Target File Detection and Deletion Method, Device, Electronic Device, and Readable Medium

Abstract

The embodiments of the present disclosure disclose a target file detection and deletion method, device, electronic device and readable medium. A specific implementation of the method includes: using the target source code to statically compile each command file in the binary file to obtain a static compilation command file set; determining whether the dynamic link library pointed to by the preload environment variable is a malicious dynamic link library; uninstalling the dynamic link library pointed to by the preload environment variable; determining whether the preload configuration file is replaced; using the static compilation command file included in the static compilation command file set for generating a file content viewing command to generate a file content viewing command, and using the file content viewing command to obtain the replaced preload configuration file; deleting the file pointed to by the replaced preload configuration file and the replaced preload configuration file. This implementation can effectively improve the security of the business.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computer technology, and in particular to a method, device, electronic device, and readable medium for detecting and deleting a target file. Background Art

[0002] Target file detection and deletion is a technology that detects and deletes malicious files. Malicious files are files that have been replaced or tampered with. Currently, the common method for detecting and deleting target files is to directly generate commands from command files stored in binary files on the system, and then use the generated commands to detect and delete the target files.

[0003] However, when using the above method to detect and delete target files, the following technical problems often occur:

[0004] First, if the command file in the binary file is tampered with or replaced, after directly using the command file in the binary file to generate a command, the generated command cannot detect the target file and delete it, which reduces the security of the service.

[0005] Second, after the replaced or tampered files are deleted, the files before replacement or tampering cannot be restored, which affects the normal execution of the business. Summary of the Invention

[0006] The content of this disclosure is used to briefly introduce concepts that will be described in detail in the detailed description section below. The content of this disclosure is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0007] Some embodiments of the present disclosure provide target file detection and deletion methods, devices, electronic devices, and readable media to solve one or more of the technical problems mentioned in the above background technology section.

[0008] In a first aspect, some embodiments of the present disclosure provide a target file detection and deletion method, the method comprising: using target source code to statically compile each command file in a binary file to obtain a static compilation command file set, wherein the static compilation command file set includes a static compilation command file for generating a file content viewing command; determining whether the dynamic link library pointed to by the preloaded environment variable is a malicious dynamic link library through pre-set dynamic link library feature information; in response to determining that the dynamic link library pointed to by the preloaded environment variable is a malicious dynamic link library, unloading the dynamic link library pointed to by the preloaded environment variable; determining whether the preloaded configuration file is replaced; in response to determining that the preloaded configuration file is replaced, generating a file content viewing command using the static compilation command file for generating a file content viewing command included in the static compilation command file set, and obtaining the replaced preloaded configuration file using the file content viewing command; deleting the file pointed to by the replaced preloaded configuration file and the replaced preloaded configuration file.

[0009] In a second aspect, some embodiments of the present disclosure provide a target file detection and deletion device, the device comprising: a compilation unit configured to statically compile each command file in a binary file using a target source code to obtain a static compilation command file set, wherein the static compilation command file set includes a static compilation command file for generating a file content viewing command; a first determination unit configured to determine whether the dynamic link library pointed to by the preload environment variable is a malicious dynamic link library based on preset dynamic link library feature information; a second determination unit configured to, in response to determining that the dynamic link library pointed to by the preload environment variable is a malicious dynamic link library, uninstall the dynamic link library pointed to by the preload environment variable; a third determination unit configured to determine whether a preload configuration file has been replaced; a generation and acquisition unit configured to, in response to determining that the preload configuration file has been replaced, generate a file content viewing command using the static compilation command file for generating a file content viewing command included in the static compilation command file set, and obtain the replaced preload configuration file using the file content viewing command; and a deletion unit configured to delete the file pointed to by the replaced preload configuration file and the replaced preload configuration file.

[0010] In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by one or more processors, the one or more processors implement the method described in any implementation of the first aspect above.

[0011] In a fourth aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the method described in any implementation of the first aspect is implemented.

[0012] The above-described embodiments of the present disclosure have the following beneficial effects: The target file detection and deletion methods of some embodiments of the present disclosure effectively prevent the inability to detect and delete the target file using the generated commands due to targeted tampering or replacement of command files within a binary file, thereby improving service security. Specifically, the inability to detect and delete the target file using the generated commands is caused by the possibility that the command files within the binary file have been targeted tampered with or replaced. Based on this, the target file detection and deletion methods of some embodiments of the present disclosure first statically compile each command file within the binary file to obtain a statically compiled command file set. Consequently, when the target file is subsequently detected using relevant commands, the compiled statically compiled command files can be directly used, avoiding the use of the individual command files within the original binary file. Consequently, tampering or replacement of the individual command files within the original binary file will not affect the detection and deletion of the target file. Consequently, the target file can be detected and deleted based on the statically compiled command file set, improving service security. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The above and other features, advantages, and aspects of the various embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0014] Figure 1 is a schematic diagram of an application scenario of the target file detection and deletion method in some embodiments of the present disclosure;

[0015] Figure 2 is a flow chart of some embodiments of the target file detection and deletion method according to the present disclosure;

[0016] Figure 3 is a flow chart of other embodiments of the target file detection and deletion method according to the present disclosure;

[0017] Figure 4 It is a schematic structural diagram of some embodiments of the target file detection and deletion device disclosed in the present invention;

[0018] Figure 5 It is a structural diagram of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0019] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of protection of the present disclosure.

[0020] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure may be combined with each other.

[0021] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0022] It should be noted that the modifications of "one" and "multiple" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, they should be understood as "one or more".

[0023] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0024] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0025] Figure 1 It is a schematic diagram of an application scenario of the target file detection and deletion method of some embodiments of the present disclosure.

[0026] exist Figure 1In the application scenario, first, the computing device 101 can use the target source code to statically compile each command file 103 in the binary file 102 to obtain a static compilation command file set 104, wherein the static compilation command file set 104 includes a static compilation command file for generating a file content viewing command. Then, the computing device 101 can determine whether the dynamic link library 107 pointed to by the preloaded environment variable 106 is a malicious dynamic link library through the pre-set dynamic link library feature information 105. Then, in response to determining that the dynamic link library 107 pointed to by the preloaded environment variable 106 is a malicious dynamic link library, the computing device 101 can uninstall the dynamic link library 107 pointed to by the preloaded environment variable 106. Next, the computing device 101 can determine whether the preloaded configuration file 108 has been replaced. Next, in response to determining that the preload configuration file 108 has been replaced, the computing device 101 may generate a file content viewing command 109 using the static compilation command file included in the static compilation command file set 104 for generating a file content viewing command 109, and obtain the replaced preload configuration file 110 using the file content viewing command 109. Finally, the computing device 101 may delete the file 111 pointed to by the replaced preload configuration file 110 and the replaced preload configuration file 110.

[0027] It should be noted that the computing device 101 can be either hardware or software. When the computing device is hardware, it can be implemented as a distributed cluster consisting of multiple servers or terminal devices, or as a single server or a single terminal device. When the computing device is software, it can be installed in the hardware devices listed above. It can be implemented as multiple software or software modules for providing distributed services, or as a single software or software module. No specific limitations are given here.

[0028] It should be understood that Figure 1 The number of computing devices in the embodiment is merely illustrative. Any number of computing devices may be provided according to implementation requirements.

[0029] Continue to refer Figure 2 , shows a process 200 of some embodiments of the target file detection and deletion method according to the present disclosure. The target file detection and deletion method includes the following steps:

[0030] Step 201 : statically compile each command file in the binary file using the target source code to obtain a statically compiled command file set.

[0031] In some embodiments, the target file detection and deletion method execution subject (such as Figure 1The computing device 101 shown can statically compile each command file in the binary file using the target source code to obtain a set of statically compiled command files. The set of statically compiled command files can include a statically compiled command file for generating a command for viewing file contents. The target source code can be the source code used by the operating system running in the execution entity. The binary file can be a file representing a dynamic link library.

[0032] As an example, the operating system running in the execution entity may be a Linux system. The various command files in the binary file may be all command files in a \bin folder.

[0033] Static compilation extracts the command files from the corresponding binary files that the executable needs to call and links them into the executable. This allows the executable to run independently of the original binary files. This allows detection of the target file even if the original binary files have been tampered with or replaced.

[0034] Step 202: Determine whether the dynamic link library pointed to by the preloaded environment variable is a malicious dynamic link library based on pre-set dynamic link library feature information.

[0035] In some embodiments, the above-mentioned execution subject can determine whether the dynamic link library pointed to by the preloaded environment variable is a malicious dynamic link library through the pre-set dynamic link library characteristic information. Among them, the above-mentioned dynamic link library characteristic information can be obtained by copying the initial dynamic link library. The above-mentioned preloaded environment variable can be an address pointing to the dynamic link library. Thus, the dynamic link library characteristic information can be matched with the dynamic link library pointed to by the preloaded environment variable. If the content in the dynamic link library pointed to by the preloaded environment variable is the same as the above-mentioned dynamic link library characteristic information, it can be determined that the dynamic link library characteristic information matches the preloaded environment variable. If the dynamic link library characteristic information contains a value that is not included in the dynamic link library pointed to by the preloaded environment variable, it can be determined that the dynamic link library characteristic information does not match the preloaded environment variable.

[0036] If all values included in the dynamic link library characteristic information match the preloaded environment variables, it can be determined whether the dynamic link library pointed to by the preloaded environment variables is a malicious dynamic link library. If there is a mismatch between the dynamic link library characteristic information and the preloaded environment variables, it can be determined that the dynamic link library pointed to by the preloaded environment variables is a malicious dynamic link library. The malicious dynamic link library can be the dynamic link library pointed to by the preloaded environment variables that has been tampered with or replaced, or a dynamic link library that has been tampered with or replaced. The malicious dynamic link library can be determined as a target file.

[0037] Thus, the initial dynamic link library information can be copied and stored in advance. Thus, it can be determined whether the dynamic link library pointed to by the preloaded environment variable has been tampered with based on the pre-set dynamic link library feature information. Thus, a tampered dynamic link library can be detected based on the dynamic link library feature information.

[0038] Optionally, the dynamic link library characteristic information is obtained by decrypting encrypted and stored dynamic link library characteristic information. Thus, by encrypting the dynamic link library characteristic information, tampering with the dynamic link library characteristic information can be prevented if the dynamic link library is tampered with. Encryption thus ensures the authenticity of the dynamic link library characteristic information, making it easier to identify malicious dynamic link libraries based on the dynamic link library characteristic information.

[0039] In some optional implementations of some embodiments, the dynamic link library characteristic information is the same as the initial value of the preloaded environment variable. The execution subject determines whether the dynamic link library pointed to by the preloaded environment variable is a malicious dynamic link library based on the pre-set dynamic link library characteristic information, which may include the following steps:

[0040] The first step is to determine that the dynamic link library characteristic information matches the preloaded environment variable, and to determine that the dynamic link library pointed to by the preloaded environment variable is not a malicious dynamic link library. The matching means that the dynamic link library characteristic information is the same as the preloaded environment variable.

[0041] In a second step, in response to determining that the dynamic link library characteristic information does not match the preloaded environment variable, determining that the dynamic link library pointed to by the preloaded environment variable is a malicious dynamic link library, wherein the mismatch refers to that the dynamic link library characteristic information is different from the preloaded environment variable.

[0042] Step 203 : In response to determining that the dynamic link library pointed to by the preloaded environment variable is a malicious dynamic link library, the dynamic link library pointed to by the preloaded environment variable is uninstalled.

[0043] In some embodiments, the execution entity may uninstall the dynamic link library pointed to by the preloaded environment variable in response to determining that the dynamic link library pointed to by the preloaded environment variable is a malicious dynamic link library.

[0044] Step 204: Determine whether the preloaded configuration file is replaced.

[0045] In some embodiments, the execution entity may determine whether the preloaded configuration file has been replaced. An initial preloaded configuration file may be pre-stored, and the preloaded configuration file may be compared with the initial preloaded configuration file. If the preloaded configuration file and the initial preloaded configuration file differ, it may be determined whether the preloaded configuration file has been replaced.

[0046] In some optional implementations of some embodiments, the above-mentioned execution entity may use a user space tracker to determine whether the preloaded configuration file is replaced.

[0047] As an example, the user control tracer described above may be a Linux user space tracer that may be used for diagnosis, debugging, and teaching.

[0048] Step 205 , in response to determining that the preload configuration file is replaced, a file content viewing command is generated using a static compilation command file included in the static compilation command file set for generating a file content viewing command, and the replaced preload configuration file is obtained using the file content viewing command.

[0049] In some embodiments, the above-mentioned execution entity can generate a file content viewing command using a static compilation command file for generating a file content viewing command included in the above-mentioned static compilation command file set in response to determining that the above-mentioned preloaded configuration file is replaced, and use the above-mentioned file content viewing command to obtain the replaced preloaded configuration file.

[0050] As an example, the file content viewing command may be the lsattr command.

[0051] Thus, by generating the file content viewing command using the static compilation command file included in the static compilation command file set, reliance on the original binary file can be avoided. Thus, even if the original binary file is tampered with or replaced, the target file can still be detected.

[0052] Step 206: Delete the file pointed to by the replaced preloaded configuration file and the replaced preloaded configuration file.

[0053] In some embodiments, the execution entity may delete the file pointed to by the replaced preloaded configuration file and the replaced preloaded configuration file.

[0054] In some optional implementations of some embodiments, the static compilation command file set further includes a static compilation command file for generating a file information viewing command and a static compilation command file for generating a file attribute change command. The execution subject may further perform the following steps:

[0055] The first step is to determine, in response to determining that the preloaded configuration file has not been replaced, whether malicious configuration information is added to the preloaded configuration file using the file content viewing command. The malicious configuration information is configuration information pointing to a malicious dynamic link library. The content of the preloaded configuration file can be determined using the file content viewing command. The content of the preloaded configuration file can be compared with a pre-stored initial preloaded configuration file. If the two have different contents, it can be determined that malicious configuration information is added to the preloaded configuration file.

[0056] In the second step, in response to determining that malicious configuration information is loaded in the above-mentioned preloaded configuration file, a file information viewing command is generated using the static compilation command file for generating a file information viewing command included in the above-mentioned static compilation command file set.

[0057] As an example, the file information viewing command may be a cat command.

[0058] The third step is to use the file information viewing command to determine whether the attributes of the preloaded configuration file have been tampered with. The file information viewing command can be used to view the attribute information of a file, etc. The initial attribute information of the preloaded configuration file can be pre-stored, and then the attribute information viewed using the file information viewing command can be compared with the initial attribute information. If the two differ, it can be determined that the attributes of the preloaded configuration file have been tampered with.

[0059] Optionally, the above execution entity may further perform the following steps:

[0060] In the first step, in response to determining that the attributes of the preloaded configuration file have been tampered with, a file attribute change command is generated using a static compilation command file for generating a file attribute change command included in the static compilation command file set. The file attribute change command can be used to change the attribute information of a file.

[0061] As an example, the above-mentioned file attribute changing command may be a chatrr command.

[0062] The second step is to use the file attribute change command to reset the attributes of the preloaded configuration file. The attributes of the preloaded configuration file can be reset to the initial attribute information.

[0063] The third step is to clear the malicious configuration information loaded in the preloaded configuration file and the malicious dynamic link library pointed to by the malicious configuration information.

[0064] The above-described embodiments of the present disclosure have the following beneficial effects: The target file detection and deletion methods of some embodiments of the present disclosure effectively prevent the inability to detect and delete the target file using the generated commands due to targeted tampering or replacement of command files within a binary file, thereby improving service security. Specifically, the inability to detect and delete the target file using the generated commands is caused by the possibility that the command files within the binary file have been targeted tampered with or replaced. Based on this, the target file detection and deletion methods of some embodiments of the present disclosure first statically compile each command file within the binary file to obtain a statically compiled command file set. Consequently, when the target file is subsequently detected using relevant commands, the compiled statically compiled command files can be directly used, avoiding the use of the individual command files within the original binary file. Consequently, tampering or replacement of the individual command files within the original binary file will not affect the detection and deletion of the target file. Consequently, the target file can be detected and deleted based on the statically compiled command file set, improving service security.

[0065] Further references Figure 3 , which shows a process 300 of another embodiment of a target file detection and deletion method. The process 300 of the target file detection and deletion method includes the following steps:

[0066] Step 301: statically compile each command file in the binary file using the target source code to obtain a statically compiled command file set.

[0067] Step 302: Determine whether the dynamic link library pointed to by the preloaded environment variable is a malicious dynamic link library based on pre-set dynamic link library feature information.

[0068] Step 303: In response to determining that the dynamic link library pointed to by the preload environment variable is a malicious dynamic link library, the dynamic link library pointed to by the preload environment variable is uninstalled.

[0069] Step 304: Determine whether the preloaded configuration file is replaced.

[0070] Step 305 , in response to determining that the preload configuration file is replaced, a file content viewing command is generated using a static compilation command file included in the static compilation command file set for generating a file content viewing command, and the replaced preload configuration file is obtained using the file content viewing command.

[0071] Step 306: Delete the file pointed to by the replaced preloaded configuration file and the replaced preloaded configuration file.

[0072] In some embodiments, the specific implementation of steps 301-306 and the resulting technical effects can be referred to Figure 2 The corresponding steps 201-206 in the embodiments are not described in detail here.

[0073] Step 307: Obtain the pre-encrypted and stored initial preloaded configuration file.

[0074] In some embodiments, the target file detection and deletion method execution subject (such as Figure 1 The computing device 101 shown can obtain the pre-encrypted and stored initial preloaded configuration file through a wired connection or a wireless connection.

[0075] Therefore, by encrypting the initial preload configuration file, the original initial preload configuration file can be retained, so that after the preload configuration file is replaced or tampered with, it can be restored through the initial preload configuration file, thereby ensuring the normal execution of the business program.

[0076] Step 308: decrypt the pre-encrypted and stored initial preload configuration file to obtain the initial preload configuration file.

[0077] In some embodiments, the execution entity may decrypt the pre-encrypted and stored initial preload configuration file to obtain the initial preload configuration file.

[0078] Step 309: determine the initial preload configuration file as a new preload configuration file.

[0079] In some embodiments, the execution entity may determine the initial preload configuration file as a new preload configuration file.

[0080] Thus, after deleting the malicious preloaded configuration file, the preloaded configuration file can be restored based on the initial preloaded configuration file. At the same time, by pre-encrypting and storing the initial preloaded configuration file, the initial preloaded configuration file can be prevented from being tampered with or replaced, further improving security.

[0081] from Figure 3 It can be seen that Figure 2 Compared with the description of some corresponding embodiments, Figure 3 Flow 300 of the target file detection and deletion method in some corresponding embodiments includes an extended step for restoring the preloaded configuration file based on the pre-encrypted and stored initial preloaded configuration file. Thus, the solutions described in these embodiments can, after identifying and deleting the target file, restore the deleted file using the pre-encrypted and stored initial preloaded configuration file, thereby ensuring normal service operation.

[0082] Further references Figure 4 As an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of a target file detection and deletion device. These device embodiments are similar to Figure 2 Corresponding to the method embodiments shown, the device can be specifically applied to various electronic devices.

[0083] like Figure 4 As shown, the target file detection and deletion device 400 of some embodiments includes: a compilation unit 401, a first determination unit 402, a second determination unit 403, a third determination unit 404, a generation and acquisition unit 405 and a deletion unit 406. The compilation unit 401 is configured to statically compile each command file in the binary file using the target source code to obtain a static compilation command file set, wherein the static compilation command file set includes a static compilation command file for generating a file content viewing command; the first determination unit 402 is configured to determine whether the dynamic link library pointed to by the pre-set dynamic link library feature information is a malicious dynamic link library; the second determination unit 403 is configured to, in response to determining that the dynamic link library pointed to by the pre-loaded environment variable is a malicious dynamic link library, generate a malicious dynamic link library for the pre-loaded environment variable. The dynamic link library pointed to by the quantity is uninstalled; the third determining unit 404 is configured to determine whether the preload configuration file is replaced; the generating and obtaining unit 405 is configured to generate a file content viewing command using the static compilation command file for generating a file content viewing command included in the static compilation command file set in response to determining that the above-mentioned preload configuration file is replaced, and obtain the replaced preload configuration file using the above-mentioned file content viewing command; the deleting unit 406 is configured to delete the file pointed to by the replaced preload configuration file and the above-mentioned replaced preload configuration file.

[0084] It is understood that the units described in the device 400 are similar to those in the reference Figure 2 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the device 400 and the units included therein, and will not be repeated here.

[0085] Reference below Figure 5 , which shows a structural diagram of an electronic device 500 suitable for implementing some embodiments of the present disclosure. Figure 5 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0086] like Figure 5As shown, the electronic device 500 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage device 508 into a random access memory (RAM) 503. Various programs and data required for the operation of the electronic device 500 are also stored in the RAM 503. The processing device 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0087] Typically, the following devices may be connected to the I / O interface 505: an input device 506 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 507 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; and a communication device 509. The communication device 509 may allow the electronic device 500 to communicate with other devices wirelessly or by wire to exchange data. Figure 5 The electronic device 500 is shown with various devices, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead. Figure 5 Each block shown in the figure may represent one device, or may represent multiple devices as needed.

[0088] In particular, according to some embodiments of the present disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, some embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from a network via the communication device 509, or installed from the storage device 508, or installed from the ROM 502. When the computer program is executed by the processing device 501, the above-mentioned functions defined in the method of some embodiments of the present disclosure are performed.

[0089] It should be noted that the computer-readable medium described in some embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, device, or device. In some embodiments of the present disclosure, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wires, optical cables, RF (radio frequency), etc., or any suitable combination thereof.

[0090] In some embodiments, the client and server can communicate using any currently known or future developed network protocol, such as HTTP (HyperText Transfer Protocol), and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0091] The computer-readable medium may be included in the electronic device, or may exist independently and not be assembled into the electronic device. The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: statically compiles each command file in the binary file using the target source code to obtain a static compilation command file set, wherein the static compilation command file set includes a static compilation command file for generating a file content viewing command; determines whether the dynamic link library pointed to by the preload environment variable is a malicious dynamic link library based on pre-set dynamic link library feature information; in response to determining that the dynamic link library pointed to by the preload environment variable is a malicious dynamic link library, uninstalls the dynamic link library pointed to by the preload environment variable; determines whether the preload configuration file is replaced; in response to determining that the preload configuration file is replaced, generates a file content viewing command using the static compilation command file for generating the file content viewing command included in the static compilation command file set, and obtains the replaced preload configuration file using the file content viewing command; and deletes the file pointed to by the replaced preload configuration file and the replaced preload configuration file.

[0092] Computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages such as Java, Smalltalk, C++, and conventional procedural programming languages such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0093] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0094] The units described in some embodiments of the present disclosure may be implemented in software or in hardware. The units described may also be provided in a processor. For example, they may be described as follows: a processor including a compilation unit, a first determination unit, a second determination unit, a third determination unit, a generation and acquisition unit, and a deletion unit. The names of these units do not, in some cases, constitute limitations on the units themselves. For example, the deletion unit may also be described as a "file deletion unit."

[0095] The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, and without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

Claims

1. A target file detection and deletion method, comprising: Using the target source code, statically compile each command file in the binary file to obtain a static compilation command file set, wherein the static compilation command file set includes a static compilation command file for generating a file content viewing command. Through static compilation, each command file in the corresponding binary file that the executable file needs to call is extracted and linked to the executable file, so that the executable file does not depend on the original binary file when running, and the target file can still be detected after the original binary file is tampered with or replaced; Determine whether the dynamic link library pointed to by the preloaded environment variable is a malicious dynamic link library based on pre-set dynamic link library feature information; In response to determining that the dynamic link library pointed to by the preload environment variable is a malicious dynamic link library, uninstalling the dynamic link library pointed to by the preload environment variable; Determine if the preloaded configuration file is replaced; In response to determining that the preload configuration file is replaced, generating a file content viewing command using a static compilation command file for generating a file content viewing command included in the static compilation command file set, and acquiring the replaced preload configuration file using the file content viewing command; Deleting the file pointed to by the replaced preloaded configuration file and the replaced preloaded configuration file; Obtain the initial preloaded configuration file that is stored in a pre-encrypted manner; Decrypting the pre-encrypted and stored initial preload configuration file to obtain the initial preload configuration file; The initial preload configuration file is determined as a new preload configuration file.

2. The method according to claim 1, wherein The static compilation command file set also includes a static compilation command file for generating a file information viewing command and a static compilation command file for generating a file attribute change command; as well as The method further comprises: In response to determining that the preloaded configuration file has not been replaced, determining whether malicious configuration information is loaded into the preloaded configuration file using the file content viewing command, wherein the malicious configuration information is configuration information pointing to a malicious dynamic link library; In response to determining that malicious configuration information is loaded in the preloaded configuration file, generating a file information viewing command using a static compilation command file for generating a file information viewing command included in the static compilation command file set; The file content viewing command is used to determine whether the attributes of the preloaded configuration file have been tampered with.

3. The method according to claim 1, wherein The method further comprises: In response to determining that the attribute of the preloaded configuration file has been tampered with, generating a file attribute changing command using a static compile command file for generating a file attribute changing command included in the static compile command file set; Resetting the attributes of the preloaded configuration file using the file attribute change command; The malicious configuration information loaded in the preloaded configuration file and the malicious dynamic link library pointed to by the malicious configuration information are cleared.

4. The method according to claim 1, wherein The dynamic link library characteristic information is the same as the initial value of the preloaded environment variable; as well as The determining whether the dynamic link library pointed to by the preloaded environment variable is a malicious dynamic link library by using the preset dynamic link library feature information includes: In response to determining that the dynamic link library characteristic information matches the preload environment variable, determining that the dynamic link library pointed to by the preload environment variable is not a malicious dynamic link library; In response to determining that the dynamic link library characteristic information does not match the preload environment variable, it is determined that the dynamic link library pointed to by the preload environment variable is a malicious dynamic link library.

5. The method according to claim 3, wherein The dynamic link library characteristic information is obtained by decrypting the encrypted and stored dynamic link library characteristic information.

6. The method according to claim 1, wherein Determining whether the preloaded configuration file is replaced includes: Utilizes a userspace tracer to determine if the preload configuration file has been replaced.

7. A target file detection and deletion device, comprising: a compilation unit configured to statically compile each command file in the binary file using the target source code to obtain a static compilation command file set, wherein the static compilation command file set includes a static compilation command file for generating a file content viewing command. Through static compilation, each command file in the corresponding binary file that the executable file needs to call is extracted and linked to the executable file, so that the executable file does not depend on the original binary file when running, and can still detect the target file after the original binary file is tampered with or replaced; The first determining unit is configured to determine whether the dynamic link library pointed to by the preloaded environment variable is a malicious dynamic link library based on preset dynamic link library feature information; a second determining unit configured to, in response to determining that the dynamic link library pointed to by the preloaded environment variable is a malicious dynamic link library, uninstall the dynamic link library pointed to by the preloaded environment variable; a third determining unit configured to determine whether the preloaded configuration file is replaced; a generating and acquiring unit configured to, in response to determining that the preload configuration file is replaced, generate a file content viewing command using a static compilation command file for generating a file content viewing command included in the static compilation command file set, and acquire the replaced preload configuration file using the file content viewing command; a deleting unit configured to delete the file pointed to by the replaced preloaded configuration file and the replaced preloaded configuration file; an acquiring unit configured to acquire an initial preloaded configuration file that is stored in encrypted form in advance; a decryption processing unit configured to decrypt the pre-encrypted and stored initial preload configuration file to obtain the initial preload configuration file; The fourth determining unit is configured to determine the initial preloading configuration file as a new preloading configuration file.

8. An electronic device comprising: one or more processors; a storage device having one or more programs stored thereon, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 6.

9. A computer-readable medium having a computer program stored thereon, wherein: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images