Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

What is xyzhSox3.exe?


  • Please log in to reply

#1
dcook22

dcook22

    New Member

  • Member
  • Pip
  • 7 posts
Hi all,

Recently I was downloading various .avi to DVD converters to burn videos of my son (now 13 months old) to DVD. Well my computer is running fine, but I've found a file called xyzhSox3.exe in my startup list. I became aware of it during a routine AVG virus scan. It found the file in my C:\Windows\system32\ folder. It did not call the file a virus, it just said it had an error reading the file. SO I went to msconfig to investigate and found not one, but two instances of the program running from the startup list and one instance of it on the list, but the "checkbox" was empty so I guess it wasn't running. The program does not show up in the processes tab of my WIndows Task Manager. So I figured, OK, I'll just uncheck the files in msconfig, restart, and we should be ready to roll. I rebooted and the programs started up again.

Now I was stuck wondering if I should go into the registry and remove the files. Before doing anything that might make my system unuseable, I googled the xyzhSox3.exe program and found, literally, nothing. No hits at all. Symantec and Mcafee also had no mention of it. Rather than being happy about this not being found on any virus site, though, I realized it's probably a Trojan that creates a random name.

but before I go through the whole Hijack This scenario (which I've never done before) I figured I should chime in here and see if anyone has ever heard of this program?

Again, my system is running fine. No slow-downs, no lockups, and there doesn't seem to be all sorts of crazy network activity when no one's on the machine.

So can anyone help me out before I bug all you knowledgeable types with a hijack this log?

Thanks in advance,

Dan

Edited by dcook22, 22 July 2007 - 09:23 PM.

  • 0

Advertisements


#2
Retired Tech

Retired Tech

    Retired Staff

  • Retired Staff
  • 20,563 posts
Could only find this :whistling:

http://www.yougamers...ead.php?t=55233

Please follow the procedures outlined here: Malware Removal Guide

You will need a PC which can connect to the internet

Run all the programmes as advised then post a current Hijack This Log in a new topic in the Malware Forum

For the purpose of accurate malware analysis, Hijack This Logs are only dealt with in the Malware Forum. Posting them anywhere else will result in a delayed response

If you are unable to run any of the programmes, please ask for advice in the Malware Forum
  • 0

#3
dcook22

dcook22

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts

Could only find this :whistling:

http://www.yougamers...ead.php?t=55233



LOL...that's the post I left on another forum about this same issue.

OK, when I get home I'll go through the malware removal process.

Thanks.

Dan
  • 0

#4
sharky2x2x

sharky2x2x

    New Member

  • Member
  • Pip
  • 1 posts
Hi there,

I've found a solution to this (at least one that works for me),
Every time i started winxp my firewall would be off so i had to manually start the firewall, so after a bit of search i found this program in the start up list. Couldn't get rid of it, so after the whole clean up (virus,spyware,adware,restore points) the program would duplicate itself into xyzhSox3.exe + xyzhSox3Server.exe, instead of disappear. So i went back to msconfig and in the start up list i disabled all the programs in the list and restart the system to see what was essencial for the OS to start.
Only 2 programs are checked in the list :
*QTTask(C:\Program Files\QuickTime\QTTask.exe)
*FreelineSchedule
After that just go and manually delete the file in C:\Windows\System32\xyzhSox3.exe and xyzhSox3Server.exe, also delete the registry key in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

After that reboot the system and you shouldn't see the program running anymore.

Let me know if this doesn't work for you.

Thanks
Sharky2x
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP