Abstract: An e-mail client serves to detect mass mailing malware by detecting if over a threshold number of addressees from within the address book of that e-mail client are being sent an e-mail or over a predetermined number of substantially identical e-mails are being sent by that e-mail client. A quarantine queue may be provided in which e-mail messages are held for a predetermined period prior to being sent out in order that separate e-mail messages being sent to a large proportion of the address book addressees may be identified and linked together.

Abstract: A malware scanner 2 operates as a low priority task within a multi-tasking environment. A pending scan database 14 is maintained storing details of computer files that have been written to a data storage device 6, but have not yet been scanned. The scanner 2 operates to subsequently scan these computer files for malware at which point they are removed from the pending scan database 14 and added to the scanned file database 16.

Abstract: A malware scanner (8) operates to scan compressed computer files (16) by compressing the malware signatures (17) using the same compression algorithm as used for the compressed computer file and then comparing the compressed malware signatures (18) with the compressed computer file directly.

Abstract: A system, method and computer program product for testing scanner updates. Initially, a full-release scanner update is distributed from a server to a plurality of computers utilizing a network. A pre-release scanner update is also distributed from the server to the computers utilizing the network. The full-release scanner update is executed on the computers for security scanning. Further, the pre-release scanner update is executed on the computers for testing purposes. Results of the testing are transmitted from the computers to the server utilizing the network.

Abstract: The malware definition data of mobile data processing devices is updated via a data channel associated with a wireless telephony link to that mobile data processing device. The data channel may be the same channel wed for SMS messaging and the transfer of control information. The mobile data processing device is typically a mobile telephone. The update data may be digitally signed to increase security.

Abstract: A malware scanner (8) operates to scan compressed computer files (16) by compressing the malware signatures (17) using the same compression algorithm as used for the compressed computer file and then comparing the compressed malware signatures (18) with the compressed computer file directly.

Abstract: A system, method and computer program product are provided for recognizing virus signatures. Initially, a list of virus signatures is provided. Next, the list of virus signatures is combined into a tree of virus signatures. Data is subsequently compared against the tree of virus signatures for virus signature recognition.

Abstract: A malware scanner 2 operates as a low priority task within a multi-tasking environment. A pending scan database 14 is maintained storing details of computer files that have been written to a data storage device 6, but have not yet been scanned. The scanner 2 operates to subsequently scan these computer files for malware at which point they are removed from the pending scan database 14 and added to the scanned file database 16.

Abstract: The malware definition data 34 of a mobile data processing device 2, 6 is updated via a data channel associated with a wireless telephony link to that mobile data processing device. The data channel may be the same channel used for SMS messaging and the transfer of control information. The mobile data processing device is typically a mobile telephone. The update data may be digitally signed to increase security.

Abstract: A malware scanner (8) operates to scan compressed computer files (16) by compressing the malware signatures (17) using the same compression algorithm as used for the compressed computer file and then comparing the compressed malware signatures (18) with the compressed computer file directly.

Abstract: An e-mail client serves to detect mass mailing malware by detecting if over a threshold number of addressees from within the address book of that e-mail client are being sent an e-mail or over a predetermined number of substantially identical e-mails are being sent by that e-mail client. The sending of e-mail messages to a substantial proportion of the addressees within an address book is a characteristic indicative of mass mailing malware. A quarantine queue may be provided in which e-mail messages are held for a predetermined period prior to being sent out in order that separate e-mail messages being sent to a large proportion of the address book addressees may be identified and linked together.