Provided in embodiments of the present invention are a method and device for virus identification, a nonvolatile storage medium, and a device. The embodiments of the present invention, by scanning files in a designated directory, acquire the file name of an executable file, and then determine a file name that is either identical or similar to the file name of the executable file, allow for identification of the executable file as a folder virus on the basis of an attribute of a folder corresponding to the identical or similar file name, obviate the need for relying on virus feature information of folder viruses, are easy to operate and not error-prone, thus increasing the efficiency and reliability of virus identification.