A method is disclosed for detecting computer viruses. The method allows receipt of an electronic mail message that includes at least one encrypted attachment. The electronic mail message is examined in order to identify potential encryption codes. The encryption codes are used in order to attempt and decrypt the attachments. The attachments are expanded into one or more files. The files are then checked for the presence of computer viruses.
