System rogue program detecting method and device

Abstract

The invention discloses a system rogue program detecting method and device. The method comprises the steps of traversing system kernel space to obtain an active drive program list, taking the drive programs from the drive program list so as to obtain drive program information, matching the drive programs with the characteristic combinations in a preset malicious code characteristic base in characteristic on the basis of the drive program information so as to detect whether the drive programs are rogue programs. According to the system rogue program detecting method and device, the safety condition of the system kernel is checked in the drive level, whether key calling paths of a system is tampered and destroyed by stubborn rogue programs is checked, and corresponding elimination repair strategies are selected for rogue programs such as Rootkit Trojan programs to eliminate the rogue programs and repair the system. The system rogue program detecting method and device are strong in pertinency, low in false alarm rate, accurate in repair, and capable of preventing repeated infection, can thoroughly eliminate Rootkit type Trojan, ensure normal utilization of a user system, and greatly improve the safety of the system.

Description

technical field [0001] The invention relates to the technical field of Internet and network security, in particular to a system malicious program detection method and device for rootkit-like stubborn Trojan horses. Background technique [0002] At present, some malicious Trojan horses install Trojan horses on user systems by means of game plug-ins, video player bundles, or disguised as system software, release kernel drivers, and destroy the protection functions of security software through drivers, preventing security software from accessing files related to Trojan horses. 1. The scanning operation of the registry entries protects the process of the Trojan horse from being terminated by the security software, thereby hiding it safely on the user's computer, causing serious consequences for the user that the Trojan horse cannot be removed repeatedly. [0003] With the rampant proliferation of Trojan horse viruses and malware, various security software pay more and more atten...

AI Technical Summary

Problems solved by technology

[0011] Therefore, although the existing Rootkit prevention methods can deal with some kernel-level Trojans, there is a high possibility of leaking viruses and failing to identify hidden Trojans, resulting in low Trojan detection accuracy

Images