Method and device for searching for parent virus

A device for searching for a parent virus file, comprising:

• a first determination module configured to determine an arbitrary virus file as a child virus file;
• a first obtaining module configured to identify a computer containing the child virus file;
• a second obtaining module configured to identify a time when the child virus first appeared in the computer;
• a third obtaining module configured to identify times when other virus files contained in the computer that are different from the child virus file are first executed;
• a second determination module configured to determine suspect parent virus files from among the other virus files, the suspect parent virus files being first executed within a predetermined time period before the time when the child virus file first appeared in the computer;
• and
• a third determination module configured to determine the parent virus file from among the suspect parent virus files.

A non-transitory computer-readable medium storing a computer program, wherein execution of the computer program causes a processor to:

• determine an arbitrary virus file as a child virus file;
• identify a computer containing the child virus file;
• identify a time when the child virus file first appeared in the computer;
• identify times when other virus files contained in the computer that are different from the child virus file are first executed;
• determine suspect parent virus files from among the other virus files, the suspect parent virus files being first executed within a predetermined time period before the time when the child virus file first appeared in the computer;
• and
• determine a parent virus file to the child virus file from among the suspect parent virus files.