup archive explorer for moving and viewing files within an archive"
N	Acronis True Image Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
N	Acronis TrueImage Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
N	AcronisTrueImage Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
N	AcronisTrueImage Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
N	HP Image Zone Fast Start	hpqthb08.exe	"Improves the startup time of HP Image Zone. If you disable it
X	Image	"rundll32 [path] [trojan filename]	Install"
Y	Image & Restore	IMAGE32.exe	"Part of McAfee Nuts & Bolts. Image/Restore can recover from drives that have been accidentally formatted or completely erased
X	Image Remote Players	sysvn.exe	"Added by a variant of the IRCBOT BACKDOOR!"
N	Image Transfer	SonyTray.exe	Sony Image Transfer software provides direct image transfer from your digital camera to a PC - can be started manually
U	ImageDrive-{hex numbers}	ImageDrive.exe	"Nero ImageDrive from Ahead - virtual CD/DVD drive software"
U	Imagefox	imagefox.exe	"ImageFox 2.0 (formerly available from ACDSee) is an ""add-on"" graphics previewer for most Windows Open/Save As dialog boxes"
X	Imagemgt32	Imagemgt32.exe	"Added by the GEMA TROJAN!"
X	ImagePath	taskbarmngr.exe	"Added by the SDBOT-XB WORM!"
U	ImageTune	dthtml.exe	"ImageTune from Hyundai ImageQuest. Rebranded version of Display Tune from Portrait Displays
N	Logiciel de transfert d'images KODAK	pts.exe	Looks for Kodak camera connection and media insertion. Available via Start -> Programs
U	Logitech ImageStudio	ISStart.exe	"Installed with Logitech's ImageStudio webcam software. The exact purpose of this startup entry is unknown at present
U	Logitech ImageStudio	LogiTray.exe	"System Tray access to ImageStudio
U	Logitech ImageStudio	LVCOMS.EXE	Entry added when you install Logitech ImageStudio webcam software. It allows the camera to be accessed by both the Logitech software and (amongst others) NetMeeting and Windows Movie Maker. If you don't use the camera on a daily basis create your own shortcut and run it manually when required
U	LogitechImageStudioTray	LogiTray.exe	"System Tray access to ImageStudio
X	MSN Funny Images	imsngsr.exe	"Added by the AGOBOT-TT WORM!"
Y	Naimagent_service	EPOAgentnaimas32.exe	"Networked version of McAfee VirusScan. Installs
Y	Naimagent_UI	EPOAgentnaimag32.exe	Workstation background program for Network Associates McAfee ePolicy Orchestrator - a network management tool for enforcing antivirus protection of the workstations using system policies. Works with both McAfee and Norton AntiVirus. NAIMAG32 and NAIMAS32 communicate with the ePolicy Orchestrator processes on the network fileserver to check for virus updates or for the need to perform a virus scan
Y	Naimagent_UI	naimag32.exe	Workstation background program for Network Associates McAfee ePolicy Orchestrator - a network management tool for enforcing antivirus protection of the workstations using system policies. Works with both McAfee and Norton AntiVirus. NAIMAG32 and NAIMAS32 communicate with the ePolicy Orchestrator processes on the network fileserver to check for virus updates or for the need to perform a virus scan
U	StillImageMonitor	Stimon.exe	"Stimon.exe enables a USB still-image device (such as a scanner) to initiate data transfer to a program. For example
N	TrueImageMonitor.exe	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
X	Twain image	mmp32.exe	"DailyWinner adware"
X	uninstal	regsvr32 image.dll	"CoolWebSearch parasite variant. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The ""image.dll"" file is found in %System%"
X	Windows Image	wintimage.exe	"Detected by Avast as the SDBOT-GEN44 WORM!"
X	Windows Image Acquisition (WIASC)	WIAcs.exe	"Added by the RIZO.A TROJAN!"
X	Windows Image Acquisition (WIASSC)	WIAcss.exe	"Added by the RIZO.A TROJAN!"
X	winimage	wvsvc.exe	"Added by the RBOT.TX WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.