Process operation handling method and device

Abstract

The invention discloses a process operation handling method and device. The method comprises: monitoring whether the access port and the access IP address of a current running process are a fixed access port and a fixed IP address, respectively; determining that the current running process is a target process used by a target virus when the access port and the access IP address of the current running process are the fixed access port and the fixed IP address, respectively; prohibiting the target process from accessing to the fixed IP address via the fixed access port; judging whether a file writing operation of the target process on a target catalogue is monitored; when the file writing operation of the target process on the target catalogue is monitored, locking the target catalogue to prohibit the file writing operation of the target process on the target catalogue; and closing the current running process. According to the technical scheme of the process operation handling method, the resource of the virus can be consumed by prohibiting the file writing operation of the process of the virus in the target catalogue so that the virus crashes automatically, and therefore, the virus can be cleared thoroughly.

Description

Technical field [0001] The present invention relates to the field of virus technology, in particular to a processing method and device for process operation. Background technique [0002] At present, when a special Trojan horse virus is in the server and the Trojan horse virus process is closed, the Trojan horse virus process will still be automatically restarted and replaced with a new process name. Therefore, the virus cannot be completely removed. [0003] And it is found in the root directory (.dev) of the system device directory that the suspicious files written by the process that may be viruses are non-system files, and after deleting the file, the file will be automatically generated. In addition, the file name of these files is also Random. Summary of the invention [0004] The present invention provides a process operation processing method and device, which consumes the resources of the virus by prohibiting the process of the virus from writing in a target directory to c...

AI Technical Summary

Problems solved by technology

[0002] At present, when the server is infected with a special Trojan horse virus, after closing the process of the Trojan horse virus, the process of the Trojan horse virus will still be automatically restarted and replaced with a new process name, so the virus cannot be completely eliminated

Images