AumHa Forums

Done. That seemed to do it. Email in html now is back to the way it was. I uninstalled Spybot, rebooted, reset IE 7, rebooted, tried Outlook and it was good. Then I went back into IE 7 and turned a bunch of add-ons back on, tweaked IE 7 back to the way I like it, and finally tried Outlook again, and it was still good.

So, if I understand this correctly, I should probably be okay if I install Spybot again but do not use the immunization feature but just use it for regular scans. Sound reasonable?

That sounds reasonable to me.

Best of luck.

Thank you for your help. I would not have been able to solve this on my own.

One final question if you don't mind. As a result of some previous help I received from this forum I've installed and use regularly AdAware SE. Would AdAware SE in conjunction with my NIS 2007 be sufficient security in your opinion? Or should I re-install Spybot?

Thanks.

I wish I was better able to answer your question, other than to state what I have done myself.

Firewall: XP SP2 native firewall
Active anti-malware: Microsoft Windows Defender (free)
Active anti-virus: Eset NOD32
Active anti-malware monitors:
. Commodo BOClean (free): http://www.nsclean.com/boclean.html
. Spyware Blaster (free): http://www.javacoolsoftware.com/spywareblaster.html

On-Demand Scanners

These are software and web-based scanners I manually update and scan with on a regular basis; and certainly if I suspect a problem. I would have ready all of them:

Ad-Aware
SpyBot Search and Destroy
AVG Anti-malware (Download and use the trial. When it expires configure as an on-Demand scanner)[*]

On-line Scanners:
When in doubt I always run a Panda ActiveScan, and an online scan by Kaspersky. BitDefender is another good choice. Listing: http://windowsxp.mvps.org/Scanners.htm

[*] AVG Antispyware
Download & install the latest version of AVG Anti-Spyware (AVG AS) from http://www.ewido.net/en/download/

* After downloading, double click on the file to launch the install process.
* Choose a language, click "OK" and then click "Next".
* Read the "License Agreement" and click "I Agree".
* Accept default installation path: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5, click "Next", then click "Install".
* After setup completes, click "Finish" to start the program automatically or launch AVG Anti-Spyware by double-clicking its icon on your desktop or in the system tray.
* The main "Status" menu will appear. Select "Change state" to inactivate 'Resident Shield' and 'Automatic Updates'.
* Then right click on AVG Anti-Spyware in the system tray and uncheck "Start with Windows".
* Start > Run > type in services.msc > [OK]

• Click the "Extended tab" and scroll down the list to find AVG Anti-Spyware guard.
• Scroll down to AVG Anti-Spyware 4.5 guard > Right-click on it > Properties > Startup Type > Select Manual; Status > Select Stop > OK your way out and close the Services window.

* Select the "Update" button and click "Start update". Wait until you see the "Update succesfull message. If you are having problems with the updater, manually update with the AVG Anti-Spyware Full database installer from here.
* Every scan, check that the definitions are up-to-date as the first step.

Scan with AVG Anti-Spyware as follows:

* Launch AVG Anti-Spyware, click on the "Scanner" button and choose the "Settings" tab.

• Under "How to act?", click on "Recommended actions" and choose "Quarantine" to set default action for detected malware.
• Under "How to Scan?", "Possibly unwanted software", and What to Scan?" leave all the default settings.
• Under "Reports" select "Automatically generate report after every scan" and UNcheck "Only if threats were found".

* Click the "Scan" tab to return to scanning options.
* Click "Complete System Scan" to start.
* When the scan has finished you will be presented with a list of infected objects found. Click "Apply all actions" to place the files in Quarantine.

Thanks again!! Much appreciated.

I've done a summary of what we know so far - including some off-forum discussion - incorporating considerable information from Robear and Bill. (They share the credit for everything right below, and I am alone responsible for screw-ups and misstatements! ) I thought it was good to pull it all together into one place. Comments and tweaks welcome, of course. (This is adapted from a memo I wrote for our internal IT department.)


Since early March many people worldwide are experiencing extreme slows in typing or editing or opening

1. HTML emails
2. on Outlook 2003
3. with IE7 installed
4. on Windows XP (all SP2?)

Remove any of the above factors and the problem goes away. For example, it doesn't happen if you upgrade to Outlook 2007, if you're using Windows Vista, or if you switch out of HTML.

We're zeroing in on an understanding. I wanted to pass along what we've discovered. Here is what we presently believe the problem to be:

1. Internet Explorer 7 changed the way that the Restricted Zone is implemented.
2. A heavily populated Restricted Zone will dramatically slow some functions because each entry will be checked frequently.
3. Several popular anti-malware and other security products (e.g., SpywareBlaster, SpyBot S&D, IE-SpyAd) heavily populate the Restricted Zone.
4. All Outlook versions before 2007 use IE as the rendering engine for HTML emails. (Outlook 2007 uses Word 2007 as its rendering engine for HTML emails, even if Word is not the actual composer.)
5. Therefore, every character typed in an HTML email - with the above four criteria - potentially will check thousands of Registry entries (in the Restricted Zone) for every character that is typed. (SpyBot, for example, currently adds about 3,000 items to the Restricted Zone if Immunization is turned on. Other programs may add even more.)
6. BOTTOM LINE: IE7's new way of handling Restricted Zone items, combined with programs that heavily populate the Restricted Zone will overburden HTML text processing when IE7 is used as the rendering engine. (It isn't clear whether these third party programs might be able to avert the problem by approaching IE's new Zones differently, or whether this is simply a bug in IE7. I think it is at least a design flaw in IE7, but I might eventually be proven wrong on that point.)

This analysis explains several observed behaviors, including the following:

1. Varying any of the above four criteria will solve the problem.
2. Switching the composer to Word (usually not recommended) will solve the problem - because IE is then bypassed.
3. Clearing the Restricted Zone solves the problem until it is repopulated (as it might be automatically from some security programs).
4. Changing anything in IE7 under Tools | Internet Options | Security (even if you change it back again during the same visit to the tab), or alternately using the "Resetting IE Settings" button (Tools | Internet Options | Advanced | Reset), interrupts the problem for the current Outlook session only.

All solutions so far are work-arounds. You can use several methods to change any of the four root criteria at the top and be done with it. The easiest solution is probably to stop using HTML email! (RichText provides nearly all the same features.) Other solutions would include updating Windows to Vista or Office to 2007, or backing IE7 back to IE6 (not recommended for general users for security reasons). One also could set Word to be one's Outlook composer (not usually recommended for various nuisance reasons, but a satisfactory work-around for many people).

My friend Bill Castner has provided the following further, more technical analysis: This issue is occurring because of an unforeseen dependency between an IE6 / Windows XP SP2 security feature (Local Machine Zone Lockdown) and a new IE7 security feature designed to protect users from improper cross-domain access to their local file system. Until such time as this dependency may be corrected, we can correct it on individual machines through one of two possible workarounds. - The theory behind the workarounds is to place Outlook execution in the same, elevated, security zone as IE itself. Creating zone parity means that cross-domain vulnerability checking does not occur, among other security checks. Thus Bill's suggested fix is to create zone parity between Outlook and IE 7. Both of the following recommendations may have to be done to solve the problem (and a .REG file could easily be created as necessary to implement them):

To opt-in to Local Machine Zone Lockdown:

1. In RegEdit, find HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN
2. Click "Edit", "New", and "DWORD"
3. The name should be set to the process name of the application experiencing the problem (e.g., outlook.exe).
4. The Value (double-click on the newly created entry) should be set to "1" (this opts the process into this feature, enabling the workaround)
5. Close RedEdit. Close all open instances of Outlook and IE. Restart Outlook.

The second option is to opt-out of the new cross-domain protection feature (which blocks access to scripts on the local file system). Opting your application out of this feature leaves it vulnerable to web sites that may scan your computer looking for script files or other information. If your application is designed to host arbitrary content, this option is not recommended.

• In RegEdit, find HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl
• Click "Edit", "New", and "Key"
• Enter FEATURE_BLOCK_LMZ_SCRIPT
• Next, click "Edit", "New", and "DWORD"
• The name should be set to the process name of the application experiencing the problem, in this case outlook.exe.
• The Value (double-click on the newly created entry) should be set to "0" (this opts the process out of this feature, enabling the workaround)
• Close RedEdit. Close all instances of Outlook and IE. Restart Outlook.

That is just a terrific summary of the issues to date.
Thank you.

I note only that one consequence of the use of RIES -- the "Reset Internet Explorer Settings" tool found on the Advanced tab of Internet Options -- is that it removes completely any restricted site entries that may exist. So RIES has not only the benefit of the temporary change in IE settings workaround, but eliminates the exacerbating effects of a heavily populated restrictive sites list.

The workarounds above done using the command line. If you copy and paste these into a Start, Run, command box they should appear in a single line:

"Opt-in" Workaround:
REG ADD "HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN" /v outlook.exe /t REG_DWORD /d 00000001

"Opt-out" Workaround:
REG ADD "HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT" /v outlook.exe /t REG_DWORD /d 00000000

<<<< Workarounds in .REG form >>>>

Dropping in on this thread after having spent several days helping to resolve another IE issue, one directly associated with MS07-027/931678 and user having changed the location of Temporary Internet File folder.

The behavior's seen in Outlook 2002/XP as well as Outlook 2003.

Bill's found posts about the behavior in IE General newsgroup dating back to Dec-06 and earlier.

For more on what RIES does and doesn't do, see this KB article:

How to use Reset Internet Explorer Settings (RIES):
http://support.microsoft.com/kb/923737

Here's a very simple workaround: start Outlook with "Outlook Today" as the start page rather than the Inbox. Works for us.

The4Bs workaround really works a treat. No need to fumble with registers, etc. But why does this work??????

Hi all,

i have joined this thread, too ..

I run in this issue a few days ago and after long,long searching i found this thread.

The ONLY fix that worked for me was to set Outlook 2003 to start with the "Outlook Today"-Page.

This is really odd, also i dont understand why this works. (??)

My System is:

Windows XP SP2, Office+Outlook 2003, IE7 (installed a few WEEKS ago)
All Patches which where available from Microsoft Update (incl. Office) was installed.

Do you guys have any news about that issue? Is there another fix available?

Thanks to all for your posts.

Greetings from Germany
Darksun777

No. Last word from the IE team was that they're "looking into it".

Other than what's already been posted in this thread, no, not that I'm aware of.

Stickied.

I was hit hard by this problem and did not like the work arounds so have been failing to install one or two Microsoft update files, in order to avoid the problem. Perhaps this is risky.

I am confused by the last post, which says "stickied", which I assume means made sticky, and that is why I find it here. Also, the topic says DONE. Does that mean this is closed? Will anyone advise us when Microsoft actually fixes the problem, or have they already?

Thanks!
Dean