IPXCATEX.EXE gone but not forgotten!

[ArmyofKirb]

Here's the skinny: Despite having deleted IPXCATEX.EXE, and removing any registry entries referring to it, I'm still having problems.
Here's what I notice: 1.A slow but continual system slow down. 2. Eventually I get dialog boxes saying IPXCATEX.EXE can't reference a memory address (0x00004837, etc.) 3. I get a notice that Windows is critically low on virtual memory. 4. When shutting-down/restarting, I get a dialog box that says IPXCATEX.EXE DLL failed to initialize because the system is shutting down.
This problem originates out of a Trojan/hijack that I had last week. I used AdAware, Spybot, About Buster, CWShredder, and Hijack This to solve the Trojan problem, but it looks like it wasn't completely taken care of.
What do you suggest I do? I appreciate any advice you can give me.

Thanks for your time and consideration,

Kirby

 

[ArmyofKirb]

Here's the Error Window I get while shutting down

IPXCATEX.EXE DLL Initialization Failed

The Application failed to initialize because the window station is shutting down.



I hope this sheds some additional light on my problem...

 

[RealBlackStuff]

That file does have NO reference anywhere!

In Windows Explorer, turn on "show all files and folders, including hidden and system". See how here.
Then do a Find on it.

Check in your System logfiles if there is any reference to a DLL belonging to that ipxcatex file.

 

[ArmyofKirb]

RBS,


How would I check my system logfiles? I don't think I've ever had the occasion to look at them...

 

[ArmyofKirb]

Would it be beneficial for me to post a HijackThis log file?

 

[RealBlackStuff]

Rightclick My Computer on the desktop, select Manage, select Event Viewer and in there the 3 logs.
HJT-logs please from Safe Mode only.
Read: How to post your Hijackthis log-files as an attachment.

 

[ArmyofKirb]

HijackThis logfile

Here's the text file...

I found entries under the applicaton log. Here's an example:

Date: 11/1/05 Source: Application Error
Time: 9:57:36PM Category: None
Type: Error Event ID: 1000
User: N/A

Description: Faulting application ipxcatex.exe, vesion 0.0.0.0. faulting module, version 0.0.0.0. fault address 0x00000000.

0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 70 78 ure ipx
0018: 63 61 74 65 78 2e 65 78 catex.ex
0020: 65 20 30 2e 30 2e 30 2e e 0.0.0.
0028: 30 20 69 6e 20 20 30 2e 0 in 0.
0030: 30 2e 30 2e 30 20 61 74 0.0.0 at
0038: 20 6f 66 66 73 65 74 20 offset
0040: 30 30 30 30 30 30 30 30 00000000
0048: 0d 0a ..

Sorry about the large amount of text... Any clue as to how to rectify this?

 

[RealBlackStuff]

Your log is clean.
Try and do a Find for files containing the word IPXCATEX and check your registry as well.

 

[ArmyofKirb]

I've already deleted the registry entries that contained any reference to ipxcatex.exe. I was at work when a moment of inspiration hit me. I remember last week when I was running Symantec AV instead of AVG, and I remember the warnings it gave me about ipxcatex.exe and another file (a DLL.) Since I don't have any other leads to go on, I'm going to re-install Symantec, find the file in question, delete it and any references to it, and hope for the best. If it takes care of it, I will un-install Symantec AV again....

 

[ArmyofKirb]

here's the link symantec gave me for the ipxcatex.exe file:

http://securityresponse.symantec.com/avcenter/venc/data/spyware.apropos.c.html

 

[ArmyofKirb]

I've been delving into my registry a little further and have come up with more stuff...The IPXCATEX.EXE file seems to be a part of Search Assistant, and I'm working hard to delete the registry entries...I'll keep ya posted...

 

[ArmyofKirb]

Holy Cow! I've found literally dozenz upon dozens of entries left over from the Trojan....Scary!

 

[ArmyofKirb]

I've determined that my browser (Firefox) had some lingering references to ipxcatex.exe somewhere within it. For the time being, I've uninstalled Firefox and I'm going to use Opera for a few days. Hopefully, I won't have any more problems and then I can re-install Firefox...The moral of the story is kids: "An ounce of prevention is worth a pound of cure."