Patent ID: 7673342

Claim:
A computer program product comprising a computer readable storage medium bearing a computer program operable to control an e-mail client computer to detect e-mail propagated malware, said computer program product comprising: e-mail generating logic operable to generate an e-mail message; comparison logic operable to compare said e-mail message with at least one of an address book of a sender of said e-mail message and one or more previously generated e-mail messages from said client computer; and identifying logic operable to identify whether: (i) said e-mail message is being sent to more than a threshold number of addressees specified within said address book; (ii) said e-mail message contains message content having at least a threshold level of similarity to non-identical message content of said previously generated e-mail messages being sent to more than a threshold number of addressees specified within said address book; and (iii) said e-mail message contains message content having at least a threshold level of similarity to non-identical message content of more than a threshold number of said previously generated e-mail messages; wherein said identifying logic is further operable to identify said email message as potentially containing malware if at least one of items (i), (ii), and (iii) is identified; and quarantine queue logic operable to hold said previously generated e-mail messages in a quarantine queue for at least a predetermined quarantine period prior to being sent from said client computer; wherein said quarantine queue logic is further operable such that it is determined whether said email message is a new message by comparing said email message with said previously generated e-mail messages held in said quarantine queue; wherein said quarantine queue logic is further operable such that said email message is added to said quarantine queue in response to a determination that said email message is said new message; wherein said quarantine queue logic is further operable such that a score value indicative of one of said previously generated e-mail messages held in said quarantine queue is updated in response to a determination that said email message is not said new message, said score value indicating a proportion of said addressees specified within said address book that have previously been sent said message sharing at least said threshold level of similarity to non-identical message content of said one of said previously generated e-mail messages.