A virus detecting method, comprising: receiving a network data stream carrying a portable executable PE file, and obtaining a file header of the PE file by means of reassembly according to a data packet in the network data stream, wherein the file header comprises structure information of the PE file; calculating first identification information according to the structure information of the PE file; matching the first identification information with virus identification information prestored in an antivirus database, and if the matching succeeds, determining, according to a correspondence that is between the virus identification information and a file type and is prestored in the antivirus database, whether the PE file is an Archive file, wherein the file type comprises an Archive file and a PE virus file; if the PE file is an Archive file, acquiring, from the network data stream, a data packet that carries a data part of the Archive file, and calculating second identification information according to the data packet that carries the data part of the Archive file; and matching the second identification information with the virus identification information prestored in the antivirus database, and if the matching succeeds, determining that the Archive file is an Archive virus file; wherein the acquiring, from the network data stream, a data packet that carries a data part of the Archive file, and calculating second identification information according to the data packet that carries the data part of the Archive file specifically comprises: searching for, in a correspondence that is between the virus identification information and an Archive file form and is prestored in the antivirus database, an Archive file form corresponding to the first identification information, wherein the Archive file form comprises an Archive file whose data part comprises data structure information and an Archive file whose data part does not comprise data structure information; acquiring, from the network data stream, the data packet that carries the data part of the Archive file; and calculating the second identification information according to the Archive file form corresponding to the first identification information and according to the data packet that carries the data part of the Archive file. receiving a network data stream carrying a portable executable PE file, and obtaining a file header of the PE file by means of reassembly according to a data packet in the network data stream, wherein the file header comprises structure information of the PE file; calculating first identification information according to the structure information of the PE file; matching the first identification information with virus identification information prestored in an antivirus database, and if the matching succeeds, determining, according to a correspondence that is between the virus identification information and a file type and is prestored in the antivirus database, whether the PE file is an Archive file, wherein the file type comprises an Archive file and a PE virus file; if the PE file is an Archive file, acquiring, from the network data stream, a data packet that carries a data part of the Archive file, and calculating second identification information according to the data packet that carries the data part of the Archive file; and matching the second identification information with the virus identification information prestored in the antivirus database, and if the matching succeeds, determining that the Archive file is an Archive virus file; wherein the acquiring, from the network data stream, a data packet that carries a data part of the Archive file, and calculating second identification information according to the data packet that carries the data part of the Archive file specifically comprises: searching for, in a correspondence that is between the virus identification information and an Archive file form and is prestored in the antivirus database, an Archive file form corresponding to the first identification information, wherein the Archive file form comprises an Archive file whose data part comprises data structure information and an Archive file whose data part does not comprise data structure information; acquiring, from the network data stream, the data packet that carries the data part of the Archive file; and calculating the second identification information according to the Archive file form corresponding to the first identification information and according to the data packet that carries the data part of the Archive file. searching for, in a correspondence that is between the virus identification information and an Archive file form and is prestored in the antivirus database, an Archive file form corresponding to the first identification information, wherein the Archive file form comprises an Archive file whose data part comprises data structure information and an Archive file whose data part does not comprise data structure information; acquiring, from the network data stream, the data packet that carries the data part of the Archive file; and calculating the second identification information according to the Archive file form corresponding to the first identification information and according to the data packet that carries the data part of the Archive file.