Problem with CALC.EXE

G

Gerry

Newman

That's quite a solution! Makes you wonder whether one of your colleagues
was testing your skills <G>.


--


Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

SOLVED!

I tried *everything*, no luck. So I stered doing a simultaneous
registry search & compare on a working machine.

Seems the NON-working machine had THIS registry entry in it:


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\calc.exe]
"debugger"="C:\\WINDOWS\\calcoolate.exe"

Since the working machine did not have this entry I exported it for
reference, then deleted it.

As soon as this registry entry was deleted, the stock MS calulator
started working again!

Thanks to all who responded.

:)


What does "won't work" mean? What exactly happens? Any error
messages?


Not necessarily. It could be a worm, trojan or one of many other
forms of malware that an antivirus program, won't find. You also
need to run spyware scanners; the usual recommendation being at
least 3 different ones. To date no single program will find
everything and they all have their own strengths and weaknesses, to
more than one is needed in order to be thorough and certain as
possible that there is no malware on the computer. Antivirus
software will NOT find most of those.

...

Calc.exe should reside in C:\windows\System32\
and probably in C:\windows\System32\dllcache\.

Make sure the ones in system32 and dllcache are actually the right
ones by clicking on them and running them. Your shortcut may
simply be damaged or have been changed.
If they run fine or if repairing the shortcut to system32 doesn't
fix it, OR if you find it in any other folders, then get out your AV
and spyware arsenal, update them all, and run scans with all of
them; you probably have a virus or worm or trojan or some such
malware got past your protections. Just deleting the extra copies
you find isn't good enough becuase in most cases it'll either just
be recreated again, or it's only going to be part of the malware.
So you need to run updated scans.
If you need recommendations on decent spyware detectors, feel free
to ask here. YOu'll get a good list of possibilities to choose from.
Personally I use Adaware, Spybot Search & Destroy, SpywareGuard and
Winpatrol. There are plenty of other good ones, too. Just be sure
to download them from reputable sources.

HTH,

Twayne`
 
J

Jose

SOLVED!

I tried *everything*, no luck. So I stered doing a simultaneous
registry search & compare on a working machine.

Seems the NON-working machine had THIS registry entry in it:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\calc.exe]
"debugger"="C:\\WINDOWS\\calcoolate.exe"

Since the working machine did not have this entry I exported it for
reference, then deleted it.

As soon as this registry entry was deleted, the stock MS calulator
started working again!

Thanks to all who responded.

:)

What does "won't work" mean?  What exactly happens?  Any error messages?
Not necessarily.  It could be a worm, trojan or one of many other forms
of malware that an antivirus program, won't find.  You also need to run
spyware scanners; the usual recommendation being at least 3 different
ones.  To date no single program will find everything and they all have
their own strengths and weaknesses, to more than one is needed in order
to be thorough and certain as possible that there is no malware on the
computer.  Antivirus software will NOT find most of those.

Calc.exe should reside in C:\windows\System32\
and probably in C:\windows\System32\dllcache\.
Make sure the ones in system32 and dllcache are actually the right ones
by clicking on them and  running them.  Your shortcut may simply be
damaged or have been changed.
  If they run fine or if repairing the shortcut to system32 doesn't fix
it, OR if you find it in any other folders, then get out your AV and
spyware arsenal, update them all, and run scans with all of them; you
probably have a virus or worm or trojan or some such malware got past
your protections.  Just deleting the extra copies you find isn't good
enough becuase in most cases it'll either just be recreated again, or
it's only going to be part of the malware.  So you need to run updated
scans.
  If you need recommendations on decent spyware detectors, feel free to
ask here.  YOu'll get a good list of possibilities to choose from.
Personally I use Adaware, Spybot Search & Destroy, SpywareGuard and
Winpatrol.  There are plenty of other good ones, too.  Just be sure to
download them from reputable sources.

Twayne`

Maybe that is from the Coolest Online Calculator:

http://www.calcoolate.com/

The debugger registry entry under calc (or any executable) says to run
THIS debugging program instead of the entry above it (calc.exe). So
no matter how you try to run calc.exe, it would always run this other
program.

There should not be a calc.exe in that registry value - unless
somebody/something put it there.

I suggested copying calc.exe it to calc.com, newman.exe/.com to see if
that worked. I guess I missed where that was tried and the results.

If you read their WWW page it says:

Now you can replace the old windows calculator with this cool online
calculator.

This is how it works:

* Download and install a small program that will replace the
windows calculator with this site.
* If you run the windows calculator when connected to the
internet, this web site will be opened. If you run the windows
calculator when not connected, the old calculator will open.

We currently support windows 95, 98, 2000 and XP. If you would like us
to support more operating systems, let us know

It's just 56k, should download in less than 3 seconds

Once the download completes, run the file.

If you want to un-install and revert to the windows calculator, go to
the control panel (Start | Settings | Control Panel) , select Add or
remove programs, find the entry calcoolate.com and press the Remove
button

So, that being said, I would check Add/Remove programs to see if it is
there, uninstall it and whack the person (unless it was you!) that
download it as not being quite "so cool".

I am not going to DL it, but when you ran calc on the afflicted
machine, did it LOOK like the Windows calculator - no clue from the
appearance it was something different?

Their notes say if it can connect to the Internet, it will run theirs,
if it can't connect, it will run the original.

Not cool - but cute...
 
N

Newman

Opps!

I did try moving the executable, but I neglected to try re-naming it.
However, if the rename would have worked, it would have taken me to
the registry anyways - so I guess I skipped a step!

Sorry about that!

;)

SOLVED!

I tried *everything*, no luck. So I stered doing a simultaneous
registry search & compare on a working machine.

Seems the NON-working machine had THIS registry entry in it:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\calc.exe]
"debugger"="C:\\WINDOWS\\calcoolate.exe"

Since the working machine did not have this entry I exported it for
reference, then deleted it.

As soon as this registry entry was deleted, the stock MS calulator
started working again!

Thanks to all who responded.

:)

Jose wrote:
Here's a weird one...
All our computers here run WinXP Pro...
and I have one computer - where CALC.EXE wont work. I double click on
it - nothing. I right-click and "run as" - nothing. I tried CALC.EXE
on my computer - works fine. I copied the working file from my
computer to the target computer and double clicked it - it wont work.
What does "won't work" mean?  What exactly happens?  Any error messages?
I read something about CALC.EXE potentially being a virus - but all
systems are fully protected with Sophos A/V. If there were a virus,
then Sophos would nail it in a second (or less ;).
Not necessarily.  It could be a worm, trojan or one of many other forms
of malware that an antivirus program, won't find.  You also need to run
spyware scanners; the usual recommendation being at least 3 different
ones.  To date no single program will find everything and they all have
their own strengths and weaknesses, to more than one is needed in order
to be thorough and certain as possible that there is no malware on the
computer.  Antivirus software will NOT find most of those.
I'm stumped!
Any ideas??

Calc.exe should reside in C:\windows\System32\
and probably in C:\windows\System32\dllcache\.
Make sure the ones in system32 and dllcache are actually the right ones
by clicking on them and  running them.  Your shortcut may simply be
damaged or have been changed.
  If they run fine or if repairing the shortcut to system32 doesn't fix
it, OR if you find it in any other folders, then get out your AV and
spyware arsenal, update them all, and run scans with all of them; you
probably have a virus or worm or trojan or some such malware got past
your protections.  Just deleting the extra copies you find isn't good
enough becuase in most cases it'll either just be recreated again, or
it's only going to be part of the malware.  So you need to run updated
scans.
  If you need recommendations on decent spyware detectors, feel free to
ask here.  YOu'll get a good list of possibilities to choose from.
Personally I use Adaware, Spybot Search & Destroy, SpywareGuard and
Winpatrol.  There are plenty of other good ones, too.  Just be sure to
download them from reputable sources.

Twayne`

Maybe that is from the Coolest Online Calculator:

http://www.calcoolate.com/

The debugger registry entry under calc (or any executable) says to run
THIS debugging program instead of the entry above it (calc.exe). So
no matter how you try to run calc.exe, it would always run this other
program.

There should not be a calc.exe in that registry value - unless
somebody/something put it there.

I suggested copying calc.exe it to calc.com, newman.exe/.com to see if
that worked. I guess I missed where that was tried and the results.

If you read their WWW page it says:

Now you can replace the old windows calculator with this cool online
calculator.

This is how it works:

* Download and install a small program that will replace the
windows calculator with this site.
* If you run the windows calculator when connected to the
internet, this web site will be opened. If you run the windows
calculator when not connected, the old calculator will open.

We currently support windows 95, 98, 2000 and XP. If you would like us
to support more operating systems, let us know

It's just 56k, should download in less than 3 seconds

Once the download completes, run the file.

If you want to un-install and revert to the windows calculator, go to
the control panel (Start | Settings | Control Panel) , select Add or
remove programs, find the entry calcoolate.com and press the Remove
button

So, that being said, I would check Add/Remove programs to see if it is
there, uninstall it and whack the person (unless it was you!) that
download it as not being quite "so cool".

I am not going to DL it, but when you ran calc on the afflicted
machine, did it LOOK like the Windows calculator - no clue from the
appearance it was something different?

Their notes say if it can connect to the Internet, it will run theirs,
if it can't connect, it will run the original.

Not cool - but cute...
 
J

Jose

Opps!

I did try moving the executable, but I neglected to try re-naming it.
However, if the rename would have worked, it would have taken me to
the registry anyways - so I guess I skipped a step!

Sorry about that!

;)

SOLVED!
I tried *everything*, no luck. So I stered doing a simultaneous
registry search & compare on a working machine.
Seems the NON-working machine had THIS registry entry in it:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\calc.exe]
"debugger"="C:\\WINDOWS\\calcoolate.exe"
Since the working machine did not have this entry I exported it for
reference, then deleted it.
As soon as this registry entry was deleted, the stock MS calulator
started working again!
Thanks to all who responded.
:)
Here's a weird one...
All our computers here run WinXP Pro...
and I have one computer - where CALC.EXE wont work. I double clickon
it - nothing. I right-click and "run as" - nothing. I tried CALC.EXE
on my computer - works fine. I copied the working file from my
computer to the target computer and double clicked it - it wont work.
What does "won't work" mean?  What exactly happens?  Any error messages?
I read something about CALC.EXE potentially being a virus - but all
systems are fully protected with Sophos A/V. If there were a virus,
then Sophos would nail it in a second (or less ;).
Not necessarily.  It could be a worm, trojan or one of many other forms
of malware that an antivirus program, won't find.  You also need torun
spyware scanners; the usual recommendation being at least 3 different
ones.  To date no single program will find everything and they all have
their own strengths and weaknesses, to more than one is needed in order
to be thorough and certain as possible that there is no malware on the
computer.  Antivirus software will NOT find most of those.
I'm stumped!
Any ideas??
...
Calc.exe should reside in C:\windows\System32\
and probably in C:\windows\System32\dllcache\.
Make sure the ones in system32 and dllcache are actually the right ones
by clicking on them and  running them.  Your shortcut may simply be
damaged or have been changed.
  If they run fine or if repairing the shortcut to system32 doesn't fix
it, OR if you find it in any other folders, then get out your AV and
spyware arsenal, update them all, and run scans with all of them; you
probably have a virus or worm or trojan or some such malware got past
your protections.  Just deleting the extra copies you find isn't good
enough becuase in most cases it'll either just be recreated again, or
it's only going to be part of the malware.  So you need to run updated
scans.
  If you need recommendations on decent spyware detectors, feel free to
ask here.  YOu'll get a good list of possibilities to choose from.
Personally I use Adaware, Spybot Search & Destroy, SpywareGuard and
Winpatrol.  There are plenty of other good ones, too.  Just be sure to
download them from reputable sources.
HTH,
Twayne`
Maybe that is from the Coolest Online Calculator:

The debugger registry entry under calc (or any executable) says to run
THIS debugging program instead of the entry above it (calc.exe).  So
no matter how you try to run calc.exe, it would always run this other
program.
There should not be a calc.exe in that registry value - unless
somebody/something put it there.
I suggested copying calc.exe it to calc.com, newman.exe/.com to see if
that worked.  I guess I missed where that was tried and the results.
If you read their WWW page it says:
Now you can replace the old windows calculator with this cool online
calculator.
This is how it works:
   * Download and install a small program that will replace the
windows calculator with this site.
   * If you run the windows calculator when connected to the
internet, this web site will be opened. If you run the windows
calculator when not connected, the old calculator will open.
We currently support windows 95, 98, 2000 and XP. If you would like us
to support more operating systems, let us know
 It's just 56k, should download in less than 3 seconds
Once the download completes, run the file.
If you want to un-install and revert to the windows calculator, go to
the control panel (Start | Settings | Control Panel) , select Add or
remove programs, find the entry calcoolate.com and press the Remove
button
So, that being said, I would check Add/Remove programs to see if it is
there, uninstall it and whack the person (unless it was you!) that
download it as not being quite "so cool".
I am not going to DL it, but when you ran calc on the afflicted
machine, did it LOOK like the Windows calculator - no clue from the
appearance it was something different?
Their notes say if it can connect to the Internet, it will run theirs,
if it can't connect, it will run the original.
Not cool - but cute...

Hello, Newman!

Of course, renaming would have worked and that knowledge would have
revealed the solution to the problem to me instantly!

Well, maybe not instantly...

Did you find it in Add/Remove Programs? Is there a folder with
leftovers in it someplace?

Good find though and good things to know for the future. At least it
all makes sense now.

Now find the perp that installed it.
 
N

Newman

Opps!

I did try moving the executable, but I neglected to try re-naming it.
However, if the rename would have worked, it would have taken me to
the registry anyways - so I guess I skipped a step!

Sorry about that!

;)

I tried *everything*, no luck. So I stered doing a simultaneous
registry search & compare on a working machine.
Seems the NON-working machine had THIS registry entry in it:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\calc.exe]
"debugger"="C:\\WINDOWS\\calcoolate.exe"
Since the working machine did not have this entry I exported it for
reference, then deleted it.
As soon as this registry entry was deleted, the stock MS calulator
started working again!
Thanks to all who responded.
Jose wrote:
Here's a weird one...
All our computers here run WinXP Pro...
and I have one computer - where CALC.EXE wont work. I double click on
it - nothing. I right-click and "run as" - nothing. I tried CALC.EXE
on my computer - works fine. I copied the working file from my
computer to the target computer and double clicked it - it wont work.
What does "won't work" mean?  What exactly happens?  Any error messages?
I read something about CALC.EXE potentially being a virus - but all
systems are fully protected with Sophos A/V. If there were a virus,
then Sophos would nail it in a second (or less ;).
Not necessarily.  It could be a worm, trojan or one of many other forms
of malware that an antivirus program, won't find.  You also need to run
spyware scanners; the usual recommendation being at least 3 different
ones.  To date no single program will find everything and they all have
their own strengths and weaknesses, to more than one is needed in order
to be thorough and certain as possible that there is no malware on the
computer.  Antivirus software will NOT find most of those.
I'm stumped!
Any ideas??

Calc.exe should reside in C:\windows\System32\
and probably in C:\windows\System32\dllcache\.
Make sure the ones in system32 and dllcache are actually the right ones
by clicking on them and  running them.  Your shortcut may simply be
damaged or have been changed.
  If they run fine or if repairing the shortcut to system32 doesn't fix
it, OR if you find it in any other folders, then get out your AV and
spyware arsenal, update them all, and run scans with all of them; you
probably have a virus or worm or trojan or some such malware got past
your protections.  Just deleting the extra copies you find isn't good
enough becuase in most cases it'll either just be recreated again, or
it's only going to be part of the malware.  So you need to run updated
scans.
  If you need recommendations on decent spyware detectors, feel free to
ask here.  YOu'll get a good list of possibilities to choose from.
Personally I use Adaware, Spybot Search & Destroy, SpywareGuard and
Winpatrol.  There are plenty of other good ones, too.  Just be sure to
download them from reputable sources.


Maybe that is from the Coolest Online Calculator:

The debugger registry entry under calc (or any executable) says to run
THIS debugging program instead of the entry above it (calc.exe).  So
no matter how you try to run calc.exe, it would always run this other
program.
There should not be a calc.exe in that registry value - unless
somebody/something put it there.
I suggested copying calc.exe it to calc.com, newman.exe/.com to see if
that worked.  I guess I missed where that was tried and the results.
If you read their WWW page it says:
Now you can replace the old windows calculator with this cool online
calculator.
This is how it works:
   * Download and install a small program that will replace the
windows calculator with this site.
   * If you run the windows calculator when connected to the
internet, this web site will be opened. If you run the windows
calculator when not connected, the old calculator will open.
We currently support windows 95, 98, 2000 and XP. If you would like us
to support more operating systems, let us know
 It's just 56k, should download in less than 3 seconds
Once the download completes, run the file.
If you want to un-install and revert to the windows calculator, go to
the control panel (Start | Settings | Control Panel) , select Add or
remove programs, find the entry calcoolate.com and press the Remove
button
So, that being said, I would check Add/Remove programs to see if it is
there, uninstall it and whack the person (unless it was you!) that
download it as not being quite "so cool".
I am not going to DL it, but when you ran calc on the afflicted
machine, did it LOOK like the Windows calculator - no clue from the
appearance it was something different?
Their notes say if it can connect to the Internet, it will run theirs,
if it can't connect, it will run the original.
Not cool - but cute...

Hello, Newman!

Of course, renaming would have worked and that knowledge would have
revealed the solution to the problem to me instantly!

Well, maybe not instantly...

Did you find it in Add/Remove Programs? Is there a folder with
leftovers in it someplace?

Good find though and good things to know for the future. At least it
all makes sense now.

Now find the perp that installed it.

Well...

This is the machine that was used by an Engineer that no longer works
here...

Hmmmm...
 
K

Kelly

For another time....see line 265:
http://www.kellys-korner-xp.com/xp_tweaks.htm

--

All the Best,
Kelly (MS-MVP/DTS&XP)

Taskbar Repair Tool Plus!
http://www.kellys-korner-xp.com/taskbarplus!.htm


Newman said:
Opps!

I did try moving the executable, but I neglected to try re-naming it.
However, if the rename would have worked, it would have taken me to
the registry anyways - so I guess I skipped a step!

Sorry about that!

;)

SOLVED!

I tried *everything*, no luck. So I stered doing a simultaneous
registry search & compare on a working machine.

Seems the NON-working machine had THIS registry entry in it:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Image
File Execution Options\calc.exe]
"debugger"="C:\\WINDOWS\\calcoolate.exe"

Since the working machine did not have this entry I exported it for
reference, then deleted it.

As soon as this registry entry was deleted, the stock MS calulator
started working again!

Thanks to all who responded.

:)

On Tue, 16 Jun 2009 18:47:33 -0400, "Twayne"

Jose wrote:
Here's a weird one...

All our computers here run WinXP Pro...

and I have one computer - where CALC.EXE wont work. I double
click on
it - nothing. I right-click and "run as" - nothing. I tried
CALC.EXE
on my computer - works fine. I copied the working file from my
computer to the target computer and double clicked it - it wont
work.

What does "won't work" mean? What exactly happens? Any error
messages?

I read something about CALC.EXE potentially being a virus - but
all
systems are fully protected with Sophos A/V. If there were a
virus,
then Sophos would nail it in a second (or less ;).

Not necessarily. It could be a worm, trojan or one of many other
forms
of malware that an antivirus program, won't find. You also need to
run
spyware scanners; the usual recommendation being at least 3
different
ones. To date no single program will find everything and they all
have
their own strengths and weaknesses, to more than one is needed in
order
to be thorough and certain as possible that there is no malware on
the
computer. Antivirus software will NOT find most of those.

I'm stumped!

Any ideas??

...

Calc.exe should reside in C:\windows\System32\
and probably in C:\windows\System32\dllcache\.

Make sure the ones in system32 and dllcache are actually the right
ones
by clicking on them and running them. Your shortcut may simply be
damaged or have been changed.
If they run fine or if repairing the shortcut to system32 doesn't
fix
it, OR if you find it in any other folders, then get out your AV and
spyware arsenal, update them all, and run scans with all of them;
you
probably have a virus or worm or trojan or some such malware got
past
your protections. Just deleting the extra copies you find isn't good
enough becuase in most cases it'll either just be recreated again,
or
it's only going to be part of the malware. So you need to run
updated
scans.
If you need recommendations on decent spyware detectors, feel free
to
ask here. YOu'll get a good list of possibilities to choose from.
Personally I use Adaware, Spybot Search & Destroy, SpywareGuard and
Winpatrol. There are plenty of other good ones, too. Just be sure to
download them from reputable sources.

HTH,

Twayne`

Maybe that is from the Coolest Online Calculator:

http://www.calcoolate.com/

The debugger registry entry under calc (or any executable) says to run
THIS debugging program instead of the entry above it (calc.exe). So
no matter how you try to run calc.exe, it would always run this other
program.

There should not be a calc.exe in that registry value - unless
somebody/something put it there.

I suggested copying calc.exe it to calc.com, newman.exe/.com to see if
that worked. I guess I missed where that was tried and the results.

If you read their WWW page it says:

Now you can replace the old windows calculator with this cool online
calculator.

This is how it works:

* Download and install a small program that will replace the
windows calculator with this site.
* If you run the windows calculator when connected to the
internet, this web site will be opened. If you run the windows
calculator when not connected, the old calculator will open.

We currently support windows 95, 98, 2000 and XP. If you would like us
to support more operating systems, let us know

It's just 56k, should download in less than 3 seconds

Once the download completes, run the file.

If you want to un-install and revert to the windows calculator, go to
the control panel (Start | Settings | Control Panel) , select Add or
remove programs, find the entry calcoolate.com and press the Remove
button

So, that being said, I would check Add/Remove programs to see if it is
there, uninstall it and whack the person (unless it was you!) that
download it as not being quite "so cool".

I am not going to DL it, but when you ran calc on the afflicted
machine, did it LOOK like the Windows calculator - no clue from the
appearance it was something different?

Their notes say if it can connect to the Internet, it will run theirs,
if it can't connect, it will run the original.

Not cool - but cute...

Hello, Newman!

Of course, renaming would have worked and that knowledge would have
revealed the solution to the problem to me instantly!

Well, maybe not instantly...

Did you find it in Add/Remove Programs? Is there a folder with
leftovers in it someplace?

Good find though and good things to know for the future. At least it
all makes sense now.

Now find the perp that installed it.

Well...

This is the machine that was used by an Engineer that no longer works
here...

Hmmmm...
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top