igfxtray.exe is usually an Intel graphics tray helper from older Intel display-driver packages, but the filename is also easy for a malicious copy to imitate. Treat it as normal only when the file sits in a trusted Windows or Intel driver location, has a valid Intel or Microsoft-trusted signature, and matches a real Intel graphics installation. If it appears from Downloads, Temp, a user profile folder, or keeps returning after you disable it, check the file before trusting the startup entry.
What igfxtray.exe does
The legitimate igfxtray.exe process belongs to Intel graphics software. On systems that still include it, the helper can load a tray icon or provide quick access to display settings. It is most common on older Windows installations, OEM driver packages, and machines that have been upgraded across several Intel graphics driver generations.
That history matters because a missing or unexpected igfxtray.exe entry is not automatically malware. A Windows update, Intel driver update, OEM cleanup utility, or manual Startup-app change can remove or disable the tray helper while the graphics driver itself keeps working. The right decision is to verify the file and behavior, not to delete every Intel-looking process on sight.
Safe vs suspicious igfxtray.exe
| Check | What it means |
|---|---|
| Trusted path | A normal copy is commonly under C:\Windows\System32\igfxtray.exe on older packages or inside a legitimate Intel/OEM graphics driver folder. A copy in %USERPROFILE%\Downloads, %TEMP%, %APPDATA%, or a random subfolder is suspicious. |
| Digital signature | Properties should show a valid Intel Corporation or Microsoft-trusted driver signature. An unsigned file, broken signature, or unrelated publisher is a strong warning sign. |
| Startup name | A normal startup entry should clearly point to igfxtray.exe or Intel graphics software. A misspelled name, random command, script wrapper, or hidden scheduled task needs investigation. |
| Behavior | One tray helper at sign-in is normal on some systems. Repeated security warnings, browser redirects, new unknown apps, or a file that reappears after removal are not normal Intel behavior. |
How to check the file safely
- Open Task Manager, right-click igfxtray.exe, and choose Open file location. If Windows cannot show a location, search the full startup command in Task Manager or Autoruns-style startup tools before deleting anything.
- Check the folder. A trusted Windows or Intel driver folder is expected; a user-writable folder is not.
- Right-click the file, open Properties, and check the Digital Signatures tab. If the signature is missing or invalid, do not allow the startup item until the file is scanned.
- Compare the file date with your recent driver updates. A new igfxtray.exe that appeared after a fake driver installer, cracked utility, or bundled app deserves extra caution.
- If the file looks legitimate but a popup appears at every startup, repair or update the Intel/OEM graphics driver instead of deleting the executable.
Should you disable igfxtray.exe at startup?
Disabling the legitimate tray helper is usually safe if you do not use its quick display menu. It should not remove the Intel graphics driver itself, and Windows display output should continue to work. Use Windows Startup Apps or Task Manager Startup, disable the entry, reboot, and confirm that display brightness, resolution, external monitor behavior, and hotkeys still work as expected.
Do not disable it as a substitute for malware cleanup. If the path is wrong, the signature is bad, or the entry returns with a different command after reboot, you are no longer troubleshooting a normal Intel tray helper. You are checking a suspicious startup persistence item.
What to do if igfxtray.exe looks suspicious
Keep the file in place long enough to preserve evidence, then disconnect from risky downloads or installers that led to it. Upload the file only to a trusted scanner if it does not contain private data, or run a local malware scan when the machine has recurring startup entries, alerts, browser changes, or unknown scheduled tasks.
If a suspicious igfxtray.exe copy already ran, check more than the visible file. Malware often leaves a loader, scheduled task, service, browser change, Defender exclusion, or another startup item that recreates the visible executable after reboot. Gridinsoft Anti-Malware can help check for hidden files, startup entries, scheduled tasks, bundled apps, browser changes, and persistence after you remove or quarantine the obvious copy.
If the process path is wrong, the name imitates a Windows component, or high CPU started after an unknown installer, scan for hidden miners, services, startup entries, and bundled components.
Scan suspicious startup filesHow to repair normal Intel graphics startup popups
If the file is signed and located in a trusted driver folder, a startup popup usually points to a damaged or outdated Intel/OEM graphics package rather than malware. Install the current graphics driver from your PC maker or Intel support, reboot, and avoid driver download sites that bundle installers or “updaters.” If the popup mentions a missing DLL or blocked tray component, remove old Intel graphics entries from Startup after the driver repair, not before.
Related checks
If you are reviewing several startup entries at once, start with our guide to suspicious Startup apps. For a general file-verification workflow, use how to check whether an EXE file is safe. If the confusing entry is part of Windows Security rather than Intel graphics, compare it with SecurityHealthSystray.exe.
If the Intel-looking entry is igfxpers.exe, check it as the older Intel Persistence Module: verify the path, signature, and whether disabling it affects display settings before you remove anything.
If your Intel startup list also includes hkcmd.exe, check it separately as the Intel hotkey helper rather than assuming every Intel-looking process has the same role.
FAQ
Is igfxtray.exe a virus?
Not by default. igfxtray.exe is usually an Intel graphics tray helper, but a malicious file can reuse the same name. The path, signature, startup command, and behavior decide whether it is safe.
Where should igfxtray.exe be located?
On many older systems, the expected location is C:\Windows\System32\igfxtray.exe or a legitimate Intel/OEM graphics driver folder. Copies under Downloads, Temp, AppData, or random user-profile folders should be treated as suspicious.
Can I remove igfxtray.exe from startup?
You can usually disable the legitimate tray helper if you do not use its quick Intel graphics menu. If the file is unsigned, in the wrong folder, or keeps returning after reboot, scan the PC instead of only disabling the startup entry.
Why did igfxtray.exe suddenly appear?
It can appear after an Intel/OEM graphics driver install, Windows update, or old startup entry restoration. It is more concerning when it appears after a fake driver updater, cracked tool, bundled installer, or security alert.
Why did igfxtray.exe disappear?
Newer Intel graphics packages may not use the old tray helper. A driver update, OEM cleanup, or Startup-app change can remove it while graphics still work normally.
References
- Intel Corporation. “Graphics Support.” Intel Support, accessed July 7, 2026. https://www.intel.com/content/www/us/en/support/products/80939/graphics.html
- Microsoft Support. “Configure startup applications in Windows.” Microsoft, accessed July 7, 2026. https://support.microsoft.com/en-US/Windows/Experience/Startup-Boot/configure-startup-applications-in-windows
- Microsoft Sysinternals. “Sigcheck.” Microsoft Learn, accessed July 7, 2026. https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck
