Patent ID: 7854007

Claim:
An apparatus, comprising: a network interface; one or more processors coupled to the network interface; logic coupled to the one or more processors which, when executed by the one or more processors, causes the one or more processors to perform: receiving an electronic mail message having a destination address for a recipient account; determining a virus score value for the message based upon a plurality of rules that specify attributes of messages that are known to contain computer viruses; wherein each rule has a weight proportional to a number of attributes specified in the rule; wherein the attributes comprise a type of file attachment to the message, a size of the file attachment, and one or more heuristics based on the message sender, subject or body and other than file attachment signatures; wherein the virus score value is determined as a first sum of products of each of score values returned by the plurality of rules multiplied by a weight associated with a corresponding rule from the plurality of rules and dividing the first sum by a second sum of the weights associated with the plurality of rules; when the virus score value is greater than or equal to a specified threshold, storing the message in a quarantine queue without immediately delivering the message to the recipient account.