Viruses can involve current versions of Microsoft Outlook in only one way: A user open a virus-infected attachment received via an Outlook e-mail message.

Because this is the most common way viruses spread, many system administrators block certain attachments at the server or use the Outlook Email Security Update to block such attachments at the client.

In the past, viruses took advantage of Outlook's programming capability and weak security and used automation to propagate. This is no longer possible, thanks to Outlook's security features. Users need to "do something" to infect their computer by email.

Beginning with the Outlook 2000 post-SP1 security update, it's unlikely that anyone will be affected by the HTML vulnerabilities  or viruses that use the address book to propagate. While older versions of Outlook are still in use, virus writers moved on and found newer and better ways to infect computers. In most cases, they use some form of social engineering to convince users to open attachments which then install the virus.

These exploits are not limited to Outlook users - anyone who uses email is at risk from these new viruses - and any that viruses that collect addresses from your computer are more likely to get the addresses from a compromised web-based email account or social media account, not Outlook's address book.

The best way to avoid a virus infection is to think before opening attachments: if the email message doesn't make sense, don't open the attachment.

One time, long, long ago, Outlook's preview pane was insecure but it's now slightly more secure than opening a message to read it. In either case, thanks to Outlook's inability to use "active content" it's safe to read mail in either the reading pane or an opened message.

This page provides information on how to protect your computer from Outlook-related viruses. While the tips target Outlook, many of the tips apply to any email client.

Outlook Client Protection

To protect your machine from becoming infected with a virus received via Microsoft Outlook, you should:

Install the latest service packs and updates for your version of Outlook

Update Outlook, Internet Explorer, other web browsers, and other Windows components

Tighten e-mail attachment security

• Block additional file types by adding extensions to the Level1Add key.
• If you use both Outlook 2000 and Word 2000, install the Word 2000 SR-1 Update Mail Command Security to block possible unauthorized sending of messages through the plain text or HTML WordMail or "Office envelope" feature.
• If you use Outlook 2000, install the Microsoft Outlook CDO Security Update to apply the same level of security to the Collaboration Data Objects programming interface.
• If you use Outlook 98 and need to restore CDO for use by forms or applications, install the Microsoft Outlook CDO Security Update.
• Block .eml attachments. See Outlook Does Not Restrict Access to EML Attachments.Consider installing the Outlook E-mail Security Update. We do not recommend this patch for all systems. Do not install it unless you read the documentation and understand what it will do to your add-ins. If you install the Outlook E-mail Security Update, you may also want to install these updates that depend on it:

See Scanning for File Attachments for more ideas on tightening e-mail attachment security.

Practice good anti-virus safety

• Never open a file attachment that you did not expect to receive.
• Install an anti-virus program, keep it updated and scan all attached files before opening them. Remember that an anti-virus program may not protect you against the very latest viruses. It may only be as good as your last update.

Other optional protection ideas

• You may want to tighten the ability of Windows Script Host to run scripts on your system.
• You can use VBA code in Outlook 2000 or 2002 to convert all incoming HTML messages to either rich text or plain text. See To convert incoming HTML messages to Outlook Rich Text or plain text format.
• Configure Outlook 2003 to display all messages in plain text. Tools, Options, Preferences, E-mail Options and check the box to Read all standard mail in plain text.
• Use the Microsoft Personal Security Advisor to check for issues with permissions, hotfixes and other possible security vulnerabilities.

Scanning for File Attachments

Instead of blocking certain file attachments, you may want to look at these methods of controlling what happens to attachments.

• The Outlook Rules Wizard (and other automatic processing tools) can move all messages containing file attachments for a separate folder for later review.
• With Outlook 2000, you can write code to move incoming messages containing file attachments with certain extensions (.vbs, .exe, etc.) to a separate folder for later review. See To quarantine application file attachments with Microsoft Outlook 2000 VBA for sample code.

Also, make sure you know what type of file is actually attached. Some viruses use a double file extension, such as .jpg.vbs. If Windows is set not to show the extension for known file types, the recipient will see the attachment listed as a harmless .jpg file, not a potentially dangerous .vbs file. The solution is to use Tools | Folder Options or View | Options, depending on your Windows version, to change the setting to show extensions for all files.

Confirming File Transmissions

If you are concerned about viruses that use Outlook to propagate, you may want to require confirmation of all outgoing messages that contain file attachments. For a code sample, see To require confirmation when sending file attachments (Microsoft Outlook 2000 VBA)

Another approach is to set up Outlook not to send mail automatically. For Exchange Server users, this means setting up offline folders, working offline and synchronizing periodically. For Internet mail users, the exact settings depends on your version of Outlook, mode and Internet connection type, but you'll generally find the right options in Tools | Services, Tools | Accounts or Tools | Options.

Note, however, that the latest viruses include their own SMTP engine for sending mail, so these techniques may not actually block virus propagation.