Ransomware processing method and system

Abstract

The invention relates to a ransomware processing method and system; the method comprises the following steps: building a backup database, wherein the backup database comprises at least one restore point and restore data corresponding to each restore point, and the restore data comprises regedit data and disk file data; receiving a processing request; selecting one restore point from the backup database according to the processing request, and invoking the disk file data corresponding to the restore point; traversing the disk, and determining whether the disk has a newly added file according to the disk file data corresponding to the restore point; adding attributes locked in startup on the newly added file if the disk has the newly added file, and restoring the disk according to the regedit data corresponding to the restore point. The ransomware processing method and system can reduce a determination scope of the ransomware in all files, can effectively lock the ransomware so as to prevent the ransomware from forming further damages, and the disk can be simultaneously restored and back to normal.

Description

technical field [0001] The present invention relates to the field of information security, in particular to a processing method and system for ransomware. Background technique [0002] Ransomware is a type of malicious software used by hackers to hijack user assets or resources and extort money from users on the condition of this. Ransomware usually encrypts documents, emails, databases, source codes, pictures, compressed files and other files on the user's system in some form to make them unusable, or interferes with the normal use of the system by modifying the system configuration files The method reduces the availability of the system, and then sends a blackmail notice to the user through a pop-up window, dialog box, or text file, requiring the user to remit money to a designated account to obtain the password for decrypting the file or obtain a method to restore the normal operation of the system. [0003] At present, there are several known methods that can lead to th...

AI Technical Summary

Problems solved by technology

Even with high-precision detection technology, there are still two disadvantages in removing ransomware by deleting files: 1. All malware will change registry data to achieve various malicious operations (such as self-starting, etc.), if only Simple deletion of files will leave junk data written by the ransomware in the registry; 2. If the ransomware has already been run (or injected into some key system processes to run), forcibly deleting the ransomware file will result in the need to read the original file As a result, some processes crash, which leads to system instability and even blue screen

Therefore, using windows system restore to remove ransomware has the following disadvantages: 1. Take up too much disk space

2. Because most of the Windows restore points are to back up executable files (dll or exe), some files that do not exist in the form of these two will not be cleared

3. The algorithm is complex and slow when creating a restore point

Compared with the method of cleaning ransomware by restoring the system based on the principle of disk filter drive, the full backup restoration system supports multi-point restoration, but at the same time, due to the large number of backups, it takes a lot of time, and it also takes a lot of time to restore. time, and due to the large amount of backup data, it requires a large amount of storage space to support

Images