Abstract: A method for determining behavior information corresponding to a dangerous file in a computer device includes running the dangerous file in a virtual environment of the computer device when detecting existence of the dangerous file, wherein the virtual environment comprises at least one virtual API identical to at least one real API in a real environment of the computer device; monitoring behavior(s) of the dangerous file in the virtual environment to obtain the behavior information corresponding to the dangerous file. According to the solution of the present disclosure, it does not need to analyze disruptive behaviors of a dangerous file manually, the behavior information of the dangerous file can be quickly obtained in a virtual environment, thereby quickly and comprehensively repair the real system of the computer device.

Abstract: The present disclosure provides a speech interactive method and device. The method includes: during a process of displaying an interface of an application, detecting a first user operation; in response to the first user operation, querying a speech instruction associated with the application based on the application containing the interface and querying a system general speech instruction; setting the speech instruction and the system general speech instruction as applicable speech instructions for the application; and providing a prompt based on the applicable speech instructions to perform a speech interaction.

Abstract: Disclosed are a file scanning method and apparatus. The method includes: obtaining a quantity of hard links of a to-be-scanned file used as a scanning target; if the quantity of hard links of the to-be-scanned file is greater than 1, when the to-be-scanned file is used as the scanning target for the first time, invoking a scanning engine to scan the to-be-scanned file to obtain a scanning result, and storing a file identifier uniquely identifying the to-be-scanned file and the scanning result to a storage unit, and when the to-be-scanned file is used as the scanning target again, querying for and obtaining the scanning result of the to-be-scanned file from the storage unit according to the file identifier.

Abstract: A method for determining behavior information corresponding to a dangerous file in a computer device includes running the dangerous file in a virtual environment of the computer device when detecting existence of the dangerous file, wherein the virtual environment comprises at least one virtual API identical to at least one real API in a real environment of the computer device; monitoring behavior(s) of the dangerous file in the virtual environment to obtain the behavior information corresponding to the dangerous file. According to the solution of the present disclosure, it does not need to analyze disruptive behaviors of a dangerous file manually, the behavior information of the dangerous file can be quickly obtained in a virtual environment, thereby quickly and comprehensively repair the real system of the computer device.

Abstract: Disclosed are a file scanning method and apparatus. The method includes: obtaining a quantity of hard links of a to-be-scanned file used as a scanning target; if the quantity of hard links of the to-be-scanned file is greater than 1, when the to-be-scanned file is used as the scanning target for the first time, invoking a scanning engine to scan the to-be-scanned file to obtain a scanning result, and storing a file identifier uniquely identifying the to-be-scanned file and the scanning result to a storage unit, and when the to-be-scanned file is used as the scanning target again, querying for and obtaining the scanning result of the to-be-scanned file from the storage unit according to the file identifier.

Abstract: Embodiments of the present disclosure provide a virus processing method and apparatus. In embodiments of the present disclosure, attribute analysis on the threads contained in the target process is performed to determine whether at least one of the threads contained in the target process matches virus attribute information. If at least one of the threads contained in the target process matches virus attribute information, virus type information is determined based on the matched virus attribute information, so that execution of process creation operation is prohibited based on the virus type information. Due to the measures of prohibiting execution of process creation operation, replication of virus in the system can be effectively prevented so as to improve security performance of the system.