Outlook Email Security Update

The Outlook Email Security Update for Outlook 98 and Outlook 2000 disables many of the features that allow viruses to spread quickly. The security update is also integrated into Office 2000 Service Pack 2. Newer versions of Outlook have the features built in, with one major change -- users can modify the list of blocked attachments.

To find out whether your copy of Outlook includes the security update, you can check the version number with the Help | About Microsoft Outlook command and compare it with this chart, which lists the versions with the security update: 

The update makes it difficult, if not impossible, to open program files in Outlook -- including VBScript .vbs files like those that spread Loveletter. It is also aimed at making it more difficult for a virus to use Outlook to transmit itself via e-mail. This aspect of the patch, however, means that some Outlook features will no longer function at all. In other cases, a user may  need to authorize access by outside programs, such as bulk mail applications.

Microsoft has provided two ways to customize the security settings:

Basic Facts and Download | Should you install this patch? | Removing the Patch | Attachment Security | Automation Security | Outlook Forms Security | Outlook Security Zone | Other Changes | Known Problems | More Information

Basic Facts and Download

Outlook 2002

Outlook 2000

Note that you must install the Office Service Release 1 update before installing the securitiy update.

Related Updates for Outlook 2000 SR-1

Outlook 98

Should you install this  patch? 

Proceed with caution. Removing the patch on Outlook 2000 is no easy matter. 

Removing the Patch

Outlook 2000

Outlook 98

Attachment Security 

Systems with the security update for Outlook 2000 and 98 or with Outlook 2002 will no longer be able to open or save the files listed below if they are attached to an Outlook message. The attachments will still be in the messages, and other programs or Outlook add-ins may be able to access them, but they will be invisible to Outlook itself. 

In addition to these "Level 1" attachments, as Microsoft calls them, the patch also supports a "Level 2" list, which warns users when they try to open a file attached to a message. End users with Outlook 2002 or Office 2000 SP3 can demote a file type from Level 1 to Level 2. Only administrators in an Exchange Server environment can customize the Level 2 list.

If you don't have Outlook 2002 or Office 2000 SP3, there are many ways to open these "dangerous" files. See Opening .exe Attachments with the Microsoft Outlook E-mail Security Patch. 

Users will also see a warning if they try to send an e-mail message that contains any Level 1 file attachment. However, the attachment is not actually stripped. If the receiving user is not running Outlook with the security patch, they will see the attachment as they normally do.

If you try to forward a message containing one of these files, even if Outlook has been customized to consider it as a Level 2 attachment (save before opening), Outlook strips the attachment from the forwarded copy. 

TIP: If you need to send a file from this list and want to avoid problems with recipients who may have installed the patch, you can simply change the file name before attaching the file -- for example, rename an .exe file to a .ex_ file -- and include instructions on how to save it and rename it in the body of your message. Or use a zip utility to compress the file. Many Compression Tools are available to work automatically from within Outlook, though probably not all will be able to grab the .exe file, given the security surrounding attachments.

Automation Security 

The "object model guard" feature of the patch imposes two extreme restrictions on automating Outlook from add-ins that use either the Outlook object model or Simple MAPI: 

The object model guard applies even if your code is digitally signed or running from a published Outlook form. The only way to turn it off is via the administrative options. Because of these restrictions, some Outlook features become virtually unusable, because of the number of times the user has to confirm the dialog boxes:

See:

To avoid the prompts in applications that you develop, you can use one of these programming interfaces:

Visit Outlookcode.com for assistance with programming issues.

Also see Reinforcing Dialog-Based Security, a paper by two U.S. Air Force Academy professors that demonstrates how to get around the object model guard prompts using VBScript code and the SendKeys method to, in effect, click the buttons on the prompts. For utilities that takes a similar approach, see:

If you get the security prompt constantly in a Defense Messaging System environment, see OL DMS 3.0 Users Receive Security Prompt When Using Outlook 2000 SR1 or Outlook 2002.

Outlook Forms Security

With the security patch in place or with Outlook 2002, this means that you should never check the Send form definition with item box on the Properties page of a message form, since this will cause the form to one-off. Instead, you should make sure that the recipient has access to the published form.

Outlook Security Zone

Other Changes

The Outlook 98 version of the patch removes the CDO (Collaboration Data Objects) component, which is often used by Outlook-related applications.

You won't be able to edit embedded objects that you receive in rich-text format messages. However, you may be able click Forward and edit the embedded object in the copy to be forwarded. See OL2002 Can't Edit an Embedded Object in Rich Text Message.

Affected Applications

Known Problems

These other problems are fixed in Office 2000 SP-2: 

More Information

If you want to provide feedback on the security update, you can write Microsoft.