Patent ID: 7380277
Filing Date: 2008-05-27
Classification: G06F,H04L

Abstract:
1. A method for detecting by an e-mail proxy interposed between a client computer and an e-mail server the presence of malicious computer code in an e-mail sent from the client computer to the e-mail server, said method comprising the steps of: intercepting by the e-mail proxy that is interposed between the client computer and the e-mail server e-mails sent from the client computer to the e-mail server, wherein the proxy intercepts an e-mail sent with a file by an application on the client computer; comparing the file that was intercepted by and now resides within the proxy with the application that sent the e-mail and that resides on the client computer to determine whether the application is attempting to send itself as part of the e-mail; declaring a suspicion of malicious code in the file and in the application when the file is determined to be a nearly identical copy of the application; determining whether a digital signature has been affixed to the file; verifying the digital signature with a trusted source upon determining that a digital signature has been affixed to the file; and rescinding the declaration of a suspicion of malicious code responsive to the determination and positive verification.