[dcook22]

Hi all,

Recently I was downloading various .avi to DVD converters to burn videos of my son (now 13 months old) to DVD. Well my computer is running fine, but I've found a file called xyzhSox3.exe in my startup list. I became aware of it during a routine AVG virus scan. It found the file in my C:\Windows\system32\ folder. It did not call the file a virus, it just said it had an error reading the file. SO I went to msconfig to investigate and found not one, but two instances of the program running from the startup list and one instance of it on the list, but the "checkbox" was empty so I guess it wasn't running. The program does not show up in the processes tab of my WIndows Task Manager. So I figured, OK, I'll just uncheck the files in msconfig, restart, and we should be ready to roll. I rebooted and the programs started up again.

Now I was stuck wondering if I should go into the registry and remove the files. Before doing anything that might make my system unuseable, I googled the xyzhSox3.exe program and found, literally, nothing. No hits at all. Symantec and Mcafee also had no mention of it. Rather than being happy about this not being found on any virus site, though, I realized it's probably a Trojan that creates a random name.

but before I go through the whole Hijack This scenario (which I've never done before) I figured I should chime in here and see if anyone has ever heard of this program?

Again, my system is running fine. No slow-downs, no lockups, and there doesn't seem to be all sorts of crazy network activity when no one's on the machine.

So can anyone help me out before I bug all you knowledgeable types with a hijack this log?

Thanks in advance,

Dan

Edited by dcook22, 22 July 2007 - 09:23 PM.

[Advertisements]

Could only find this

http://www.yougamers...ead.php?t=55233

Please follow the procedures outlined here: Malware Removal Guide

You will need a PC which can connect to the internet

Run all the programmes as advised then post a current Hijack This Log in a new topic in the Malware Forum

For the purpose of accurate malware analysis, Hijack This Logs are only dealt with in the Malware Forum. Posting them anywhere else will result in a delayed response

If you are unable to run any of the programmes, please ask for advice in the Malware Forum

[Retired Tech]

Could only find this

http://www.yougamers...ead.php?t=55233

Please follow the procedures outlined here: Malware Removal Guide

You will need a PC which can connect to the internet

Run all the programmes as advised then post a current Hijack This Log in a new topic in the Malware Forum

For the purpose of accurate malware analysis, Hijack This Logs are only dealt with in the Malware Forum. Posting them anywhere else will result in a delayed response

If you are unable to run any of the programmes, please ask for advice in the Malware Forum

[dcook22]

Could only find this

http://www.yougamers...ead.php?t=55233

LOL...that's the post I left on another forum about this same issue.

OK, when I get home I'll go through the malware removal process.

Thanks.

Dan

[sharky2x2x]

Hi there,

I've found a solution to this (at least one that works for me),
Every time i started winxp my firewall would be off so i had to manually start the firewall, so after a bit of search i found this program in the start up list. Couldn't get rid of it, so after the whole clean up (virus,spyware,adware,restore points) the program would duplicate itself into xyzhSox3.exe + xyzhSox3Server.exe, instead of disappear. So i went back to msconfig and in the start up list i disabled all the programs in the list and restart the system to see what was essencial for the OS to start.
Only 2 programs are checked in the list :
*QTTask(C:\Program Files\QuickTime\QTTask.exe)
*FreelineSchedule
After that just go and manually delete the file in C:\Windows\System32\xyzhSox3.exe and xyzhSox3Server.exe, also delete the registry key in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

After that reboot the system and you shouldn't see the program running anymore.

Let me know if this doesn't work for you.

Thanks
Sharky2x