Patent ID: 9723021
Date: 2017-08-01
CPC Classifications: G06F,H04L,H04W

Claim:
1. A virus detecting method, comprising: receiving a network data stream carrying a portable execute (PE) file; obtaining a file header of the PE file using a data packet in the network data stream, wherein the file header comprises structure information of the PE file; calculating first identification information using the structure information of the PE file; determining, according to a correspondence between virus identification information prestored in an antivirus database and a file type and prestored in the antivirus database, whether the PE file is an Archive file when successfully matching the first identification information with the virus identification information, wherein the file type comprises an Archive file and a PE virus file; acquiring, from the network data stream, a data packet that carries a data part of the Archive file when the PE file is an Archive file; calculating second identification information using the data packet that carries the data part of the Archive file; and determining, that the Archive file is an Archive virus file when successfully matching the second identification information with the virus identification information prestored in the antivirus database.