A method and device for detecting and inoculating emails infected with viruses
are described. The method involves identifying a particular traffic and its associated
data packets as an email session and scanning the associated data packets in order
to compare their contents with a database of known signatures. If a match is found
between the data packets and a signature of a known virus, it is determined if
there is an attachment to the email. If an attachment is detected, some or all
of the bits of the data packets associated with the attachment are altered, thereby
rendering the infected attachment harmless. The network device includes memory
for storing the database of known signatures and a content processor able to compare
the contents of data packets with a database of known signatures. The content processor
is also operable to alter some or all of the bits of the attachment to inoculate
the email and attachment.
