SYSTEM AND METHOD FOR PERFORMING ANTI-VIRUS SCAN OF FILE ON VIRTUAL MACHINE Russian patent published in 2017 - IPC G06F21/53 G06F21/56 

FIELD: information technology.

SUBSTANCE: computer-implemented method for performing an anti-virus scan of a file on a virtual machine in which: a file in a virtual machine is executed with successive entry of API function calls and entry of internal events into the first log, the first type signature from the database of first type signatures is identified from the first log, re-execution of the file is performed on the virtual machine with entries of internal events in the second log. After that, the second type signature is identified in the second log from the second type signature database and the criterion for making entries about the API function calls based on the second and the first logs is determined, the third execution of the file is made on the virtual machine, adding only internal events to the third log, as long as the criterion for entering records about API function calls, after which records are made about API function calls, is not performed, an anti-virus scan of the file is performed by identifying in the third log a malicious signature using database of malicious signatures, the file will be considered malicious when a malicious signature is detected in the third log.

EFFECT: detecting a malicious file containing program code that makes it difficult to detect this malicious file when executing a file on a virtual machine.

40 cl, 3 tbl, 6 dwg