[Coolzone]

When i boot up, the calculator will be open on the desktop. Nothing in the start up folder, nothing in msconfig, unchecking the calculator under accessories for add/remove windows component has no effect. run tune up, win aso , crab cleaner , panda online scan, bitdefender online scan all to no avail. It has to be a registry item, either missing or turned on/off function.
Please send response by mail ray:

 

[justpassingby]

Press ctrl+alt+del and check that it's the calc.exe process. Download, unzip and run process explorer, right-click the calc.exe process => properties and check that it runs from c:\windows\system32\. If it's another process or another location then it could be some malware disguised as the calculator.

Have you checked the scheduled tasks ?

 

[ComputerGeek101]

One thing you could do is rename the calculator program so that when it tries to autorun the computer will be unable to find it. If it still appears then it can't be the windows calculator and must be a fake. Possibly malware.

Navigate to "C:\WINDOWS\system32\" and find calc.exe. Rename it to something else like calculator.exe. (The .exe might not appear if your computer isn't set to show it.)

Then reboot and see if it loads. If it doesn't you've fixed it and if it does then it's a fake and possibly malware.

 

[Coolzone]

THx for the 2 responses. Re-naming leads to windows putting a fresh calc.exe in place.
I used Process explorer and "Verified Microsoft Windows Component Publisher". But when we look now at thread etc, that is abit above what i have done sofar. Will need guidance to correct the value which leads to the calulator to boot to desktop. It is not a scheduled task.
thx for helping.
I have only recently started testing a new program "regseeker". My suspicion is a 8:2 probability that it changed a value, because the syptom is on my machine as well as on a costumer machine. My system is due for rebuilt, but holding up. If i can not reproduce that error, i have no way to help the costumer (comp is released). THX

 

[sobeit]

go to run, msconfig and see if its under startup. If not there, right click the calculator and check the properties/path and see if you can locate it.

Finally if all else fails, just to a restore to a previously saved restore point to just prior to the problems.

 

[Coolzone]

Hi, thx for the try to help. if u read my previous post. it is not: start up/msconfig/task folder/malware/virus/rename...It is a verified windows process. when u go to add/remove windows component we can remove under accesorries the calculator...actually it is new service structure....when i do that windows is complaining not finding calc.exe and it should be saying nothing. So we have either a value forcing the boot in the registry...like a force desktop....or a value missing which leads to a boot up appearance. the caclulator close normal and will stay closed and is verified windows component. in which file or registry area can i find that calc to look at set values? thx for the help

 

[justpassingby]

Use Autoruns, it'll tell you about everything that runs at startup.

Double-check the path of the calc.exe file that runs at startup with process explorer (don't close the calculator until you've checked the path). Then go to http://virusscan.jotti.org/ and upload that file. I know panda already scanned it but better make sure it's not some a virus like this one.

 

[Ebadelhady]

Hi Coolzone , ihave got same problem on my laptop ACER and like to know how you solve it if you did...tks

 

[Ebadelhady]

It is loaded by the following key:
HEKY-CURRENT USER\Software\Microsoft\WindowsNT\Current Version\Winlogon
Registery Value Name:Shell ..double click and remove calc.exe
or use Trojan Remover to do it 4u