Here's what you have to remember: The systray icon is NOT the program. The program simply adds the icon to the systray as a different way to interact with it.

Now, when you choose 'Exit' on that systray icon, the program immediately removes the icon. THIS DOES NOT MEAN XOLOX HAS SHUTDOWN. The main XoloX window is still there, just hidden.

Eventually it will shutdown. It's not doing anything nefarious (it creates no new connections during this period), IT'S JUST SLOW. They should immediately post a close message when they drop the icon, but I suppose the program spends an extended time in its communications loop before polling for system messages or something.

In short: There is no trojan here, just some shutdown code that needs to be rewritten.

-3vi1