explorer.exe/iexplore.exe replaced with calc.exe

[Nigel Barraclough]

Something very weird happened to my PC yesterday (XP Home SP2). The icons
and taskbar disappeared and several copies of calc.exe appeared. When I
re-booted Windows would not load up properly. I have discovered what the
basic problem is - explorer.exe has been replaced with calc.exe although the
file is still called explorer.exe - Windows seems to need explorer to boot
properly. I have also discovered that the same thing has happened to
iexplore.exe.

If I try to replace the false explorer amd iexplore files they get converted
back to calc again.

I am not aware that I have an infection. AdAware and Spybot show nothing
and I use AVG.

Has anyone seen anything like this. If yes, how do I resolve the problem.

 

[Martin]

Something very weird happened to my PC yesterday (XP Home SP2). The icons
and taskbar disappeared and several copies of calc.exe appeared. When I
re-booted Windows would not load up properly. I have discovered what the
basic problem is - explorer.exe has been replaced with calc.exe although
the file is still called explorer.exe - Windows seems to need explorer to
boot properly. I have also discovered that the same thing has happened to
iexplore.exe.

If I try to replace the false explorer amd iexplore files they get
converted back to calc again.

I am not aware that I have an infection. AdAware and Spybot show nothing
and I use AVG.

Has anyone seen anything like this. If yes, how do I resolve the problem.

Run the System File Checker.

Open a Command Prompt and type

sfc /?

for help.

I'd use sfc /scanonce and then re-boot.
Have you'r XP CD-ROM to hand - you probably be prompted for it by sfc.

Martin.

 

[Guest]

if you have sp2 installed try going to tools on you IE click manage add ons
find calc.exe in list and disable it...wouldnt hurt to know for sure if its a
virus or some other malicious program..run a virus scan

 

[Don Taylor]

Something very weird happened to my PC yesterday (XP Home SP2). The icons
and taskbar disappeared and several copies of calc.exe appeared. When I
re-booted Windows would not load up properly. I have discovered what the
basic problem is - explorer.exe has been replaced with calc.exe although the
file is still called explorer.exe - Windows seems to need explorer to boot
properly. I have also discovered that the same thing has happened to
iexplore.exe.

If I try to replace the false explorer amd iexplore files they get converted
back to calc again.

I am not aware that I have an infection. AdAware and Spybot show nothing
and I use AVG.

Has anyone seen anything like this. If yes, how do I resolve the problem.

If it were just the icons acting funny then I'd suspect you had run
into yet one more limit coded into XP somewhere, there is a thing
called the "shell icon cache" and somehow when you get too many
icons or the cache gets confused XP will start substituting one icon
for another. Google for "shell icon cache" to find supporting info
on this. The Windows XP Annoyances book/website has info on this.
I got hit by that a while back and it happened several times.

The bandaid to get around that is to blow away the cache and it will
get rebuilt.

But if it is really that the executables are being substituted for
each other, the physical binaries, and not just the icons or the
links from an icon to an executable, then this may not apply.

 

[Danny Swinkels]

When you try to open any exe does calc.exe open? If so try this use task
manager/file/new task(i assume you must be using that anyway..) open
command.com (not cmd.exe because command.com is a .com) once command.com
is opend you should be able to start any exe from that window, launch
regedit.exe and take a look at
HKEY_CLASSES_ROOT\exefile\shell\open\command and make sure the value for
(default) is "%1" %* and not something like calc.exe

not sure if that really fits what you're describing but worth a peak

 

[Nigel Barraclough]

Thanks for this idea. I tried it without anything happening and was not
asked for my CD.

 

[Nigel Barraclough]

Thanks for the reply. I haven't got SP2 installed. I have virus checked
the whole system with AVG7 and also with AdAware and Spybot and found
nothing. I now have Windows reinstalled and, at the moment, explorer.exe is
behaving normally but iexplore.exe gets changed back to calc.exe within a
few seconds. I have to run Internet Explorer from another directory where
iexplore.exe does not get corrupted.

 

[Nigel Barraclough]

It is not the icons that are being affected, the executables are being
substituted with calc.exe. I have reinstalled Windows and at the moment
explorer.exe is behaving OK. However iexplore.exe gets overwritten by
calc.exe within a few seconds in the c:\program files\internet explorer
directory. I can run internet explorer from a copy of iexplore.exe in the
c:\temp folder.

 

[Nigel Barraclough]

It is only explorer.exe and iexplore.exe that have converted into calc.exe.
If you examine properties of the fake explorer.exe and iexplore.exe it says
the original fle name was calc.exe.

I have checked the registry and it is OK (not like calc.exe).