Seem to have lost Calc.exe in Win XP

  • Thread starter Thread starter EW_Zuki
  • Start date Start date
Jose said:
You can try uninstalling and reinstalling calc.

No, that didn't work.
If that doesn't work:

Then I would say that that error has been happening all along and you
never noticed it (it is silent). Calc.exe was deleted somehow and the
Windows thinks the copy is suspicious and won't replace it - it tried
at least!

If calc.exe (a protected file) is deleted from c\:windows\system32,
and WFP is working, it will copy a replacement from c:\windows
\system32\dllcache. If it is not there, WFP will ask for an XP
installation CD.

I would say it has been trying to copy it but unable since it doesn't
look like what WFP thinks it should.

That could mean the the one in dllcache is wrong (as far as XP is
concerned), so that is the cacl.exe that is now a suspect.

If you have an XP installation CD, delete it from dllcache (make a
copy first), then delete it from system32. WFP will ask you for the
CD and it will replace both (that is what it does) from the hopefully
untampered with copy from the CD (since CDs are read only).

calc.exe wasn't in c:\windows\system32\dllcache, but I deleted it from
c\:windows\system32 (saving a copy).
I then ran WFP. It completed without a complaint or asking for the XP
installation CD.
After both are replaced from the CD, remove the CD and delete it from
system32 and see if it is replaced (in seconds) by the one in
dllcache, or you still get the same error.

Malware scans won't hurt anything:

Download, install, update and do a full scan with these free malware
detection programs:

Malwarebytes (MBAM): http://malwarebytes.org/

I recently ran a full scan with MBAM.

I'll get this, run a full scan, and report back.
These can be uninstalled later if desired.

Thanks
 
Despite your detailed instructions, and my careful following of them,
they didn't work as described.

Hi again,

What didn't work? Were you able to find everything in the instructions and
click everything? (After you clicked Next, did you click Finish? :)

Click Start, click (all)Programs, click Accessories
Do you see Calculator on the Accessories panel of Start Menu?
If so, does it start Calculator?

(I just realized no one asked if you checked Recycle Bin for calc.exe :)


Did you find your i386 folder and was CALC.EX_ in it?
(Either C:\i386 or C:\Windows\i386)
(Or do a file search for CALC.EX_)

I did this, and System File Checker finished and closed without a comment.
Does that mean OK?

Probably. (It's not talkative like me. "No news is good news." :)

Check Event Viewer System log for source: Windows File Protection
Start> Run> %SystemRoot%\system32\eventvwr.msc
(Click the word "Source" at the top of that column, scroll down.)

There should be 2 information reports when SFC completes:
The first should say, "Windows File Protection file scan was started."
The second: "Windows File Protection file scan completed successfully."
(There may be a second set of 2 reports when you ran WFP again.)

From your reply to Jose:
Right click calc.exe> Properties, what is the modified date?
My original is: Friday, August 17, 2001, 10:36:38 PM
Click the version tab of the properties, click (item) File Version, in right
pane, does it say: 5.1.2600.0 (xpclient.010817-1148) ?

calc.exe wasn't in c:\windows\system32\dllcache, but I deleted it from
c\:windows\system32 (saving a copy).
I then ran WFP. It completed without a complaint or asking for the XP
installation CD.

Back to square one. When Pegasus pointed you to the dllcache for a copy of
calc.exe, did you COPY the file? or MOVE that file out of dllcache and into
system32? Above, you said it "wasn't in" dllcache. If it was gone, that
might explain why you got this message:
The protected system file calc.exe could not be restored to its
original, valid version. The file version of the bad file is 5.1.2600.0

That is the same as my version number. It could not restore it from dllcache
if it was not there. Check both system32 and dllcache to be sure that both
have a copy of calc.exe in them.

If there is no calc.exe in dllcache and your i386 folder is in C:, then:
Start> Run> paste next line and press Enter:
expand C:\i386\calc.ex_ C:\WINDOWS\System32\dllcache\calc.exe

If no calc.exe in dllcache and your i386 folder is in C:\WINDOWS, then:
Start> Run> paste next line and press Enter:
expand C:\WINDOWS\i386\calc.ex_ C:\WINDOWS\System32\dllcache\calc.exe

I recently ran a full scan with MBAM.


I'll get this, run a full scan, and report back.

What anti-virus program are you using?

(Norton with Protected Recycle Bin? :)

Symantec Norton Protected Recycle Bin Exposure
http://www.symantec.com/avcenter/security/Content/2006.01.10.html

I am beginning to think that maybe Windows File Protection is working OK
after all: Assuming the Event log for the "sfc /scannow" was successful.
Since Calculator is an optional accessory, I wonder if it is necessarily
considered to be a file that is "required for Windows to run properly", and
can't someone with Administrator privileges over-ride WFP in some cases?

Description of the Windows File Protection feature
http://support.microsoft.com/kb/222193/

Windows File Protection on Windows 2000 and Windows XP (Windows)
http://msdn.microsoft.com/en-us/library/aa372820(VS.85).aspx

Here are the files associated with Calculator AFAIK:
C:\Windows\system32\calc.exe
C:\Windows\Help\calc.chm
C:\Windows\Help\calc.hlp
C:\Documents and Settings\All Users\Start
Menu\Programs\Accessories\Calculator.lnk

HTH. (Hope This Helps. :)
--Richard
 
Trying again to follow Richard's instructions, and to accurately describe
what happens..

Richard said:
You might try un-installing, and re-installing calc.exe -->
Control Panel> Add/Remove Programs> Add/Remove Windows Components

See result said:
In Components window, Click Accessories and Utilities,

click Details button

See result, Step3.jpg <http://www.rcblue.com/Misc/Step3.jpg
In next window, click Accessories, click Details button

Button is greyed out.
In next window, Un-check Calculator

Calculator IS already unchecked; see <http://www.rcblue.com/Misc/Step3.jpg>

So what do I do?
, click OK, OK, Next.
After it is uninstalled, repeat above, except:
Instead of Un-check --> Checkmark Calculator, OK, OK, Next.

See if you have an i386 folder with CALC.EX_

Well, I don't know where the i386 folder is, but I searched C:\WINDOWS and
subfolders for CALC.EX_ ; nope
Try running System File Checker. (Takes about 25 minutes or so.)
Click Start, click Run, type or paste next line and press Enter:
sfc /scannow

I've now done this several times. All runs finished silently. However, if
calc.exe is in C:\WINDOWS\system32\dllcache\ but not in C:\WINDOWS\system32\,
after running SFC I find that calc.exe is in nether
C:\WINDOWS\system32\dllcache\ or C:\WINDOWS\system32\. If calc.exe is in both
folders, after SFC it's in C:\WINDOWS\system32\ but not in
C:\WINDOWS\system32\dllcache\.
 
Trying again to follow Richard's instructions, and to accurately describe
what happens..







See result, Step3.jpg <http://www.rcblue.com/Misc/Step3.jpg


Button is greyed out.


Calculator IS already unchecked; see <http://www.rcblue.com/Misc/Step3.jpg>

So what do I do?



Well, I don't know where the i386 folder is, but I searched C:\WINDOWS and
subfolders for CALC.EX_ ; nope


I've now done this several times. All runs finished silently. However, if
calc.exe is in C:\WINDOWS\system32\dllcache\ but not in C:\WINDOWS\system32\,
after running SFC I find that calc.exe is in nether
C:\WINDOWS\system32\dllcache\ or C:\WINDOWS\system32\. If calc.exe is in both
folders, after SFC it's in C:\WINDOWS\system32\ but not in
C:\WINDOWS\system32\dllcache\.

The "most important" version is the one in dllcache.

If WFC gives that error in the event log and fails to replace in when
deleted from system32 and sfc doesn't like it either. it is
afflicted.

As far as Windows is concerned, the one in dllcache doesn't match what
it thinks is correct. That is where WFC and sfc look for missing
files and decide what to do. Your event log says WFC would like to
replace it when it is missing from system32, but doesn't like the
replacement so it does not get replaced. It doesn't matter if it
looks the same and acts the same from someplace else - Windows doesn't
like it.

If you want it to work (and I know you do) that is the one that
matters and needs to be replaced.

You can replace (copy) it from another system and see if it is
replaced properly when deleted from system32.

Do you have any kind of XP Installation media (CD). That is where the
unexpanded version would be.
 
Richard said:
Hi again,

What didn't work? Were you able to find everything in the instructions and
click everything? (After you clicked Next, did you click Finish? :)

Please see my re-reply to your previous post, which I made earlier this
morning.
Click Start, click (all)Programs, click Accessories
Do you see Calculator on the Accessories panel of Start Menu?
No.

If so, does it start Calculator?

(I just realized no one asked if you checked Recycle Bin for calc.exe :)

Yes, it's there, deleted "9/22/2009 8:02 AM".
Did you find your i386 folder and was CALC.EX_ in it?

I seem to not have a i386 folder. And a search within the Windows folder
(plus subfolders) didn't find CALC.EX_ .
(Either C:\i386 or C:\Windows\i386)
(Or do a file search for CALC.EX_)



Probably. (It's not talkative like me. "No news is good news." :)

Check Event Viewer System log for source: Windows File Protection
Start> Run> %SystemRoot%\system32\eventvwr.msc
(Click the word "Source" at the top of that column, scroll down.)

There should be 2 information reports when SFC completes:
The first should say, "Windows File Protection file scan was started."
The second: "Windows File Protection file scan completed successfully."
(There may be a second set of 2 reports when you ran WFP again.)

Wow! I found maybe 2000 WPF events for just today! See
From your reply to Jose:

Right click calc.exe> Properties, what is the modified date?

Well, the one I keep on my desktop and use to copy into c\:windows\system32\
and c\:windows\system32\dllcache\ says "Modified: Wednesday, July 16, 2003,
9:19:10 AM"
My original is: Friday, August 17, 2001, 10:36:38 PM
Click the version tab of the properties, click (item) File Version, in right
pane, does it say: 5.1.2600.0 (xpclient.010817-1148) ?



Back to square one. When Pegasus pointed you to the dllcache for a copy of
calc.exe, did you COPY the file?

I copied it, IIRC.

or MOVE that file out of dllcache and into
system32? Above, you said it "wasn't in" dllcache. If it was gone, that
might explain why you got this message:


That is the same as my version number. It could not restore it from dllcache
if it was not there. Check both system32 and dllcache to be sure that both
have a copy of calc.exe in them.

If there is no calc.exe in dllcache and your i386 folder is in C:, then:
Start> Run> paste next line and press Enter:
expand C:\i386\calc.ex_ C:\WINDOWS\System32\dllcache\calc.exe
If no calc.exe in dllcache and your i386 folder is in C:\WINDOWS, then:
Start> Run> paste next line and press Enter:
expand C:\WINDOWS\i386\calc.ex_ C:\WINDOWS\System32\dllcache\calc.exe

As I said above I seems to have no i386. But I ran both of your expand
commands anyway. The command line window opened but closed so quickly that I
could even see if it said anything.
What anti-virus program are you using?

Kaspersky Internet Security 2009.
 
Jose said:
The "most important" version is the one in dllcache.

If WFC gives that error in the event log and fails to replace in when
deleted from system32 and sfc doesn't like it either. it is
afflicted.

As far as Windows is concerned, the one in dllcache doesn't match what
it thinks is correct. That is where WFC and sfc look for missing
files and decide what to do. Your event log says WFC would like to
replace it when it is missing from system32, but doesn't like the
replacement so it does not get replaced. It doesn't matter if it
looks the same and acts the same from someplace else - Windows doesn't
like it.

If you want it to work (and I know you do) that is the one that
matters and needs to be replaced.

Actually, long ago "Bob" told me about Calculator Plus. I prefer it to
Calculator (calc.exe) which I keep a copy of on my desktop but don't use.
You can replace (copy) it from another system and see if it is
replaced properly when deleted from system32.

OK, I'm still curious about what's going on, so I'll get a copy from a
friend.
Do you have any kind of XP Installation media (CD). That is where the
unexpanded version would be.

I have a "Dell Dimension ResourceCD", but searching it for "calc" gets no
hits. I'll try the friend. He runs Win 2000.
 
Try this:
Control Panel >> Add/Remove Programs>>Add/Remove Windows Components.
It should be on Accessories and Utilities, Click Details, select
Accessories and click Details again. Uncheck the box for Calculator.
OK your way out of Add/Remove Programs. Repeat the procedure but this
time place a check in the Calculator box to re-install it.
 
"B.D.©" said:
Try this:
Control Panel >> Add/Remove Programs>>Add/Remove Windows Components.
It should be on Accessories and Utilities, Click Details, select
Accessories and click Details again. Uncheck the box for Calculator.

Calculator IS already unchecked. See
<http://www.rcblue.com/Misc/Step1.jpg>
<http://www.rcblue.com/Misc/Step2.jpg>
OK your way out of Add/Remove Programs. Repeat the procedure but this
time place a check in the Calculator box to re-install it.

OK:
<http://www.rcblue.com/Misc/Step4.jpg>
<http://www.rcblue.com/Misc/Step5.jpg>
<http://www.rcblue.com/Misc/Step6.jpg>
<http://www.rcblue.com/Misc/Step7.jpg>

And that's the end of the line. calc.exe isn't found even though it's now in
both C:\WINDOWS\system32\dllcache\ and C:\WINDOWS\system32\ ;
and it isn't installed.
<http://www.rcblue.com/Misc/Showing_Calc_is_not_installed_in_Accessories.jpg>
 
EW_Zuki said:
Calculator IS already unchecked. See
<http://www.rcblue.com/Misc/Step1.jpg>
<http://www.rcblue.com/Misc/Step2.jpg>


OK:
<http://www.rcblue.com/Misc/Step4.jpg>
<http://www.rcblue.com/Misc/Step5.jpg>
<http://www.rcblue.com/Misc/Step6.jpg>
<http://www.rcblue.com/Misc/Step7.jpg>

And that's the end of the line. calc.exe isn't found even though it's now in
both C:\WINDOWS\system32\dllcache\ and C:\WINDOWS\system32\ ;
and it isn't installed.
<http://www.rcblue.com/Misc/Showing_Calc_is_not_installed_in_Accessories.jpg>
For some stupid reason the shortcut is getting lost. Go to
C:\WINDOWS\System32\ locate the calc.exe file. Right click on it and
choose Send To >> Desktop as Shortcut. Rename the new shortcut to
Calculator and R-Click drag it to the Start Button , wait for the menu
to expand (Don't release the Mouse button)drag up to Programs >>
Accessories and any place inside the list in that folder. Release the
button and choose Move Here.
 
Calculator IS already unchecked. See
<http://www.rcblue.com/Misc/Step1.jpg>
<http://www.rcblue.com/Misc/Step2.jpg>


OK:
<http://www.rcblue.com/Misc/Step4.jpg>
<http://www.rcblue.com/Misc/Step5.jpg>
<http://www.rcblue.com/Misc/Step6.jpg>
<http://www.rcblue.com/Misc/Step7.jpg>

And that's the end of the line. calc.exe isn't found even though it's nowin
both C:\WINDOWS\system32\dllcache\ and C:\WINDOWS\system32\ ;
and it isn't installed.
<http://www.rcblue.com/Misc/Showing_Calc_is_not_installed_in_Accessori...>

I will wait for you to get through trying things and then fix the
problem of calc,exe not being replaced (and the subsequent message in
the Event Log telling you why).

If it is missing from the menus or desktop, who cares - that is easy
to fix. I would be more annoyed with why calc.exe is not being
replaced like it should, why you have an error in the Event Log you
should not have, etc. then worry about the other stuff. However,
maybe just getting the shortcut back will satisfactorily resolve the
issue for you.

If you fix the missing shortcut, you will still have the other problem
with WFP and the error in the Event Log (I'm pretty sure) and how it
got that way.

The Event Log says Windows doesn't like the calc.exe that is in
dllcache (it should). It is either wrong (even if it looks right), or
we need to tell Windows it really is okay. You need to replace it
from someplace other than your system - email it to your self from
another system if you have to.

Not everyone has a c:\i386 folder.

Did you ever say how you were fixed for Windows media?
 
Calculator IS already unchecked. See
<http://www.rcblue.com/Misc/Step1.jpg>
<http://www.rcblue.com/Misc/Step2.jpg>


OK:
<http://www.rcblue.com/Misc/Step4.jpg>
<http://www.rcblue.com/Misc/Step5.jpg>
<http://www.rcblue.com/Misc/Step6.jpg>
<http://www.rcblue.com/Misc/Step7.jpg>

And that's the end of the line. calc.exe isn't found even though it's nowin
both C:\WINDOWS\system32\dllcache\ and C:\WINDOWS\system32\ ;
and it isn't installed.
<http://www.rcblue.com/Misc/Showing_Calc_is_not_installed_in_Accessori...>

I could not see your screenshots before - the last one is prompting
for an XP installation CD, so if you can get one, change the browse
path to point to it and let the install get a fresh copy of calc from
the CD.

That would be the unexpanded one that Windows will expand and
reinstall for you.
 
This is a reply to EW_Zuki's Tue, 22 Sep 2009 10:50:01 -0700 message

and to EW_Zuki's Tue, 22 Sep 2009 20:31:01 -0700 message

Your "Showing_Calc_is_not_installed_in_Accessories.jpg" screenshot indicates
that Calculator is not the only thing missing. I didn't see Paint or WordPad
there either. (There was an extra Notepad.) Your Programs menu panel, in
alphabetical order, only went as far as "eCleaner", so I couldn't see if you
had the "Games" sub-folder there. That was another thing in the Windows
Components dialog that was not checkmarked. In fact, I didn't see any
checkmarks except the 1 you added to Calculator, that didn't work.

Was there a time when you did have Calculator? or Was your winXP a custom
installation without optional components from the start?

:
I seem to not have a i386 folder. And a search within the Windows
folder (plus subfolders) didn't find CALC.EX_ .

OK. Not all installations have a copy of the i386 folder from the CD.

Is your computer 32-bit? or 64-bit?

:

Wow! I found maybe 2000 WPF events for just today! See
<http://www.rcblue.com/Misc/Event_Viewer__System.jpg> (an 18.72 MB file)


Oh Boy! ... ("We're going to need bigger GUNS!" :)


I counted 966 WFP items, only 50 of which were dated 22Sep2009, and 6 were
dated 21Sep2009, the remaining 910 items were dated 20Sep2009. (Your picture
spoke more than 2000 words though. I'll let you count the words... :)

That monster file was more than a half hour download on my slow dialup
connection. My graphics viewer displayed it without groaning much. There
was a lot of blank white space down the right side. After loading it into
Windows Paint, with no changes, and SaveAs (other filename).JPG, the size
was reduced to 7.54MB, even without cropping the right side. You might want
to check the JPEG compression setting on your graphics program. I got the
filesize down to 2.49MB as 16-color GIF.

(Where did you get the 32 feet tall monitor to take that screen shot? :)

The picture did not show the message text of any of the items, so it was of
limited value. It did show 5 different WFP event id's - 64016 (start), 64001
(file restored), 64004 (invalid version - could not restore), 64020 (bad
signature - restore to original), 64021 (could not be copied into DLL
cache). I did not see a 64017 (scan completed successfully) event.

The only 64001 (file restored) was dated 9/20/2009 7:10:25 AM. It was all
downhill after that. Most were pairs of 64020 and 64004 entries. Apparently
the attempts to restore to original, resulted in a could not restore because
of invalid version. Apparently all attempts to copy files to dllcache failed
also. Obviously something is seriously very bad wrong with a lot of files.
See my other message this date for suggestions on correcting things.

By the way, instead of a screen shot, in Event Viewer, you could have
clicked System on the left, and then click Action on the menu bar, and Save
Log File As, and choose File Type: Text. That file would be less than .5 MB
in size. If you want to archive the current log for viewing later in Event
Viewer, use the "evt" file type. Also, while "System" is selected on the
left, click Action, click Properties, and change Maximum log size to 1024.
On 22 Sept when you made the picture, the log only went back to 15 Sept. We
can't look back at events around the time calc grew legs and walked off.

Also, since you only have one Computer name, click View on the menu bar,
click Add/Remove Columns, click Computer, click <-Remove, click OK.

Also, if you need to send someone a copy of a log, use the "evt" file type,
which includes additional error code information that the text format does
not include, and ZIP it (with 7-Zip or WinZip) before attaching to EMAIL.
You can send me a copy, so I can see which files are messed - there may be
some sort of common thread back to a single cause. (No promises. :)

:
As I said above I seems to have no i386. But I ran both of your expand
commands anyway. The command line window opened but closed so quickly that
I could even see if it said anything.

The two messages that flashed "quickly" on the screen were probably:
Can't open input file: c:\i386\calc.ex_.
Can't open input file: c:\WINDOWS\i386\calc.ex_.

(I should have had you use Command Prompt, where you can see stuff. :)


I haven't seen a "report" on SAS here yet.

:
Kaspersky Internet Security 2009.

OK. That's one of the good ones. Make sure it has fully up to date
definitions when you do a full scan of your system32 folder.


Did you find those 2 help files in C:\Windows\Help?

(See also my other reply to you this date for further. :)
--Richard
 
This is a reply to EW_Zuki's Tue, 22 Sep 2009 11:06:01 -0700 message
Actually, long ago "Bob" told me about Calculator Plus. I prefer it to
Calculator (calc.exe) which I keep a copy of on my desktop but don't use.


OK, I'm still curious about what's going on, so I'll get a copy from a
friend.


I have a "Dell Dimension ResourceCD", but searching it for "calc" gets no
hits. I'll try the friend. He runs Win 2000.

You probably won't solve the WFP rejection of the dllcache copy problem by
using a calc from another operating system. Even Windows setup has to get
permission from WFP to make changes to operating system files. You need to
use the Add Windows Components, and point the path to a valid i386 folder on
your drive, or to a valid Windows XP Professional installation CD.

If your computer did not ship with the optional Windows XP Professional CD,
you can "Request back up disks from Dell" here:

https://support.dell.com/support/topics/global.aspx/support/dellcare/en/backupcd_form
(I didn't see any mention of cost on that page.) You will need to enter your
Dell "Service Tag" ID, which is on the back of desktop models, or elsewhere
on laptops. There's a button on that page that will you help locate it. (If
you don't have a user manual for your computer, look on the left side of
some of the support pages for a User Manuals link.)

If the computer did not come with an XP CD, then it possibly has a hidden
partition on the hard drive that can be accessed by pressing an F key, (mine
is F12,) for a BOOT MENU when the Dell logo appears at startup. You can
check right now to see if your drive has a Recovery Partition here:

Start> Run> diskmgmt.msc

Your (C:) drive should say: "Healthy (System)"
An unLettered hidden partition may say: "Healthy (EISA Conguration)"
Windows Disk Management will let you see manufacturer's hidden partitions,
but should not let you access it through Disk Management.

WARNING: Some kinds of recovery partitions only have the ability to restore
the operating system drive to factory condition without any of the data you
have added, so be sure you have backup copies of your Valued Data before
doing any sort of Repair Install, or re-install. Check your User Manual.

Your best option to correct the missing files problem in a way that WFP
approves, is to use a genuine Windows XP Professional CD with the same
Service Pack level as your computer, and boot the CD and press R key to get
to the Recovery Console and at the command line:
CHKDSK /p

and after the Check Disk scan completes:
SFC /scannow

That way WFP can restore files it needs from the CD when it scans. (And
hopefully put copies in dllcache that it likes. :)

Then after booting from the drive, go to the Add/remove Windows Components
dialog, and if no checkmarks, checkmark all the stuff you want, etc., and
point the path to the CD.
- - -

That still leaves us with the mystery of why WFP found so many hinky files
with bad signatures or supposedly wrong versions. Malware is usually at the
top of the list of suspects for radical file changes. Your malware scans
have not pointed in that direction so far. WFP's catalog of files might have
become corrupt. Filing system errors will be exposed when you run CHKDSK.
Sometimes the setup packages for application installations mess things up.
If you can pin down the time when calc.exe went missing, you can check
Add/Remove programs for any applications that were installed about the same
time, and check their website for bug reports or revision updates, to see if
there might be a known problem. You can check in the program's folder for a
setup log or .inf file that may reveal a setup quirk.

Your "Step7.jpg" image showed that Windows looked here for an i386 folder:

C:\Documents and Settings\<UserName>\Local Settings\Temp\setup\i386

and did not find one. Apparently there had been some sort of previous setup
of some software that used the Current User %temp% folder to unpack its
installation files. That leads me to wonder if someone used a Windows setup
information file as a pattern for their own setup, and did not sufficiently
modify the pattern, and maybe caused all optional Windows components to be
uninstalled. That's a stretch, but whatever happened, WFP did not stop it.

What Registry Cleaner do you use? Some brands make backup copies of the
registry when cleaning uninstall leftovers, which may have some clues.

(Well, I've peeled back all the layers of yellow Post-It notes plastered
around the inside of my empty skull and can't think of anything else. :)

Looking forward to your progress report.
--Richard
 
Back
Top