HTTP compression in IE
Discussion
Ok, i've spent far too long surfing for this one .. wondered if anyone here had the answer.
A friend is experiencing crap browsing performance with IE. Turns out that some ad- or mal- ware has screwed up his IE settings so that it now no longer spits out the:
Accept-Encoding: gzip, deflate
in the headers that it should. Consequently some websites are taking absolutely ages to download and display.
I can find out how to affect/change the browser User-Agent string in the registry, but no sign of any compression settings which may have been reset.
Any ideas? Muchos gracias!
A friend is experiencing crap browsing performance with IE. Turns out that some ad- or mal- ware has screwed up his IE settings so that it now no longer spits out the:
Accept-Encoding: gzip, deflate
in the headers that it should. Consequently some websites are taking absolutely ages to download and display.
I can find out how to affect/change the browser User-Agent string in the registry, but no sign of any compression settings which may have been reset.
Any ideas? Muchos gracias!
Hi,
I've done a bit of work on this in the past.
Check out Tools->Internet Options -> Advanced, scroll down and make sure use HTTP 1.1 is enabled.
In the registry its at:
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings]
"EnableHttp1_1"=dword:00000001
There are various other settings located in the registry for this too.
If he's using an HTTP proxy server that changes a few things. Also if he's using dialup modem connection, IE stores these settings differently for each dialup connection.
IF the above doesn't work let me know what the connection setup is, IE version and OS and I should be able to start offering a few other things to look at.
best
Ex
>> Edited by TheExcession on Monday 20th September 13:35
I've done a bit of work on this in the past.
Check out Tools->Internet Options -> Advanced, scroll down and make sure use HTTP 1.1 is enabled.
In the registry its at:
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings]
"EnableHttp1_1"=dword:00000001
There are various other settings located in the registry for this too.
If he's using an HTTP proxy server that changes a few things. Also if he's using dialup modem connection, IE stores these settings differently for each dialup connection.
IF the above doesn't work let me know what the connection setup is, IE version and OS and I should be able to start offering a few other things to look at.
best
Ex
>> Edited by TheExcession on Monday 20th September 13:35
Adrian,
Thanks for the reply! The setting you mention is set to 1 in the registry unfortunately. So must be something else.
It's a WinXP machine, using IE 6 (not sure of the exact version) and he's connecting using a LAN, no proxy, then ADSL router out to the internet.
If you have any more things to look for, or try, that would be really helpful!
Cheers,
Marc
Thanks for the reply! The setting you mention is set to 1 in the registry unfortunately. So must be something else.
It's a WinXP machine, using IE 6 (not sure of the exact version) and he's connecting using a LAN, no proxy, then ADSL router out to the internet.
If you have any more things to look for, or try, that would be really helpful!
Cheers,
Marc
hmmm, well I'm a bit short on ideas now - that registry entry should have sorted it.
Take you did a reboot after applying the change.
What are you using to determine that the header is missing? Ethereal? - If so perhaps you could mail me a trace of him accessing the home page of PistonHeads.
best
Ex
Take you did a reboot after applying the change.
What are you using to determine that the header is missing? Ethereal? - If so perhaps you could mail me a trace of him accessing the home page of PistonHeads.
best
Ex
I didn't have to reboot - the value was already set to 1. 
Yes, I used Ethereal (what a fantastic program that is, btw). But I don't have the trace now - I have to swap from wireless to wired, and connect to the router that he's connected to
What you'll see is a full set of headers from IE; the user-agent header had been modified a little, but I found the setting in the registry to revert that back to normal. And the accept-encoding header looks like this:
So there are a load of spaces where the "gzip,deflate" options should be ...
Any use?
Cheers,
Marc
ps. One thing I must admit that I didn't do was un-set and re-set the setting in IE options. I'll do that now and get back to you.
pps. I also checked the version of urlmon.dll - it's exactly the same as on my machine and is identical. Thought the accept-encoding header might be hardcoded in there.
Yes, I used Ethereal (what a fantastic program that is, btw). But I don't have the trace now - I have to swap from wireless to wired, and connect to the router that he's connected to
What you'll see is a full set of headers from IE; the user-agent header had been modified a little, but I found the setting in the registry to revert that back to normal. And the accept-encoding header looks like this:
Ethereal said:
Accept-Encoding:
So there are a load of spaces where the "gzip,deflate" options should be ...
Any use?
Cheers,
Marc
ps. One thing I must admit that I didn't do was un-set and re-set the setting in IE options. I'll do that now and get back to you.
pps. I also checked the version of urlmon.dll - it's exactly the same as on my machine and is identical. Thought the accept-encoding header might be hardcoded in there.
futie said:
I didn't have to reboot - the value was already set to 1.
Yes, I used Ethereal (what a fantastic program that is, btw). But I don't have the trace now - I have to swap from wireless to wired, and connect to the router that he's connected to
What you'll see is a full set of headers from IE; the user-agent header had been modified a little, but I found the setting in the registry to revert that back to normal. And the accept-encoding header looks like this:
Ethereal said:
Accept-Encoding:
So there are a load of spaces where the "gzip,deflate" options should be ...
Any use?
Cheers,
Marc
ps. One thing I must admit that I didn't do was un-set and re-set the setting in IE options. I'll do that now and get back to you.
pps. I also checked the version of urlmon.dll - it's exactly the same as on my machine and is identical. Thought the accept-encoding header might be hardcoded in there.
Hi Marc - yup Ethereal rocks - you should try writing your own disectors sometime - we have and use it to decode our satellite protocols where they appear on Ethernet in our systems - it's utterly brilliant.
Now back to the problem - I just did a bit of testing and interestingly if I disable HTTP1.1 in my browser settings then the Accept-Encoding HTTP header completly disappears from the request.
So the fact you are getting a blank string is well strange - init
Trying to look into this a bit more I did a search through my system32 folder for any files containing the text 'deflate'.
Give the following files a quick check:
dxdiagn.dll
javart.dll
URLMON.DLL
vsinit.dll
vsutil.dll
WININET.DLL
&
vsmon.exe - a zone alarm file
&
a load of MFC files that I don't think are important.
From what you have described this certainly looks like some cheeky monkey has blanked out this string in a dll somewhere - this would certainly be appropriate for some pay per bit service where you wanted your customers to run an uncompressed stream.
I'd offer the the file size and date of these dll's but there seems no point as the files size won't be changed (if spaces have been written in) and likely the file has been 'touched' after the modification so the date appears the same.
The list above are certain candidates for you to replace with known good versions from a working machine.
Rememeber to reboot after any mods to URLMON and WININET, these are held in the dll cache. Also do the file search again after the reboot to ensure the updated files haven't been compromised again and you can see the 'deflate' string in the file.
Great stuff! Let me know how you get on.
best
Ex
>> Edited by TheExcession on Wednesday 22 September 21:51
It's me again 
Well we've looked at all the files you mentioned - of all the ones which exist on the client PC (the zonealarm files don't exist) they are all identical! Even wininet.dll contains the string: gzip, deflate!
So i'm still stumped.
Any more bright ideas? The machine certainly has had some ad/mal-ware on it in the past, but is clean now. Also Norton internet security is running, but we've tried turning that off. I've also re-registered a few of the IE dlls.
Well we've looked at all the files you mentioned - of all the ones which exist on the client PC (the zonealarm files don't exist) they are all identical! Even wininet.dll contains the string: gzip, deflate!
So i'm still stumped.
Ethereal said:
GET /Default.aspx?ec=lex&id=3e720435810f47db97362b9819e47dc8&sp=0 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-gb
Accept-Encoding:
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: www.sitememory.com
Connection: Keep-Alive
Cookie: smuid=**removed**
Any more bright ideas? The machine certainly has had some ad/mal-ware on it in the past, but is clean now. Also Norton internet security is running, but we've tried turning that off. I've also re-registered a few of the IE dlls.
Right, we're gonna need 2 pounds of semtex, some detonators.....
Last resort I can think of is using regmon, to track access to the registry at the point of IE starting up, and/or at the point of going to the site using http compression (actually, any site would do wouldn't it).
It's going to be very time consuming, but I can't think of any other way of doing it.
Something has got to be different between the 2 machines, and my bet is on the registry.
I've heard of this problem a few times, and I don't remember anyone actually sorting it, they either rebuilt the machine or lived with it.
Last resort I can think of is using regmon, to track access to the registry at the point of IE starting up, and/or at the point of going to the site using http compression (actually, any site would do wouldn't it).
It's going to be very time consuming, but I can't think of any other way of doing it.
Something has got to be different between the 2 machines, and my bet is on the registry.
I've heard of this problem a few times, and I don't remember anyone actually sorting it, they either rebuilt the machine or lived with it.
squirrelz said:Yeah - I think a rebuild is the only other alternative, but our thoughts are: if we've found this problem, maybe someone else has it too, and so if we can sort it, then it's not just better for us, but better for anyone who has poor performance accessing our site.
I've heard of this problem a few times, and I don't remember anyone actually sorting it, they either rebuilt the machine or lived with it.
Ok, will get regmon and do some tracing - wish me luck!
Oh, and ps - thanks v. much for the help!
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff