Outlook Express Attachment Blocking

Microsoft Outlook and Outlook Express can be configured to block what Microsoft calls "unsafe" email attachment types1. Until the release of Outlook Express 6 service pack 1, this feature was disabled by default.  With the new release being distributed through Windows Update, people may start finding that email attachments are unavailable to them.2

It is recommended that most people leave the feature enabled.  Malicious use of these email attachment types is much more common than non-malicious use. For example, in March of 2002, the JMU email server handled 2607 messages with .exe attachments and  2376 of those were viruses. If you get an occasional email message with a blocked attachment type, inform the sender that your mail system will not accept such attachments and ask them to rename the attachment and resend it. The JMU e-mail server already blocks many of these attachment types.

If you find that you are unable to receive desired attachments on a regular basis and you cannot make other arrangements for a different filename format, you can reconfigure Outlook Express to allow these high risk attachments. If you do this, however, you will be exposed to both desired and undesired high risk attachments. Outlook Express cannot determine whether a particular attachment is desired and anti-virus software cannot protect you from new viruses. Please treat any unexpected high risk attachments with caution. You cannot opt-out of the central JMU e-mail server filters.

There are two ways to allow high risk attachments:

  1. You can choose to enable delivery of only certain types of high risk attachments.
    1. Click Start
    2. Click Settings
    3. Click Control Panel
    4. Double-click Folder Options
    5. Click the File Types Tab
    6. Under the Extensions column, locate the extension of the attachment type that you would like to receive and highlight it. If the extension you would like to receive is not in this list, then you cannot disable receipt of only that attachment type. Instead, you will need to disable the unsafe attachment protection feature entirely as described in the second option below.
    7. Click Advanced
    8. Uncheck Confirm Open After Download
    9. Click OK
  2. You can choose to disable the unsafe attachment protection entirely in which case all types of high risk attachments will be delivered to you.3
    1. Start Outlook Express
    2. Select Options off the Tools menu
    3. Click the Security tab
    4. Under Virus Protection, uncheck the box labeled "Do not allow attachments to be saved or opened that could potentially be a virus".
    5. Click OK

However you configure Outlook Express, please continue to follow RUNSAFE guidelines.

Additional information on security issues with Outlook, Outlook Express, and Internet Explorer can be found here.

Notes:

  1. The documentation says the "unsafe file list includes any file types that may have script or code associated with them". However, Microsoft Office file types are not on the unsafe list even though they may include macros.
  2. This version of Outlook Express will likely be installed on most people's computers as it is included with Internet Explorer 6 service pack 1 and Windows XP service pack 1. These products will likely get installed at some point during a Windows Update visit. Because of the many serious defects in older versions, Internet Explorer 6 service pack 1 is the preferable version to be running.
  3. The JMU email server attempts to block certain types of high risk email attachments from being delivered to your mailbox.

References: