| Status | Autorun name | Command | Description |
| X | irwftp | ftpmon.exe | Added by the BANCBAN-BO TROJAN! |
| U | IrXfer | IrXfer.exe | Microsoft Infrared Transfer application |
| U | IS CfgWiz | cfgwiz.exe | Configuration wizard for older versions of Symantec's Norton Internet Security (and the now discontinued Norton Personal Firewall). On the first run after installation or a significant software update via LiveUpdate this entry looks after registration, subscription and post-installation tasks (such as LiveUpdate, full scan and scheduling) and confirms the default configuration settings. If this entry is disabled, the configuration wizard will run the next time Norton Internet Security is launched via the Start Menu |
| U | IS360tray | IS360tray.exe | System Tray access to and notifications for Security 360 anti-malware from Iobit - which has now been discontinued. Note - in November 2009 IObit were accused of stealing database information from Malwarebytes' Anti-Malware and others so review the links on the Wikipedia page and make your own mind up |
| X | iSafeAV | iSafeAV.exe | iSafe AntiVirus rogue security software - not recommended, removal instructions here |
| X | isamini.exe | isamonitor.exe | Added by the ZLOB.MEDIA-CODEC TROJAN! This purports to be a Windows Media Player upgrade (with names such as "iCodecPack", "X Password Manager" and "Media-Codec") to allow the user to view adult oriented videos on certain websites - but actually downloads and installs additional malware on the user's machine. Various directories and filenames are used - see the link for details. The most popular for this example appears to be "Video ActiveX Object" |
| X | isamonitor.exe | isamonitor.exe | Added by the ZLOB.MEDIA-CODEC TROJAN! This purports to be a Windows Media Player upgrade (with names such as "iCodecPack", "X Password Manager" and "Media-Codec") to allow the user to view adult oriented videos on certain websites - but actually downloads and installs additional malware on the user's machine. Various directories and filenames are used - see the link for details |
| X | Isass | Isass.exe | Added by the FUTRO TROJAN! |
| X | isass.exe | isass.exe | Added by the SPY-VL TROJAN! |
| X | IsassRenascimento | Issas.exe | Added by the BANKER.GAX TROJAN! |
| U | ISBMgr.exe | ISBMgr.exe | Sony ISB Utility - supports the battery management on some Sony laptops |
| X | iscch | iscch.exe | Added by the LCPRANK-A WORM! |
| N | isdbdc | isdbdc.exe | For Compaq PC's. May install properties in dial-up networking when you register with an ISP |
| U | isDeleteMe | isDel.bat | Used by Norton Internet Security to remove certain files and directories on reboot when uninstalling their product |
| N | ISDN Monitor | Linksts.exe | Tray icon which gets installed when you install the drivers for Asuscom internal ISDN modem cards (or rebadged Asuscom ISDN cards, such as MRi). This icon enables you to monitor or configure your ISDN card. Once you have configured your ISDN card correctly, you will never need to use this icon |
| U | ISDNwatch | IWatch.exe | FRITZ!X ISDNWatch - "dialing filter for more security and control on the ISDN PC. The PC is doubly protected against dialer programs and premium-service numbers: ISDNWatch allows the user to block calls to and from both individual numbers and whole number blocks" |
| X | iSecurity applet | rundll32.exe iSecurity.cpl,SecurityMonitor | Added by the DLOADER.UZO TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted |
| X | ish-b.exe | ish-b.exe | Added by the IRCBOT-ACZ TROJAN! |
| U | ISHelp | help.exe | ISpy is a security risk that logs keystrokes and captures screenshots. If you didn't install this yourself uninstall it |
| U | iShield | iShield.exe | "GuardWare iShield blocks pornographic images when you surf the Internet on your computer using a web browser" |
| X | ishost.exe | ishost.exe | Added by the DLOADR-XJ TROJAN! |
| Y | ISLP2STA | ISLP2STA.EXE | A process from Cisco Systems Inc associated with Windows Update for wireless NIC drivers |
| X | ISMModule | ISMModule.exe | Internet Speed Monitor C adware related - see example here |
| X | ISMModule2 | ISMModule2.exe | Internet Speed Monitor C adware related - see example here |
| X | ISMModule3 | ISMModule3.exe | Internet Speed Monitor C adware |
| X | ISMModule4 | ISMModule4.exe | Internet Speed Monitor A adware related |
| X | ISMModule6 | ISMModule6.exe | Internet Speed Monitor C adware related - see example here |
| X | ISMModule7 | ISMModule7.exe | Internet Speed Monitor C adware related - see example here |
| X | ISMModule8 | ISMModule8.exe | Internet Speed Monitor C adware related |
| X | ISMPack5 | ISMPack5.exe | Internet Speed Monitor C adware related - see example here |
| X | ISMPack6 | ISMPack6.exe | Internet Speed Monitor C adware related - see example here |
| X | ISMPack7 | ISMPack7.exe | Internet Speed Monitor C adware |
| X | ISMPack8 | ISMPack8.exe | Internet Speed Monitor C adware related - see example here |
| Y | ISP.COM High Speed | slipgui.exe | User interface for Slipstream - internet acceleration through compression/decompression techniques, intelligent cacheing on the server side, and real-time conversion of large/high-bandwidth images to less bulky pix. Used by popular ISPs such as IceNet, Wanadoo, Terra, OnSpeed, United Online and AOL Canada. Required if the user's account is locked in to that proxy server |
| X | ISPSERVICE | psycho.exe | Added by the IRCFLOOD-O TROJAN! |
| X | ISPSERVICE | wintmp.exe | Added by the IRCBOT.GP BACKDOOR! |
| U | iSpyNOW | ispynow.exe | iSpyNOW - remote monitoring and surveillance software |
| X | Israfel | Israfel.vbs | Added by the GAGGLE.D or GAGGLE.E WORMS! |
| N | IsReminder | ISPopup.exe | Related to GuardWare iShield - this is the registration reminder for the trial version, so not required in startup |
| X | ISRHelper.exe | ISRHelper.exe | Instant Spyware Removal rogue security software - not recommended, removal instructions here |
| Y | ISS_Certtool | certtool.exe | Part of Client Security Software for IBM\Lenovo notebooks. If you have configured the software via the associated wizard this will need to be running if you want to mount password protected areas of the disk (created with SafeGuard PrivateDisk), use the password manager or file/folder encryption options |
| N | issch | issch.exe | InstallShield is used by a number of software producers to install their programs and manage software updates. This entry runs scheduled searches for and performs any updates to supported installed software so you're always working with the most current version. Manually check for software updates for installed programs on a regular basis |
| X | issearch.exe | issearch.exe | Added by the ZLOB-QF TROJAN! |
| X | issEnc32Svr | issEnc32.exe | Added by a variant of the RBOT WORM! |
| N | ISSI EZUpdate Service | issimsvc.exe | Part of IBM Global Services - used internally by IBM for automatic updating of software and Microsoft patching |
| U | ISStart | ISStart.exe | Installed with Logitech's QuickSmart, ImageStudio and QuickCam (older versions) webcam software. The exact purpose of this startup entry is unknown at present, with opinions varying from: (i) adding a tray icon when a camera is connected - apparently no longer the case, (ii) repairing a problem with the image gallery and (iii) being required with some versions to take pictures and capture videos |
| Y | ISSVC | ISSVC.exe | Common process for older versions of Symantec's Norton Internet Security and the now discontinued Norton Personal Firewall security products. The exact purpose is unknown at present but neither program can function properly if this process is disabled. Loads via a registry "RunServices" key in 98/Me and as a service in XP |
| X | IST Service | istsvc.exe | ISTBar adware |
| X | ist service uninstall | [random filename] | ISTBar adware related |
| X | istinstall zazzer.exe | istinstall zazzer.exe | Unidentified adware downloader/installer |
| Y | ISTray | pctsTray.exe | System Tray access to both PC Tools Internet Security suite and Spyware Doctor antispyware from PC Tools |
| N | ISUSPM | ISUSPM.exe | InstallShield is used by a number of software producers to install their programs and manage software updates. This entry searches for and performs any updates to supported installed software so you're always working with the most current version. Manually check for software updates for installed programs on a regular basis |
| N | ISUSPM Startup | ISUSPM.exe | InstallShield is used by a number of software producers to install their programs and manage software updates. This entry searches for and performs any updates to supported installed software so you're always working with the most current version. Manually check for software updates for installed programs on a regular basis |
| N | ISUSScheduler | issch.exe | InstallShield is used by a number of software producers to install their programs and manage software updates. This entry runs scheduled searches for and performs any updates to supported installed software so you're always working with the most current version. Manually check for software updates for installed programs on a regular basis |
| Y | ISW.exe | ISW.exe | AT&T Internet Security Wizard tool installed when you choose to install their internet security suite - sourced by Radialpoint. Apart from downloading the suite installation files, the exact purpose is unknown at this time but it may be used to source critical updates and alerts so should therefore be left enabled |
| X | isxa | isxa.exe | Added by the SMALL-EIV TROJAN! |
| ? | ISXAgent | ISXAgent.exe | Related to Imprivata IT security products. What does it do and is it required? |
| N | iSysCleaner | iSysCleaner.exe | iSysCleaner - a simple tool that searches for junk files on your computer and allows you to delete them. Simple cleaning maintenance can be done by the user |
| X | isystem | isystem.exe | Added by the CHORUS-A TROJAN! Searchforfree browser hijacker |
| X | ItalU | italfds.exe | Added by a TROJAN - see here |
| X | iTbaMgqSlSQqG | iTbaMgqSlSQqG.exe | Added by the FAKEAV-DVN TROJAN! |
| U | Itk | Itk.exe | In The Know - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it |
| U | itk.exe | itk.exe | Insert ToggleKey by Mike Lin. ITK sounds a tone whenever you press Insert |
| U | iTouch | iTouch.exe | Loads the iTouch configuration settings for supported Logitech keyboards. It's required if your keyboard has shortcut buttons and you use them or have reconfigured them for different functions. It's also required if your keyboard does not have the num lock, caps lock, and scroll lock lights on it and you use the on-screen display indications for these |
| N | ItsDeductiblePopUp | ItsDeductible.exe | ItsDeductible from Income Dynamics. Calculates your noncash donations quickly and easily. This startup entry checks a registry entry for the next 'PopUp' date and if it is a past or current date displays a program related tip |
| ? | ITSecMng | ItSecMng.exe | Related to Bluetooth wireless support on Toshiba notebooks. What does it do and is it required? |
| X | ITUNES | itune.exe | Added by the RBOT-ZU WORM! |
| X | ITUNES | itunes.exe | Added by a variant of the RBOT WORM! Note - do not confuse with the legitimate Apple iTunes process with the same filename which is always located in %ProgramFiles%\iTunes. This one is located in %System% |
| X | Itunes | dials.exe | Detected by Kaspersky as the AGENT.MM TROJAN! |
| X | Itunes | itunes.exe | Added by the OSCABOT-L WORM! Note - do not confuse with the legitimate Apple iTunes process with the same filename which is always located in %ProgramFiles%\iTunes. This one is located in %Windir% |
| U | iTunes | iTunesHelper.exe | Installed with Apple's iTunes media management software. Tested without an iPod or iPhone, and on a system with more than 1GB of memory, disabling it does not adversely affect iTunes loading times - but it may help on systems with less memory. iPod and iPhone users report this is required to autostart iTunes when they are connected (can anyone confirm this?). In older versions, if it was disabled in it would re-instate itself after running iTunes a few times |
| U | iTunes Helper | iTunesHelper.exe | Installed with Apple's iTunes media management software. Tested without an iPod or iPhone, and on a system with more than 1GB of memory, disabling it does not adversely affect iTunes loading times - but it may help on systems with less memory. iPod and iPhone users report this is required to autostart iTunes when they are connected (can anyone confirm this?). In older versions, if it was disabled in it would re-instate itself after running iTunes a few times |
| X | iTunes Music | iTunesHelper32.exe | Added by the SDBOT.CHK WORM! |
| X | iTunesAgent | ita.exe | Added by the TACTSLAY.U TROJAN! |
| X | itunesff | itunesff.exe | Added by the EB adult premium dialer |
| U | iTunesHelper | iTunesHelper.exe | Installed with Apple's iTunes media management software. Tested without an iPod or iPhone, and on a system with more than 1GB of memory, disabling it does not adversely affect iTunes loading times - but it may help on systems with less memory. iPod and iPhone users report this is required to autostart iTunes when they are connected (can anyone confirm this?). In older versions, if it was disabled in it would re-instate itself after running iTunes a few times |
| U | itype | itype.exe | Microsoft IntelliType Pro utility (from version 5.5) - required to support the multimedia keys, programmed keys and key macros on Microsoft's range of keyboards. If this entry is disabled, any keys or key combinations that are changed by the user to perform functions other than default settings, defer back to their default settings and supported keys will not function in applications with advanced text services enabled |
| X | iudymosj | mrgviurtssd.exe | Added by the AGENT-OEM TROJAN! |
| N | Iusage | netdet.exe | Internet Usage Monitor - utility to calculate the cost and time on the internet via dial-up |
| X | iut75 | uzcx.exe | Added by the DLOADER-AXV TROJAN! |
| X | iv | iv.exe | Part of the Internet Antivirus and Internet Antivirus Pro rogue security software - not recommended, removal instructions here |
| X | ivHost | taskManager.exe | Added by a variant of the SPYBOT WORM! See here |
| X | ivHost | [6 random letters].exe | Added by a variant of the SPYBOT WORM! See examples here and here |
| N | IVPServiceMgr | ivpsvmgr.exe | Toshiba IVP Service Manager application which appears as a red satellite dish icon in the System Tray. This is Toshiba's equivalent to the Windows Automatic Update feature as, whenever you are connected to the Internet, it will check for Windows updates and Toshiba updates |
| X | ivy.exe | ivy.exe | Added by the AGENT-ENZ TROJAN! |
| N | IW ControlCenter | iwctrl.exe | Pinnacle Systems InstantWrite enables you to use your CD-R, CD-RW and DVD-RAM drive just like a hard disk or floppy disk. You can drag and drop files, create new directories right on your CD-R, CD-RW or DVD-RAM. Maybe required if you use this feature on a regular basis |
| U | IW_Drop_Icon | iwctrl.exe | Pinnacle Systems InstantWrite enables you to use your CD-R, CD-RW and DVD-RAM drive just like a hard disk or floppy disk. You can drag and drop files, create new directories right on your CD-R, CD-RW or DVD-RAM. Maybe required if you use this feature on a regular basis |
| U | iwctrl | iwctrl.exe | Pinnacle Systems InstantWrite enables you to use your CD-R, CD-RW and DVD-RAM drive just like a hard disk or floppy disk. You can drag and drop files, create new directories right on your CD-R, CD-RW or DVD-RAM. Maybe required if you use this feature on a regular basis |
| U | IWL | rundll32.exe [path] IWL.dll | IKL surveillance software. Uninstall this software unless you put it there yourself |
| X | ixplore | ixplore.exe | Added by the SDBOT-CY TROJAN! |
| X | ixplores | ixplores.exe | Added by the SDBOT-CE WORM! |
| X | ixproxy | [path to trojan] | Added by the XORPIX-A TROJAN! |
| X | ixsso | ixsso.exe | Added by the AGENT.AM TROJAN! Note - example names include "XviD", "Winamp Remote", "Windows Media Player" and "Futuremark" |
| X | iyelejiv | yujixit.exe | Added by the SDBOT.BJK WORM! |
| ? | IZE | N/A | ?? |
