GB2357939A

GB2357939A - E-mail virus detection and deletion

Info

Publication number: GB2357939A
Application number: GB0016553A
Authority: GB
Inventors: Nick Galea
Original assignee: GFI Fax and Voices Ltd
Current assignee: GFI Software Ltd
Priority date: 2000-07-05
Filing date: 2000-07-05
Publication date: 2001-07-04
Anticipated expiration: 2020-07-05
Also published as: GB0016553D0; GB2357939B; US20020004908A1

Abstract

An anti-virus system for electronic mail messages having detection means for determining the presence of an electronic mail message and analysing and scanning means for detecting in the electronic mail message any tags indicating the presence of operable program code, such tags and operable code are removed from the electronic message before the message is delivered to the intended recipient. Means may also be provided for separately scanning the body and attachments of the message and for quarantining either body text or an attachment that is found to contain operable code until a decision is made whether the operable code should be deleted.

Description

2357939 ELECTRONIC MAIL MESSAGE ANTI-VIRUS SYSTEM AND METHOD This

invention relates to an electronic mail message anti-virus system and method.

Computers and computer networks are susceptible to attack from an HTML electronic mail message that contains a malicious code or the ability to trigger a program that could damage the computer system upon receipt of the electronic mail message. Anti-virus systems have been developed to detect such viruses which would other-wise infect a computer. Versions of anti-virus systems are known for detecting viruses transmitted by electronic mail. However, known anti-virus systems have been largely unsuccessful in combating viruses delivered by electronic mail for a number of reasons. First, known systems can only protect against known viruses. This may be done by scanning an incoming electronic mail messace for strinas of characters which are known to be included in known viruses. However, because such systems can only protect against known viruses and since electronic mail can spread viruses in a matter of hours, such systems are completely ineffective against electronic mail viruses as the anti-virus system cannot be updated with strings associated with the new virus before the computer is infected. Another problem with conventional electronic mail virus detection is that not all viruses are widespread. A virus may be created against a particular company, to obtain particular information from that company, for example, for industrial espionage. In that case, no measures can be taken to protect the system from the virus because the virus is not known until after the attack has occurred. Another problem with conventional anti- virus systems is that they scan only the attachment of an electronic mail message and not the electronic mail body itself However, electronic mail viruses may not only be contained in attachments but may be contained in the message body itself, in which case, a virus can be activated without the user opening an electronic mall attachment.

11) It is an object of the present invention to provide an anti-virus system and method which substantially overcome these limitations.

According to the present invention there is provided an anti-virus system 0 for an electronic mall messaae, the system including means for determining the W Z 0 presence of the electronic mail message, means for analysing and scanning the electronic mail messaae for tacs indicating the presence of operable program code Z:) W I= Z1-1) and for removing any such tags and operable pro-ram code from the electroMic 1 c c mail message., and means for applying the electronic mail message with the tags and operable program code removed to server means.

Preferably, the means for determining the presence of the electronic mail message includes means for breakine, the messaae into constituent bodies or I- W C) message texts and attachments of the electronic message, the means for analysi ig and scanning comprises rneans for scanning the constituent bodies a id attachments and the means for applying the electronic mail message with the tags and operable program code removed to server means includes means 16r rebuildine, the electronic messae from the constituent bodies and attachments.

Conveniently, the means for analysing and scanning comprises means flor scannine, the message for predetermined character strings.

Advantageously, the means for applying the electronic mail message with the tags and operable program code removed to server means includes means f or 1 replacing the removed tag and operable program code with alternative text.

1 Z_ Preferably the alternative text is adapted to inform a recipient of message that operable program code has been removed.

W 1 Advantageously the means for analysing and scanning includes means f IF scanning attachments for operable macros.

Advantageously the system further comprises quarantine means for quarantining a constituent body containing operable program code and/or W removin. from the message and quarantining an attachment containing a macro.

c Z Z 0 Preferably the quarantine means includes rneans for removing a mac,o from an attachment, quarantining the rnacro and releasing the attachment with the macro removed.

Preferably the quarantine means includes means for storing the body, attachment or macro in a quarantine storage location as a quarantined item. meals for receiving a input indicating a decision whether the quarantined item may be delivered to an intended recipient; and dependant on the decision input either releasing the quarantined item for delivery to the intended recipient or deleting the quarantined item.

Conveniently, the quarantine rneans includes means, on deleting the quarantined item, for informing the intended recipient and/or a sender of the 1.

message that the quarantined item has been deleted without being delivered to the intended recipient.

Conveniently the means for scanning attachments for operable macros 1 comprises means for sequentially scanning the attachments for a plurality of predetermined character strings.

Preferably, the means for scanning attachments for a plurality of predetermined character strings includes means for terminating scanning when 0 one of the predetermined strings is not found on completely scanning the C5 attachment.

Conveniently, the means for determining the presence of the electronic mail message is adapted to capture all electronic mall messages passing between a first network and a second network.

Advantageously, the means for determining the presence of the electronic g 0 mail messacre is adapted to capture all electronic mail messages passing between W an internal or private network and an external or public network.

Accordine, to a second aspect of the present invention there is provided a method of removing a virus from an electronic mail message including the steps Z> 0 C1) of (a) capturing the message- (b) scanning the message for tags indicating the presence of operable program code; (c) removing the tags and operable program 0 I= 0 0 code from the electronic rnail message., and (d) releasing the electronic mail message with the tags and operable program code removed.

1 0 Alternatively, step (c) comprises quarantining a message or a part of a message containing operable program code.

0 4 Preferably step (a) includes the step of breaking the message ir to constituent bodies or message texts and attachments of the electronic rnessa e; step (b) comprises scanning the constituent bodies and attachments and step i.d) includes the step of rebuilding, the electronic message from the constituent boffies W and attachments.

Conveniently step (b) comprises scanning the message for predetermined character strings.

Advantageously step (c) includes replacing the removed tag and operable Z:1 program code with alternative text.

Preferably the alternative text is adapted to inform a recipient of the messao,e that operable program code has been removed.

Advantageously step (b) includes scanning attachments for opera41e macros and step (c) comprises removing from the message and quarantining a 1 0 y macros or, alternatively, any attachments containing macros.

Preferably the step of quarantining a constituent body, attachment or macro comprises the steps of.. storing the constituent body, attachment or macro in a quarantine storage location as a quarantined item. receiving a decision whetter the quarantined item rnay be delivered to an intended recipient.' and dependant on the decision either releasing the quarantined itern for delivery to the intendd recipient or deleting the quarantined item.

0 Conveniently, the step of deleting the quarantined item includes informing the intended recipient and/or a sender of the message that the quarantined item has W been deleted without beina delivered to the intended recipient.

0 Conveniently the step of scanning, attachments for operable maer:)s 1 includes sequentially scanning the attachments for a plurality of predeterminA character strinas.

Preferably, the step of scanning attachments for a plurality of Z_ predetermined character strings is terminated when one of the predeterminA strings is not found on completely scanning the attachment.

Conveniently, step (a) comprises capturln-a, all electronic mail messages passing between a first network and a second network.

Advantageously, step (a) comprises capturing all electronic mail messages 1 C passing between an internal oi- private network and an external or public network.

Z According to a third aspect of the invention, there is provided a computer program comprisinC, code means for performing all the steps of the method described above when the program is run on one or more computers.

Conveniently the computer program is embodied on a computer-readable medium.

According to a fourth aspect of the present invention, there is provided a computer program product comprising program code means stored in a computer-readable medium for performing the method described above when that program product is run on one or more computers.

An advantage of the present invention is that it does not seek to determine whether program coding included with an electronic message is malicious or not, 0 c Z:1 but removes the capability of such an electronic mail message to execute the program or commands. That is, all electronic mail messages scanned that contain program code or instructions to run programs, are re-written in such a way that this capability is removed from the electronic mall message, or the message or =1 part of the message containing the operable code is quarantined. This secures the recipient against all current, future and one-off viruses.

W A specific embodiment of the invention will now be described by of example, with reference to accompanying drawings, in which:

Z> Z FIG 1 shows a flowchart of a rnethod, according to the present invention, c of removing operable program code from a body or attachment of an electronic 0 => mail messacre; 0 FIG 2 shows a flowchart of a rnethod according to the invention of Z.

removing macros or attachments which contain macros from an electronic mail message; 6 FIG 3 shows a flowchart of steps of the method of FIG 2 for determinir g i whether an electronic mall message contains a Microsoft Word T"1 macro; 1 FIG 4 shows a flowchart of steps of the method of FIG 2 for deteri-ninir whether an electronic rnall messaue contains a Microsoft Excel"'\' macro.

FIG 5 shows a block diagram of building blocks used in the method of the invention; FIG 6 shows the flow of electronic mall messages through a computer Z.

system employing the method of FIGS 1 & 2. and C5 1 FIG 7 shows steps in quarantining attachments of the method of FIG 2.

In the drawings, like numerals denote like steps.

W FIG 1 Illustrates an application of the invention in which the method of tie invention is used in a gateway or electronic mall server, between a user's network and a public network, for example. However, it will be appreciated that te invention may be used to protect a single computer. As illustrated in FIG 1, M electronic message received by the electronic rnall server, step 101, is isolated, or captured, step 102. The captured electronic mail rriessage is divided up, step 103, into its constituent bodies of message text 110,111 and attachments 112, 113. An electronic mall message can have multiple bodies, also known as message text, and multiple attachments, but only two of each are illustrated in FIG 1. T[e bodies and attachments are sequentially scanned, step 104, to determine wheth( any of the said bodies or attachments contains a character string indicating tl presence of operable program code. That is, the program scans the body attachment for a tag or tags which identify program code that will be run c C) Z> W viewing the electronic mall message or code that will run an external prograj executed once the electronic rnail message is viewed. For example, in the currei version of HTIVIL the tag---scripts"identifies program code. The presence of suc a tag means that an electronic rnall message can potentially run an extern program or tricroer a program. It will be understood that for future or differei W.n versions of HTML, there may be more or different names for identifying scril code. However, amending, the method at step 104 to scan for such differei 1 7 character scripts is a trivial task compared with the impossibility of updating known anti-virus systems with character strings from all viruses in advance. If a script tag is found in an embodiment or attachment, the program is removed, step 105, from the body or attachment and preferably replaced with replacement text.

Such replacement text may indicate to the eventual recipient of the electronic mall message that operable code has been removed. The electronic mall message is reassembled, step 106, by the electronic mall analyser program, that is, the electronic mall messaOre is reconstituted from the separate bodies and the attachments reattached so the electronic mall messa-e is recreated. The electronic mail message is passed, at step 107, back to the electronic mail server for forwardina,, step 108, to the intended recipient. The intended recipient, therefore, receives a cleaned electronic rnall message, which has no capability of running any pro-rams and is, therefore, completely secure. Alternatively, the message containing script tag may be quarantined until subsequently released or deleted.

Simultaneously, or sequentially, the attachments are scanned to determine the presence of macros, as illustrated in FIG 2. As already described in relation to FIG 1, incoming or outgoing electronic mail messacles are received by the 0 CY electronic mail server, step 201, and an electronic mail message is isolated, step 202, and any attachments 212,213 are removed, step 203), from the electronic mail 20 message and sequentially scanned to determine whether the attachments contain macros, step 214. If a macro is detected within an attachment, the attachment may either be deleted, step 2 15, or quarantined, step 2 16. Alternatively, the macro may be quarantined and the attachment released with the macro removed. If the macro or attachment is quarantined, a decision will subsequently be made, step 217, 25 whether the macro or attachment should be deleted, or reassembled and reattached to the electronic mall message, step 218, or forwarded by other means to the intended recipient. If no macros are found in the attachment, then the attachment is reattached to the electronic mail message, step 218, and the electronic mail message is passed back to the electronic mail server, step 219, for forwarding, step 30 220, to the intended recipient. If an attachment has been deleted then a new attachment may be attached to the electronic mail message indicating to the Z1 0 intended recipient that the original attachment has been removed. In this manner, the method of the invention automatically removes any attachments from an 8 electronic mail messaoe which have the capability of runniner program codes 3r Z.) W external programs by using macros. That is, all macros or attachments containilig macros are removed and deleted, or at least quarantined, whether they are harmIlil or not. 1 As shown in FIG '), If, for example, the analyser determines that an attachment is a Microsoft Word T" document, the attachment is searchid sequentially for a number of character strings, thus the attachment is initially searched, step 3 0 1, for the character string "Root Entry". If the character string is not found, it is thereby determined that the attachment does not contain a macto and the attachment is released for rebuilding the message, step 218. If, howev(r, the string is found, the attachment is rescanned, step 302, for string "VBA" and is in the previous step, if the string is not found, the attachment is released, otherwise the attachment is rescanned sequentially in the same manner for tile string "PROJECT", step 303, and "DocumentSummaryInformation", step 304. If the attachment is found to contain all four of the strings, the attachment is eith-.r deleted, step 215, or quarantined, step 216.

Similarly, FIG 4 shows the procedure where the analysing program determines that the attachment is a Microsoft EXCeIT "-" document, in which the attachment is sequentially tested fo r the strings "Root Entry "DocumentSummarylnformation", "Macros", "VBK' and "PROJECT", steps

401-405. Once again, if the attachment is found to contain all five of these strings, it is determined that the attachment contains a macro and the attachment is either deleted, step 215, or quarantined, step 216. Alternatively, just the macro may he detached and quarantined. It will be appreciated that if other known types of documents are detected they may be scanned in similar ways for appropria e character strings.

A block diaoram of buildina blocks used in the method of the invention s shown in FIG 5. A capture and release server component 502 transports mail inio and out of the analysing system. The server component interfaces with - n external mailing system 501, such as Microsoft Exchange Server, Lotus Notes or SMT/POP 3 servers. This server component interface enables the electronic mail analyser to capture all incoming and outgoing rnall and places incoming mail 5C 3 9 and outgoing mail 504, in a process queue 505. An electronic mail analysing component 506 analyses electronic mail messages from the processing queue 505 sequentially. This electronic mail analysing component consists of a backbone which controls a number of smaller modules which perform specific actions on 5 the electronic mail message, such as a module for breaking the message into parts 507, a module for searching for character strings or keywords 508 that identify program code and a module for checking attachments for macros 509. These socalled plug-in modules provide all the electronic mall processing intelligence to the system, and the backbone manages the message process queue. The electronic mail analyser therefore submits each of the electronic mail messages to the plugins in turn. In addition to those already described, there may be additional plugins for decrypting the message body as well as, for example, checking the message content. Once an electronic mall message has been processed by all the plug-ins, the electronic mall analyser returns the message to the capture and release server component which releases a virus-free message to the external mailing system for delivery to the intended recipient.

As shown in FIG 6, the electronic mail analysing component, 506, is a central part of the overall system and a capture and release server component 502, both passes electronic mail message from an external electronic mail system 501 to the electronic mail analysing component 506, and after processing, the server component 502 passes an electronic mail message 5 10 back to the electronic mail system.

In certain circumstances a user may, for example, wish to be able to receive electronic mail attachments containing macros from, for example, particular known users. It will be understood that user settings may be stored in the electronic rnail analysing component, 506 to specify whether embedded HTNfL scripts and macros are to be removed from all electronic mail messages or whether exceptions are to be made for messages received from or sent to particular users. In such a situation, the systern would first check whether user settings exist for the particular sender and recipient of a captured message and if so the user settings would be applied and if not, default settings would be used.

As best shown in FIG 7, an electronic mail message having program coe or attachments having program code or containing macros, is passed by quarantine component 701 into quarantine 700. The quarantined message message component is held while an authorised person is notified 702 to reject approve the message, the authorised person being chosen from a list 703 persons qualified to approve or reject quarantined rnail. Dependent on decision made, the quarantined rnessage may be rejected, step 704, and delete step 705, in which case, optionally, the sender and/or recipient may be notifi 706 that the message or message or component lias been deleted. Alternative step 707, the quarantined message is approved and the message or compon passed back to the server component, step 708, for delivery to the intend recipient.

Claims

1. An anti-virus system for an electronic mail message, the system including means for determining the presence of the electronic mail message; means for analysing and scanning the electronic mail message for tags indicating the presence of operable program code and for removing any such tags and operable program code from the electronic mail message- and means for applying the electronic mail message with the tags and operable program code removed to server means.

2. An anti-virus system as claimed in claim 1, wherein the means for determining the presence of the electronic mail message includes means for breaking the message into constituent bodies or message texts and attachments of the electronic message; the means for analysing and scanning comprise means for scanning the constituent bodies and attachments and the means for applying the electronic mail message with the tags and operable program code removed to server means includes means for rebuilding the electronic message from the constituent bodies and attachments.

3. An anti-virus system as claimed in claims 1 or 2, wherein the means for analysing and scanning comprises means for scanning the message for predetermined character strings.

4. An anti-virus system as claimed in any of the preceding claims, wherein the means for applying the electronic mail message with the tags and operable program code removed to server means includes means for replacing the removed tag and operable program code with alternative text.

5. An anti-virus system as claimed in claim 4, wherein the means for replacing with alternative text is adapted to replace with alternative text for informing a recipient of the message that operable program code has been removed.

12

6. An anti-virus system as claimed in any of claims 2 to 5, wherein the means for analysing and scanning includes means for scanning attachments for operable macros.

7. An anti-virus system as claimed in claims 2 to 6, wherein the system further comprises quarantine means for quarantining a constituent body contail ling operable program code and/or removing from the message and quarantining an attachment containing a macro or operable program code.

8. An anti-virus system as claimed in claim 7, wherein the quarantine m(ans includes means for removing a macro from an attachment, quarantining the macro and releasing the attachment with the macro removed. -

9. An anti-virus system as claimed in claims 7 or 8, wherein the quaramine, means includes means for storing the body, attachment or macro in a quaran, ine storage location as a quarantined item; means for receiving a input indicating a decision whether the quarantined item may be delivered to an intended recipient; and dependant on the decision input either releasing the quarantined item for delivery to the intended recipient with or without the operable code removed or deleting the quarantined item.

10. An anti-virus system as claimed in claims 7 or 9, wherein the quaranline means includes means, on deleting the quarantined item, for informing the intended recipient and/or a sender of the message that the quarantined item ms been deleted without being delivered to the intended recipient.

11. An anti-virus system as claimed in claims 2 to 10, wherein the means r scanning attachments for operable macros comprises means for sequentially scanning the attachments for a plurality of predetermined character strings.

12. An anti-virus system as claimed in claim 11, wherein the means Sor scanning attachments for a plurality of predetermined character strings includes means for terminating scanning when one of the predetermined strings is iiot found on completely scanning the attachment.

13 13. An anti-virus system as claimed in any of the preceding claims, wherein the means for determining the presence of the electronic mail message is adapted to capture electronic mail messages passing between a first network and a second network.

14. An anti-virus system as claimed in claim 13, wherein the means for determining the presence of the electronic mail message is adapted to capture electronic mail messages passing between an internal or private network and an external or public network.

15. A method for removing a virus from an electronic mail message including the steps of (a) capturing the message; (b) scanning the message for tags indicating the presence of operable program code; (c) removing the tags and operable program code from the electronic mail message; and (d) releasing the electronic mail message with the tags and operable program code removed.

16. A method as claimed in claim 15, wherein step (c) comprises quarantining 15 a message or a part of a message containing operable program code.

17. A method as claimed in claims 15 or 16, wherein step (a) includes the step of breaking the message into constituent bodies or message texts and attachments of the electronic message; step (b) comprises scanning the constituent bodies and attachments and step (d) includes the step of rebuilding the electronic message 20 from the constituent bodies and attachments.

18. A method as claimed in claims 15 to 17, wherein step (b) comprises scanning the message for predetermined character strings.

19. A method as claimed in claims 15 to 18, wherein step (c) includes replacing the removed tag and operable program code with alternative text.

20. A method a claimed in claim 19, wherein the step of replacing the removed tag And operable code with alternative text comprises using the alternative text to inform a recipient of the message that operable program code has been removed.

14

21. A method as claimed in claims 17 to 20, wherein step (b) inclu les scanning attachments for operable macros and step (c) comprises removing from the message and quarantining any macros and/or any attachments contain. ng macros.

22. A method as claimed in claims 16 to 2 1, wherein the step of quarantinin 3; a constituent body, attachment or macro comprises the steps of.. storing he constituent body, attachment or macro in a quarantine storage location as a quarantined item; receiving a decision whether the quarantined item may be delivered to an intended recipient; and dependant on the decision either releasing 10 the quarantined item for delivery, with or without the operable code or mago deleted, to the intended recipient or deleting the quarantined item.

23. A method as claimed in claim 22, wherein the step of deleting Ihe quarantined item includes informing the intended recipient and/or a sender of message that the quarantined item has been deleted without being delivered to 1 c 15 intended recipient.

24. A method as claimed in claims 21 to 23, wherein the step of scanni g attachments for operable macros includes sequentially scanning the attachmel ts 1 t for a plurality of predetermined character strings.

25. A method as claimed n claim 24, wherein the step of scanning attachmer ts for a plurality of predetermined character strings is terminated when one of t ' e predetermined strings is not found on completely scanning the attachment.

26. A method as claimed in any of claims 15 to 25, wherein step (a) compris s capturing electronic mail messages passing between a first network and a seco d network.

27. A method as claimed in claim 26, wherein step (a) comprises capturbig electronic mail messages passing between an internal or private network and an external or public network.

1 28. A computer program comprising code means for performing all the steps of the method of any of claims 15 to 27 when the program is run on one or more computers.

27. A computer program as claimed in claim 28, wherein the computer 5 program is embodied on a computer-readable medium.

28. A computer program product comprising program code means stored in a computer-readable medium for performing the method of any of claims 15 to 27 when that program product is run on one or more computers.

29. An anti-virus system substantially as hereinbefore described with reference 10 to and as illustrated in the accompanying drawings.

30. A method substantially as hereinbefore described with reference to and as illustrated in the accompanying drawings.

31. A computer program substantially as hereinbefore described with referer ce to and as illustrated in the accompanying drawings.

31. A computer program substantially as hereinbefore described with reference to and as illustrated in the accompanying drawings.

Amendments to the claims have been filed as follows CLAIMS 1. An anti-virus system for an electronic mail message, the system including: means for determining the presence of the electronic mail message; means fDr analysing and scanning the electronic mail message for tags indicating tie presence of operable program code and for removing any such tags and operatle program code from the electronic mail message; means for replacing the removed tag and operable program code with alternative text; and means for applying the electronic mail message, with the tags and operable program code replaced, o 10 server means.

2. An anti-virus system as claimed in claim 1, wherein the means f)r replacing with alternative text is adapted to replacing with alternative text informing a recipient of the message that operable program code has b removed.

3. An anti-virus system as claimed in claim 1 or 2, wherein the means f)r determining the presence of the electronic mall message includes means)r breaking the message into constituent bodies or message texts and attachments.)f the electronic message; the means for analysing and scanning comprise means for scanning the constituent bodies and attachments and the means for applying the electronic mall message with the tags and operable program code replaced o server means includes means for rebuilding the electronic message from the constituent bodies and attachments.

4. An anti-virus system as claimed in any of the preceding claims, where n the means for analysing and scanning comprises means for scanning the messa e for predetermined character strings.

5. An anti-virus system as claimed in claims 3) to 4, wherein the means for analysing and scanning includes means for scanning attachments for operable macros.

11 6. An anti-virus system as claimed in claims 3 to 5, wherein the system further comprises quarantine means for quarantining a constituent body containing operable program code instead of, or as well as, replacing the operable program code and applying the constituent body to the server means, and/or removing from the message and quarantining an attachment containing a macro or an attachment containing operable program code.

7. An anti-virus system as claimed in claim 6, wherein the quarantine means includes means for removing a macro from an attachment, quarantining the macro and releasing the attachment with the macro removed.

8. An anti-virus system as claimed in claims 6 or 7, wherein the quarantine means includes means for storing the constituent body, attachment or macro in a quarantine storage location as a quarantined item; means for receiving a input indicating a decision whether the quarantined item may be delivered to an intended recipient; and dependant on the decision input either releasing the quarantined item for delivery to the intended recipient with or without the operable code removed or deleting the quarantined item.

9. An anti-virus system as claimed in claims 6 to 8, wherein the quarantine means includes means, on deleting the quarantined item, for informing the intended recipient and/or a sender of the message that the quarantined item has been deleted without being delivered to the intended recipient.

10. An anti-virus system as claimed in claim 5, wherein the means for scanning attachments for operable macros comprises means for sequentially scanning the attachments for a plurality of predetermined character strings.

11. An anti-virus system as claimed in claim 10, wherein the means for scanning attachments for a plurality of predetermined character strings includes means for terminating scanning when one of the predetermined strings is not found on completely scanning the attachment.

12. An anti-virus system as claimed in any of the preceding claims, wherein 0 the means for determining the presence of the electronic mail message is adapted 18 to capture electronic mail messages passing between a first network and a seccnd network.

13. An anti-virus system as claimed in claim 12, wherein the means 7br determining the presence of the electronic mall message is adapted to captilre electronic mail messages passing between an internal or private network and an external or public network.

14. A method for removing a virus from an electronic mail message including the steps of (a) capturing the message; (b) scanning the message for t2gs indicating the presence of operable program code; (c) removing the tags and operable program code from the electronic mail message and replacing the removed tag and operable program code with alternative text; and (d) releasing the electronic mail message with the tags and operable program code replaced.

15. A method a claimed in claim 14, wherein the step of replacing die removed tag and operable code with alternative text comprises using die alternative text to inform a recipient of the message that operable program co le has been replaced.

16. A method as claimed in claim 14 or 15, wherein step (c) comprises quarantining a message or a part of a message containing operable program code.

0 17. A method as claimed in claim 16, wherein the step of quarantining a message or part of a message comprises the steps of.. storincr a constituent bocy, attachment and/or a macro of the message in a quarantine storage location as a quarantined item; receiving a decision whether the quarantined item may be delivered to an intended recipient; and dependant on the decision either releasilig the quarantined item for delivery, with or without the operable code or macro deleted, to the intended recipient or deleting the quarantined item.

18. A method as claimed in claim 17, wherein the step of deleting t ie quarantined item includes informing the intended recipient and/or a sender of t le message that the quarantined item has been deleted without being delivered to t le intended recipient, 19 19. A method as claimed in any of claims 14 or 18, wherein step (a) includes the step of breaking the message into constituent bodies or message texts and attachments of the electronic message; step (b) comprises scanning the constituent bodies and attachments and step (d) includes the step of rebuilding the electronic message from the constituent bodies and attachments.

20. A method as claimed in any of claims 14 to 19, wherein step (b) comprises scanning the message for predetermined character strings.

21. A method as claimed in claims 19 to 20, wherein step (b) includes scanning attachments for operable macros and step (c) comprises removing from the message and quarantining any macros and/or any attachments containing macros.

22. A method as claimed in claims 19 to 21, wherein the step of scanning attachments for operable macros includes sequentially scanning the attachments for a plurality of predetermined character strings.

23. A method as claimed in claim 22, wherein the step of scanning attachments for a plurality of predetermined character strings is terminated when one of the predetermined strings is not found on completely scanning the attachment.

24. A method as claimed in any of claims 14 to 23, wherein step (a) comprises capturing electronic mail messages passing between a first network and a second network.

25. A method as claimed in claim 24, wherein step (a) comprises capturing electronic mail messages passing between an internal or private network and an external or public network.

26. A computer program comprising code means for performing all the steps of the method of any of claims 14 to 25 when the program is run on one or more computers.

27. A computer program as claimed in claim 26, wherein the computer program is embodied on a computer-readable medium.

2-0 28. A computer program product comprising program code means stored in a computer-readable medium for performing the method of any of claims 14 to 25 when that program product is run on one or more computers.

29. An anti-virus system substantially as hereinbefore described with referei ce 5 to and as illustrated in the accompanying drawings.