Method to detect viruses hidden inside a password-protected archive of compressed files

摘要

A method for inspecting a compressed archive file for virus infection without having to decompress the files contained therein. Data in the archive header is used to determine the probability that the compressed archive is infected. Default parameters used for the compression, the compression ratio, the number of files stored in the compressed archive, and the total size of the archive are factors utilized during inspection according to the present invention to detect archives with a high probability of infection, as well as to recognize archives with a low probability of infection. The method is especially beneficial when the archive has been encrypted or password-protected and the files contained therein cannot be decompressed, but is also advantageous when decompression is possible. In addition, use of the present invention avoids the danger of attempting to decompress a malicious archive containing an archive bomb.