Disclosed in the present invention are a method and apparatus for determining a virus-infected file, which belong to the field of computer security. The method includes: locating data in a file being scanned according to the file offset address associated with a virus signature of a virus; making a comparison of the virus signature with the data located in the file being scanned; and determining that the file being scanned is a virus-infected file when the virus signature matches the located data. The apparatus includes: a locating module, a comparison module and a determination module.