A virus processing method and device for file packages

Abstract

The embodiment of the invention discloses a virus processing method and device capable of aiming at a file package. The method comprises the following steps that: calling a virus search engine in a terminal to scan the file package stored in the terminal, and determining the file characteristics of a target file in the file package, wherein the file characteristics at least comprise the file path of the target file and / or the integrity identification of the target file; according to the characteristic information in a preset virus reservoir in the terminal, carrying out detection comparison on the determined file path and / or integrity identification, and when a detection comparison result shows that the file characteristics meet a matching condition, determining the target file as a virus file; and according to a virus checking and killing rule, carrying out checking and killing processing on the virus file. When the method is adopted, the virus checking and killing success rate of the file package can be conveniently and quickly improved, a variant sample checking and killing rate is improved, and false alarms are reduced.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a virus processing method and device for file packages. Background technique [0002] The traditional virus scanning method mainly detects and compares features related to malicious code in a certain target file, and does not process features that are not related to malicious code. [0003] In the prior art, the specified code of the file needs to be determined, and the implementation method is relatively complicated. Moreover, when the specified code changes, the matching search of files cannot be realized. For example, when a virus mutates and malicious codes mutate, it is impossible to detect and kill such viruses. Contents of the invention [0004] The embodiments of the present invention provide a virus processing method and device for a file package, which can simply and quickly complete the virus detection and killing process of the target file in the file package. ...

AI Technical Summary

Problems solved by technology

[0003] The existing technology needs to determine the specified code of the file, and the implementation method is relatively complicated

Moreover, when the specified code changes, the matching search of the file cannot be realized. For example, when the virus mutates and the malicious code mutates, the detection and killing of this type of virus cannot be realized.

Images