Method and device for virus detection

Abstract

An embodiment of the invention discloses a method and device for virus detection. The method for virus detection can comprises the steps of reading first data stored in a master boot record (MBR) in a virtual disk image corresponding to a first virtual machine; after the first virtual machine is started, leading a suspicious virus sample to the first virtual machine to run; after the running duration of the first virtual machine exceeds first set duration, reading second data stored in the MBR in the virtual disk image corresponding to the first virtual machine; comparing the read second data with the first data, and determining that the suspicious virus sample is a virus sample if finding the difference between the second data and the first data by comparison. According to the technical scheme, the method and device for virus detection are favorable for improving detection accuracy in viruses which possibly modify the MBR.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a virus detection method and device. Background technique [0002] With the development of computer technology and network technology, there are more and more types of viruses, and viruses with strong destructiveness and concealment have existed for a long time. Master Boot Record (MBR, Master Boot Record), also known as the master boot sector, is the first sector that must be read when the computer is turned on to access the hard disk. MBR usually stores the relevant information of the hard disk itself and the partitions of each partition of the hard disk. Size and location information, etc., are important entries for data information. Some viruses may achieve the purpose of self-starting by tampering with the data stored in the MBR during the process of spreading infection. [0003] The prior art utilizes MBR detection software installed in a computer to detect whet...

AI Technical Summary

Problems solved by technology

The inventors of the present invention have found through research and practice that at least the following technical problems exist in the prior art. If the virus destroys the MBR and the computer cannot be started, the detection software installed in the computer cannot detect whether the data stored in the MBR has been modified. In this case, it is difficult to accurately pinpoint the cause of the failure

Images