File macro virus immunization method and device

Abstract

The invention discloses a file macro virus immunization method and device. The device comprises a request intercepting and capturing module, a request analyzing module, a macro virus judging module, a first processing module and a second processing module, wherein the request intercepting and capturing module is applicable to interception and capture of a file behavior request of an Office progress; the request analyzing module is suitable for analyzing the file behavior request to obtain information of a corresponding file behavior; the macro virus judging module is suitable for judging whether a file behavior is a macro virus behavior or not; the first processing module is suitable for allowing the file behavior request when the Office progress modifies the macro virus behavior of a template file; the second processing module is suitable for stopping the file behavior request in other macro virus behaviors; the request analyzing module is suitable for analyzing parameters of an application program interface (API) to obtain information of the corresponding file behavior; and the information of the file behavior at least comprises one or more of the following information: a file path, a behavior name, a sharing manner and a file attribute. According to the file macro virus immunization method and device disclosed by the invention, an immunization range of the macro viruses can be provided and the immunization efficiency of the macro viruses is improved.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a file macro virus immunization method and device. Background technique [0002] A macro virus is a computer virus that resides in the macros of a document or template. Once such a document is opened, the macros in it are executed, and the macro virus is activated, transferred to the computer, and resides on the template. From then on, all autosaved documents will be "infected" with this macro virus, and if another user opens the infected document, the macro virus will be transferred to his computer. [0003] Because the macro virus is hidden in the data file, and the script syntax it uses is flexible, there are many ways to write a function, so it is very difficult to identify whether a file has a macro virus. [0004] In the prior art, a file macro virus immunization method adopts the method of occupying pits. Specifically, if a certain macro virus is found to relea...

AI Technical Summary

Problems solved by technology

[0003] Because the macro virus is hidden in the data file, and the script syntax it uses is flexible and changeable, there are many ways to write a function, so it is very difficult to identify whether a file has a macro virus

[0004] In the prior art, a file macro virus immunization method adopts the method of occupying pits. Specifically, if a certain macro virus is found to release a file with a specific name, a new folder with the same name is created, and the Windows file and folder with the same name are used to create a new folder with the same name. Prevent the spread of macro viruses in a way that cannot coexist; this method can only immunize specific and existing macro viruses, but not new and unknown viruses, so the immune efficiency is not high

[0005] Another kind of file macro virus immunity method in the prior art prohibits all macro functions of Office by disabling all macro methods; this method will affect the files that normally need to use macro functions

Images