Patent ID: 7900254

Claim:
A recording medium, including at least one of a random access memory, a read only memory and a hard disk drive, encoded with a computer program product executable by a processor of a computer for controlling the computer to identify a malware infected message, said computer program product comprising: reference event logging code operable to log a reference event associated with a corresponding originating message; reply time detecting code operable to detect a reply email message generated in less than a threshold reply time from said reference event associated with said corresponding originating message to which said reply email message is a reply; attachment status detecting code operable to detect an attachment status of said reply email message matching a trigger attachment status; infected message identifying code operable to identify said reply email message as a malware infected message when said reply email message was generated in less than said threshold reply time and said reply email message has an attachment status matching said trigger attachment status; and performing code operable to perform an action in response to said identification of said reply email message as said malware infected message.