Re: Seem to have lost Calc.exe in Win XP

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance



"Richard" wrote:

"EW_Zuki" <EWZuki@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:BD2FA949-B902-420B-831D-C6CCF7AA4744@xxxxxxxxxxxxxxxx

"Richard" wrote:
You might try un-installing, and re-installing calc.exe -->
Control Panel> Add/Remove Programs> Add/Remove Windows Components
In Components window, Click Accessories and Utilities,
click Details button
In next window, click Accessories, click Details button
In next window, Un-check Calculator, click OK, OK, Next.
After it is uninstalled, repeat above, except:
Instead of Un-check --> Checkmark Calculator, OK, OK, Next.

Despite your detailed instructions, and my careful following of them,
they didn't work as described.

Hi again,

What didn't work? Were you able to find everything in the instructions and
click everything? (After you clicked Next, did you click Finish? :)

Please see my re-reply to your previous post, which I made earlier this
morning.

Click Start, click (all)Programs, click Accessories
Do you see Calculator on the Accessories panel of Start Menu?

No.

If so, does it start Calculator?

(I just realized no one asked if you checked Recycle Bin for calc.exe :)

Yes, it's there, deleted "9/22/2009 8:02 AM".

See if you have an i386 folder with CALC.EX_

Did you find your i386 folder and was CALC.EX_ in it?

I seem to not have a i386 folder. And a search within the Windows folder
(plus subfolders) didn't find CALC.EX_ .

(Either C:\i386 or C:\Windows\i386)
(Or do a file search for CALC.EX_)


Try running System File Checker. (Takes about 25 minutes or so.)
Click Start, click Run, type or paste next line and press Enter:
sfc /scannow

I did this, and System File Checker finished and closed without a comment.
Does that mean OK?

Probably. (It's not talkative like me. "No news is good news." :)

Check Event Viewer System log for source: Windows File Protection
Start> Run> %SystemRoot%\system32\eventvwr.msc
(Click the word "Source" at the top of that column, scroll down.)

There should be 2 information reports when SFC completes:
The first should say, "Windows File Protection file scan was started."
The second: "Windows File Protection file scan completed successfully."
(There may be a second set of 2 reports when you ran WFP again.)

Wow! I found maybe 2000 WPF events for just today! See
<http://www.rcblue.com/Misc/Event_Viewer__System.jpg> (an 18.72 MB file)

From your reply to Jose:
"EW_Zuki" <EWZuki@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:C595C7F4-CC19-40AF-89FB-BC21F8831AEC@xxxxxxxxxxxxxxxx

"Jose" wrote:
<snip>
If calc.exe (a protected file) is deleted from c\:windows\system32,
and WFP is working, it will copy a replacement from c:\windows
\system32\dllcache. If it is not there, WFP will ask for an XP
installation CD.

Right click calc.exe> Properties, what is the modified date?

Well, the one I keep on my desktop and use to copy into c\:windows\system32\
and c\:windows\system32\dllcache\ says "Modified: Wednesday, July 16, 2003,
9:19:10 AM"

My original is: Friday, August 17, 2001, 10:36:38 PM
Click the version tab of the properties, click (item) File Version, in right
pane, does it say: 5.1.2600.0 (xpclient.010817-1148) ?


I would say it has been trying to copy it but unable since it doesn't
look like what WFP thinks it should.

That could mean the the one in dllcache is wrong (as far as XP is
concerned), so that is the cacl.exe that is now a suspect.

If you have an XP installation CD, delete it from dllcache (make a
copy first), then delete it from system32. WFP will ask you for the
CD and it will replace both (that is what it does) from the hopefully
untampered with copy from the CD (since CDs are read only).

calc.exe wasn't in c:\windows\system32\dllcache, but I deleted it from
c\:windows\system32 (saving a copy).
I then ran WFP. It completed without a complaint or asking for the XP
installation CD.

Back to square one. When Pegasus pointed you to the dllcache for a copy of
calc.exe, did you COPY the file?

I copied it, IIRC.

or MOVE that file out of dllcache and into
system32? Above, you said it "wasn't in" dllcache. If it was gone, that
might explain why you got this message:

The protected system file calc.exe could not be restored to its
original, valid version. The file version of the bad file is 5.1.2600.0

That is the same as my version number. It could not restore it from dllcache
if it was not there. Check both system32 and dllcache to be sure that both
have a copy of calc.exe in them.

If there is no calc.exe in dllcache and your i386 folder is in C:, then:
Start> Run> paste next line and press Enter:
expand C:\i386\calc.ex_ C:\WINDOWS\System32\dllcache\calc.exe
If no calc.exe in dllcache and your i386 folder is in C:\WINDOWS, then:
Start> Run> paste next line and press Enter:
expand C:\WINDOWS\i386\calc.ex_ C:\WINDOWS\System32\dllcache\calc.exe

As I said above I seems to have no i386. But I ran both of your expand
commands anyway. The command line window opened but closed so quickly that I
could even see if it said anything.


Download, install, update and do a full scan with these free malware
detection programs:

Malwarebytes (MBAM): http://malwarebytes.org/

I recently ran a full scan with MBAM.

SUPERAntiSpyware: (SAS): http://www.superantispyware.com/

I'll get this, run a full scan, and report back.

What anti-virus program are you using?

Kaspersky Internet Security 2009.

(Norton with Protected Recycle Bin? :)

Symantec Norton Protected Recycle Bin Exposure
http://www.symantec.com/avcenter/security/Content/2006.01.10.html

I am beginning to think that maybe Windows File Protection is working OK
after all: Assuming the Event log for the "sfc /scannow" was successful.
Since Calculator is an optional accessory, I wonder if it is necessarily
considered to be a file that is "required for Windows to run properly", and
can't someone with Administrator privileges over-ride WFP in some cases?

Description of the Windows File Protection feature
http://support.microsoft.com/kb/222193/

Windows File Protection on Windows 2000 and Windows XP (Windows)
http://msdn.microsoft.com/en-us/library/aa372820(VS.85).aspx

Here are the files associated with Calculator AFAIK:
C:\Windows\system32\calc.exe
C:\Windows\Help\calc.chm
C:\Windows\Help\calc.hlp
C:\Documents and Settings\All Users\Start
Menu\Programs\Accessories\Calculator.lnk

HTH. (Hope This Helps. :)
--Richard

.

Quantcast