1. A computer implemented method for preventing malicious code from propagating in a computer, the method comprising the steps of: detecting attempted malicious behavior of running code received in a first email and executed by a user; blocking the attempted malicious behavior in response to the detection, the running code being placed in a repository where the running code can no longer be executed by the user; generating a signature to identify the running code stored in the repository that attempted the malicious behavior, the signature being one of a number of signatures generated over a period of time for other running code that attempted malicious behavior; regulating the number of signatures by sorting the signatures according to matches per signature to the other running code and removing signatures as newer signatures are generated in response to reaching a predetermined limit; detecting code received in a second email by the user that is identified to match the signature generated, the identification occurring before the user executes the identified code; and blocking the execution of the identified code.