Method and apparatus for intercepting installation of malicious program and electronic device

Abstract

Embodiments of the invention disclose a method and an apparatus for intercepting installation of a malicious program and an electronic device, which relate to the technical field of computer security and can solve the problem of non-comprehensive interception of the malicious program in the prior art by preventing the malicious program from creating a directory and / or a registry entry. The method comprises the steps of monitoring an event message that a program installation process is to create the directory and / or the registry entry in a system, wherein the event message comprises to-be-created directory path and / or registry entry; judging whether the to-be-created directory path and / or registry entry is recorded in a preset configurable file or not; and if the to-be-created directory path and / or registry entry is recorded in the configurable file, preventing the program installation process from creating the directory and / or the registry entry. The method and the apparatus are suitable for preventing the installation of the malicious program.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a method, device and electronic equipment for intercepting malicious program installation. Background technique [0002] With the development of Internet technology, the number of software is also increasing massively. Users download and install software on their computers through various channels. Although some are regular software, regular software may also promote the installation of some malicious programs. If malicious programs are installed on the user's computer In fact, the consequences are immeasurable. Therefore, it is necessary to identify malicious programs in the software and prevent its installation when installing the software. [0003] The existing malicious program interception scheme is to use a hook function to intercept the running of the malicious program process when the process creates the software. The principle is to intercept the malicious prog...

AI Technical Summary

Problems solved by technology

[0002] With the development of Internet technology, the number of software is also increasing massively. Users download and install software on their computers through various channels. Although some are legitimate software, legitimate software may also promote the installation of some malicious programs. If malicious programs are installed on the user's computer On the contrary, the consequences are immeasurable. Therefore, it is necessary to identify the malicious programs in the software and prevent its installation when installing the software.

[0003] The existing malicious program interception scheme is to use a hook function to intercept the running of the malicious program process when the process creates the software. The principle is to intercept the malicious program according to the name of the installation package of the malicious program. Unable to block the installation of malicious programs

Although the installation package name of the malicious program that needs to be intercepted can be configured in the existing scheme, the configurable installation package name is also a known limited number of fixed names, and it is still impossible to intercept malicious programs with random installation package names. Therefore, existing malicious The program interception scheme will have the problem that it is easy to miss and block malicious programs, and the interception is not comprehensive

Images