Table of Contents
Protect Against Viruses with the Outlook E-mail Security Update
Outlook 2000 Update: E-Mail Security
Outlook 98 Update: E-Mail Security
Outlook E-mail Security Update Frequently Asked Questions
File Types Impacted by the Outlook 98/2000 E-mail Security Update
Add a File Type to the Outlook 98/2000 E-mail Security List
Functionality Impacted by Outlook 98/2000 E-mail Security Update
ISVs Affected by Outlook 98/2000 E-mail Security Update
Outlook E-mail Security Update Information for Organizations and Developers
Changes to Outlook Automation in the Outlook E-mail Security Update
Protect Against Viruses with the Outlook E-mail Security Update
The Outlook® E-mail Security Update is in development. Please check back to this page for updates to this information, including the update itself when it is completed. Add this page to your Favorites or bookmark it so you can return here often. Or, you can subscribe to the Microsoft Office Auto Update Notification service and be notified by e-mail when this page is updated.
Since it is common to send files as attachments, users have been deceived into opening files disguised as friendly e-mail attachments. Malicious hackers have used the method of opening e-mail attachments directly from within Outlook as a way to trick users into spreading viruses. Viruses that spread through e-mail do so by using the Contacts list and Address Book in Outlook. By using Outlook automation (by means of the extensible object model in Outlook), the virus forwards itself to all your contacts without your knowledge.
In the case of the recent ILOVEYOU and Melissa viruses, malicious hackers have abused legitimate Outlook functionality, such as the ability to share documents quickly and easily with co-workers and update your contact list seamlessly between your palm-held device and your computer. Since Outlook cannot distinguish between "friendly" and "malicious" uses, Microsoft has introduced a significant security enhancement for Outlook 98 and Outlook 2000. The Outlook 2000 E-mail Security Update and the Outlook 98 E-mail Security Update provide protection from most viruses, such as the ILOVEYOU and Melissa viruses, as well as other viruses that spread through e-mail, or worm viruses that can replicate through Outlook. The Outlook 98/2000 E-mail Security Update puts you back in control of your software. Once you have installed the update, mail is not sent on your behalf without your permission, and you are protected from accidentally opening attached files that pose a security risk to your computer.
This update limits certain functionality in Outlook to provide a higher level of security; it was not created to address a security vulnerability within Outlook. The update provides unprecedented security protection for Outlook and Microsoft encourages that all users of Outlook 2000 and Outlook 98 install this update.
Three ways to protect you from e-mail viruses
The security update protects you from e-mail viruses in three ways:
- E-mail attachment security prevents users from accessing several file types when sent as e-mail attachments. Impacted file types include executables, batch files and other file types that contain executable code often used by malicious hackers to spread viruses.
- Object Model Guard prompts customers with a dialog box when an external program attempts to access their Outlook address book or send e-mail on their behalf, which is how insidious viruses such as ILOVEYOU spread.
- Heightened Outlook default security settings increase the default Internet security zone setting within Outlook from "Internet" to "Restricted Sites." In addition, active scripting within restricted sites is disabled by default.
Certain functionality in Office may be impacted by this update. You should read Functionality Impacted by Outlook 98/2000 E-mail Security Update for more information before installing the update.
Organization and system administrators should see Outlook E-mail Security Update Information for Organizations and Developers for information on how to customize options within this update.
Functionality in other products may be impacted as well. Presently Microsoft is working closely with many of these vendors to evaluate the impact of the Outlook E-mail Security Update on their products. For a list of vendors whose software may be impacted, read ISVs Affected by Outlook 98/2000 E-mail Security Update.
Since access to certain file attachments in Outlook is restricted by the update, users will need an alternate method for distributing files, such as a file shares, intranets, online hard drives, or community Web sites (such as MSN Online File Cabinets). For a list of file types impacted by this update, read File Types Impacted by the Outlook 98/2000 E-mail Security Update.
Keep in mind that in addition to installing the Outlook E-mail Security Update, you can help prevent an e-mail worm virus from spreading by always using high-quality anti-virus scanning software and deleting any e-mail message containing a questionable attachment before the attachment is opened. To determine if the message contains a non-malicious attachment, contact the person who sent the message.
Note The Outlook 2000 E-mail Security Update requires that you first install Office 2000 Service Release 1a (SR-1a).
Types of attachments that are restricted
When you install the Outlook 98/2000 E-mail Security Update, Outlook checks the file type of each attachment received in your Inbox. Outlook compares the type of file against two different lists of file types Level 1 security file types and Level 2 security file types. Access to Level 1 security file types is restricted since they can execute programs or code, or links to programs that could execute a virus on your computer. Access to Level 2 security file types is not restricted, however you must save them to your hard disk drive. Files that are not on these lists are not restricted.
Level 1 security files Level 1 security files (restricted access in Outlook) are files that may contain executable code themselves, or they may contain links to other files that contain executable code that could execute a virus on your computer. Level 1 file types include program files (.EXEs, .COMs), script modules and files (.BASs, .VBSs, .JSs), Internet links (URLs, .ISNs), and shortcuts to files (.LNKs, .PIFs). For a list of Level 1 security file types, read File Types Impacted by the Outlook 98/2000 E-mail Security Update.
Level 2 security files File types on the Level 2 security list must be saved to disk before they can be opened; the files cannot be opened directly from within Outlook. There are no files types on the Level 2 security list by default, but file types can be added to the list by system administrators.
The Level 1 and Level 2 file types can be customized by organzations that use Microsoft Exchange Server. However, other file types can be added to these lists. For more information, read Outlook E-mail Security Update Information for Organizations and Developers or Add a File Type to the Outlook 98/2000 E-mail Security List.
What happens when I receive mail with an attachment?
A message with a Level 1 attachment If you receive a message that contains a Level 1 file as an attachment, your Inbox will display the paperclip in the attachment column to let you know that the message originally contained an attachment. When you open the message, the attachment will not be available and the following will be displayed at the top of the message:
Also, Save Attachments on the File menu and View Attachments on the shortcut menu will not be available for this message.
A message with a Level 1 attachment and a safe attachment If you receive a message with two attachments, one of which is on the Level 1 security list, then only the safe attachment will be available. Access to the attachment that is part of the Level 1 security list will be restricted. When you open the message, you will see the same message as above, but you will also have the safe attachment in the message. Save Attachments and View Attachments can be used for the safe attachment.
A message with a Level 2 attachment If you receive a message containing a Level 2 file as an attachment, the following warning is displayed if you try to open the attachment.
What if I try to send a message with an attachment that is restricted?
When you attach a file to e-mail, the update checks the file type when you send the message. If the file is either a Level 1 or Level 2 file, you will be warned that other Outlook users may not be able to open the attachment:
If you click Yes, the message is sent with the attachment; if other users have this update installed, the attachment will be deleted. If you click No, the message will be returned to you for editing, which will involve removal of the attachment.
How Outlook automation code is restricted
The Outlook E-mail Security Update for Outlook 2000 and Outlook 98 changes the behavior of some Outlook automation functionality. Since viruses can spread by sending copies of e-mail messages to people listed in your Address Book, programs cannot automatically access your Address Book or Contacts list, nor can they send messages without your approval. These changes will ensure that Outlook can't be used to distribute e-mail without your permission.
For example, if code attempts to access your Address Book in Outlook, a warning appears. You can either allow the program access for this instance, or you can select the Allow access for checkbox and specify an amount of time up to 10 minutes. If you do not want the program to access your Address Book, click No.
For more information about changes to automation in Outlook, read Changes to Outlook Automation in the E-mail Security Patch.
Outlook security settings are set to Restricted Sites by default
Default security zone settings are set to Restricted Sites (rather than Internet) by default, and active scripting within Restricted sites is disabled by default, when this update is installed. For more information on the difference between these two zones, see the Microsoft Knowledge Base article (Q174360) How to Use Security Zones in Internet Explorer. You can change your Outlook security settings manually; on the Tools menu, click Options and then click the Security tab.More information
For additional information about the ILOVEYOU virus, read Information on the VBS/Loveletter Virus.
If you are using Outlook 2000, the Knowledge Base article (Q262701) OL2000: Developer Information About the E-mail Security Patch contains additional information about Outlook automation. For Outlook 98 users, read the Knowledge Base article (Q262700) OL98: Developer Information About the E-mail Security Patch.
For additional information about software security, take a look at the Office Update Security and Microsoft Office Focus.
For more information, type e-mail security in the Office Assistant or on the Answer Wizard tab in the Outlook 2000/98 Help window, and then click Search.
For troubleshooting information about the Outlook E-mail Security Update, type troubleshoot e-mail security in the Office Assistant or on the Answer Wizard tab in the Outlook 2000/98 Help window, and then click Search.
All rights reserved. Terms of use. Disclaimer.