An antivirus method for taking measures against a virus invading a computer, comprising: causing antivirus software for detecting and removing the virus using a definition file to operate under a program execution environment different from a virtual machine (110, 120), and to monitor at least one virtual machine that is created on the computer and that executes one or more application programs, the definition file storing pattern data of each virus and being frequently updated; periodically storing, by the virtual machine (110, 120), a state of the virtual machine as a snapshot; and suspending the virtual machine from which the virus is detected, if the antivirus software detects the virus (step S21); characterised by the virus removal procedures of: by using the snapshot of the suspended virtual machine that was stored immediately before the antivirus software detected the virus, restoring the virtual machine at a state corresponding to a point in time at which the snapshot was stored (step S23); detecting, by the antivirus software, whether there is a previously-undetected virus from the restored virtual machine using the frequently-updated definition file (steps S24 and S25); and either: resuming an operation of the restored virtual machine when no previously-undetected virus is detected (step S27); or when a previously-undetected virus is detected, restoring the virtual machine by using an earlier snapshot of the suspended virtual machine that was stored immediately before the snapshot that was used to restore the virtual machine immediately before the previously-undetected virus was detected (step S23), and subsequently repeating the procedures of detecting whether there is a previously-undetected virus from the restored virtual machine (steps S24 and S25) and restoring the virtual machine using an earlier snapshot (step S23), until it is determined that operation of the suspended virtual machine can be resumed or that the virus removal procedures are to be terminated. causing antivirus software for detecting and removing the virus using a definition file to operate under a program execution environment different from a virtual machine (110, 120), and to monitor at least one virtual machine that is created on the computer and that executes one or more application programs, the definition file storing pattern data of each virus and being frequently updated; periodically storing, by the virtual machine (110, 120), a state of the virtual machine as a snapshot; and suspending the virtual machine from which the virus is detected, if the antivirus software detects the virus (step S21); characterised by the virus removal procedures of: by using the snapshot of the suspended virtual machine that was stored immediately before the antivirus software detected the virus, restoring the virtual machine at a state corresponding to a point in time at which the snapshot was stored (step S23); detecting, by the antivirus software, whether there is a previously-undetected virus from the restored virtual machine using the frequently-updated definition file (steps S24 and S25); by using the snapshot of the suspended virtual machine that was stored immediately before the antivirus software detected the virus, restoring the virtual machine at a state corresponding to a point in time at which the snapshot was stored (step S23); detecting, by the antivirus software, whether there is a previously-undetected virus from the restored virtual machine using the frequently-updated definition file (steps S24 and S25); and either: resuming an operation of the restored virtual machine when no previously-undetected virus is detected (step S27); or when a previously-undetected virus is detected, restoring the virtual machine by using an earlier snapshot of the suspended virtual machine that was stored immediately before the snapshot that was used to restore the virtual machine immediately before the previously-undetected virus was detected (step S23), and subsequently repeating the procedures of detecting whether there is a previously-undetected virus from the restored virtual machine (steps S24 and S25) and restoring the virtual machine using an earlier snapshot (step S23), until it is determined that operation of the suspended virtual machine can be resumed or that the virus removal procedures are to be terminated. resuming an operation of the restored virtual machine when no previously-undetected virus is detected (step S27); or when a previously-undetected virus is detected, restoring the virtual machine by using an earlier snapshot of the suspended virtual machine that was stored immediately before the snapshot that was used to restore the virtual machine immediately before the previously-undetected virus was detected (step S23), and subsequently repeating the procedures of detecting whether there is a previously-undetected virus from the restored virtual machine (steps S24 and S25) and restoring the virtual machine using an earlier snapshot (step S23), until it is determined that operation of the suspended virtual machine can be resumed or that the virus removal procedures are to be terminated.