Patent ID: 8176558

Claim:
An antivirus method for taking measures against a virus invading a computer, comprising: causing a second virtual machine, which executes antivirus software for detecting and removing the virus, to monitor at least one first virtual machine that is created on the computer and execute one or more application program; periodically storing a state of the first virtual machine as snapshot; suspending the first virtual machine from which the virus is detected if the antivirus software executed on the second virtual machine detects the virus; causing the antivirus software to detect the virus for the first virtual machine restored by using the snapshot; determining whether or not the antivirus software detects a virus that cannot be removed from the first virtual machine; restoring the first virtual machine at a state of a point in time when the snapshot representing a preceding state of the first virtual machine in the determining process is stored by using the preceding snapshot of the suspended first virtual machine, if the antivirus software detects the virus that cannot be removed from the first virtual machine; causing the antivirus software to scan the first virtual machine restored to the preceding snapshot; determining whether or not the first virtual machine restored to the preceding snapshot is infected with a virus based on scanning result; resuming the first virtual machine restored to the preceding snapshot if the restored first virtual machine is not infected with the virus; and returning to the process determining whether or not the antivirus software detects a virus that cannot be removed from the first virtual machine, if the restored first virtual machine is infected with the virus.