1. A computer-implemented method comprising: receiving, at a network gateway computer system logically interposed between a client workstation and an email server, an archive file that is in transit across a network as an attachment to an email message destined for the client workstation; and without decrypting and without decompressing contents of the archive file: identifying, by an anti-virus detection module running on the network gateway computer system, a type and associated structure of the archive file by examining (i) one or more primary identification bytes stored within the archive file that contain information intended to identify the type of the archive file or (ii) one or more secondary identification bytes stored within the archive file that contain identifiable data intended for a purpose other than identifying the type of the archive file; based on the identified type and the associated structure, obtaining, by the anti-virus detection module, descriptive information from the archive file describing a contained file of a plurality of contained files within the archive file, the descriptive information including at least a hash value of the contained file in uncompressed format; evaluating, by the anti-virus detection module, the descriptive information by comparing the descriptive information to signatures of known malicious or known undesired computer files; if the evaluating results in a determination that the contained file is a known malicious or a known undesired computer file, then producing, by the anti-virus detection module, a clean version of the archive file by removing the contained file from the archive file and regenerating the archive file without the contained file; and delivering, by the network gateway computer system, the clean version of the archive file to the client workstation.
1. A computer-implemented method comprising: receiving, at a network gateway computer system logically interposed between a client workstation and an email server, an archive file that is in transit across a network as an attachment to an email message destined for the client workstation; and without decrypting and without decompressing contents of the archive file: identifying, by an anti-virus detection module running on the network gateway computer system, a type and associated structure of the archive file by examining (i) one or more primary identification bytes stored within the archive file that contain information intended to identify the type of the archive file or (ii) one or more secondary identification bytes stored within the archive file that contain identifiable data intended for a purpose other than identifying the type of the archive file; based on the identified type and the associated structure, obtaining, by the anti-virus detection module, descriptive information from the archive file describing a contained file of a plurality of contained files within the archive file, the descriptive information including at least a hash value of the contained file in uncompressed format; evaluating, by the anti-virus detection module, the descriptive information by comparing the descriptive information to signatures of known malicious or known undesired computer files; if the evaluating results in a determination that the contained file is a known malicious or a known undesired computer file, then producing, by the anti-virus detection module, a clean version of the archive file by removing the contained file from the archive file and regenerating the archive file without the contained file; and delivering, by the network gateway computer system, the clean version of the archive file to the client workstation. 7. The method of claim 1 , further comprising responsive to the determination that the contained file is a known malicious or a known undesired computer file, issuing an alert to a user or administrator indicating detection of the malicious or undesired computer file and describing any action taken.