Macro Virus Detection Plug-in for Data Files

The patent pre-registers a macro virus detecting module as a plug-in of the data file processing program before actual file operations occur. This preliminary setup allows the detection module to be automatically activated when files are opened, enabling detection without requiring complex pre-analysis of all possible data file structures. The module is prepared in advance to handle macro virus detection specifically when triggered by file opening events.

The patent introduces a macro virus detecting module as an intermediary component between the data file processing program and the files themselves. This module acts as a mediator that intercepts file opening operations and performs detection before the main processing program loads file contents. This intermediary approach simplifies the detection process by focusing only on macro virus-specific analysis rather than requiring comprehensive analysis of all data file structures.

Instead of continuous real-time monitoring, the patent implements periodic detection by triggering the macro virus detecting module only at specific event points - when a data file is opened but not yet loaded. This periodic action occurs at discrete intervals based on user operations rather than continuously, significantly reducing system resource consumption while maintaining effective detection capability at critical moments when macro viruses are most likely to be activated.

The detection is performed preliminarily when a file is opened but before its contents are fully loaded into memory. This timing allows the detecting module to analyze the file structure and detect macro viruses before they can be executed, without requiring continuous monitoring resources. The preliminary detection at this specific stage achieves security goals while minimizing ongoing system resource usage.

The patent applies local quality by making the detection module highly specialized for macro virus detection rather than attempting to monitor all types of file operations. The module is configured with specific detection capabilities focused on macro virus characteristics, allowing it to distinguish between normal macro operations and malicious virus behaviors. This specialized local detection quality reduces false warnings by accurately identifying only genuine threats rather than flagging all macro operations as suspicious.

The detection occurs preliminarily at the file opening stage before any macro execution takes place. By detecting macro viruses at this early stage, the system can prevent malicious macros from executing altogether, rather than monitoring and warning during execution. This preliminary detection approach eliminates the need for frequent warnings during user operations, as threats are blocked before they can manifest as suspicious behaviors requiring user attention.