Method and device for detecting unknown risk of starting item

Abstract

The invention is applicable to the field of computers, and provides a method and a device for detecting unknown risks of a startup item, comprising: acquiring startup information associated with the startup item, the startup information at least including a registry and a system service item; the current unnecessary process is cleaned, recovery information of a cleaned registry and a system service item is obtained, and the recovery information at least comprises a recovery type and recovery time; judging whether the starting information contains a suspicious process file or not based on the recovery information and a server process starting log; when it is judged that the starting information contains the suspicious process file, the suspicious process file is set to be non-automatic starting, and the follow-up starting behavior of the suspicious process file is monitored; according to the method, the malicious file is determined step by step, the suspicious process file is marked, the registry containing the suspicious process file and the system service item are processed and then subjected to virtual operation, and the virtual operation result is obtained, and the method has the beneficial effects that the malicious file is determined step by step, and the determination accuracy can be effectively improved.

Description

technical field [0001] The invention belongs to the technical field of computers, and in particular relates to a method and device for detecting unknown risks of startup items. Background technique [0002] With the development of science and technology, a large number of applications that meet the different needs of users have emerged. In order to respond to user operations and start quickly, many applications have chosen to automatically start and run with the startup of the operating system. However, some malicious codes invade the operating system. Afterwards, it also starts with the startup of the operating system, which brings a great security threat to the user's operating system. [0003] Malicious codes mainly refer to programs with bad intentions such as endangering the security of information. They generally lurk in the victim computer system to destroy or steal information. The main categories of malicious codes include: computer viruses, worms and Trojan horses....

AI Technical Summary

Problems solved by technology

[0004] In the prior art, the malicious code is generally detected and eliminated only after the operating system fails. Once the malicious code is seriously destructive, it will bring great losses to the user.

Images