1. A method of blocking an email spam, comprising: matching a predefined pattern in a message body and message header fields of an email received on a computer host; creating a data structure of characteristic information corresponding to the matched pattern, the data structure of characteristic information being created after the email is received on the computer host; wherein the characteristic information of the matched pattern includes information for locating the matched pattern in the message header fields or message body, and information describing the content of the matched pattern; analyzing the characteristic information of the matched pattern to determine whether the email is a spare; and if the email is a spam, blocking the spam.