What does this update do?

The Outlook E-mail Security Update is a major security enhancement for Outlook 2000 and Outlook 98. It will guard against most viruses that are spread via e-mail attachments (such as the Goner, ILOVEYOU, and Melissa viruses), and worm viruses that can replicate by using the Outlook Address Book. This update provides the following additional security safeguards for Outlook:

• E-mail attachment security   Prevents users from accessing several file types when sent as e-mail attachments. Affected file types include executables, batch files, and other file types that contain executable code often used by malicious hackers to spread viruses.
• Object Model Guard   Prompts users with a dialog box when an external program attempts to access their Outlook Address Book or send e-mail on their behalf, which is how insidious viruses such as ILOVEYOU spread.
• Heightened Outlook default security settings   Increase the default Internet security zone setting within Outlook from "Internet" to "restricted sites."

What types of files are affected?

Since the following file types — listed by file extension — can execute malicious code, they are disabled in e-mail messages if the Outlook 98/2000 SR-1 E-mail Security Update is installed. As a protection from potential viruses, users are restricted from accessing these attachments from within Outlook. Users who would like to distribute the attachments on this list can post them to file shares, intranets, online hard drives, or community Web sites.

Can the Outlook E-mail Security Update be installed with all versions of Outlook?

The Outlook E-mail Security Update is for Outlook 98 and Outlook 2000 SR-1 or Outlook 2000 SR-1a users.

How much does this update cost?

This update can be downloaded free of charge from the Microsoft Office Online site.

Is this update available on CD?

No, this update is available on the Microsoft Office Online site and can be downloaded free of charge.

Who should install this update?

Microsoft recommends that all Outlook 98 and Outlook 2000 users install this update for additional security protection in Outlook. Before installing the update, review the following information to understand the functionality that may be affected: If using Outlook 2000, read the Microsoft Knowledge Base article (Q262634) OL2000: Known Issues with the Outlook E-Mail Security Update if using Outlook 98, read the Microsoft Knowledge Base article (Q262618) OL98: Known Issues with the Outlook E-Mail Security Update. Users in organizations should check with their system administrator before installing this update.

If I don't like this update, can I uninstall it?

Once installed, this update integrates with your Outlook product and cannot be uninstalled without completely uninstalling Office. Read the Microsoft Knowledge Base article (Q262634) OL2000: Known Issues with the Outlook E-Mail Security Update. If you are using Outlook 98, read the Microsoft Knowledge Base article (Q262618) OL98: Known Issues with the Outlook E-Mail Security Update carefully to make sure that you want the extra security measures provided by the update, and to make sure, before you install the update, that you understand the functionality that may be affected. You can uninstall the update by uninstalling and reinstalling Office.

What Office functionality is affected by this update?

To determine what functionality may be affected by this update, there are two Microsoft Knowledge Base articles that may help. If you are using Outlook 2000, read the Microsoft Knowledge Base article (Q262634) OL2000: Known Issues with the Outlook E-Mail Security Update. If you are using Outlook 98, read the Microsoft Knowledge Base article (Q262618) OL98: Known Issues with the Outlook E-Mail Security Update.

Will this update completely protect me from all viruses?

This update, if installed, will guard against most viruses, such as the Goner, ILOVEYOU, and Melissa viruses, that are spread via e-mail attachments, or that spread by retrieving e-mail addresses from the user's Outlook Address Book and forwarding the virus to those recipients. It's important to note that Microsoft encourages all users to install the latest product updates, run an up-to-date virus scanner, and follow safe computing practices. While it's impossible to completely prevent virus attacks, installing this update and following other best practices can help safeguard your computer. For more information about the Outlook 2000 SR-1 E-mail Security Update, read the Microsoft Knowledge Base article (Q262631) OL2000: Information About the Outlook E-mail Security Update. For more information about the Outlook 98 E-mail Security Update, read the Microsoft Knowledge Base article (Q262617) OL98: Information About the Outlook E-mail Security Update.

How should users share these attachments now?

Users should share these attachments through other channels, such as files shares, Web folders, intranets, online hard drives, or community Web sites.

How did you create the attachment list?

The attachment list includes all executables or file types that could potentially execute malicious code.

What is the difference between Internet Zone and Restricted Zone?

The Restricted Zone is significantly more secure and restrictive than the Internet Zone. Most scripting and ActiveX® downloads and plug-ins are disabled by default. Cookies and file downloads are also disabled by default.

Why is SR-1a required for this update for Office 2000 users?

The Office 2000 SR-1 E-mail Security Update requires Office 2000 Service Release 1. Office 2000 Service Release 1a (SR-1a) is the current version of Office 2000 SR-1; it includes the original Office 2000 SR-1 update and the Office 2000/Windows 2000 Registry Repair Utility. If you have installed Office 2000 SR-1 you do not need to install Office 2000 SR-1a before you install this update. Office 2000 SR-1 and Office 2000 SR-1a both include the following important security updates:

• Visual Basic® for Applications (VBA) macro security setting improvements
• CPL and VBS files added to default list of files that must be saved to disk before opening
• Security enhancement for saving temporary attached files to local drive
• Updated security for attachments viewed in preview pane

Do you think corporations will install this update, even though it limits functionality?

Yes, many organizations will choose to deploy this update to provide further security safeguards for their organization. It's important to recognize that security is a broader issue and many organizations already have significant safeguards in place, such as security at the server and gateway level, or specific customizations for their organization. While this update will be a great additional security option for many organizations, some organizations may choose to customize the features within the update. System administrators should read the Knowledge Base article (Q263297) OL2000: Administrator Information About the Outlook E-mail Security Update for information about customizing the Outlook 2000 SR-1 E-mail Security Update.