Method and device, medium and electronic device for preventing Trojans from damaging shared files

Abstract

The present invention discloses a method and device for preventing Trojans from damaging shared files, as well as a storage medium and an electronic device. The method includes: obtaining an access operation to a shared folder; determining whether the access operation is a predetermined operation; if the access operation is the predetermined operation, determining the user terminal that initiated the access operation; and reducing the access operation authority of the user terminal to the predetermined access operation authority. The aforementioned method sets the predetermined operation to represent the operation when the client terminal is infected with a Trojan virus. When monitoring the operation of the shared file in the shared folder as the predetermined operation, the user terminal that initiated the access operation is found and the access operation authority of the user terminal is reduced to the predetermined access operation authority, so as to avoid the corresponding user terminal from initiating more predetermined operations and causing possible similar modifications to the shared folder, thereby avoiding more losses due to the corresponding operations.

Description

Technical Field

[0001] The present invention relates to the field of security technology, and in particular to a method and device for preventing a Trojan horse from destroying a shared file, as well as a medium and an electronic device. Background Art

[0002] A Trojan virus is a typical computer virus that implants a Trojan program into a controlled computer to steal sensitive data from the controlled computer or use the controlling computer to perform illegal operations.

[0003] In order to facilitate the sharing of file data between different user terminals, a shared folder may be set up under LAN application conditions or similar application conditions; under certain application conditions, a higher level of access operation permissions are set for all user terminals in the shared folder, so that the user terminal can rewrite, delete or add files in the shared folder. When a user terminal is infected with a Trojan virus and becomes a controlled computer, the user terminal may hijack the shared files in the shared folder, or write a Trojan program into the shared files in the shared folder. Summary of the invention

[0004] The method and device for preventing Trojans from damaging shared files provided by the present invention monitor access operations to shared files to determine whether corresponding operations may cause shared file damage, cut off access to shared files by user terminals that may be infected by Trojans, and thus prevent Trojans from further damaging shared files.

[0005] The purpose of the present invention is to be achieved by adopting the following technical solutions:

[0006] In a first aspect, the present invention provides a method for preventing a Trojan horse from damaging a shared file, comprising:

[0007] Get access to shared folders;

[0008] Determining whether the access operation is a predetermined operation;

[0009] In a case where the access operation is the predetermined operation, determining a user terminal that initiates the access operation;

[0010] Reduce the access operation authority of the user terminal to a predetermined access operation authority.

[0011] Optionally, the predetermined operation is a write operation; the write operation is:

[0012] Change the suffix of the files stored in the shared folder, or

[0013] deleting the files already stored in the shared folder and adding a file with the same name as the first file but with a different suffix to the shared folder; or

[0014] An operation of encrypting files in the shared folder.

[0015] Optionally, after determining that the access operation is the predetermined operation, the method further includes:

[0016] Scanning files corresponding to the access operation;

[0017] If it is determined that the file contains a Trojan horse program, repair, delete or isolate the file corresponding to the access operation; or

[0018] When it is determined that the access operation encrypts the corresponding file, the file corresponding to the access operation is decrypted.

[0019] Optionally, obtain access to the shared folder, including:

[0020] The Audit component is used to obtain the user terminal's access operations to the shared folder.

[0021] Optionally, determining a user terminal that initiates the access operation includes:

[0022] Query the user ID that initiated the access operation;

[0023] The corresponding IP address, MAC address or user name is queried according to the user ID, and the terminal corresponding to the IP address, the MAC address or the user name is used as the user terminal.

[0024] Optionally, reducing the access operation authority of the user terminal to a predetermined access operation authority includes:

[0025] Stop the user terminal from accessing the shared folder, or block the user terminal from accessing the server where the shared folder is located.

[0026] Optionally, when the access operation is the predetermined operation, determining the user terminal that initiates the access operation includes:

[0027] In the case where the access operation is the predetermined operation, scanning and determining whether the file corresponding to the predetermined operation includes a Trojan program, or determining whether the file corresponding to the predetermined operation is encrypted by the access operation;

[0028] In the case that the file includes a Trojan horse program or is encrypted by the access operation, a user terminal that initiates the access operation is determined.

[0029] In a second aspect, the present invention provides a device for preventing a Trojan horse from damaging a shared file, comprising:

[0030] A recording unit, used to obtain access operations to a shared folder;

[0031] A first judging unit, configured to judge whether the access operation is a predetermined operation;

[0032] A searching unit, configured to determine a user terminal initiating the access operation when the access operation is the predetermined operation;

[0033] The permission adjustment unit is used to reduce the access operation permission of the user terminal to a predetermined access operation permission.

[0034] Optionally, the predetermined operation is a write operation;

[0035] The write operation is:

[0036] Change the suffix of the files stored in the shared folder, or

[0037] deleting the files already stored in the shared folder and adding a file with the same name as the first file but with a different suffix to the shared folder; or

[0038] An operation of encrypting files in the shared folder.

[0039] Optionally, the device further comprises:

[0040] A scanning unit, configured to scan a file corresponding to the access operation when the access operation is a write operation;

[0041] a repair unit, configured to repair or delete the file corresponding to the access operation when it is determined that the file contains a Trojan horse program; or

[0042] When it is determined that the access operation encrypts the corresponding file, the file corresponding to the access operation is repaired.

[0043] Optionally, the recording unit is an Audit component.

[0044] Optionally, the searching unit searches for a user terminal that initiates the access operation, including:

[0045] Find the user ID that initiated the access operation;

[0046] The corresponding IP address, MAC address or user name is queried according to the user ID, and the terminal identified by the IP address, the MAC address or the user name is used as the user terminal.

[0047] Optionally, the permission adjustment unit reduces the access operation permission of the user terminal to a predetermined access operation permission, specifically:

[0048] Stop the user terminal from accessing the shared folder, or block the user terminal from accessing the server where the shared folder is located.

[0049] Optionally, the searching unit determines the user terminal that initiates the access operation, including:

[0050] In the case where the access operation is the predetermined operation, scanning and determining whether the file corresponding to the predetermined operation includes a Trojan program, or determining whether the file corresponding to the predetermined operation is encrypted by the access operation;

[0051] In the case that the file includes a Trojan horse program or is encrypted by the access operation, a user terminal that initiates the access operation is determined.

[0052] In a third aspect, the present invention provides a storage medium storing a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the method for preventing Trojans from damaging shared files as described above.

[0053] In a fourth aspect, the present invention provides an electronic device, comprising a storage medium and a processor; the processor is suitable for implementing various instructions; the storage medium is suitable for storing multiple instructions; the instructions are suitable for being loaded by the processor and executed as described above in the method for preventing Trojans from destroying shared files.

[0054] The method and device for preventing Trojans from damaging shared files provided in the present application set the predetermined operation to represent the operation in the case where the client terminal may be infected with a Trojan virus. When monitoring the operation on the shared files in the shared folder is not the predetermined operation, the user terminal that initiated the access operation is found, and the access operation authority of the user terminal is reduced to the predetermined access operation authority, so as to avoid the corresponding user terminal from initiating more predetermined operations and causing more shared files in the shared folder to be tampered with, thereby avoiding more losses due to the corresponding operations.

[0055] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0057] Figure 1 is a flow chart of a method for preventing a Trojan horse from damaging a shared file provided by an embodiment;

[0058] Figure 2 is a flow chart of a method for preventing a Trojan horse from damaging a shared file provided by another embodiment;

[0059] Figure 3 is a flow chart of a method for preventing a Trojan horse from damaging a shared file provided by another embodiment;

[0060] Figure 4 The structure diagram of a device for preventing Trojans from damaging shared files is provided in an embodiment. DETAILED DESCRIPTION

[0061] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0062] In order to have a clearer understanding of the technical solution of the present application, a scenario in which the technical solution of the present application may be applied is first introduced below.

[0063] A possible application scenario is a local area network application scenario; in the local area network, there are multiple computers: one of the computers serves as a shared file server, which provides shared file service functions; other computers serve as user terminals, accessing the shared folders of the shared server with preset access operation permissions; specifically, the preset access operation permissions may include: deleting shared files in the shared folder, modifying shared files in the shared folder, and adding new files to the shared folder.

[0064] For some reason, one or several user terminals are infected with Trojan virus and become the controlled terminal of Trojan virus, which can be controlled by the control terminal of Trojan virus to perform illegal operations. In the above situation, the control terminal of Trojan virus (that is, the user terminal controlled by Trojan virus) may perform illegal operations on shared folders.

[0065] For example, the control end controls the controlled user terminal to add a Trojan program to a shared folder, and disguises the Trojan virus as a normal file; other user terminals are also infected with the Trojan virus after downloading the file and become controlled terminals.

[0066] For example, the control end adds Trojan virus source code to the shared files in the shared folder, and other users are infected with the Trojan virus after downloading the files and become the controlled end.

[0067] For another example, the control end controls the user terminal where the controlled end is located to destroy or encrypt files in the shared folder in order to extort money.

[0068] In order to prevent Trojan programs from using shared files to quickly spread Trojan viruses, or cause excessive damage to files in shared folders, the present application provides a corresponding technical solution to prevent Trojans from damaging shared files.

[0069] Figure 1 FIG. 1 is a flow chart of a method for preventing a Trojan horse from damaging a shared file provided by an embodiment. Figure 1 As shown, in one embodiment, the technical solution for preventing Trojans from damaging shared files includes steps S101-S104.

[0070] S101: Obtaining access to a shared folder.

[0071] After the shared folder is opened on the shared file server to provide shared file services for the user terminal, the corresponding operation monitoring function is opened to obtain access operations to the shared folder to provide judgment information for subsequent preventive operations.

[0072] Considering that many operating systems currently used have access logs, in actual applications, access operations can be obtained by reading the access logs in the operating system, and subsequent operations can be started after new access operations are recorded in the access logs.

[0073] It should be noted that in order to minimize the damage caused by the Trojan horse, all subsequent operations should be performed as early as possible, so in step S101, it is preferred to obtain the access operation to the shared folder in real time to discover abnormal operations as early as possible.

[0074] Of course, in some other cases, such as when a user terminal can only access shared files in a shared folder by polling, it is also possible to obtain the access operation of a user terminal to the shared folder after the access time of the user terminal ends. In other application cases, a certain query interval time can also be set, and the access operation to the shared folder can be obtained after the query interval time has passed.

[0075] S102: Determine whether the access operation is a predetermined operation. If the access operation is a predetermined operation, execute S103; if the access operation is not a predetermined operation, terminate the execution.

[0076] After obtaining the access operation to the shared folder in S101, the type of the access operation is determined, specifically, whether the access operation is a predetermined operation according to the attribute identifier of the access operation.

[0077] In actual applications, the aforementioned predetermined operations are pre-set as possible illegal operations or abnormal operations; when the corresponding access operation is identified as a predetermined operation, there is a considerable probability that the corresponding access operation may be an illegal operation or an abnormal operation.

[0078] The probability that an illegal operation or abnormal operation is initiated by a user who normally operates a user terminal is small; however, if the user terminal does trigger a corresponding access operation, it is determined that the corresponding operation may not be initiated by the user, and it can be estimated that the user terminal that triggers the corresponding access operation is more likely to be infected by a Trojan horse.

[0079] S103: Determine the user terminal that initiates the access operation.

[0080] After the access operation is determined to be a predetermined access operation in S102, the user terminal initiating the access operation can be determined through the access log or the execution path of the backtracking access action, and it can be determined that the corresponding user terminal may be a user terminal infected with a Trojan virus.

[0081] S104: Reduce the access operation authority of the user terminal to a predetermined access operation authority.

[0082] After determining that the user terminal may be infected with a Trojan virus, in order to prevent the user terminal from continuing to perform the aforementioned access operation with a higher operating authority, resulting in other access operations of the same type appearing in the shared folder and causing problems with more files (such as the aforementioned occurrence of more shared files infected with Trojan viruses or more shared files being encrypted), the access operation authority of the corresponding user terminal is reduced to the predetermined access operation authority; for example, the access authority of the corresponding user terminal can be set to only be able to view shared files.

[0083] According to the operation process of the aforementioned steps S101-S104, the method for preventing Trojans from destroying shared files provided in the embodiment of the present application sets certain operations as predetermined operations that occur when the client terminal is infected with a Trojan virus. When monitoring the operation on the shared files in the shared folder is not the predetermined operation, the user terminal that initiates the access operation is found and the access operation authority of the user terminal is reduced to the predetermined access operation authority, thereby preventing the corresponding user terminal from initiating more predetermined operations and causing more shared files in the shared folder to be tampered with, thereby avoiding more losses due to the corresponding operations.

[0084] Figure 2 FIG. 1 is a flow chart of a method for preventing a Trojan horse from damaging a shared file provided by another embodiment. Figure 2 As shown, the method of another embodiment includes steps S201-S205.

[0085] S201: Obtaining access to a shared folder.

[0086] After the shared file server opens the shared folder therein and provides the shared file service for the user terminal, the shared file server also opens the corresponding operation monitoring function to obtain the access operation to the shared folder to provide monitoring information for subsequent preventive operations.

[0087] In order to minimize the damage caused by the Trojan horse, all subsequent operations should be performed as early as possible, so in step S201, it is preferred to obtain the access operation to the shared folder in real time to discover abnormal operations as early as possible.

[0088] Of course, in other cases, such as when a user terminal can only access shared files in a shared folder by polling, it is also possible to obtain the access operation of a user terminal to the shared folder after the access time of the user terminal ends.

[0089] In other application cases, a certain query interval may also be set, and access operations to the shared folder may be obtained after the query interval has elapsed.

[0090] S202: Determine whether the access operation is a predetermined operation; if the access operation is a predetermined operation, execute S203; if the access operation is not a predetermined operation, terminate the execution.

[0091] Similar to S102 in the above-mentioned embodiment, the embodiment of the present application also determines certain operations as illegal operations or abnormal operations, and such operations are regarded as predetermined operations; when the corresponding access operation is determined as a predetermined operation, there is a considerable probability that the corresponding access operation may be estimated to be an illegal operation or an abnormal operation. If the access operation is a predetermined operation, it is determined that the user terminal that triggers the application operation may be infected with a Trojan virus.

[0092] S203: Scan and determine whether the file corresponding to the predetermined operation includes a Trojan program; if the file corresponding to the predetermined operation includes a Trojan program, execute S204; if the file corresponding to the predetermined operation does not include a Trojan program, terminate the execution.

[0093] Under normal circumstances, if a predetermined operation occurs, the corresponding operation may not be actively triggered by the user terminal, but by a Trojan virus hidden in the user terminal, and the Trojan virus code has been written into the file in the shared folder operated by the predetermined operation through the predetermined operation.

[0094] In order to verify whether the corresponding operation introduces a Trojan program into the file of the shared folder, the file corresponding to the predetermined operation is scanned. If it is found that the file contains a Trojan program after scanning the file, it can be determined that the corresponding operation is not actively triggered by the user using the user terminal, but is triggered by a Trojan virus, and it can be determined that the user terminal that triggers the corresponding predetermined operation is infected with a Trojan virus. Of course, in this case, it is necessary to ensure that there are more Trojan program samples so that the Trojan program in the shared file can be more accurately identified.

[0095] S204: Determine the user terminal that initiates the predetermined operation.

[0096] S205: Reduce the access operation authority of the user terminal to a predetermined access operation authority.

[0097] After determining that triggering the corresponding predetermined operation will write a Trojan program in the shared file, it is necessary to trace back the user terminal that initiated the predetermined operation and change the access operation permissions of the corresponding user terminal to prevent this user terminal from performing the aforementioned predetermined operation in the shared folder again, causing more shared files to be added with Trojan programs.

[0098] In the method for preventing Trojans from damaging shared files provided by the implementation of the present application, after a predetermined access operation is queried, the shared file for which the access operation is initiated is scanned to determine whether the shared file contains a Trojan program. If the shared program contains a Trojan program, it is determined that the user terminal corresponding to the predetermined operation has been infected with the Trojan program, and the access operation authority of the user terminal is reduced to prevent the user terminal from initiating the aforementioned operation again, thereby preventing other shared files in the shared folder from being infected by the Trojan program.

[0099] Figure 3 It is a flow chart of a method for preventing Trojans from damaging shared files provided by another embodiment. Figure 3 is another method to prevent Trojans from damaging shared files; see Figure 3The method of this embodiment is different from the above-mentioned embodiment only in one step, specifically: the above-mentioned S203 is replaced by S303: scanning and determining whether the file corresponding to the predetermined operation is encrypted by the predetermined operation; if the file is encrypted by the predetermined operation, executing S304; if the file is not encrypted by the predetermined operation, the execution ends.

[0100] In the method for preventing Trojans from destroying shared files provided in an embodiment of the present application, after determining that a predetermined operation has occurred and the predetermined operation has caused the file to be encrypted, it is determined that the corresponding encryption operation may be used for the purpose of hijacking the file for ransom. In order to avoid the same operation from occurring and causing more shared files to be encrypted, the access operation authority of the corresponding user terminal is reduced, which can prevent other shared files in the shared folder from being infected by Trojan programs.

[0101] The methods for preventing Trojans from damaging shared files provided in the above three embodiments can all be applied to Microsoft's Windows operating system; when applied in the Windows operating system, the system's supporting Audit component can be used to record the user terminal's access operations to the shared folder. The Audit component includes the auditctl configuration tool, the ausearch result search tool, the aureport tool, and the autrace tracking tool; the corresponding operation modes and methods can be found in the Windows user manual.

[0102] In other embodiments, if the shared folder is installed in other operating systems, the query tool or log acquisition tool provided by the corresponding operating system can also be used; or, corresponding access operation recording software can be developed specifically for obtaining access operations to the shared folder.

[0103] In most cases of the aforementioned embodiments, the designers or users of Trojan viruses, in order to obtain illegal profits, often change the content of shared files or encrypt shared files through write operations, that is, the access operations are mostly specific types of write operations. In order to deal with such actions.

[0104] Therefore, in the aforementioned embodiments, the write operation can be set as a predetermined operation, and the write operation can be set as several special write operations; in specific applications, according to the different ways in which the Trojan program induces infection or threatens users, the corresponding predetermined operations may include the following three: (1) the write operation is an operation of changing the suffix of a file already stored in a shared file; (2) the operation of deleting a file already stored in a shared folder and adding a file with the same name as the aforementioned file but with a different suffix to the shared folder; (3) the operation of encrypting files in a shared folder.

[0105] It should be noted that in the case where the aforementioned types of write operations have been performed, the shared file in the shared folder on which the write operation is performed has been infected with a Trojan virus or has been encrypted. In order to avoid corresponding losses or to avoid virus infection caused by other user terminals that are not infected with the Trojan virus opening the file, after determining that the access operation is a predetermined write operation, the aforementioned embodiment may also execute steps S401 and S402.

[0106] S401: Scan files corresponding to the access operation.

[0107] S402: When it is determined that the file corresponding to the access operation contains a Trojan program, repair, delete or isolate the corresponding file; or, when it is determined that the access operation encrypts the corresponding file, decrypt the file corresponding to the access operation.

[0108] In some cases, the user of a Trojan virus may cause the loss of information assets of the LAN owner simply for the purpose of deleting a shared folder; therefore, in some cases, the deletion operation may also be set as a scheduled operation.

[0109] In the above three embodiments, the process of determining the user terminal that initiates the access operation includes steps S501 and S502.

[0110] S501: Query the user ID that initiated the access operation.

[0111] S502: Query the corresponding IP address according to the user ID, and regard the user terminal corresponding to the IP address as an illegal user terminal.

[0112] In some types of operating systems, although tools such as the Audit component can be used to find the operation type and operation user ID of the access operation, this user ID is only used to identify that the operation was issued by a certain user, and the user ID cannot be used directly to identify the real user terminal.

[0113] However, in a local area network, the IP address of the user terminal is unique within a certain period of time, and the server can find the IP address of the corresponding user terminal, so the user ID can be used to reversely find the user IP address corresponding to the corresponding operation, and the user terminal corresponding to this IP address can be regarded as an illegal user terminal, thereby reducing the terminal corresponding to this IP address as a user terminal.

[0114] In some embodiments, because the local area network adopts a strategy of dynamically allocating IP addresses, as the user terminal is shut down or goes offline, the corresponding IP address is recycled, and the corresponding IP address may be used by a user who is not infected with the Trojan virus; or a terminal infected with the Trojan virus may adopt a strategy of changing the IP address to access a shared folder.

[0115] To solve this problem, in other embodiments, the user ID can also be used to query the user's MAC address or user name, and the terminal corresponding to the user's MAC address or user name can be used as the user terminal; in a local area network, the user's MAC address or user name is unique, so the MAC address or user name can always lock the corresponding user terminal, avoiding the allocation of a new IP address when the corresponding user terminal is started again, or the user terminal accessing the shared folder again by changing the IP strategy.

[0116] In the aforementioned embodiments, in the steps of executing S104, S205, and S305, reducing the access rights of the user terminal to the predetermined access rights may specifically be:

[0117] Stop the user terminal from accessing the shared folder, or block the user terminal from accessing the server where the shared folder is located.

[0118] In actual applications, the corresponding access rights can be determined according to application requirements. For example, when the client terminal needs to perform other types of interactive operations with the server host, only the user terminal's access to the shared folder in the server can be stopped; and if the server host only serves as a shared folder host, the user terminal's access to the server where the shared folder is located can be directly blocked, for example, the server directly discards the data message sent by the user terminal after receiving it.

[0119] In addition to providing the aforementioned three embodiments of the method for preventing Trojans from damaging shared files, the embodiment of the present invention also provides a device for preventing Trojans from damaging shared files.

[0120] Figure 4 : is a structural diagram of a device for preventing Trojans from damaging shared files provided by an embodiment of the present application. Figure 4 As shown, the device includes a recording unit 41, a first judgment unit 42, a search unit 43 and a permission adjustment unit 44.

[0121] Among them: the recording unit 41 is used to obtain the access operation to the shared folder; the first judgment unit 42 is used to judge whether the access operation is a predetermined operation; the search unit 43 is used to determine the user terminal that initiates the access operation when the access operation is a predetermined operation; the authority adjustment unit 44 is used to reduce the access operation authority of the user terminal to the predetermined access operation authority.

[0122] In some embodiments, when the access operation is a predetermined operation, the search unit 43 scans and determines whether the file corresponding to the predetermined operation includes a Trojan program, or determines whether the file corresponding to the predetermined operation is encrypted by the access operation;

[0123] In the case where the file includes a Trojan horse program or is encrypted by an access operation, the user terminal that initiates the access operation is determined.

[0124] In some embodiments, the predetermined operation is a write operation; the write operation is:

[0125] Change the file extension of a file stored in a shared folder, or

[0126] Deleting the files already stored in the shared folder and adding a file with the same name as the first file but with a different suffix to the shared folder; or

[0127] Encrypt files in a shared folder.

[0128] In addition, when the predetermined operation is a write operation, the apparatus for preventing Trojans from damaging shared files provided in some embodiments further includes: a scanning unit and a repairing unit.

[0129] The scanning unit is used to scan the file corresponding to the access operation when the access operation is a write operation;

[0130] The repair unit is used to repair or delete the file corresponding to the access operation when it is determined that the file contains a Trojan program; or to repair the file corresponding to the access operation when it is determined that the access operation encrypts the corresponding file.

[0131] In some embodiments, the recording unit 41 is an Audit component.

[0132] In some embodiments, the searching unit 43 searches for the user terminal that initiated the access operation, including:

[0133] Find the user ID that initiated the access operation;

[0134] The corresponding IP address, MAC address or user name is queried according to the user ID, and the terminal identified by the IP address, MAC address or user name is used as the user terminal.

[0135] In some embodiments, the permission adjustment unit 44 reduces the access operation permission of the user terminal to a predetermined access operation permission, specifically: stopping the user terminal from accessing the shared folder, or blocking the user terminal from accessing the server where the shared folder is located.

[0136] In some embodiments, the searching unit determines the user terminal that initiates the access operation, including:

[0137] In the case where the access operation is the predetermined operation, scanning and determining whether the file corresponding to the predetermined operation includes a Trojan program, or determining whether the file corresponding to the predetermined operation is encrypted by the access operation;

[0138] In the case that the file includes a Trojan horse program or is encrypted by the access operation, a user terminal that initiates the access operation is determined.

[0139] An embodiment of the present invention further provides a storage medium storing a plurality of instructions, wherein the instructions are used for a processor to load and execute the aforementioned method for preventing a Trojan horse from damaging a shared file.

[0140] In addition, an embodiment of the present application also provides an electronic device, which includes a storage medium and a processor; the processor is used to implement various instructions, and the memory is used to store multiple instructions, and the instructions are suitable for being loaded and executed by the processor to prevent Trojans from destroying shared files.

[0141] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0142] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0143] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the description of the above specific languages ​​is for disclosing the best mode of the present invention.

[0144] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0145] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, the various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the following intention: that the claimed invention requires more features than those explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0146] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0147] In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the following claims, any one of the claimed embodiments can be used in any combination.

[0148] The various component embodiments of the present invention can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all functions of some or all components in the method, device, storage medium, and electronic device for preventing Trojans from destroying shared files according to an embodiment of the present invention. The present invention can also be implemented as a device or device program (e.g., computer program and computer program product) for executing part or all of the methods described herein. Such a program for implementing the present invention can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0149] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc., does not indicate any order. These words may be interpreted as names.

Claims

1. A method for preventing Trojans from damaging shared files, characterized in that: include: Get access to shared folders; Determining whether the access operation is a predetermined operation; In a case where the access operation is the predetermined operation, determining a user terminal that initiates the access operation; Reducing the access operation authority of the user terminal to a predetermined access operation authority; The predetermined operation is a write operation; the write operation is: Change the suffix of the files stored in the shared folder, or An operation of adding a file having the same name as the first file but with a different suffix to the shared folder while deleting the files already stored in the shared folder; or, An operation of encrypting files in the shared folder; After determining that the access operation is the predetermined operation, the method further includes: Scanning files corresponding to the access operation; If it is determined that the file contains a Trojan horse program, repair, delete or isolate the file corresponding to the access operation; or When it is determined that the access operation encrypts the corresponding file, the file corresponding to the access operation is decrypted.

2. The method for preventing Trojans from damaging shared files according to claim 1, characterized in that: Get access to shared folders, including: The Audit component is used to obtain the user terminal's access operations to the shared folder.

3. The method for preventing Trojans from damaging shared files according to claim 1, characterized in that: Determining the user terminal that initiates the access operation includes: Query the user ID that initiated the access operation; The corresponding IP address, MAC address or user name is queried according to the user ID, and the terminal corresponding to the IP address, the MAC address or the user name is used as the user terminal.

4. The method for preventing Trojans from damaging shared files according to claim 1, characterized in that: Reducing the access operation authority of the user terminal to a predetermined access operation authority includes: Stop the user terminal from accessing the shared folder, or block the user terminal from accessing the server where the shared folder is located.

5. The method for preventing Trojans from damaging shared files according to any one of claims 1 to 4, characterized in that: In a case where the access operation is the predetermined operation, determining the user terminal that initiates the access operation includes: In the case where the access operation is the predetermined operation, scanning and determining whether the file corresponding to the predetermined operation includes a Trojan program, or determining whether the file corresponding to the predetermined operation is encrypted by the access operation; In the case that the file includes a Trojan horse program or is encrypted by the access operation, a user terminal that initiates the access operation is determined.

6. A device for preventing Trojans from damaging shared files, characterized in that: include: A recording unit, used to obtain access operations to a shared folder; A first judging unit, configured to judge whether the access operation is a predetermined operation; A searching unit, configured to determine a user terminal initiating the access operation when the access operation is the predetermined operation; A permission adjustment unit, used to reduce the access operation permission of the user terminal to a predetermined access operation permission; The predetermined operation is a write operation; The write operation is: Change the suffix of the files stored in the shared folder, or An operation of adding a file having the same name as the first file but with a different suffix to the shared folder while deleting the files already stored in the shared folder; or, An operation of encrypting files in the shared folder; Also includes: A scanning unit, configured to scan a file corresponding to the access operation when the access operation is a write operation; a repair unit, configured to repair or delete the file corresponding to the access operation when it is determined that the file contains a Trojan horse program; or When it is determined that the access operation encrypts the corresponding file, the file corresponding to the access operation is repaired.

7. The device for preventing Trojans from damaging shared files according to claim 6, characterized in that: The recording unit is an Audit component.

8. The device for preventing Trojans from damaging shared files according to claim 6, characterized in that: The searching unit searches for the user terminal that initiates the access operation, including: Find the user ID that initiated the access operation; The corresponding IP address, MAC address or user name is queried according to the user ID, and the terminal identified by the IP address, the MAC address or the user name is used as the user terminal.

9. The device for preventing Trojans from damaging shared files according to claim 6, characterized in that: The permission adjustment unit reduces the access operation permission of the user terminal to a predetermined access operation permission, specifically: Stop the user terminal from accessing the shared folder, or block the user terminal from accessing the server where the shared folder is located.

10. The device for preventing Trojans from damaging shared files according to any one of claims 6 to 9, characterized in that: The searching unit determines the user terminal that initiates the access operation, including: In the case where the access operation is the predetermined operation, scanning and determining whether the file corresponding to the predetermined operation includes a Trojan program, or determining whether the file corresponding to the predetermined operation is encrypted by the access operation; In the case that the file includes a Trojan horse program or is encrypted by the access operation, a user terminal that initiates the access operation is determined.

11. A medium, characterized in that The medium is a storage medium; the storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the method for preventing Trojans from damaging shared files as described in any one of claims 1-5.

12. An electronic device, characterized in that: The electronic device includes a storage medium and a processor; The processor is adapted to implement each instruction; The storage medium is suitable for storing a plurality of instructions; The instructions are suitable for being loaded by the processor and executing a method for preventing a Trojan horse from damaging a shared file as claimed in any one of claims 1 to 5.

Images