Patent ID: 8065738

Claim:
A computer-implemented method for detecting automated spam programs designed to transmit unauthorized electronic mail via endpoint machines, at least a portion of the method being performed by an endpoint machine comprising at least one processor, the method comprising: monitoring, using a networking-monitoring module installed on the endpoint machine, electronic-mail traffic on the endpoint machine by: monitoring all network activity on the endpoint machine; detecting, within the network activity on the endpoint machine, the electronic-mail traffic by: detecting incoming-mail-protocol traffic within the network activity by comparing the network activity with digital signatures for incoming-mail protocols; detecting outgoing-mail-protocol traffic within the network activity by comparing the network activity with digital signatures for outgoing-mail protocols; identifying, using a program-identification module installed on the endpoint machine, a computer program on the endpoint machine that is responsible for at least a portion of the electronic-mail traffic on the endpoint machine; accessing, using a rule-application module installed on the endpoint machine, at least one rule for determining, based on characteristics of the program, whether the program comprises a spam program; determining, by applying the rule to the program using the rule-application module installed on the endpoint machine, that the program comprises a spam program designed to transmit unauthorized electronic mail via the endpoint machine; in response to the determination that the program comprises a spam program designed to transmit unauthorized electronic mail via the endpoint machine, using a security module installed on the endpoint machine to perform a security operation on the program.