Method and system for processing virus-infected files

Abstract

The invention discloses a method and a system for processing files affected by virus. The method comprises the following steps of: acquiring files which fail to read in a file system to be used as files to be processed; acquiring cluster distributed information of the files to be processed on a disk; reading data of the files to be processed from the disk according to the cluster distributed information; writing the read data in a temporary file; and analyzing the safety of the temporary file, and if the temporary file is unsafe, clearing the temporary file and the corresponding files to be processed. The step for acquiring the cluster distributed information of the files to be processed on the disk comprises the following substeps of: opening the files to be processed in read attribute to obtain corresponding handles; and acquiring the cluster distributed information, which corresponds to the handles, of the files to be processed on the disk based on a function of disk drive control codes of a driver interface function of equipment. By the method and the system, the efficiency of killing the virus can be improved.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a processing method and system for virus-infected files. Background technique [0002] With the continuous development of computer technology, computers have become an indispensable partner for people no matter in daily life or work, and have brought a lot of convenience to people's work and life, but there is one The discordant factor, that is the computer virus. [0003] A computer virus refers to a set of computer instructions or program codes compiled or inserted into computer programs that destroy computer functions or data, affect computer use, and are capable of self-replication. Once infected with a virus, the computer usually shows that its files are added, deleted, changed names or attributes, and moved to other directories. These operations of viruses on computer files may cause normal programs to fail to run, computer operating systems to crash, and compute...

AI Technical Summary

Problems solved by technology

Viruses in the prior art often lock the virus-infected file by occupying the file handle, setting the read-only attribute of the file, and making the file in a deleted state. The lock cannot be cracked by conventional means.

[0005] A kind of virus-killing method of prior art, enumerates all processes under the operating system, and enumerates the file handle that each process opens, finds the virus-infected file that adds exclusive lock by checking file handle; Virus-infected files with exclusive locks, but the enumeration of processes and file handles is time-consuming, and the anti-virus efficiency is not high

[0006] Another anti-virus method in the prior art uses some undisclosed methods to check and kill virus-infected files with kernel locks; however, the undisclosed methods are easily incompatible with other programs in the operating system, causing unstable problems such as blue screens in the operating system , thus affecting the antivirus efficiency

Images