Xhoc.exe not found

[pctech]

Have a user with a Compaq Presario 5300 series, PC will not run, install, or uninstall any programs. DOS mode still works. Upon boot up, the screen shows: C:\xhoc.exe not found then you are required to hit the return key several times before getting to the standard Windows 98 desktop. I have found destroyed 2 files that were attacked by the W32 virus, but now the system is cleaned and the same error still is found. I hold 7 certifications in the computer industry, but I haven't resolved this problem yet. Since my knowledge of Compaq is not that great, it would be terrific if someone could help me out. Has anyone else had this problem with XHOC.EXE not found. No viruses, but can't run any programs or install any programs. The PC has full function in DOS mode only.

Thanks,
PC Tech

 

[WhitPhil]

Is it a DOS black screen that contains this error?
If so, check in c:\Autoexec.bat

If not, does it appear in MSCONFIG?

If you restart to SAFE mode, do you get the same error?

Once you do get to the desktop, what is happening? You say you can't run or install programs? Are you getting errors? Can you run programs from Start > Run??

BTW: There isn't a W32 virus. Many of the names (at least from Norton's perspective) are prefixed by "W32".
Eg: W32-Bugbear, W32-Opaserv, W32-Yaha, etc

 

[pctech]

I found out that this is an Indian virus by removing the hidden features in the Windows directory, XHOC.TXT brags about it from an Indian virus, but gives no URL or identification except for being an Indian virus. I seem to have full function in DOS. In Windows 98 mode, normal, you really can't run any applications, install, or uninstall anything. So I can't run regedit. I will try the MSCONFIG and the Safe Mode, should have thought about that huh? Oh well, I have been quite busy lately. It got confusing, because I could find anything under the Microsoft's site, nor Norton's Symantec, nor McAfee, even Google didn't have anything on this XHOC.EXE problem. Anytime a program is attempted to be executed, it does nothing but ask for that xhoc.exe program and by continually striking the return key, nothing is run.

Thanks for the reply.
PCTECH

 

[The_Egg]

More than likely, the virus has edited the registry value for .EXE file to open with xhoc.exe

HKEY_CLASSES_ROOT\.exe
Default = exefile


HKEY_CLASSES_ROOT\exefile\shell\open\command
Default = "%1" %*

Now, all we need is someone running Win98 to export those keys and attach them here.
(as exefile.reg.txt, then you'll need to remove the .txt from the end)

Alas, I'm running WinXP


Though I could knock an old REGEDIT4 file up for you . . .
It's certainly worth trying!

 

[The_Egg]

Here you go

Rt click -> save target as
Copy it over to the other HD
Rename from exe_9x.reg.txt to exe_9x.reg
Double click to merge into the registry.

Good luck!

 

[The_Egg]

Hello?

Hey, I'm dying to know if my regfix worked.
I'm 99.9% confident it will . . .