Macro-virus searching and killing method and system

Abstract

The invention discloses a macro-virus searching and killing method and system applied to an enterprise-edition virus searching and killing application program. The macro-virus searching and killing method comprises the steps of monitoring specific-type document opening operation through an enterprise-edition client-side, wherein specific-type documents include office software documents; intercepting a request for target document opening when the request is monitored and uploading a target document to the enterprise-edition client-side; judging whether the target document carries macro-virus or not through the enterprise-edition client-side; and sending a processing instruction to the enterprise-edition client-side according to a judgment result. By means of the macro-virus searching and killing method and system, macro-virus propagation inside an enterprise network can be effectively prevented.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a macro virus checking and killing method and system. Background technique [0002] A macro virus is a set of one or more macros with virus characteristics specially developed by virus creators by taking advantage of the openness of Microsoft Office, that is, the BASIC programming interface provided in Office. This collection of virus macros will affect the use of computers, and can self-replicate and spread through DOC documents and DOT templates. Once the document infected with the macro virus is opened, its macro will be executed, and the macro virus will be activated, further transferred to the computer, and reside on the Normal template. From then on, all autosaved documents will be "infected" with this macro virus, and if another user opens the infected document, the macro virus will be transferred to his computer. [0003] With Microsoft's revision of Office97 ...

AI Technical Summary

Problems solved by technology

[0004] First, the macro virus is very easy to spread in the intranet, and it is difficult to protect

The circulation of office documents is one of the most common ways to transmit office data. Numerous office documents are transmitted from the superior to the grassroots in the form of a pyramid, and the grassroots interact with each other continuously. This flow of office documents is faithful Spread and replicate macro viruses rapidly, leaving IT administrators helpless

[0005] Second, macro viruses can destroy key data in the intranet, causing severe damage and large-scale loss of data in the intranet. It is difficult and time-consuming to restore

[0008] The current method to solve the macro virus in the enterprise is to deploy anti-virus tools on the intranet client. However, due to the extremely fast mutation of the macro virus, if you want to follow the speed of the macro virus mutation, you need to update it in a considerable process. The macro virus database is updated at a fast speed, which makes the macro virus database stored in the terminal become larger and bloated, which affects the efficiency of scanning and killing, and even affects the normal operation of the terminal system

In addition, if the terminal in the intranet cannot connect to the Internet, it can only connect to the management terminal to update the macro virus database, which is less efficient in killing and cannot quickly resist the variant macro virus

Images