Appendix: New Outlook Patch Prevents Spread of E-Mail-Based Viruses

Because of Outlook’s susceptibility to worm-type e-mail-borne viruses, the danger this poses to customers, and Microsoft’s potential liability if it failed to act, Microsoft has issued a comprehensive patch for Outlook 98 and Outlook 2000. The patch protects against future LoveBug-type viruses by severely restricting the types of file attachments that are acceptable within e-mail messages and by limiting the capacity of viruses to spread themselves using Outlook’s programming interfaces.

Background

The LoveBug (also known as “ILoveYou”) and Melissa viruses were remarkable not so much in the damage they caused but in the speed with which they spread. Because the messages attracted many users, and the viruses were able to use Outlook to replicate themselves to other e-mail addresses in the user’s Outlook contact list, the viruses spread rapidly in a chain-reaction-like manner. This type of virus spreads so quickly that antivirus vendors cannot create virus scanner updates before it does widespread damage. Since Outlook is the world’s most prevalent e-mail client and has programming interfaces that allow a virus to spread itself to the user’s entire contact list, Outlook was the perfect vehicle for doing widespread damage. It could have been much worse.