Patent ID: 7822818

Claim:
A computer-assisted method of reducing spread of malware in communications between instant message (IM) clients and an IM server, comprising: registering a virtual IM user with the IM server, wherein the virtual IM user includes an account name by which other IM users of the IM server are able to communicate with the virtual IM user, and the virtual IM user further includes fictitious information tailored to entice a source of malware to communicate with the virtual IM user; intercepting one or more communication packets exchanged between the other IM users and the IM server, wherein one or more communication packets contain buddy lists of the other IM users; responsive to intercepting the buddy lists of the other IM users, adding one or more fictitious buddies to the buddy lists of some of the other IM users, wherein each of the fictitious buddies is assigned an account name; sending a message, using the account name of one of the fictitious buddies, to one of the other IM users to elicit return messages from a particular type of malware operator, the particular type being one that only sends messages to buddies that have previously sent messages; receiving a message from an IM user to the virtual IM user, or from an IM user to the one or more fictitious buddies responsive to the message sent using the account name of the one of the fictitious buddies; sending a confirmation message to the IM user requesting the IM user to confirm that the IM user intended to send the message to the virtual IM user or to the one or more fictitious buddies; receiving a response to the confirmation message from the IM user; and identifying the IM user as a source of malware responsive to content of the response to the confirmation message.