runxmlpl.exe

Has anyone heard of runxmlpl.exe? I googled it, but all I found was that is was a suspicious file. Does anybody have any more detailed info than this?

Thanks in advance for responding.

Troy

 

I believe the file belongs to Wistron RunXMLPL by Wistron. Some malware can camouflage themselves as runxmlpl.exe, particularly if they are located in C:\WINDOWS or C:\WINDOWS\system32 folder.

 

Yes, I saw that Winstron was the publisher of it in my Google search results. Do you know if it is a vaild file or if it is spyware? Looking at the file's properties, the only other info displayed was the language was Chinese.

Thanks

Troy

 

Where is the file located? Can you manually locate it? If so, right click and check the properties, does it have a "Version" tab? If so provide me with as much information as possible.

 

It is located in C:\Windows.

The version is 1.0.0.1

The Company is Winstron

The Language is Chinese (Taiwan)

It is Copyright 2004

The description is RunXMLPL

That's about it.

Troy

 

OH! One other thing. It is listed in my startup items as preload.

Thanks.

Troy

 

Go to the site below, upload the file and let me know the results.

http://virusscan.jotti.org/

 

Status was OK. All scans had a Found Nothing result.

 

Try Kaspersky's file scanner, if this one says its clean then I would say the file is legit.

http://www.kaspersky.com/virusscanner

 

Kaspersky says it's clean. Wonder what it's doing in my startup items? Even though it's in my startup items, it's not a running process. It must have terminated after running.

Any other ideas?

Thanks for the time.

Troy

 

See the below thread, then attach a current HJT log from normal mode.
http://www.majorgeeks.com/images/grenade.gif Downloading, Installing, and Running HijackThis