Untamed Address Book - Outlook 98

This one has me frustrated. During a short visit to my sister's, as usual I was sat down at her PC and told to fix it. Got it all updated and up to speed except for one problem: Whenever it boots up, a Windows address book pops up. The name of this wab is -check (note the "- "). This wab is empty. Close it and all is well until the next reboot. If I call up her Outlook 98 and select address book, it calls up her correct populated wab. I can search and find -check.wab but if I delete it, the next time I reboot, I get a can't find the -check address book error.

I found nothing in the registry pointing to the problem - I checked all the Run, RunOnce, RunOnceEx, RunServices and RunServicesOnce keys.

I checked runs, loads, and boots in system files

msconfig showed nothing at startup running associated with the wab.

Searching the Net for solutions is difficult as the "-" is more often than not ignored or it is treated as a hyphen and wraps to a separate line.

That's as far as I got before I had to catch a plane. I'm heading back down to see her in a couple weeks - I want to load up on any and all ideas, suggestions, etc before I go.

I'm open to anything on this one

- b

 

Hiya and welcome

First thing I would say, is check for viruses:

http://housecall.antivirus.com/housecall/start_corp.asp

Also, go here and download Startup Log. Install and run it, allow the DOS window to close, then copy/paste the list. We don't need the Stubs at the end:

http://home.earthlink.net/~rmbox/Reticulated/Toys.html

Also, have a look here:

Programs | Startup. Is there anything in there that points to WAB? If so, rightclick and choose Delete.

Regards

eddie

 

I forgot to mention that updating and running the virus checker is the first thing I did on her system - it was clean. The programs | startup menu only had the MS Office junk in it - cleaned that out. I sent her the startlog.com file and am waiting for the results. Thanks for the reply and I'll for the results as soon as they are in.

 

Logs

Okay - got her to run the logger - here's the log - I only see 1 reference to the .wab file but it does not specify the name. Hope you see something I missed.


Start-Ups checked at 01-14-2002 8:28:09.47a
StartUp Log (version 1.54) - Release Date 12/12/2001

StartUp Log Index

1. HKLM Run
2. HKCU Run
3. HKLM RunOnce
4. HKCU RunOnce
5. HKLM RunServices
6. HKLM RunServicesOnce
7. WIN.INI file
8. SYSTEM.INI file
9. AUTOEXEC.BAT file
10. StartUp folder
11. All Users StartUp
12. Misc. StartUp Configurations

____

The following is a list of your current Start-Ups
____

1. HKLM Run - Registry

[RegPath]
"StartUp"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry "= "c:\\windows\\scanregw.exe /autorun "
"TaskMonitor "= "c:\\windows\\taskmon.exe "
"SystemTray "= "SysTray.Exe "
"LoadPowerProfile "= "Rundll32.exe powrprof.dll,LoadCurrentPwrScheme "
"Norton Auto-Protect "= "C:\\PROGRA~1\\NORTON~1\\NAVAPW32.EXE /LOADQUIET "
"HPSCANMonitor "= "c:\\windows\\SYSTEM\\hpsjvxd.exe "
"StillImageMonitor "= "C:\\WINDOWS\\SYSTEM\\STIMON.EXE "
"Adaptec DirectCD "= "C:\\Program Files\\DirectCD\\DIRECTCD.EXE "
"CriticalUpdate "= "c:\\windows\\SYSTEM\\wucrtupd.exe -startup "
"Pop-Up Stopper "= "\ "C:\\PROGRAM FILES\\PANICWARE\\POP-UP STOPPER\\DPPS2.EXE\" "
"LoadQM "= "loadqm.exe "
"Tweak UI "= "RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp "

====
____

2. HKCU Run - Registry

[RegPath]
"StartUp"


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager "= "C:\\PROGRA~1\\YAHOO!\\MESSEN~1\\ypager.exe "
"Weather "= "C:\\PROGRAM FILES\\AWS\\WEATHERBUG\\WEATHER.EXE 1 "
"TClockEx "= "C:\\PROGRAM FILES\\ACCESSORIES\\TASKBARCLOCK\\TCLOCKEX.EXE "

====
____

3. HKLM RunOnce - Registry

[RegPath]
"StartUp"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

====
____

4. HKCU RunOnce - Registry

[RegPath]
"StartUp"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]


====
____

5. HKLM RunServices - Registry

[RegPath]
"StartUp"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"LoadPowerProfile "= "Rundll32.exe powrprof.dll,LoadCurrentPwrScheme "
"SchedulingAgent "= "mstask.exe "
"TrueVector "= "C:\\WINDOWS\\SYSTEM\\ZONELABS\\VSMON.EXE -service "
"MiniLog "= "C:\\WINDOWS\\SYSTEM\\ZONELABS\\MINILOG.EXE -service "


====
____

6. HKLM RunServicesOnce - Registry

[RegPath]
"StartUp"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]


====
____

7. WIN.INI File - (c:\windows\win.ini)

Your win.ini run/load lines should look like run= and load= exclusively.
There should be nothing to the right of the equal signs.


These are the run and load lines in your WIN.INI file

run=

load=

====
____

8. SYSTEM.INI File - (c:\windows\system.ini)

Your system.ini shell line should look like shell=Explorer.exe exclusively.
You should only see Explorer.exe following the equal sign.


This is the shell line in your SYSTEM.INI file

shell=Explorer.exe

====
____

9. AUTOEXEC.BAT File - (c:\autoexec.bat)

(Some trojans have been known to start from this file)


These are your program startups and set paths in your autoexec.bat file

@ECHO OFF
rem
rem *** DO NOT EDIT THIS FILE! ***
rem
rem This file was created by the System Configuration Utility as
rem a placeholder for your AUTOEXEC.BAT file. Your actual
rem AUTOEXEC.BAT file has been saved under the name AUTOEXEC.TSH.
rem

====
____

10. StartUp Folder - (c:\windows\start menu\programs\startup)

Shortcuts to any program will automatically start when placed here.


These are the shortcuts located in your StartUp folder

C:\WINDOWS\Start Menu\Programs\StartUp\Norton Program Scheduler.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\HP Parallel Port Test.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\America Online Tray Icon.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\Tardis.exe

====
____

11. All Users Folder - (c:\windows\all users\start menu\programs\startup)

Shortcuts to any program will automatically start when placed here.


These are the shortcuts located in your All Users StartUp folder

C:\WINDOWS\All Users\Start Menu\Programs\StartUp\ZoneAlarm.lnk

====
____

12. Miscellaneous StartUp Configurations

-=======-
Registry StartUp Directories
-=======-

Should show the Start Menu StartUp and All Users StartUp directories

.....................................................................

[1] HKCU - Shell Folders

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

"Startup "= "C:\\WINDOWS\\Start Menu\\Programs\\StartUp "

.....................................................................

[2] HKCU - User Shell Folders

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders


.....................................................................

[3] HKLM - Shell Folders

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders

"Common Startup "= "C:\\WINDOWS\\All Users\\Start Menu\\Programs\\StartUp "

.....................................................................

[4] HKLM - User Shell Folders

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders


.....................................................................

-=========-
Registry Shell Spawning
-=========-

Open Commands for Executable File Types

@= "\ "%1\" %* "
(.exe file - RegPath = HKCR\exefile\shell\open\command)

@= "\ "%1\" %* "
(.com file - RegPath = HKCR\comfile\shell\open\command)

@= "\ "%1\" /S "
(.scr file - RegPath = HKCR\scrfile\shell\open\command)

@= "\ "%1\" %* "
(.bat file - RegPath = HKCR\batfile\shell\open\command)

@= "\ "%1\" %* "
(.pif file - RegPath = HKCR\piffile\shell\open\command)

@= "C:\\WINDOWS\\SYSTEM\\MSHTA.EXE \ "%1\" %* "
(.hta file - RegPath = HKCR\htafile\shell\open\command)

-====-
HKLM RunOnceEx - Registry
-====-


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx]


-====-
HKU (.Default) Run - Registry
-====-


[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager "= "C:\\PROGRA~1\\YAHOO!\\MESSEN~1\\ypager.exe "
"Weather "= "C:\\PROGRAM FILES\\AWS\\WEATHERBUG\\WEATHER.EXE 1 "
"TClockEx "= "C:\\PROGRAM FILES\\ACCESSORIES\\TASKBARCLOCK\\TCLOCKEX.EXE "


-=========-
HKU (.Default) RunOnce - Registry
-=========-


[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\RunOnce]


-====-
StubPaths - Registry (Partial Listing)
-====-

(Please see the StubPath.txt on your desktop for complete listing)

HKLM\Software\Microsoft\Active Setup\Installed Components


"OldStubPath "= "c:\\windows\\SYSTEM\\ie4uinit.exe "
"RealStubPath "= "C:\\WINDOWS\\SYSTEM\\IE4UINIT.EXE "
"StubPath "= "c:\\windows\\COMMAND\\sulfnbk.exe /L "
"RealStubPath "= "\ "C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:OE /CALLER:IE50 /user /install "
"StubPath "=" "
"StubPath "= "C:\\WINDOWS\\SYSTEM\\updcrl.exe -e -u C:\\WINDOWS\\SYSTEM\\verisignpub1.crl "
"StubPath "= "\ "C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:WAB /CALLER:IE50 /user /install "

-===-
DOSSTART.BAT File - (c:\windows\dosstart.bat)
-===-

@echo off

REM Notes:
REM DOSSTART.BAT is run whenenver you choose "Restart the computer
REM in MS-DOS mode" from the Shutdown menu in Windows. It allows
REM you to load programs that you might not want loaded in Windows,
REM (because they have functional equivalents) but that you do
REM want loaded under MS-DOS. The two primary candidates for
REM this are MSCDEX and a real mode driver for the mouse you ship
REM with your system. Commands that you want present in both Windows
REM and MS-DOS should be placed in the Autoexec.bat in the
REM \Image directory of your reference server. Please note that for
REM MSCDEX you will need to load the corresponding real-mode CD
REM driver in Config.sys. This driver won't be used by Windows 98
REM but will be available prior to and after Windows 98 exits.
REM
REM This file is also helpful if you want to F8 boot into MS-DOS 7.0
REM before Windows loads and access the CD-ROM. All you have to do
REM is press F8 and then run DOSSTART to load MSCDEX and your real
REM mode mouse driver (no need to remember the command line parameters
REM for these two files.
REM
REM - You MUST explicitly specify the CD ROM Drive Letter for MSCDEX.
REM - The string following the /D: statement must explicitly match
REM the string in CONFIG.SYS following your CD-ROM device driver.

rem MSCDEX.EXE /D:IBMCD001 /l:g /m:8
c:\mouse\mouse.exe

rem C:\WINDOWS\CWDINIT.EXE /A

-=======-
Screen Saver Settings (Possible system.ini start-up)
-=======-

SCRNSAVE.EXE=C:\WINDOWS\SYSTEM\UNDERW~1.SCR

====
____

- Supplemental Environment Information -

TMP=c:\windows\TEMP
TEMP=C:\windows\TEMP
winbootdir=C:\WINDOWS
PATH=C:\WINDOWS;c:\windows;c:\windows\COMMAND
COMSPEC=C:\WINDOWS\COMMAND.COM
windir=C:\WINDOWS


====
____

- End -

 

Hiya

Is this the entry that you saw:

\\setup50.exe\" /APP:WAB /CALLER:IE50 /user /install"

Thats normal.

Now, lets see if its any of the startup Programs.

ScanRegistry: keep

TaskMonitor: The Task Monitor the disk-access patterns of programs when they are started and stores this information in log files in the Applog folder. Task Monitor also records the number of times you use a program. The Disk Defragmenter tool uses this information to optimize your hard disk so that programs that you use frequently are loaded faster. Not required - but can be useful. Note: for Norton Anti-Virus 2002 users, loading TaskMonitor will typically solve many, if not most, of those annoying IE scripting errors (per Symantec's Knowledgebase)

SystemTray: keep

LoadPowerProfile: Power management specifics such as monitor shut-off, system standby, etc. keep

Norton Auto-Protect: Norton Anti-Virus's background scanning process. Can be inconvenient because it scans files when Run/Opened or Downloaded/Created and you can scan files manually via right-click after downloading/copying. However, in light of some of the viruses around these days it's probably best to put up with the inconvenience

HPSCANMonitor: HP scanning software that enables you to scan images from your scanner. Needed if you're using the scanner. If unavailable via Start -> Programs

StillImageMonitor: If your scanner does not have a button to initiate scanning you kill stimon. Even if it does have a button, you can still manually launch the scanning application. If unavailable via Start -> Programs

Adaptec DirectCD: DirectCD allows you (amongst other things) to drag and drop files onto a suitably formated CD-RW disc. Unless you use this on a frequent basis it isn't required an is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive

CriticalUpdate: Microsoft Windows Critical Update Notification. If you want to keep Windows 98 up-to-date, check the Windows Update site - not required

Pop-Up Stopper: optional.

LoadQM: Loads the MSN Explorer Query Manager - a waste of resources and bandwidth. Also installed by the latest version of MSN Messenger. Not required

Tweak UI: Restores settings that can't be retained if you have Tweak UI installed

Now, for the ones that you want to remove, go to Run and type MSCONFIG. Startup Tab. Uncheck the ones that you don't want, apply and restart. If you're unsure, do seperately, but apply and restart after each one.

If it still comes up, we'll delve deeper.

Regards

eddie

 

Thanks for the reply - yes, that wab reference you noted was the one I was referring to.

We have a consensus for the next plan of attack - work my way through msconfig until the offender is identified - unfortunately, that will have to wait until I go back down their in March. Therefore, we can put this thread on hold unless someone thinks of something (anything) else to try - especially if it is something I can talk my sister through over the phone/email.

Thanks - will reopen thread with results upon my return.

later...