Patent ID: 8443447

Claim:
A computer-implemented method for detecting malware-infected electronic mail messages, the method comprising: monitoring, by a server computer, an electronic mail (email) account associated with a unique email address for receipt of an email message, the unique email address being associated with a unique contact in an address book on a client computer; determining, by the server computer, that an email message addressed to the unique email address has been received, wherein receipt of the email message addressed to the unique mail address indicates to the server computer that malware has attempted to propagate by reading the address book on the client computer and sending the email message addressed to the unique email address; and performing both an automated malware analysis and an automated correlation process by the server computer to confirm that the email message contains malware, wherein the automated malware analysis is performed by a pattern-based antivirus scanning engine, and the automated correlation process determines whether a plurality of similar emails have been received by multiple registered user accounts, each said registered user account being associated with a unique email address at a client computer, in order to confirm that the email message contains malware.