Start Up Applications I

Y	Image & Restore	IMAGE32.exe	Part of McAfee Nuts & Bolts. Image/Restore can recover from drives that have been accidentally formatted or completely erased, if Image was recently run
U	ImageDrive-{hex numbers}	ImageDrive.exe	Nero ImageDrive from Ahead - virtual CD/DVD drive software
U	Imagefox	imagefox.exe	ImageFox 2.0 is an "add-on" graphics previewer for most Windows Open/Save As dialog boxes
X	Imagemgt32	Imagemgt32.exe	Added by the GEMA TROJAN!
X	IMClass	Svhosl.exe	Added by an unidentified WORM or TROJAN!
N	imekrig	imekrig.exe	Part of MS Input Method Editor which is used to ease the input of Asian characters in MS Office (Chinese, Japanese and this one is Korean)
N	IMEKRMIG6.1	IMEKRMIG.EXE	Part of MS Input Method Editor which is used to ease the input of Asian characters in MS Office (Chinese, Japanese and this one is Korean)
N	Imesh	??	Imesh is a file sharing system
N	Imesh Auto Update	??	Update check for the Imesh file sharing system. Turn the update off under "options"
U	ImgIcon	ImgIcon.exe	Displays Iomega icons in Explorer/My Computer, ejects Zip disks on shutdown and displays a special delete confirmation box when deleting files on an Iomega drive. Available via Start -> Programs. If you disable it remember to eject disks first before powering the drive down - hence the "U" recommendation. Note - FreeCell may not run with ImgIcon running
N	ImgStart	ImgStart.exe	Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs
N	Imjpmig.	IMJPMIG.EXE	Part of MS Input Method Editor which is used to ease the input of Asian characters in MS Office (Chinese, Korean and this one is Japanese). . represents the version number
?	immcheck.exe	immcheck.exe	Related to I-FORCE driver for force feedback steering wheel?
U	IMOL	IMOLApp.exe	IncrediMail for Office Outlook Add-On
N	Imonitor	Plguni.exe	McAfee QuickClean 3.0 - removes internet clutter and unwanted programs
U	IMStart	IMStart.exe	InterMute security software related
X	IMwire	imwireup.exe	SafeSurfing parasite variant
N	InCD	incd.exe	Ahead InCD packet writing software. Similar to DirectCD. On my system there isn't an entry, on another visitor's there is. Run manually before insert an appropriately formatted CD-RW disk
N	IncMail	IncMail.exe	"IncrediMail is an advanced, feature-rich email program that offers you an unprecedented interactive experience. Unique multimedia features will enable you to tailor your email experience so that it fits your mood and personality"
N	InControl Desktop Manager	DMHKEY.EXE	For Diamond Multimedia video cards. Allows System Tray access to desktop utilities such as screen resolution. Available via Start -> Programs
N	Incredimail	incredimail.exe	"IncrediMail is an advanced, feature-rich email program that offers you an unprecedented interactive experience. Unique multimedia features will enable you to tailor your email experience so that it fits your mood and personality"
U	Index Washer	WashIdx.exe	Windows Washer from Webroot Software. Useful utility that deletes safe to remove files, cookies, browsing history, etc. Available via from Start -> Programs. Disable within the program options - otherwise it is re-enabled in MSCONFIG
X	Indexindicator	Indexindicator.exe	Added by the LAZAR TROJAN!
N	IndexSearch	IndexSearch.exe	Associated with PaperPort scanner software from ScanSoft
X	Inet DataBase	Inetdbs.exe	Added by the QEDS WORM!
X	Inet Delivery	Intdel.exe	Spyware
X	Inet Delivery	intdel_2.exe	Spyware
X	Inetapi	Netapi.exe	Added by the NETDEVIL.14 TROJAN!
U	inetcntrl	inetcntrl.exe	Bsafe Online - internet filter
?	InetConf	inetconf.exe	??
U	Inetd	INETD32.EXE	Windows Inet Daemon from Hummingbird Communications. "Hummingbird Inetd has the advanced ability to conserve PC resources by listening for connection requests and launching server daemons". Provides PCs with the full functionality of a UNIX workstation
U	inetinfo.exe	inetinfo.exe	Executable used by MS Internet Information Server (IIS). If it's running, then so is IIS. Useful in knowing whether you require the patch for the Code Red worm. Comes with PWS (Personal Web Server) or NT4 and handles ASP-, PHP code (+ more)
X	inetmgr	inetmgr.exe	Actual Names (AdvSearch) Internet Keywords parasite
X	InetMSN	msnet.exe	Added by a variant of the SDBOT TROJAN!
U	Info Select	is.exe	Info Select from Micro Logic - personal information manager
X	Info32x	Info32x.exe	Added by the GEMA TROJAN!
?	Infoplay.exe	Infoplay.exe	Written by New Media Properties, LLC and you're asked if you want to download and install it if you visit one of their search engine websites (which I chose not to). What does it do and is it needed?
U	Infra-red Monitor	IRMON.EXE	System Tray access to infra-red devices. Not required unless you use infra-red devices
X	infus	infus.exe	Adult content dialler
U	Infuzer	Infuzer.exe	Infuzer - "is a service that copies dates from the web or an email straight to your electronic calendar". Beware of the following adware trait - "Infuzer provides web site owners with a unique opportunity to communicate with their visitors in a way that is useful and relevant to them, as well as increasing return visits and brand awareness, and providing new e-commerce opportunities"
X	infwin	infwin.exe	Msview parasite variant
X	Initial Page	install.exe	EasySearch browser hijack installer
Y	Initialize8x8	8x8_init.exe	Tool that initializes a Pinnacle PCTV card - maybe in capture or in showing overlay
N	Ink Monitor	InkMonitor.exe	Associated with Epson (and maybe other) printers. Tells you when the ink's running low and asks if you want to buy another cartridge on-line
N	InkWatch	InkWatch.exe	Associated with Canon (and maybe other) printers. Tells you when the ink's running low and asks if you want to buy another cartridge on-line
Y	InoRPC	InoRpc.exe	Associated with eTrust Antivirus/InoculateIT
Y	InoRT	InoRT9x.exe	Associated with the Realtime Monitor of eTrust Antivirus/InoculateIT version 6 virus scanners from Computer Associates. For NT/2K/XP users you may need a patch if seeing high CPU useage - see here
U	InoTask	InoTask.exe	Scheduled scans and signature updates for eTrust Antivirus/InoculateIT version 6 virus scanners from Computer Associates. Leave enabled unless you manually update signatures or perform routine scans. If enabled it can result in high CPU useage when performing updates - see here
?	insCOA5	insCOA5.exe	??
?	Install Pending Files	sifxinst.exe	Uninstall program for Lanovation's Prism Deploy and Prism Pack adminstrators software deployement tools. For specific information see here. Is it required?
N	InstallAurealDemos	InstallAurealDemos.js	Used to initialize the Aureal A3D demos InstallShield wizard
U	InstallBuddy	Ibtna.exe	InstallBuddy - automatically translates and installs your desktop documents, such as Adobe PDF, HTML, Microsoft Word, Excel and PowerPoint files, to your Palm organizer when you HotSync
X	Installed shell32.dll	Office.exe...	Added by a variant of the LOVGATE WORM!
?	InstallNAIProduct	SETUP.EXE	Could be related to Network Associates Inc who own the McAfee VirusScan product amongst others. This was found in a directory called "VSC". Could it be an installation that failed and "SETUP.EXE" was left to run at startup as an error?
X	Instant Access	rundll32.exe EGDHTML_1023.dll, InstantAccess	Adult content dialler related
N	Instant Update Center	reminder.exe	From Broderbund's PrintMaster 10. It is an event reminder (for calendar dates, etc). Delete from the startup using Startup Manager program because it keeps re-checking itself when using MSCONFIG. PrintMaster 11 uses filename PMremind.exe - it has to be unchecked in startup in the same manner
U	Instant Wireless Configuration Utility	WUSB11cfg.exe	Utility used by the LINKSYS LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration
N	InstantAccess	INSTAN~1.EXE	From TextBridge Pro 9.0 OCR scanner software. Available via Start -> Programs
U	InstantDrive	InstantDrive.exe	Pinnacle Systems (ex VOB) InstantDrive - creates a virtual CD-ROM drive on the computer�s hard drive. Part of InstantCD/DVD burning software
X	InstantPleasure	instantpleasure.exe	Adult content dialler
X	InstantPleasureXXX	instantpleasurexxx.exe	Adult content dialler
N	InstantTray	PCLETray.exe	Pinnacle InstantCD/DVD disc creation software. Tray icon enabling a pop-up menu that lets you call up any of Instant CD/DVD's tools with one click. Can be started manually
X	instit	instit.bat	Added by the OPASERV.H WORM!
X	instit	INSTIT.BAT	Added by the OPASERV.K WORM!
?	InstUtlR.exe	InstUtlR.exe	??
X	intdctrr	idctup20.exe	SafeSurfing parasite variant
U	Intel Active Monitor	imontray.exe	System tray monitoring of fans, temperature, voltage, etc for Intel motherboards. Only needed if you "overclock" or live in hot environment. Can also cause problems when running on a laptop if you change PCMCIA cards
U	Intel File Transfer	xfr.exe	Part of Intel's LANDesk Management Suite 6 and the Common Base Agent (CBA) - used for communicating between the core server and managed clients
U	Intel PDS	pds.exe	Intel Ping Discovery Service (PDS). Part of Intel's LANDesk Management Suite 6 and the Common Base Agent (CBA) - used for communicating between the core server and managed clients. Will start the dial-up if installed and enabled
U	Intel Product Number Utility	IntelProcNumUtility.exe	Intel Processor Serial Number Control Utility allows you to enable and disable the processor serial number capability of an Intel PIII processor. You can find more information here. System Tray icon providing the user with a visual state indication. You can find more information here
N	Intel PROSet Tray Icon	promon.exe	System Tray icon for Intel PRO series ethernet adapters giving access to the diagnostic features
X	Intel system works	iis.exe	Added by the RBOT.QGA WORM!
X	InteliSys	smss.exe	Advertisingvision adware - file is located in C:Windows or C:Winnt, and not in it's System32 subdirectory, as is the case with the legitimate Smss.exe system file which would normally NOT figure in Msconfig/Startup!
U	IntelliPoint	point32.exe	Microsoft Intellipoint software for their Intellimouse series of mice - required if you use non-standard Windows driver features
U	Intellitype	type32.exe	For MS programmable keyboards. If you disable Intellitype in Startup, any "Hot Keys" that are changed by the user to perform functions other than default settings, defer back to their default settings unless you have changed them
U	IntelMEM	IntelMEM.exe	Related to connection events on an Intel chipset based modem. It can alert you if the telephone line is being used when you're trying to get online (when you're using dial-up). It can also alert you if your modem line is disconnected. Furthermore, it can alert you if you have made a wrong connection with your modem line
U	IntelProcNumUtility	cpunumber.exe	Intel Processor Serial Number Control Utility allows you to enable and disable the processor serial number capability of an Intel PIII processor. You can find more information here. System Tray icon providing the user with a visual state indication. You can find more information here
N	Intel� Common User Interface	igfxtray.exe	Quick access to the control panel via a System Tray icon for graphics based upon the Intel chipsets (ie, i810). These chipsets are often included on motherboards. Available via Start -> Settings -> Control Panel
?	Intense Registry Service	IntEdReg.exe /CHECK	Intense Educational Ltd - Language Office Software. Is it required?
X	InterceptedSystem	[path to worm]	Added by the ANACON-B WORM!
Y	InterCheck Monitor	Icmon.exe	Part of Sophos ant-virus sofware
X	Interdll	Interdll.exe	Added by the DELF family of TROJANS!
X	Internal	[trojan filename]	Added by the SMOTHER and TRANSLAT TROJANS!
X	Internal	regedit.exe /s %windir%c:[month number]	Added by the FORTNIGHT.D TROJAN!
X	InternalSystray	Kazza.exe	Added by a variant of the OPTIX TROJAN! Note - unlike the valid KaZaA executable, this is located in C:WindowsSystem (Win9x/Me), C:WinntSystem32 (WinNT/2K), or C:WindowsSystem32 (WinXP)
X	internat	internat.exe	Added by the LYDRA-F TROJAN! Note - the real internat.exe resides in %windir%system (where %windir% is the Windows directory - C:Windows or C:Winnt) whereas this version resides in %windir%
X	Internat	systray.exe	Added by the ALADINZ.P TROJAN! Note - this is not the legitimate systray.exe process
X	Internat Conf	bootconf.exe	Homepage hijacker, redirecting to coolwwwsearch.com; see for example here
N	internat.exe	internat.exe	Language selection icon in system tray
X	Internat.exe	internat.exe	Added by the NETSNAKE TROJAN! Note - the real internat.exe resides in %windir%system (where %windir% is the Windows directory - C:Windows or C:Winnt) and has a "?" icon wheras this version resides in %windir% and has a ZIP icon
X	internct	WinSocks5.exe	Added by the GRAYBIRD.F TROJAN!
U	Internet Answering Machine	IAMNET~1.EXE	From Callwave. It offers a free utility to monitor your incoming phonecalls if you only have a single telephone line for internet access
U	Internet Answering Machine	IAM.exe	From Callwave - offers a free utility to monitor your incoming phonecalls if you only have a single telephone line for internet access
X	Internet Config	svchosts.exe	Added by the SDBOT TROJAN!
X	Internet Connection Wizard	stisvsq.exe	EasySearch adware
U	Internet Download Accelerator	ida.exe	Internet Download Accelerator download manager
X	Internet Exploere Services	urlmon32.dll.exe	Added by the EVIAN.C WORM!
X	Internet Explorer	iexplorer.exe	Added by the LORSIS WORM! Note - the legitimate IE (iexplore.exe) does not figure in Msconfig/Startup unless added manually and this loads from the "RunServices" key