Malware processing method and device

Abstract

Embodiments of the invention disclose a malicious software processing method and apparatus, and relate to the field of terminal security. By resetting a registry callback number, the problem is solved that malicious software returns a failure result when a registry of the malicious software is operated through a registry callback mechanism, so that a terminal is prohibited to perform corresponding operation on the registry of the malicious software and cannot delete or modify the registry of the malicious software.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to a malware processing method and device. Background technique [0002] When the terminal wants to delete or modify the software registry, it needs to use the registry callback mechanism. When the callback mechanism returns successfully, it can continue to call other registry functions. When the return result fails, it cannot continue to call other registry functions. Malware passes This callback mechanism judges whether the operation is aimed at its own registry, and if so, returns a failure result, which can prohibit the terminal from performing corresponding operations on the malware registry. Endpoints cannot delete or modify malware's registry. Contents of the invention [0003] In view of this, the embodiment of the present invention provides a malware processing method and device, which solves the problem that in the prior art, when the terminal clean...

AI Technical Summary

Problems solved by technology

[0003] In view of this, the embodiment of the present invention provides a malware processing method and device, which solves the problem that in the prior art, when the terminal cleans up or modifies the malware registry, the malware prohibits operations on the malware registry through registry callback protection. The problem

Images