Abstract: A method for inspecting a compressed archive file for virus infection without having to decompress the files contained therein. Data in the archive header is used to determine the probability that the compressed archive is infected. Default parameters used for the compression, the compression ratio, the number of files stored in the compressed archive, and the total size of the archive are factors utilized during inspection according to the present invention to detect archives with a high probability of infection, as well as to recognize archives with a low probability of infection. The method is especially beneficial when the archive has been encrypted or password-protected and the files contained therein cannot be decompressed, but is also advantageous when decompression is possible. In addition, use of the present invention avoids the danger of attempting to decompress a malicious archive containing an archive bomb.

Abstract: A method for inspecting an archive, the method comprising the steps of: retrieving information from a header of the archive, such as a compression ratio of one or more files of the archive, the average compression ratio of the archive, an expression of the compression ratio of one or more files of the archive, the size of the archive and the number of files stored within the archive, and employing said information for inspecting the archive.