Office XP Tips: Outlook Attachments, Macro Virus Protection

Jim Welp, PCWorld.com

It takes a special kind of sociopath to write and distribute a computer virus. You have to be mean enough to want to hurt innocent victims, self-delusional enough to presume you'll leave a mark on the world, and sinister enough to use your programming skills for evil, even though you could do so much good with them.

At any rate, Office XP has some laudable security enhancements that will probably make it much tougher for the bad guys. And, not surprisingly, the very measures that Microsoft has implemented to improve security have garnered criticism.

Don't Get Too Attached

Microsoft Outlook has arguably been the greatest target for e-mail computer viruses of all time. Because of its popularity, and because it's historically been easier to attack than its competitors, Outlook has been a favorite of virus writers for years now.

In recent years, many of the most notorious worms have appeared as attachments that spread using Outlook's Address Book. If you open an attachment that contains a worm, the malicious program immediately propagates by sending a copy of itself to every address in your Address Book. Despite the publicity these worms have generated, the millions of victims, and the stern warnings delivered through thousands of news outlets, some folks blithely continue to click on suspicious attachments. Stop it, people!

Presumably fed up with the attacks, Microsoft has taken a strong approach with Outlook 2002. The program looks at the file extensions of attachments and simply won't allow you to open ones it considers high risk. These include a lot of common file types, including executable programs (.exe), Visual Basic Script files (.vbs), and Help files (.hlp), plus dozens more. If someone sends you a file that Outlook deems unacceptable, you'll receive an error message.

While this might seem like using an elephant gun to kill a fly, I like the approach. First, it puts up a serious roadblock for the unsuspecting masses who unwittingly open attachments, a key demographic for the bad guys. Second, those who really need to exchange these file types via e-mail can use workarounds, such as compressing a file and sending it as a.zip attachment or simply using a Web-based free e-mail account for attachments. The inconvenience seems like a small price to pay for greater security. Finally, if your profession calls for you to exchange files created in the prohibited formats, here's another option: Politely ask your Outlook administrator to customize your security settings by offering a candy bar and this article, which explains how.

The article closes with a list of the file types that Outlook 2002 won't allow.

Inoculate Against Macro Viruses

In addition to worms, computers have long been vulnerable to another type of virus that takes advantage of Office's popularity: macro viruses. These nasties are favored by virus writers because their unsuspecting victims can't easily distinguish a contaminated file from any other Word or Excel file.

XP provides a choice of three security levels to protect you from macro viruses. You set the level by opening any office application and choosing Tools, Macro, Security to open the Security dialog box. (For security, XP checks for a digital signature in a macro to see if it's a "trusted source.") If you use a lot of macros created by someone you know and trust, Medium is probably best. If you create your own macros and don't want to see a lot of alert messages, choose Low. For everybody else, High is safest.

Keep Office XP Up To Date

No matter how much Microsoft beefs up security in Office XP, the suite will probably always be vulnerable. To combat new forms of attack, Microsoft regularly releases security updates and service releases, making them available on the Web at the Microsoft Download Center.

It's a good idea to bookmark this page and check back occasionally for critical security updates, especially if you engage in high-risk computing behavior.

Make Yourself Even Safer

So you're feeling pretty snug and secure because of Office XP's security features, eh? Don't. The world is full of reprobate programmers trying to get over the nuclear wedgies they suffered in fifth grade. Until they do, you've got to stay on your toes. One good way is to read Contributing Editor Stan Miastkowski's excellent article "Fortress PC."

And be sure not to miss this collection of Internet security downloads compiled by the PCWorld.com Downloads team.

For a more in-depth look at the inner workings of computer viruses, see Senior Associate Editor Kim Zetter's article "How It Works: Viruses."