Process operation processing method and device

Abstract

The invention discloses a process operation handling method and device. The method comprises: monitoring whether the access port and the access IP address of a current running process are a fixed access port and a fixed IP address, respectively; determining that the current running process is a target process used by a target virus when the access port and the access IP address of the current running process are the fixed access port and the fixed IP address, respectively; prohibiting the target process from accessing to the fixed IP address via the fixed access port; judging whether a file writing operation of the target process on a target catalogue is monitored; when the file writing operation of the target process on the target catalogue is monitored, locking the target catalogue to prohibit the file writing operation of the target process on the target catalogue; and closing the current running process. According to the technical scheme of the process operation handling method, the resource of the virus can be consumed by prohibiting the file writing operation of the process of the virus in the target catalogue so that the virus crashes automatically, and therefore, the virus can be cleared thoroughly.

Description

technical field [0001] The invention relates to the technical field of viruses, in particular to a process operation processing method and device. Background technique [0002] At present, when the server is infected with a special Trojan horse virus, after closing the process of the Trojan horse virus, the process of the Trojan horse virus will still be automatically restarted and replaced with a new process name. Therefore, the virus cannot be completely removed. [0003] And in the root directory (.dev) of the system device directory, it is found that the suspicious files written by the process that may be a virus are non-system files, and after deleting the file, the file will be automatically generated. In addition, the file names of these files are also random. Contents of the invention [0004] The present invention provides a processing method and device for process operation, which consumes resources of the virus by prohibiting the process of the virus from writi...

AI Technical Summary

Problems solved by technology

[0002] At present, when the server is infected with a special Trojan horse virus, after closing the process of the Trojan horse virus, the process of the Trojan horse virus will still be automatically restarted and replaced with a new process name, so the virus cannot be completely eliminated

Images