Patent ID: 7376842

Claim:
A computer program product embodied on a tangible computer readable medium for detecting malware, said computer program product comprising: receiving code operable to receive a message containing a plurality of data records, each data record having associated record, characterizing data and payload data, said record characterizing data including type data identifying data type of payload data of said data record and length dam identifying length of said data record; determining code operable to determine from type data of a data record whether or not payload data of said data record should be scanned for malware; scanning code operable if said type data indicates that said payload data should be scanned for malware to scan said payload data for malware; and calculating code operable if a last data record within said message has not yet been subject m said determination to calculate from said length dam a start location of a next data record within said message to be subject to said determination; wherein said scanning of said payload data includes directly scanning said payload data in an unencoded form and is initiated before an entirety of said message is received and after at least one of said plurality of data records is received in order to reduce a latency associated with said malware scanning.