A method and system for prevent blackmail virus from secondary encrypting host document

Abstract

The invention provides a method and a system for preventing blackmail virus from secondary encrypting host document. The method and the system comprise the following steps: when blackmail virus alarmis triggered by blackmail defense means and is disposed, information of corresponding operation process of blackmail virus is obtained and added to a blacklist; Through the information in the blacklist, the host environment information is associated, and extortion virus data is subjected to deep cleaning; After the host system is restarted, a file sensing program is started, when the file sensingprogram is aware of the process of modifying the file, the file operated by the modifying process is screened, the specific operation information is matched with the blacklist data, and whether the residual blacklist virus data exists in the host environment is judged; If it exists, clean it up and write it to the blacklist, otherwise release the corresponding process. The invention can accuratelylocate and deeply clean the residual blackmail virus data in the system, and accurately defend the host computer after restarting, so as to ensure that the operating system and the host computer files are not destroyed and modified by the blackmail virus twice.

Description

technical field [0001] The present invention relates to the technical field of information security, and in particular to a method and system for defending against ransomware from secondary encryption of host files. Background technique [0002] At present, the mainstream ransomware virus runs immediately after entering the user's host. The encryption process has evolved from a single modification of file content to a multi-dimensional means of destruction. After the system restarts, it will cause irreparable damage to the operating system and host files. Existing defense technologies are difficult to accurately defend against this phenomenon. They can only back up the original files, but cannot achieve effective defense, and cannot guarantee that the ransomware will not attack the host again after the system is restarted. Contents of the invention [0003] The present invention proposes a defense method for restarting the operating system of the ransomware virus to encry...

AI Technical Summary

Problems solved by technology

[0002] At present, the mainstream ransomware virus runs immediately after entering the user's host. The encryption process has evolved from a single modification of file content to a multi-dimensional means of destruction. After the system restarts, it will cause irreparable damage to the operating system and host files

Existing defense technologies are difficult to accurately defend against this phenomenon. They can only back up their original documents, which cannot be effectively defended. There is no guarantee that the ransomware virus will not attack the host again after the system is restarted.

Images