Storage medium storing terminal identifying program terminal identifying apparatus, and mail system

A terminal identifying apparatus operating in cooperation with a mail server including a virus definitions, a mail-archive-information storage unit which stores information of the e-mail as mail-archive information, a distributing unit which distributes an e-mail addressed to a terminal in response to a distribution request from the terminal, and a history storage unit which stores a distribution request history associating a distribution request of an email with terminal identification information identifying a terminal that issued distribution request of the terminal, said terminal identifying apparatus comprising:

• an e-mail-with-new-virus identifying unit which checking the mail archive information in the mail server and identifies an e-mail with a new virus, when definitions of new viruses have been added in the virus definitions;
• an account information obtaining unit obtaining account information of the e-mail with the new virus;
• and
• an infected-terminal identification extracting unit extracting the terminal identification information of the terminal that issued the distribution request of the e-mail with the new virus, as new-virus-infected-terminal identification information, based upon both the obtained account information and the distribution request history in the mail server.

A mail system comprising:

• a mail server which serves as a server of e-mails;
• and
• one or more relay devices relaying e-mails which are sent and received between the mail server and terminals;
• wherein said mail server includes
• a mail archive information storage unit storing information of e-mails as mail archive information,
• a distributing unit distributing e-mails addressed to the terminal in response of a distribution request from the terminal;
• a history storage unit storing a distribution request history associating each distribution request of an e-mail with terminal identification information serving as information identifying a terminal that issued the distribution request of the e-mail;
• an e-mail-with-new-virus identifying unit checking the mail archive information and identifies whether the e-mail has a new virus when definitions of new viruses have been added in a virus definition file;
• an account-information obtaining unit obtaining account information of the e-mail with the new virus, the e-mail identified by the e-mail-with-new-virus identifying unit;
• an infected-terminal-identification extracting unit extracting the terminal identification information of the terminal that issued a distribution request of the e-mail with the new virus, as new-virus-infected-terminal identification information, based upon both the obtained account information and the distribution request history;
• and
• an infected-terminal-identification-information sending unit sending the extracted new-virus-infected-terminal identification information to the one or more relay devices;
• and
• wherein each of said relay devices includes
• an infected-terminal-identification-information receiving unit receiving the sent new-virus-infected-terminal identification information;
• an infected-terminal determining unit determining whether a terminal with a new virus corresponding to the received new-virus-infected-terminal identification information is included in terminals whose traffic the relay device relays;
• and
• a quarantining unit quarantining the new-virus-infected terminal from a network when the infected-terminal determining unit determined that the new-virus-infected-terminal is included in terminals whose traffic the relay device relays.