| Status | Autorun name | Command | Description |
| X | iexplorere loader | iexplorere.exe | Added by the SDBOT.SS WORM! |
| X | Iexplorerr.exe | Iexplorerr.exe | Added by the BANKER-EUT TROJAN! The file is located in %Windir%\Sun\Java\Deployment\logs |
| X | Iexplorerr.exe | Iexplorerr.exe | Added by the BANKER.AOVZ TROJAN! The file is located in %Windir%\msagent\gf |
| X | IExplorerService | WinSock.exe | Added by the AGENT.KIU TROJAN! |
| X | IExplUpd | IExplUpd.exe | Added by the MDROP-CXY TROJAN! |
| X | iExpresser | iexpresser.exe | Added by the SLENFBOT.AP WORM! |
| X | ifp | ipf.exe | Added by the CLAGGER-AG TROJAN! |
| X | ifperx | [random filename] | Added by a variant of the SLAPER TROJAN! |
| X | ifperx | xmliwvug.exe | Added by the SLAPER.U TROJAN! |
| U | IFSplash.exe | IFSplash.exe | I-FORCE driver for force feedback steering wheel |
| U | IFXSPMGT | ifxspmgt.exe | Part of the Infineon Security Platform Software - which supports the on-board TPM security device included with some laptops from suppliers such as Acer, ASUS, HP and Sony |
| X | igamatu | ekor.exe | Added by the SDBOT.AQ TROJAN! |
| X | igamatu | atecaca.exe | Added by the IRCBOT.R WORM! |
| U | igfxhkcmd | hkcmd.exe | Hot Key handler for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled, you can access settings like graphics properties and screen rotation via pre-programmed key combinations - such as CTRL+ALT+F12 which displays the graphics properties (otherwise available via a right-click on the desktop or the Control Panel). Different chipset versions may have different pre-programmed settings and in some cases these may be programmable |
| U | igfxpers | igfxpers.exe | Installed with the graphics drivers for Intel desktop and mobile motherboard chipsets with integrated graphics. It's purpose or function isn't known at present but testing with it disabled would appear to indicate it isn't required - hence the recommended "U" status |
| X | igfxtras | svchots.exe | Added by the AUTORUN-AIW WORM! |
| U | IgfxTray | igfxtray.exe | System Tray access to display settings for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled, you can access settings like graphics properties and hot key settings via the icon on the System Tray. Different chipset versions may have different options available. These options are normally also available via the system Control Panel - under Display (XP) or Personalization and Appearance (Vista) |
| X | igfxtray Module | igfxtray.exe | Added by the VB-RI MALWARE! Note - this is not the legitimate Intel graphics System Tray utility which has the same filename and is located in %System%. This one is located in %Windir% |
| ? | Iglpbv | Iglpbv.exe | ?? |
| N | igndlm.exe | DLM.exe | IGN Download Manager has become a requirement for downloading files through FilePlanet.com. It is based on Internet Explorer and it installs through an ActiveX-plugin, hence Internet Explorer must be installed beforehand and downloads has to be initialized through that browser |
| X | igsex2x | igsex2x.exe | NewDial premium rate adult content dialler |
| X | IGuardPc.exe | IGuardPc.exe | IGuardPc rogue security software - not recommended, removal instructions here. A member of the AntiAID family |
| ? | iHP-100 | iHPDetect.exe | Drive Letter Searcher, iRiver iHP-100 iHP and H Series player related - does it need to start with Windows every time? |
| X | iilc | IILC.EXE | Homepage hijacker |
| X | Iinl | iptl.exe | PurityScan adware |
| X | IIS | inet.exe | Meplex adware |
| X | IISADMINS | systems.exe | Added by the AGOBOT.U WORM! |
| X | iisvers | iisvers.exe | Added by an unidentified TROJAN or adware |
| X | iiuyvyu | uzcx.exe | Added by the AGENT-EOF TROJAN! |
| N | iIWiper | Systemwiper.exe | System Wiper from iI Software - allows you to clear the history of your activites from you computer. Run manually on a regular basis |
| Y | IJ75P2PSERVER | IJ75P2PS.EXE | Printer utility which is required in order to make the printer work correctly |
| U | IJNetworkScanUtility | CNMNSUT.EXE | Network utility available for some Canon scanners and multifunction devices. Allows the device to see computers on a network and those computers running the utility to control scanning via the Control Panel on the scanner - which saves you having to run back and forth between the scanner and your computer |
| Y | IKE Service 95 | IKEService.exe | Associated with PGP. The PGP Tray can be disabled, but without IKESERVICE you won't be able to de- or encrypt anything |
| U | iKeyWorks | IKEYMAIN.EXE | A4Tech wireless keyboard driver and utility |
| U | IKL | rundll32.exe [path] IKL.dll | IKL surveillance software. Uninstall this software unless you put it there yourself |
| X | iktc | dmiy.exe | Added by the AGENT-RDY TROJAN! |
| X | ilasss | lsass.exe | Added by the INJECT-GZ TROJAN! Note - the legitimate lsass.exe process should not normally figure in Msconfig/Startup! |
| X | iLeAAmvQHHaC | iLeAAmvQHHaC.exe | Added by the FAKEAV-DIN TROJAN! |
| N | iLike | ilikesidebar.exe | iLike Sidebar for iTunes and Windows Media Player |
| X | iLLeGaL | Mplayer.exe | Added by the HOLAR.C (or GALIL) WORM! Note - this should not be comfused with Windows Media Player which has the same filename |
| X | iLLeGaL.exe | Mplayer.exe | Added by the HOLAR.C (or GALIL) WORM! Note - this should not be comfused with Windows Media Player which has the same filename |
| ? | ILO_Office_Manager | IntEdReg.exe /OFFMAN | Intense Educational Ltd - Language Office Software. Is it required? |
| X | ilortgdg | keepSafe.exe | Added by the KILLAV.KAX TROJAN! Note - this is not the legitimate KeepSafe from Stardock Corporation which shares the same filename and is normally located in a %ProgramFiles%\Stardock subfolder. This one is found in %System% |
| U | iLyric | iLyric.exe | iLyric plugin for the popular Winamp media player. Allows you to retrieve the lyrics for your songs with the press of a button. Not longer available |
| N | iM Start Center | iM_Tray.exe | Installed with the Sound Blaster Audigy range of soundcards. A radio tuner installed if the user chooses during installation. Available via Start -> Programs -> iM Networks -> iM Radio Tuner |
| X | im_autorn | im_1.exe | Added by the IMAV.A WORM! |
| X | im_autorn | im_2.exe | Added by the BAGLEDL-BO TROJAN! |
| X | Image | rundll32 [path] [trojan filename],Install | Added by the WINSHOW.Y TROJAN! |
| Y | Image & Restore | IMAGE32.exe | Part of McAfee Nuts & Bolts. Image/Restore can recover from drives that have been accidentally formatted or completely erased, if Image was recently run |
| X | Image Remote Players | sysvn.exe | Added by a variant of the IRCBOT BACKDOOR! |
| N | Image Transfer | SonyTray.exe | Sony Image Transfer software provides direct image transfer from your digital camera to a PC - can be started manually |
| U | ImageDrive-{hex numbers} | ImageDrive.exe | Nero ImageDrive from Ahead - virtual CD/DVD drive software |
| U | Imagefox | imagefox.exe | ImageFox 2.0 (formerly available from ACDSee) is an "add-on" graphics previewer for most Windows Open/Save As dialog boxes |
| X | Imagemgt32 | Imagemgt32.exe | Added by the GEMA TROJAN! |
| X | ImagePath | taskbarmngr.exe | Added by the SDBOT-XB WORM! |
| U | ImageTune | dthtml.exe | ImageTune from Hyundai ImageQuest. Rebranded version of Display Tune from Portrait Displays, Inc. - which "is the perfect software utility to initially set-up and adjust your display to achieve its optimum performance. All adjustments are made through a simple graphical user interface" |
| X | IMAPI | load.exe | Added by the DOWNDEL-A TROJAN! |
| N | iMarkup Client | iUtil.exe | Enables the iMarkup Client web page annotation utility to run in the background and be available in systray. Shortcut available via Start -> Programs |
| U | Imatio | imation.exe | Imation Disk Manager - enables you to create a password protected area on your Imation USB flash drive |
| X | imchat | imchat.exe | Added by a variant of the IRCBOT TROJAN! |
| X | IMClass | Svhosl.exe | Added by an unidentified WORM or TROJAN! |
| X | imcssl | xmliwvug.exe | Added by the SLAPER.U TROJAN! |
| X | IME | conime.exe | Added by the DLDR-G TROJAN! Note - this is not the legitimate Microsoft Console IME process of the same filename which is located in %System% and is used when a Asian language is used in Windows. This one is located in %Windir% |
| N | imekrmig | imekrmig.exe | Microsoft's Input Method Editor for the Japanese language which is used to both display and enable the input of characters in e-mails, documents, web forms and other files - should you need to. Found on PCs where East Asian languages have been installed through the Regional and Language options icon in the Control Panel |
| N | IMEKRMIG6.1 | IMEKRMIG.EXE | Microsoft's Input Method Editor for the Korean language which is used to both display and enable the input of characters in e-mails, documents, web forms and other files - should you need to. Found on PCs where East Asian languages have been installed through the Regional and Language options icon in the Control Panel |
| N | Imesh | ?? | Imesh is a file sharing system |
| N | Imesh Auto Update | ?? | Update check for the Imesh file sharing system. Turn the update off under "options" |
| X | IMEvtMgr.exe | IMEvtMgr.exe | Added by the KEYLOG-AR TROJAN! |
| U | ImgIcon | ImgIcon.exe | Displays Iomega icons in Explorer/My Computer, ejects Zip disks on shutdown and displays a special delete confirmation box when deleting files on an Iomega drive. Available via Start -> Programs. If you disable it remember to eject disks first before powering the drive down - hence the "U" recommendation. Note - FreeCell may not run with ImgIcon running |
| X | imgit | [path to file] | Added by the BANKER-EM TROJAN! |
| N | ImgStart | ImgStart.exe | Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs |
| N | ImgTask | Imgtask.exe | Related to the WalletPix digital photo album. "On some computers, the Wallet Pix device will leave behind a memory-resident file called ImgTask.exe. This file will be located in the operating system directory on your computer (typically %Windir%). You can remove this file at any time and it will not impact your computer's performance or functionality. The file will be restored each time you plug in the Wallet Pix though" |
| U | IMJPMIG | IMJPMIG.EXE | Microsoft's Input Method Editor for the Japanese language which is used to both display and enable the input of characters in e-mails, documents, web forms and other files - should you need to. Found on PCs where East Asian languages have been installed through the Regional and Language options icon in the Control Panel |
| X | IMJPMIG6.1 | HelpCat.exe | Added by the BESVERIT WORM! |
| U | IMJPMIG8.1 | IMJPMIG.EXE | Microsoft's Input Method Editor for the Japanese language which is used to both display and enable the input of characters in e-mails, documents, web forms and other files - should you need to. Found on PCs where East Asian languages have been installed through the Regional and Language options icon in the Control Panel |
| X | IMJPMIG8.2 | msime82.exe | Added by the VB-CYG WORM! |
| X | IMJPMIG8.2 | msime80.exe | Added by the VB-CYJ TROJAN! |
| ? | immcheck.exe | immcheck.exe | Related to I-FORCE driver for force feedback steering wheel? |
| X | ImMsn | timed.exe | Added by the WEBDOR.AK BACKDOOR! |
| X | ImMsn | msncomm.exe | Added by the WEBDOR.AK BACKDOOR! |
| U | IMOL | IMOLApp.exe | IncrediMail for Office Outlook Add-On |
| U | Imonitor | Plguni.exe | Part of McAfee's QuickClean - which removes internet clutter and unwanted programs. This entry monitor changes made to the registry so that they can be undone later using QuickClean - such as removing programs. QuickClean is now integrated into their Total Protection, Internet Security and AntiVirus Plus products primarily as a file cleaner/shredder and no longer supports program removal |
| X | imonitor | [path to trojan] | Added by the IMONI-A TROJAN! |
| U | IMONTRAY | imontray.exe | System tray monitoring of fans, temperature, voltage, etc for Intel motherboards. Only needed if you "overclock" or live in hot environment. Can also cause problems when running on a laptop if you change PCMCIA cards |
| X | imPlayok | imPlayok.exe | Added by the CUTWAIL TROJAN! |
| X | IMprocess | IM-svr.EXE | IMNames adware |
| N | Impulse Dock | ImpulseDock.exe | Older version of the Impulse digital distribution platform from Stardock Corporation |
| N | Impulse Now | IMPULS~1.EXE | System Tray access to and notifications for the Impulse digital distribution platform from Stardock Corporation. This is the Vista/7 MSConfig entry |
| N | Impulse Now | ImpulseNow.exe | System Tray access to and notifications for the Impulse digital distribution platform from Stardock Corporation. This is the Windows Defender entry |
| N | ImpulseNow | IMPULS~1.EXE | System Tray access to and notifications for the Impulse digital distribution platform from Stardock Corporation. This is the XP MSConfig entry |
| N | ImpulseNow | ImpulseNow.exe | System Tray access to and notifications for the Impulse digital distribution platform from Stardock Corporation |
| U | ImScInst | ImScInst.exe | Microsoft's Input Method Editor which is used to both display and enable the input of characters from East Asian and Right-to-left (e.g. Arabic) languages in e-mails, documents and other files - should you need to. Found on PCs where these languages have been installed through the Regional and Language options icon in the Control Panel |
| U | ImScInst.exe | ImScInst.exe | Microsoft's Input Method Editor which is used to both display and enable the input of characters from East Asian and Right-to-left (e.g. Arabic) languages in e-mails, documents and other files - should you need to. Found on PCs where these languages have been installed through the Regional and Language options icon in the Control Panel |
| X | imscmig | imscmig.exe | Added by the LURKA.B VIRUS! Note - do not confuse with the legitimate MS Input Method Editor entry which shares the same filename and is found in a sub-folder of %ProgramFiles%\Common Files%\Microsoft%\IME - this one is found in %Windir% |
| U | IMSCMig | IMSCMIG.EXE | Associated with Microsoft's Input Method Editor for Asian languages which is used to both display and enable the input of characters in e-mails, documents and other files - should you need to (e.g. Chinese, Hindi, Japanese, etc) |
| U | IMStart | IMStart.exe | InterMute security software related |
| U | IMVU | IMVUClient.exe | IMVU chat client that allows you to create "your own avatars who chat in animated 3D scenes" |
| X | imwinsrvc | acpmonsrv.exe | Added by the SLAPER.E TROJAN! |
| X | IMwire | imwireup.exe | SafeSurfing adware variant |
| X | imxecs | vbrun70sp4.exe | Added by the AGOBOT.ALA WORM! |
