Replies

Bundaburra,
Thanks for the suggestion. I am surprised that EMET would allow duplicate entries for the same program. It must be confusing. At present, everything seems to be working OK. However, I think I will remove the second OUTLOOK.EXE entry (the non-bold one at the bottom of the list) and see how that goes.

I am still trying to understand why this has suddenly happened, apparently out of the blue. But here is what I am wondering: I first installed EMET (2.0) in January 2011 and upgraded through several versions to 5.0 in September 2014. My PC at the time died in December that year; it was replaced, but EMET was not immediately installed (it was overlooked). Eventually I discovered the omission and installed version 5.5 in February this year. I don’t remember the last time that I went into the Outlook Rules Wizard, but it is possible that last week was the first time since version 5.5 was installed. Perhaps the previous versions (up to 5.0) that were installed on the old machine did not have this conflict with Rules Wizard, and I didn’t discover the change with the new version until I actually had to review one of the Outlook rules.

Anyway, as long as it works OK with EAF unchecked for Outlook (and the duplicate entry deleted), I am satisfied.

Thanks again.

Dell Precision 3630 w/32 GB RAM, 500 GB (C:), 1 TB (D:)
Window 10 Pro x64
Internet: FTTC (Fibre to the Kerb)

Joe,
Thank you for your response.
Yes, I do have the current version of EMET (5.5). I even downloaded a fresh copy and confirmed the version and even the build number were the same.

In further testing, I noted a Sys Tray notification from EMET when Outlook crashed. The message said: “EMET detected EAF mitigation and will close the application: Outlook”.

It has been quite a while since I installed EMET, and I don’t remember all the things that it checks. It is going to take a while for me to set aside time to read through the user manual to bring myself back up to date.

In short, I am not sure what EAF mitigation is at present. As per your suggestion, I tried to disable EMET temporarily, but couldn’t determine how to do this. However, I did stop the “Microsoft EMET Service” (via WinPatrol). Doing this stopped the above EMET message appearing in the notification area, but didn’t stop Outlook from crashing when opening the Rules Wizard.

On the EMET main window/control panel, this is a list of “Running Processes”. The list is fairly long. The list has a column “Running EMET”. For all running processes (notably excepting OUTLOOK), this field is blank. For OUTLOOK, the field has a green circle with a white tick/check mark. Right-clicking the OUTLOOK.EXE row and clicking on “Configure Process…” firstly displays an error dialog: ‘ “C:Program Files (x86)Microsoft OfficeOffice14OUTLOOK.EXE” conflicts with existing entry for “C:Program Files (x86)Microsoft OfficeOffice14OUTLOOK.EXE” ‘. Huhn?? Anyway, clicking OK (only button) opens a window “Application Configuration”. This window contains a table of check boxes with program names (in bold) in the leftmost column. The remaining columns have check boxes for DEP, SEHOP, NullPage, HeapSpray, EAF, etc. In the case of EAF, it was checked for all applications in the list. So I unchecked it for OUTLOOK.EXE and pressed OK. Closed Outlook and started all over again. Still crashed in Rules Wizard.

Going back into the Application Configuration window to check that EAF was still unchecked (it was), I noticed at the bottom row of the list was a SECOND entry for OUTLOOK.EXE and its EAF box was still checked. Also, the name OUTLOOK.EXE was not in bold (every other application was in bold, including the original OUTLOOK.EXE entry that I had unchecked). Not sure why there are two entries for OUTLOOK.EXE or why the second one is not in bold, but I unchecked EAF in the second one (so now both entries have EAF unchecked). OK’d the window again, closed and restarted Outlook and re-opened the Rules Wizard. This time it didn’t crash!

So I am not sure what is going on here. Why two entries for OUTLOOK.EXE and why is one not in bold, unlike all the other entries? Is it safe to leave EAF unchecked (ie, what safety feature have I turned off)? There is a big red cross button at the top of the Application Configuration window labelled “Remove Selected”, so I suppose that I could remove one of the OUTLOOK.EXE entries (probably the unbolded entry at the bottom of the list). There is also an “Add Application” button at the top of this window, so it appears that the user can add other applications. Maybe the second OUTLOOK.EXE was added (whereas the bold entries were included automatically). However, I do not recall ever seeing the Application Configuration Configuration window before, so I am sure that I did not add a second OUTLOOK.EXE manually (and I am the only user of this PC).

So in summary, the problem appears to be resolved – but I am not sure how the problem occurred, nor what the problem really was. I will have to bone up on the features of EMET to get a better insight. If anyone has any suggestions, please feel free to comment here.

Cheers.

Dell Precision 3630 w/32 GB RAM, 500 GB (C:), 1 TB (D:)
Window 10 Pro x64
Internet: FTTC (Fibre to the Kerb)

Good find! That warning message used to bug me back when I used to use older versions of IE – didn’t realise that you could turn it off. Anyway, I have unchecked the option, so if it was causing me any problems in Outlook it won’t now! Thanks.

Dell Precision 3630 w/32 GB RAM, 500 GB (C:), 1 TB (D:)
Window 10 Pro x64
Internet: FTTC (Fibre to the Kerb)

Pete – as a follow up to that: If you want to have a script like that run completely in the background, with no screen interaction, set the scheduled task to be run by a different user who does not log on.

Great idea! I will keep your suggestion in mind for when I need a background task.

I agree with you about leaving the option unchecked and not using IE for browsing (I use Firefox). But shouldn’t Firefox and other browsers have the same protection available? The Outlook problem highlights the interactions and dependencies between various MS products, some of which we probably don’t even know about, but who knows if settings in IE can also affect other products such as Firefox?

I have always understood that Firefox is completely independent of Internet Explorer. Similarly Chrome. Outlook and IE are both MS products so it seems natural that they should both use common code to process HTML.

And it raises another question: if you want to see the linked images in an Outlook message, is that a security risk? (I do like the word “problematic”.)

It possibly is. That is why, by default, images are not automatically displayed in an Outlook message unless you have specifically asked for pictures to be downloaded and displayed, or have whitelisted the sender or the site in one of several ways. This applies to both “http:” and “https:” images. At least that is my understanding.

Dell Precision 3630 w/32 GB RAM, 500 GB (C:), 1 TB (D:)
Window 10 Pro x64
Internet: FTTC (Fibre to the Kerb)

Bundaburra – It’s problematic. A case of one size does not fit all. As you pointed out, in the same article Fred Langa mentions that checking this option will cause problems downloading protected files.

Going back even further, Susan Bradley (January 26, 2012 – Top Story) recommends unchecking the option to allow protected PDFs to download. This was for an older version of IE, but apparently still applies to IE11. She also links to a MS Support article 2549423 which says much the same thing. Apparently the default setting is UNchecked (why mine was checked I don’t know – possibly it was set by a patch, or maybe I set it after reading the Langa article and forgot about it).

In any case, it seems that a lot of functionality is unavailable with the option checked, but there is a potential security hole if it is UNchecked. Fortunately, the latter seems to be a problem only if/when you use IE as a browser (which I don’t unless MS forces me to). So I think I am pretty safe leaving it unchecked. However, I like your workaround, and have saved your script for possible future use. Thanks.

Dell Precision 3630 w/32 GB RAM, 500 GB (C:), 1 TB (D:)
Window 10 Pro x64
Internet: FTTC (Fibre to the Kerb)

John, it certainly sounds like the same problem I had. Resetting the whole of IE probably unchecked the “Do not save encrypted pages to disk” option (among many other things). A kind of shotgun approach! Unchecking this flag is what fixed it for me.

Thanks for your comment.

Dell Precision 3630 w/32 GB RAM, 500 GB (C:), 1 TB (D:)
Window 10 Pro x64
Internet: FTTC (Fibre to the Kerb)

Thanks Bundaburra for your comments. I had cleared the TIF folder early on as it was one of the suggested actions I found in my original research. I just checked it again – there were now 72 files (all cookies) for a total of 21.5 MB. My “Disk space to use” is also set to the default 250 MB. So it was less than 10% full. Anyway, I have cleared it again.

Doesn’t TIF cache ALL downloaded URLs? In my case it was only encrypted images (with “https:” prefix) that failed to display. If the TIF folder was full (250 MB) I would have expected that ALL images would have failed to display. In any case, unchecking the Advanced option “Do not save encrypted pages to disk” did the trick. Although this seems a bit counterintuitive – unchecking would cause encrypted images to be saved in TIF, eventually tending to fill it up. Obviously I don’t understand how this option is used.

Dell Precision 3630 w/32 GB RAM, 500 GB (C:), 1 TB (D:)
Window 10 Pro x64
Internet: FTTC (Fibre to the Kerb)

Thanks for the Slipstick link. Scanning down the page, the heading “Encrypted page setting” caught my eye because only images with “https:” fail to display. I examined the Advanced IE Internet option “Do not save encrypted pages to disk” and saw that it was checked. I unchecked it and immediately the encrypted Outlook images started displaying again.

I never use IE as a browser and had never seen this option before. I can only assume that it was set by a recent Cumulative Security Update to IE. Either that or the space allocated by default to saving encrypted pages (wherever that is) finally filled up after 18 months of using this PC.

Dell Precision 3630 w/32 GB RAM, 500 GB (C:), 1 TB (D:)
Window 10 Pro x64
Internet: FTTC (Fibre to the Kerb)

Has been about two days now with no problems (touch wood!). Appears that it may have been a problem with the original server I was using.

I was aware of the timeout setting. Early on I progressively set it for longer periods, right out to two minutes. Unfortunately it does not seem to retry the login during that period, but just waits in vain for a response to the original attempt. All that does is just delay the appearance of the pop-up :^_^:.

Dell Precision 3630 w/32 GB RAM, 500 GB (C:), 1 TB (D:)
Window 10 Pro x64
Internet: FTTC (Fibre to the Kerb)

I have successfully tested setting up an Outlook account to send (SMTP) but not receive (POP3). Instead, the webmail account concerned is set to forward to another email address.

Thanks for showing me how to do this.

Cheers,
Pete.

Dell Precision 3630 w/32 GB RAM, 500 GB (C:), 1 TB (D:)
Window 10 Pro x64
Internet: FTTC (Fibre to the Kerb)

Have set up both Yahoo accounts using: pop.mail.yahoo.com.AU and smtp.mail.yahoo.com.AU.

Both seem to work OK. Will let them “soak” for a day or so and see if I still get the timeouts.

Pete.

Dell Precision 3630 w/32 GB RAM, 500 GB (C:), 1 TB (D:)
Window 10 Pro x64
Internet: FTTC (Fibre to the Kerb)

Thanks, I didn’t know that. I will try “pop.mail.yahoo.com.au” and see if it makes any improvement.

Dell Precision 3630 w/32 GB RAM, 500 GB (C:), 1 TB (D:)
Window 10 Pro x64
Internet: FTTC (Fibre to the Kerb)

The servers for the two domains seem to be different, so it may indeed matter whether you use one or the other. Have you tried a quick contact with yahoo’s tech support?

The POP server is “pop.mail.yahoo.com” which does not seem to be specific to the AU domain.

I couldn’t find Yahoo tech support when I first looked for it, but I will look again. Anyway, my understanding is that there was no support for a free service.

Dell Precision 3630 w/32 GB RAM, 500 GB (C:), 1 TB (D:)
Window 10 Pro x64
Internet: FTTC (Fibre to the Kerb)

This is just what I was looking for. I will set it all up and test it later today and report back. Many thanks for all the help.

Pete.

Dell Precision 3630 w/32 GB RAM, 500 GB (C:), 1 TB (D:)
Window 10 Pro x64
Internet: FTTC (Fibre to the Kerb)

That was also my suspicion. It has been happening so often for the last 2-3 weeks that I thought there might be another Lounger on the same server who could confirm the problem. Some additional info FWIW — my Yahoo email domain is @yahoo.com.au — don’t know if this would be significant.

Thanks for your quick response! And the welcome.

Dell Precision 3630 w/32 GB RAM, 500 GB (C:), 1 TB (D:)
Window 10 Pro x64
Internet: FTTC (Fibre to the Kerb)