Method, device, electronic device and storage medium for protecting isolated area files

Abstract

The embodiments of this specification relate to the field of computer technology, and in particular to a method, device, electronic device, and storage medium for protecting files in an isolated area. The method for protecting files in an isolated area is applied to a terminal device, and includes: in response to antivirus software scanning a virus file, encrypting the binary content of the virus file once to obtain first file information; storing the encrypted virus file in the isolated area of ​​the terminal device; wherein the binary content of the encrypted virus file is the first file information; writing the first file information to a registry under a preset path; when the antivirus software is uninstalled and reinstalled, the final file information of the isolated area is obtained based on the file information currently existing in the isolated area and the file information in the registry. The technical solution provided in this specification can effectively protect files in the isolated area after the antivirus software is uninstalled.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of computer technology, and in particular to a method, device, electronic device, and storage medium for protecting files in an isolated area. Background Art

[0002] Typically, virus files that have been scanned or proactively processed by antivirus software (hereinafter referred to as antivirus software) are stored separately in a separate and hidden folder pre-created by the antivirus software. This folder is called the quarantine area.

[0003] When antivirus software is operating normally, the terminal device protects the quarantine area through its driver or application-layer software, prohibiting the deletion of files within the quarantine area or directly deleting the quarantine area. However, if the antivirus software is uninstalled, the terminal device no longer protects the quarantine area, making it easy for files within the quarantine area to be deleted. Therefore, if the files within the quarantine area are actually caused by the antivirus software's mistaken deletion, or if the user subsequently wants to analyze the files within the quarantine area, it is necessary to effectively protect the files within the quarantine area after the antivirus software is uninstalled.

[0004] Based on this, there is an urgent need for a method, device, electronic device and storage medium for protecting isolated area files to solve the above technical problems. Summary of the Invention

[0005] In order to effectively protect files in the isolation area after the antivirus software is uninstalled, the embodiments of this specification provide a method, device, electronic device and storage medium for protecting files in the isolation area.

[0006] In a first aspect, an embodiment of this specification provides a method for protecting files in an isolated area, which is applied to a terminal device and includes:

[0007] In response to the antivirus software scanning a virus file, encrypting the binary content of the virus file to obtain first file information;

[0008] Storing the encrypted virus file in the isolation area of ​​the terminal device;

[0009] Writing the first file information into the registry under the preset path;

[0010] When the antivirus software is uninstalled and reinstalled, the final file information of the isolation area is obtained based on the file information currently existing in the isolation area and the file information of the registry.

[0011] In one possible design, writing the first file information into a registry under a preset path includes:

[0012] Performing secondary encryption on the first file information to obtain second file information;

[0013] The second file information is written into the registry under the preset path.

[0014] In one possible design, the primary encryption is implemented using a message digest algorithm;

[0015] and / or,

[0016] The secondary encryption is implemented using the base64 encryption algorithm.

[0017] In one possible design, writing the second file information into a registry under a preset path includes:

[0018] Determining the number of registry entries to be written based on the size of the second file information and a preset writing rule;

[0019] Splitting the second file information into sub-file information of the same number as the number of sub-file information to be written into the registry;

[0020] The information of each of the divided sub-files is written into a registry under a preset path respectively.

[0021] In one possible design, obtaining final file information of the isolated area based on the currently existing file information of the isolated area and the file information of the registry includes:

[0022] Decrypting the file information in the registry to obtain the file information to be compared; wherein the decryption algorithm corresponds to the secondary encryption algorithm;

[0023] The file information to be compared is compared with the file information currently existing in the isolation area to obtain the final file information of the isolation area.

[0024] In one possible design, comparing the file information to be compared with the file information currently existing in the isolation area to obtain final file information of the isolation area includes:

[0025] Comparing the file information to be compared with the file information currently existing in the isolation area;

[0026] If the two are the same, the file information currently existing in the isolation area is used as the final file information of the isolation area;

[0027] If there is a difference between the two, the part of the file information to be compared that is different from the file information currently existing in the isolation area is written into a pre-created file, and the written file is stored in the isolation area to form the final file information of the isolation area.

[0028] In one possible design, the isolation area stores a configuration file, which is used to record the initial number of virus files existing in the isolation area before the antivirus software is uninstalled;

[0029] After obtaining the final file information of the isolation area, the method further includes:

[0030] Reading the configuration file to obtain an initial number of virus files existing in the quarantine area before uninstalling the antivirus software;

[0031] Determine the current number of virus files in the quarantine area after uninstalling and reinstalling the antivirus software;

[0032] If the initial number is the same as the current number, outputting a prompt indicating that the virus files in the quarantine area have not changed before and after the antivirus software is uninstalled;

[0033] Otherwise, a prompt is outputted indicating that the virus files existing in the isolation area have changed before and after the antivirus software is uninstalled.

[0034] In a second aspect, an embodiment of this specification further provides a device for protecting files in an isolated area, which is applied to a terminal device and includes:

[0035] an encryption module, configured to, in response to antivirus software scanning a virus file, encrypt the binary content of the virus file once to obtain first file information;

[0036] A storage module, used for storing the encrypted virus file in the isolation area of ​​the terminal device;

[0037] A writing module, configured to write the first file information into a registry under a preset path;

[0038] The obtaining module is used to obtain the final file information of the isolation area based on the file information currently existing in the isolation area and the file information of the registry after the antivirus software is uninstalled and reinstalled.

[0039] In a third aspect, an embodiment of this specification further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in any embodiment of this specification is implemented.

[0040] In a fourth aspect, an embodiment of this specification further provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method described in any embodiment of this specification.

[0041] The embodiments of this specification provide a method, device, electronic device and storage medium for protecting files in an isolation area. By writing the first file information of a virus file into a registry under a preset path, when the antivirus software is uninstalled and reinstalled, even if the files in the isolation area are accidentally deleted, the final file information of the isolation area can be obtained based on the file information in the registry, thereby effectively protecting the files in the isolation area after the antivirus software is uninstalled. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0043] Figure 1 This is a flow chart of a method for protecting files in an isolated area provided in an embodiment of this specification;

[0044] Figure 2 This is a hardware architecture diagram of an electronic device provided in an embodiment of this specification;

[0045] Figure 3 This is a structural diagram of a protection device for isolated area files provided in one embodiment of this specification. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solutions and advantages of the embodiments of this specification clearer, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are part of the embodiments of this specification, not all the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this specification.

[0047] Please refer to Figure 1 The embodiment of this specification provides a method for protecting files in an isolated area, which is applied to a terminal device. The method includes:

[0048] Step 100: In response to antivirus software scanning a virus file, encrypt the binary content of the virus file to obtain first file information;

[0049] Step 102: Storing the encrypted virus file in the isolation area of ​​the terminal device;

[0050] Step 104: writing the first file information into the registry under the preset path;

[0051] Step 106: After the antivirus software is uninstalled and reinstalled, the final file information of the quarantine area is obtained based on the current file information of the quarantine area and the file information of the registry.

[0052] In this embodiment, by writing the first file information of the virus file into the registry under the preset path, when the antivirus software is uninstalled and reinstalled, even if the files in the isolation area are accidentally deleted, the final file information of the isolation area can be obtained based on the file information in the registry, thereby effectively protecting the files in the isolation area after the antivirus software is uninstalled.

[0053] Described below Figure 1 How to perform the steps shown.

[0054] For step 100:

[0055] In order to prevent the antivirus software from detecting the virus again after placing it in the quarantine area, it is necessary to encrypt the binary content of the virus file once to obtain the first file information. In this way, the characteristic information of the first file information will change compared with the binary content that has not been encrypted once, thereby preventing the antivirus software from detecting the encrypted virus file again.

[0056] In some implementations, the primary encryption may be implemented by performing an exclusive OR operation with a preset character string. Of course, the primary encryption may also be implemented by other methods, which are not limited here.

[0057] Regarding step 102:

[0058] The encrypted virus files are stored in the isolation area of ​​the terminal device. In this way, when the antivirus software is uninstalled later, the isolation area and the files in the isolation area can be retained through the driver, thus avoiding the risk that the files in the isolation area may be deleted synchronously when the antivirus software is uninstalled.

[0059] Regarding step 104:

[0060] In one embodiment of this specification, step 104 may specifically include:

[0061] Performing secondary encryption on the first file information to obtain second file information;

[0062] The second file information is written into the registry under the preset path.

[0063] In this embodiment, if the first file information is directly written to the registry under the preset path, hackers may be able to decrypt the binary content of the virus file without primary encryption, which is not conducive to ensuring the security of the original file content. Therefore, by performing a secondary encryption on the first file information to obtain the second file information, the security of the original file content can be guaranteed.

[0064] In some implementations, the secondary encryption is implemented using a base64 encryption algorithm.

[0065] In this embodiment, some first file information may contain special characters, which may prevent the first file information from being smoothly written into the registry. Therefore, the second file information obtained by adopting the base64 encryption algorithm can avoid containing special characters, so that the second file information can be smoothly written into the registry.

[0066] Of course, secondary encryption can also be implemented in other ways, which are not limited here.

[0067] In one embodiment of this specification, step 104 may specifically include:

[0068] Determining the number of register entries to be written based on the size of the second file information and a preset writing rule;

[0069] Splitting the second file information into sub-file information of the same number as the number to be written into the registry;

[0070] Write the information of each divided sub-file into the registry under the preset path respectively.

[0071] In this embodiment, to facilitate writing and subsequent reading of the second file information, when the capacity of the second file information is too large, it may be considered to divide the second file information into the same number of sub-file information as the number of sub-file information to be written into the registry.

[0072] In some implementations, the preset writing rule specifies, for example, a mapping relationship between the size of the second file information and the number of entries to be written into the registry, which will not be described in detail herein.

[0073] It is understandable that, when the second file information stored in the registry is subsequently read, the sub-file information corresponding to the second file information may be sequentially spliced ​​and then read.

[0074] Regarding step 106:

[0075] In one embodiment of the present specification, step 106 may specifically include: 0. decrypting the file information of the registry to obtain the file information to be compared; wherein the decrypted algorithm

[0076] The method corresponds to the secondary encryption algorithm;

[0077] Compare the file information to be compared with the file information currently existing in the isolation area to obtain the final file information of the isolation area.

[0078] In this embodiment, in order to obtain the final file information of the isolation area, it is necessary to read the file information of the registry 5 and the file information currently existing in the isolation area, and then compare the two;

[0079] The file information in the registry is encrypted twice, so it is necessary to decrypt the registry file information to obtain the file information to be compared. In other words, by comparing the file information to be compared with the file information currently in the quarantine area, the final file information in the quarantine area can be obtained, thus effectively protecting the files in the quarantine area after the antivirus software is uninstalled.

[0080] In one embodiment of this specification, the step of "comparing the file information to be compared with the file information currently existing in the isolation area to obtain the final file information of the isolation area" may specifically include:

[0081] Compare the file information to be compared with the file information currently in the quarantine area;

[0082] If the two are the same, the file information currently in the quarantine area will be used as the final file information in the quarantine area;

[0083] 5 If there is a difference between the two, the file information to be compared and the file information currently in the quarantine area will be

[0084] The different parts of the information are written into the pre-created file, and the completed file is stored in the isolation area to form the final file information of the isolation area.

[0085] In this embodiment, since the files in the isolation area are more easily deleted than the file information in the registry, when determining the final file information of the isolation area based on the file information to be compared and the file information currently existing in the isolation area, the file information to be compared (i.e., the file information in the registry) needs to be used as the basis. Therefore, if the two are the same, there is no need to change the current file status of the isolation area, that is, the file information currently existing in the isolation area is used as the final file information of the isolation area; if the two are different, it is necessary to write the part of the file information to be compared that is different from the file information currently existing in the isolation area into a pre-created file, and store the file after writing into the isolation area to form the final file information of the isolation area.

[0086] It is understandable that when there is a difference between the two, the file corresponding to the file information currently existing in the isolation area that is different from the file information to be compared can be retained or deleted, which is not limited here.

[0087] In addition, you can also create a file first, and then write the file information to be compared into the file; then compare the file information to be compared with the file information currently in the isolation area. If the two are the same, the file in the isolation area will not be changed; if the two are different, the file corresponding to the part of the file information to be compared that is different from the file information currently in the isolation area will be stored in the isolation area.

[0088] In one embodiment of the present specification, the quarantine area stores a configuration file, which is used to record the initial number of virus files existing in the quarantine area before the antivirus software is uninstalled;

[0089] After the step of "obtaining the final file information of the quarantine area", the following steps are also included:

[0090] Read the configuration file to obtain the initial number of virus files in the quarantine area before the antivirus software is uninstalled;

[0091] Determine the current number of virus files in the quarantine area after uninstalling and reinstalling the antivirus software;

[0092] If the initial number and the current number are the same, a prompt will be output indicating that the virus files in the quarantine area have not changed before and after the antivirus software was uninstalled;

[0093] Otherwise, a prompt will be output indicating whether the virus files in the quarantine area have changed before and after the antivirus software is uninstalled.

[0094] In this embodiment, the aforementioned steps yield the final file information for the quarantined area, i.e., the current number of virus files in the quarantined area after the antivirus software has been uninstalled and reinstalled. However, if both the first and second file information for a virus file are deleted, the virus file no longer exists in the quarantined area. Therefore, it is possible to read the configuration file to obtain the initial number of virus files in the quarantined area before the antivirus software was uninstalled, thereby outputting a prompt indicating whether the number of virus files in the quarantined area has changed before and after the antivirus software has been uninstalled.

[0095] It should be noted that if the files in the isolation area are not deleted, the information stored in the registry is actually useless. That is, the registry is mainly used to ensure that when the files in the isolation area are accidentally deleted or deleted in a targeted manner, the files in the isolation area can be restored to the greatest extent by comparing the file information in the registry with the first file information.

[0096] like Figure 2 、 Figure 3 As shown, the embodiment of this specification provides a device for protecting files in an isolated area. The device embodiment can be implemented by software, hardware, or a combination of software and hardware. From the hardware level, Figure 2The figure shows a hardware architecture diagram of an electronic device where a device for protecting files in an isolated area provided by an embodiment of this specification is located. Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown, the electronic device in the embodiment may also include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, Figure 3 As shown, as a device in a logical sense, it is formed by the CPU of the electronic device in which it is located reading the corresponding computer program in the non-volatile memory into the internal memory and running it.

[0097] like Figure 3 As shown, this embodiment provides a device for protecting files in an isolated area, which is applied to a terminal device. The device includes:

[0098] The encryption module 300 is configured to encrypt the binary content of a virus file in response to the antivirus software scanning the virus file to obtain first file information;

[0099] The storage module 302 is used to store the encrypted virus file in the isolation area of ​​the terminal device;

[0100] The writing module 304 is used to write the first file information into a registry under a preset path;

[0101] The obtaining module 306 is used to obtain the final file information of the isolation area based on the file information currently existing in the isolation area and the file information of the registry after the antivirus software is uninstalled and reinstalled.

[0102] In the embodiment of this specification, the encryption module 300 can be used to execute step 100 in the above method embodiment, the storage module 302 can be used to execute step 102 in the above method embodiment, the write module 304 can be used to execute step 104 in the above method embodiment, and the obtain module 306 can be used to execute step 106 in the above method embodiment.

[0103] In one embodiment of this specification, the writing module is used to perform the following operations:

[0104] Performing secondary encryption on the first file information to obtain second file information;

[0105] The second file information is written into the registry under the preset path.

[0106] In one embodiment of this specification, the one-time encryption is implemented using a message digest algorithm;

[0107] and / or,

[0108] The secondary encryption is implemented using the base64 encryption algorithm.

[0109] In one embodiment of the present specification, when executing the step of writing the second file information into the registry under the preset path, the writing module is configured to perform the following operations:

[0110] Determining the number of registry entries to be written based on the size of the second file information and a preset writing rule;

[0111] Splitting the second file information into sub-file information of the same number as the number of sub-file information to be written into the registry;

[0112] The information of each of the divided sub-files is written into a registry under a preset path respectively.

[0113] In one embodiment of this specification, the obtaining module is configured to perform the following operations:

[0114] Decrypting the file information in the registry to obtain the file information to be compared; wherein the decryption algorithm corresponds to the secondary encryption algorithm;

[0115] The file information to be compared is compared with the file information currently existing in the isolation area to obtain the final file information of the isolation area.

[0116] In one embodiment of the present specification, the obtaining module is configured to perform the following operations when performing the comparison of the file information to be compared with the file information currently existing in the isolated area to obtain the final file information of the isolated area:

[0117] Comparing the file information to be compared with the file information currently existing in the isolation area;

[0118] If the two are the same, the file information currently existing in the isolation area is used as the final file information of the isolation area;

[0119] If there is a difference between the two, the part of the file information to be compared that is different from the file information currently existing in the isolation area is written into a pre-created file, and the written file is stored in the isolation area to form the final file information of the isolation area.

[0120] In one embodiment of the present specification, the isolation area stores a configuration file, the configuration file being used to record the initial number of virus files existing in the isolation area before the antivirus software is uninstalled;

[0121] Also includes:

[0122] Determine the module to perform the following operations:

[0123] Reading the configuration file to obtain an initial number of virus files existing in the quarantine area before uninstalling the antivirus software;

[0124] Determine the current number of virus files in the quarantine area after uninstalling and reinstalling the antivirus software;

[0125] If the initial number is the same as the current number, outputting a prompt indicating that the virus files in the quarantine area have not changed before and after the antivirus software is uninstalled;

[0126] Otherwise, a prompt is outputted indicating that the virus files existing in the isolation area have changed before and after the antivirus software is uninstalled.

[0127] It should be understood that the structures illustrated in the embodiments of this specification do not constitute a specific limitation on a device for protecting files in an isolated area. In other embodiments of this specification, a device for protecting files in an isolated area may include more or fewer components than illustrated, or may combine or separate certain components, or arrange the components differently. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0128] The information interaction, execution process, etc. between the modules in the above-mentioned device are based on the same concept as the method embodiments of this specification. For specific contents, please refer to the description in the method embodiments of this specification and will not be repeated here.

[0129] An embodiment of this specification also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, a method for protecting isolated area files in any embodiment of this specification is implemented.

[0130] An embodiment of the present specification further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the processor executes a method for protecting isolated area files according to any embodiment of the present specification.

[0131] Specifically, a system or device equipped with a storage medium can be provided, on which software program codes that implement the functions of any of the above-mentioned embodiments are stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program codes stored in the storage medium.

[0132] In this case, the program code read from the storage medium itself can realize the function of any one of the above embodiments, and thus the program code and the storage medium storing the program code constitute part of this specification.

[0133] Examples of storage media for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program code can be downloaded from a server computer via a communication network.

[0134] In addition, it should be clear that the functions of any of the above embodiments can be achieved not only by executing the program code read by the computer, but also by enabling the operating system operating on the computer to complete part or all of the actual operations based on the instructions of the program code.

[0135] In addition, it can be understood that the program code read from the storage medium is written into a memory provided in an expansion board inserted into the computer or into a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above embodiments.

[0136] It should be noted that, in this article, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises", "comprising" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprising a ..." do not exclude the presence of other identical factors in the process, method, article or device comprising the elements.

[0137] Those skilled in the art will understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk, etc. Various media that can store program codes.

[0138] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this specification, rather than to limit them. Although this specification has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of this specification.

Claims

1. A method for protecting files in an isolated area, characterized in that: Applied in terminal equipment, including: In response to the antivirus software scanning a virus file, encrypting the binary content of the virus file to obtain first file information; Storing the encrypted virus file in the isolation area of ​​the terminal device; Writing the first file information into the registry under the preset path; After the antivirus software is uninstalled and reinstalled, the final file information of the isolated area is obtained based on the file information currently existing in the isolated area and the file information of the registry; Writing the first file information into a registry under a preset path includes: Performing secondary encryption on the first file information to obtain second file information; Writing the second file information into the registry under the preset path; The obtaining of final file information of the isolation area based on the currently existing file information of the isolation area and the file information of the registry comprises: Decrypting the file information in the registry to obtain the file information to be compared; wherein the decryption algorithm corresponds to the secondary encryption algorithm; The file information to be compared is compared with the file information currently existing in the isolation area to obtain the final file information of the isolation area.

2. The method according to claim 1, characterized in that The secondary encryption is implemented using the base64 encryption algorithm.

3. The method according to claim 1, characterized in that Writing the second file information into a registry under a preset path includes: Determining the number of registry entries to be written based on the size of the second file information and a preset writing rule; Splitting the second file information into sub-file information of the same number as the number of sub-file information to be written into the registry; The information of each of the divided sub-files is written into a registry under a preset path respectively.

4. The method according to claim 1, wherein The comparing the file information to be compared with the file information currently existing in the isolation area to obtain the final file information of the isolation area includes: Comparing the file information to be compared with the file information currently existing in the isolation area; If the two are the same, the file information currently existing in the isolation area is used as the final file information of the isolation area; If there is a difference between the two, the part of the file information to be compared that is different from the file information currently existing in the isolation area is written into a pre-created file, and the written file is stored in the isolation area to form the final file information of the isolation area.

5. The method according to claim 4, characterized in that The isolation area stores a configuration file, which is used to record the initial number of virus files existing in the isolation area before the antivirus software is uninstalled; After obtaining the final file information of the isolation area, the method further includes: Reading the configuration file to obtain an initial number of virus files existing in the quarantine area before uninstalling the antivirus software; Determine the current number of virus files in the quarantine area after uninstalling and reinstalling the antivirus software; If the initial number is the same as the current number, outputting a prompt indicating that the virus files in the quarantine area have not changed before and after the antivirus software is uninstalled; Otherwise, a prompt is outputted indicating that the virus files existing in the isolation area have changed before and after the antivirus software is uninstalled.

6. A device for protecting files in an isolated area, characterized in that: Applied in terminal equipment, including: an encryption module, configured to, in response to antivirus software scanning a virus file, encrypt the binary content of the virus file once to obtain first file information; A storage module, used for storing the encrypted virus file in the isolation area of ​​the terminal device; A writing module, used for writing the first file information into a registry under a preset path; An obtaining module, configured to obtain final file information of the isolation area based on the file information currently existing in the isolation area and the file information of the registry after the antivirus software is uninstalled and reinstalled; The writing module is used to perform the following operations: Performing secondary encryption on the first file information to obtain second file information; Writing the second file information into the registry under the preset path; The module is used to perform the following operations: Decrypting the file information in the registry to obtain the file information to be compared; wherein the decryption algorithm corresponds to the secondary encryption algorithm; The file information to be compared is compared with the file information currently existing in the isolation area to obtain the final file information of the isolation area.

7. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium, characterized in that A computer program is stored thereon, and when the computer program is executed in a computer, the computer is caused to execute the method according to any one of claims 1 to 5.

Images