Method and device for unlocking files

Abstract

The invention provides a file unlocking method and device. The method comprises the following steps of: calling an application programming interface (API) of an operating system to open an object file; judging whether the return value of the object file meets the preset type if the object file can not be opened; if so, calling the custom API for file opening to operate the object file, specifically, obtaining the file operation request which includes input parameters of the caller, wherein the input parameters include a file path; searching an object manager for the corresponding file object parsing routine based on the file path; and if the corresponding file object parsing routine is searched, generating an I / O request packet based on the file object parsing routine and sending the I / O request packet to the preset original address of file system lower equipment. The method and the device have the following beneficial effect that the self-protection behaviours of the files with malicious programs can be distinguished and countered in the complex client environments to enhance the counterforce of attacking and defending drive level malicious programs.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a file unlocking method and a file unlocking device. Background technique [0002] A computer virus refers to a set of computer instructions or program codes that are inserted into a computer program by the compiler to destroy computer functions or data, affect the use of the computer, and are capable of self-replication. Once a computer is infected with a virus, the computer usually shows that its files are increased , delete, change the name or attribute, and move to other directories. These operations of the virus on the computer files may cause a series of problems such as the inability to run normal programs, the crash of the computer operating system, the remote control of the computer, and the theft of user information. question. [0003] In order to ensure the safe operation of the computer, it is necessary to scan and kill the virus-infected files in the compu...

AI Technical Summary

Problems solved by technology

Existing security software has a single means of unlocking and shredding virus-infected files, and cannot break through the layers of protection set up for virus-infected files, and the ability to resist is not strong

Traditional security software vendors have only solved part of the "undelete" problem, and often show a certain lack of ability in the attack and defense of the operating system kernel state, and the ability to resist driver-level malicious programs (Rootkit) is relatively weak

Images