| Status | Autorun name | Command | Description |
| X | I am not Ranky. I am eTunnel! | msyervice.exe | Added by an unidentified WORM or TROJAN! |
| X | I am not Ranky. I am eTunnel! | winsys.exe | Added by an unidentified WORM or TROJAN! |
| X | I am not Ranky. I am eTunnel! | disney.exe | Added by an unidentified WORM or TROJAN! |
| X | I just want to say I love Milko and I need a drink | svchost.exe | Added by the CHIKO WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\Administrator\Local Settings\Application Data |
| X | I-Worm.GiGu | uGiG.eXe | Added by the GINK WORM! |
| X | I/O Controllers | svcnet.exe | Added by the TIBIK-B TROJAN! |
| X | I386 | I386.exe | Added by the MYPOWER WORM! |
| ? | I81SHELL | I81SHELL.exe | Appears to be related to drivers for an Intel 810 graphics chipset on an ASUS motherboard |
| U | i8kfangui | i8kfangui.exe | Graphical interface for fan speed control |
| U | IAAnotif | Iaanotif.exe | Part of Intel® Matrix Storage Manager (formally known as Intel® Application Accelerator and Intel® Application Accelerator RAID Edition). Used in conjunction with the event monitor service (IAANTMON - Iaantmon.exe) to display event notifications (such as RAID volume status changes, HDD I/O errors or HDD SMART event) via a System Tray icon when an event occurs. Via this icon you can then choose to launch the Intel Matrix Storage Console or ignore the current alert |
| Y | iamapp | iamapp.exe | AtGuard personal firewall engine. As Atguard was bought by Symantec some time ago, it's now the Norton Personal Firewall executable as well |
| X | Iamnacho On Irc.MusIrc.com Is a Homosexual! | XBox64.exe | Added by the RANDEX.Y WORM! |
| ? | IaNvSrv | IaNvSrv.exe | Related to the option ROM part of the Intel® Matrix Storage Manager. Located in %ProgramFiles%\Intel\Intel Matrix Storage Manager\OROM\aNvSrv. What does it do and is it required? |
| ? | Iap | iap.exe | Possibly part of Dell OpenManage Client Instrumentation - software that allows remote management application programs to access information about, monitor the status of or change the state of the client computer, such as shutting it down remotely? |
| U | ias | ias.exe | InvisibleASpy keystroke logger/monitoring program - remove unless you installed it yourself! |
| X | IASHLPR | IASHLPR.EXE | Added by the OPASERV.T WORM! |
| X | ibin | [path to trojan] | Added by the PERDA-C TROJAN! |
| X | ibm | ibm.exe | Added by the LEGMIR-AH TROJAN! |
| Y | IBM Client Security | certtool.exe | Part of Client Security Software for IBM\Lenovo notebooks. If you have configured the software via the associated wizard this will need to be running if you want to mount password protected areas of the disk (created with SafeGuard PrivateDisk), use the password manager or file/folder encryption options |
| N | IBM Client Security Software | csecwiz.exe | Setup wizard for the Client Security Software for IBM\Lenovo notebooks. This entry only runs once, after the software has been installed and the notebook rebooted for the first time. If the wizard isn't completed a shortcut is available via the Start menu until it is |
| X | IBM Keyboard Driver | ikeybdrv.exe | Added by the SDBOT.IC TROJAN! |
| Y | IBM Password Manager | pwmgr.exe | Part of Client Security Software for IBM\Lenovo notebooks - IBM® Client Security Password Manager "enables you to manage your sensitive and easy-to-forget login information, such as user IDs, passwords, and other personal information, with IBM Client Security. The IBM Client Security Password Manager stores all information through the IBM Security Chip so that your UVM user authentication policy controls access to your secure applications and Web sites." Can also be used with or without the Fingerprint Reader on select models |
| N | IBM RecordNow! | RecordNow.exe | IBM customized version of the RecordNow! CD-writing utility from Sonic Solutions |
| U | IBM ThinkPad EasyEject Support Application | EzEjMnAp.Exe | EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: "The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once, rather than stopping each device individually." Configuration and performing of EasyEject actions is available via Fn+F9 key combination on some models |
| N | IBM ThinkPad EasyEject Tray Utility | EZEJTRAY.EXE | System Tray access to the EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: "The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once, rather than stopping each device individually." Configuration and performing of EasyEject actions is available via Fn+F9 key combination on some models |
| N | IBM ThinkPad Tray Utility | TP98TRAY.EXE | System Tray access to the ThinkPad Configuration utility for IBM/Lenovo ThinkPad notebooks. "The ThinkPad Configuration utility is a control center to configure your ThinkPad hardware. With this utility, you can setup or change your device configurations for ThinkPad hardware and options" |
| U | IBM ThinkPad Utility | NPDTray.exe | System Tray access to Presentation Director for IBM/Lenovo Thinkpad notebooks - which allows you to create and quickly select between various single and mulitple display options. Scheme selection and settings are also available via Fn+F7 key combination on some models |
| U | IBM TrackPoint Accessibility Features | tp4ex.exe | Supports accessibility features for the TrackPoint stick and associated buttons on IBM/Lenovo ThinkPad notebooks. If features such as "Click Sound", "Button Lock" and "Cross Hair cursor" are enabled this entry will run at startup. If none of the accessibility features are used it remains as a startup entry but doesn't run |
| ? | IBM Warranty Notification | ERTS0749.exe | IBM Warranty Notification - presumably it's a reminder to either register or that warranty is about to expire? |
| Y | IBM_PWMGR | pwmgr.exe | Part of Client Security Software for IBM\Lenovo notebooks - IBM® Client Security Password Manager "enables you to manage your sensitive and easy-to-forget login information, such as user IDs, passwords, and other personal information, with IBM Client Security. The IBM Client Security Password Manager stores all information through the IBM Security Chip so that your UVM user authentication policy controls access to your secure applications and Web sites." Can also be used with or without the Fingerprint Reader on select models |
| N | ibmmessages | ibmmessages.exe | "The Access IBM Message Center displays messages to inform you about helpful software that may be pre-installed on your PC. The Message Center can also provide messages about new updates available from the IBM Support Center to keep your computer current" |
| ? | Ibmmon.exe | Ibmmon.exe | ?? |
| U | Ibmpmsvc | ibmpmsvc.exe | Power management driver for IBM laptops. Provides support for the use of four keys on the thinkpad keyboard with blue key tops - Fn, F3, F4 & F12 - which have specific functions to control the standby and hibernate buttons. Not required if you don't plan to go into standy or hibernate modes |
| ? | IBMPRC | ibmprc.exe | IBM application - what does it do and is it required? |
| U | IBMUltraBayHotSwapCPLLoader | IBMBAY2N.EXE | Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops |
| ? | IBMUltraBayHotSwapSound | IBMBAYSN.EXE | Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops. Is it needed though - does it just play a sound? |
| X | Ibs | ibs.exe | Added by the HIDEDIAL-B TROJAN! |
| U | IBWin Background process | IBackground.exe | IBackup for Windows |
| U | IBWin Monitor | IBMonitor.exe | IBackup for Windows |
| N | IC_KEY_3 | spvic.exe | Instant Chess related |
| Y | IcaBar | icabar.exe | Related to Citrix MetaFrame |
| U | iCalendar | Calendar.exe | Older version of Desktop iCalendar/Desktop iCalendar Lite by Desksware which include support for Google Calendar and add weather, tasks and appointments to your desktop |
| X | icasServ | icasServ.exe | Browser hijacker, redirecting to Searchforfree.info. Also detected as the ICASERV-A TROJAN! |
| X | icccomp | [8 random letters].exe | Added by the ZHELATIN.EQ WORM! |
| X | ICcontrol | iccontrol.exe | ICcontrol premium rate adult content dialer |
| X | icdd7ee6 | rundll32.exe icdd7ee6.dll,EnableRunDLL32 | LZIO.com adware downloader. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "icdd7ee6.dll" file is found in %System% |
| X | icddefff | rundll32.exe icddefff.dll,EnableRunDLL32 | LZIO.com adware downloader. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "icddefff.dll" file is found in %System% |
| Y | ICF | mfp.exe | McAfee Family Protection - which 'is easy-to-use and built to empower parents to say "yes" to their children's online interests while protecting them as they learn and explore' and "protects children of all ages from exposure to inappropriate content, social networking risks, strangers, and other threats" |
| N | ICH Synth | eusexe.exe | Sound related and can be disabled without affecting performance although advanced sound features may be sacrificed. May be related to Compaq PC's with "SoundMAX integrated Digital Audio" (Analog Devices Inc.) devices |
| X | icifati | yujixit.exe | Added by the SDBOT.ZZH WORM! |
| U | iClean | iClean.exe | IEClean - "advanced, comprehensive package of tools which perform a number of functions to allow you to control your online privacy" |
| U | ICM | ICM.EXE | Starts Internet Call Manager dialog box and/or taskbar icons at bootup. This is a subscription program from internetcallmanager.com that monitors a dialup phone line for incoming calls and handles voicemail |
| X | ICManagement | msic32.exe | Added by the MSIC BACKDOOR! |
| N | iCn | NAG.EXE | iChoose - shopping browser enhancement that alerts you to cheaper deals for goods you want to buy, if they exist. Not related to the Mac icon program of the same name |
| U | ICO | ICO.EXE | Found on some Sony Vaio, IBM Thinkpad and Dell (and possibly other) laptops and seems to be related to Mouse Suite 98 Daemon according to the properties. Required on the Dell Inspirion 530 as without it the Dell mouse suite does not load and mouse settings are not retained on a reboot. Appears to cause a behaviour where the desktop suddenly flips back up when playing DirectX associated games |
| N | Icon Animation | HDE.EXE | Part of McAfee Nuts & Bolts. Provides entertaining animation of your desktop icons |
| N | Icon Hearit 95 | hearit95.exe | Audio desktop customization utility from Moon Valley Software. Resource hog |
| N | Icon Hearit 98 | hearit98.exe | Audio desktop customization utility from Moon Valley Software. Resource hog |
| X | Icon lptt01 | icon.exe | RapidBlaster variant (in a "Icon" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here |
| X | Icon ml097e | icon.exe | RapidBlaster variant (in a "Icon" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here |
| Y | iconcache | icon.bat | Related to the Vista Customization Pack |
| Y | ICONCLNT | iconclnt.exe | APC PowerChute® Personal Edition tray icon |
| U | ICONDESK | ICONDESK.EXE | Small utility which will allow you the option of hiding or showing your desktop icons |
| N | Iconfig.exe | Iconfig.exe | Icon for LS-120 "Superdisk" |
| X | iConfigLoader | DIIhost.exe | Added by the GAOBOT.AO WORM! |
| N | Iconoid | Iconoid.exe | Iconoid is a desktop icon manager |
| N | Iconsaver | Iconsaver.exe | IconSaver is a desktop icon manager |
| X | ICQ | ICQNET.vbs | Added by the GORMLEZ-A WORM! |
| X | ICQ | syscdd2.exe | Added by the SDBOT-ON BACKDOOR! |
| X | ICQ Agent | icq6.exe | Added by the AGENT-FZJ TROJAN! |
| X | ICQ Center | [path to worm] | Added by the RANDIN WORM! |
| X | ICQ Chat Service | icqjdhs.exe | Added by a variant of the RBOT WORM! |
| X | ICQ Hacking Pro | ICQpro.exe | Added by a variant of the NETSPY TROJAN! |
| N | ICQ Lite | ICQLite.exe | ICQ Lite - compact version of the popular messaging program |
| X | icq lite | scvhost.exe | Added by the AGENT-DSF TROJAN! |
| X | icq lite | winlog.exe | Added by the IRCBOT-TJ TROJAN! |
| X | ICQ Lite Messenger | ICQLITE.EXE | Added by an unidentified VIRUS, WORM or TROJAN! The legitimate ICQ Lite executable is located in %ProgramFiles%\ICQLITE whereas this one is located in %System% |
| X | ICQ Messenger 2002 | ICQ2002.exe | Added by the SDBOT-ABL WORM! |
| X | ICQ Net | winlogon.exe | Added by variants of the NETSKY WORMS! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup! |
| N | ICQ Plus | vplus.exe | ICQ Plus is a freeware utility makes your ICQ skinnable (change the look). Available via Start -> Programs |
| X | IcqBeta | webcamupdate.exe | Added by an unidentified TROJAN! |
| U | ICQMonitor | ICQMonitor.exe | ICQ Monitor Sniffer surveillance software for the ICQ instant messenger. Uninstall this software unless you put it there yourself |
| X | ICQMsn | [path to trojan] | Added by the RANCK-AH TROJAN! The most common example is "cbfks.exe" located in %System% |
| X | ICQNet | winlogon.exe | Added by the NETSKY-C WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir% |
| X | icrosof Avps32 Control | av32.pif | Added by the RBOT-AVC WORM! |
| X | icrosoft Visual | plscx.exe | Added by the RBOT-AYO WORM! |
| X | icrosoft Visual InterDevc | zvslmqb.exe | Added by the RBOT-AYP WORM! |
| X | icrosoft Windows DLL Services Configuration | poker3.exe | Added by the SDBOT-AER WORM! |
| X | icrosoftf Avpx Control | avpx.exe | Added by the RBOT-AYN WORM! |
| U | ICSDCLT | rundll32.exe Icsdclt.dll, ICSClient | Internet Connection Sharing allows more than one computer to simultaneously access the internet with a single connection. Also required when networking two machines |
| N | ICServer | Icserver.exe | Intel Intercast viewer software. Gives access to selected internet pages which are broadcasted by several TV stations |
| Y | ICSMGR | ICSMGR.EXE | Monitors DNS and DHCP requests for ICS (Internet Connection Sharing). Needed if you're sharing the internet on various computers |
| X | ICU-Sucker | Service32.exe | Added by the ILLNOTIFIER.D TROJAN! |
| N | ID Commander | IDCom.exe | Caller ID utility for identifying incoming telephone numbers |
| X | ID8525 | ID8525.exe | Added by the ID8525.A TROJAN! |
| X | ID8525 | id85255.exe | Added by the ID8525.A TROJAN! |
| ? | IDA | IDA.EXE | Part of HP's PC Common Operating Environment (PC COE) project. Located in %ProgramFiles%\Hewlett-Packard\PC COE. What does it do and is it required? |
| X | IDE | ide.exe | Added by the ASSASIN.F TROJAN! |
| X | IDE Loader | IDElibr32.exe | Added by the XILON TROJAN! Related to the game "Diablo II" |
| X | idecntl | idecntl.exe | Added by a variant of the CRYPTER.C TROJAN! |
