Patent ID: 8327447

Claim:
A computer-implemented method comprising: receiving an electronic mail (email) message having attached thereto a self-extracting archive file, the self-extracting archive file including a header portion that is unencrypted and uncompressed and a file data portion containing contents of one or more files in compressed form; and prior to delivery of the email message to an intended recipient, determining whether any of the one or more files may be malicious or undesired files by causing the self-extracting archive file to be processed by an anti-virus detection module executing on a computer system, including determining a type of archive file and associated structure of the self-extracting archive file by examining one or more identification bytes stored within the header portion that identify the type of archive file; based on the type of archive file and the associated structure, for each of the one or more files, extracting descriptive information from the header portion describing characteristics of the one or more files, including one or more of a checksum of the file in uncompressed form, a size of the file in uncompressed form and a size of the file in the compressed form; and identifying a file of the one or more files as a potentially malicious or undesired file when a comparison of the descriptive information to detection signatures of known malicious or undesired files results in a match.