1. A method of preventing an e-mail from infecting a computing device, the method comprising: viewing the e-mail in a browser on the computing device; creating a document object model (DOM) tree from the e-mail, wherein the DOM tree contains known and unknown elements and wherein known elements are known to be safe and wherein unknown elements potentially include malicious Javascripts and HTML elements wherein the DOM tree includes a plurality of branches, the plurality of branches including at least one branch having only known elements; applying a first filter to the DOM tree, the first filter excluding the at least one branch in the DOM tree having only known elements, thereby creating a modified DOM tree wherein the excluding of the at least one branch from the DOM tree is performed such that remaining branches of the DOM tree are still connected with one another; filtering the modified DOM tree using a script analyzer filter wherein the script analyzer filter intercepts unknown elements in the modified DOM tree; and emulating execution of the unknown elements in the modified DOM tree to determine which unknown elements are malicious.
1. A method of preventing an e-mail from infecting a computing device, the method comprising: viewing the e-mail in a browser on the computing device; creating a document object model (DOM) tree from the e-mail, wherein the DOM tree contains known and unknown elements and wherein known elements are known to be safe and wherein unknown elements potentially include malicious Javascripts and HTML elements wherein the DOM tree includes a plurality of branches, the plurality of branches including at least one branch having only known elements; applying a first filter to the DOM tree, the first filter excluding the at least one branch in the DOM tree having only known elements, thereby creating a modified DOM tree wherein the excluding of the at least one branch from the DOM tree is performed such that remaining branches of the DOM tree are still connected with one another; filtering the modified DOM tree using a script analyzer filter wherein the script analyzer filter intercepts unknown elements in the modified DOM tree; and emulating execution of the unknown elements in the modified DOM tree to determine which unknown elements are malicious. 7. A method as recited in claim 1 wherein branches having abnormal or unknown elements and scripts remain in the DOM tree.