Attachment Security Update for Microsoft Outlook

Click here to subscribe
to our biweekly
EMO newsletter
EMO back issues

Attachment Security Update

The Outlook E-mail Attachment Security Update changes the way Outlook handles attached program files (.exe, .com, .bat, .cmd) and other potentially dangerous files when you try to open them from inside a mail message. The idea is to make it harder for viruses such as Worm.ExploreZip Virus to get through.

This patch is once again available for Outlook 98. We asked and Microsoft responded! Now Outlook 98 users once again have two choices -- this Attachment Security Update or the much more stringent Outlook E-mail Security Update.

Note, however, that the versions of this patch for Outlook 97 and Outlook 98 does not provide protection against careless opening of VBScript .vbs files such as those use by the VBS/LoveLetter virus and its variants. It protects only against .exe, .com, .url, .lnk, .zip, .bat, .pif, .inf, .reg, .cmd, .bas, .isp, .ins, .crt, .pcd, .mst, .scr, .hlp, or .chm files.

The version included with Office 2000 Service Release 1/1a (SR1) increases attachment security to protect against running .vbs or .cpl files from an Outlook mail message. You can also customize it to protect against careless opening of any type of file -- such as the Shell Scrap Object .shs files used to propagate the Stages virus.

Availability and Setup | Usage | More Information

Availability and Setup

To patch Outlook 2000 for attachment security, install Office Service Release 1/1a (SR1).

For Outlook 98, download the Outlook 98 version, quit Outlook, and then run the file that you downloaded.

For Outlook 97, download the Outlook 97 version, quit Outlook, and then run the file that you downloaded.

After installing the patch, you should check your attachment security setting:

Choose Tools | Options, and switch to the Security tab.
On the Security tab, click Attachment Security.
Make sure that the Security method is set to High.
Click OK until you return to Outlook's main window.

If you install a later patch for Outlook 2000 that does not include the components of the Outlook E-mail Security Update, the Attachment Security button may be missing. See OL2000 The Attachment Security Button Is Missing for a fix.

Usage

With the Attachment Security Update installed, when you open a program file or other protected file attached to an e-mail message, Outlook displays a dialog like this:

With the update installed, you do not have the option of running a program file directly. You must save it to disk before you can run it.

In the Outlook 2000 SR1 version, you can bring more file types under this protection. See XCLN How to Modify the Behavior of the Attachment Security Warning in Outlook 2000 SR-1 for details on the required changes to the Windows Registry.

More Information

Protecting Microsoft Outlook against Viruses

Viruses Affecting Microsoft Outlook

Anti-virus Tools

Outlook E-mail Attachment Security Update

OL2000 To Protect Against Virus Infection from Messages Received with Attachments

OL2000 Cannot Add or Remove File Types Affected by Security Patch -- List of file types blocked from direct opening in Outlook 2000 Service Release 1

OL2000 Attachment Security Features Included in Service Release 1

Updated Apr 07 2008