System and method for killing ROOTKIT

Abstract

This invention discloses one virus killing ROOTKIT system and method, wherein, the system comprises virtual machine monitor, service operation system in virtual monitor and at least one customer operation system; the service operation system comprises test module to check whether there is ROOTKIT in the operation system and to find alarm. This invention system and method can check ROOTKIT in reliable operation inside the memory area besides operation system.

Description

technical field [0001] The invention relates to a system and method for checking and killing viruses, in particular to a system and method for checking and killing ROOTKIT. Background technique [0002] With the continuous increase of commercial users' dependence on personal computers (PCs), the main tools for users to check viruses and Trojans on PCs are anti-virus and anti-Trojan tool software. The working principle of these tools is When the system is running, it scans the processes in the system memory and the system files saved on the hard disk, and matches the relevant characteristic files to find viruses and Trojan horses. [0003] The operating system is composed of two parts: the kernel (Kernel) and the shell (Shell). Among them: the kernel is responsible for all practical work, including CPU task scheduling, memory allocation management, device management, file operations, etc.; the shell is based on the interaction provided by the kernel. An interface that exists...

AI Technical Summary

Problems solved by technology

[0008] 1) This method can only detect files in the hard disk, and cannot check processes that may enter the system or the running state of the system through the network or other means;

[0009] 2) Shutting down the system will cause inconvenience to users, especially for some important systems that cannot be shut down for 24 hours (for example, the bank's authorization system, etc.), the method of shutting down the system is unrealistic;

Images