Computer virus detection method, device, electronic device and storage medium

Abstract

Embodiments of the present invention disclose a computer virus detection method, device, electronic device, and storage medium, relating to the field of computer security technology and capable of improving the speed of computer virus detection. The method comprises: opening a first file in response to a virus detection instruction; executing a first process of reading the first file and performing a first task for a second file; after completing the first task, determining whether the first process has ended; if the first process has ended, executing a second process of sending the first file to an antivirus engine and performing a second task for a third file; after completing the second task, determining whether the antivirus engine has completed virus detection; and if the antivirus engine has completed virus detection, closing the first file. Embodiments of the present invention are applicable to scenarios where computer viruses are detected.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a computer virus detection method, device, electronic equipment and storage medium. Background Art

[0002] At present, with the gradual popularization of information network technology, computers have been widely used in work and life.

[0003] A computer virus is a set of self-replicating computer instructions or program code inserted by its creator into a computer program to disrupt computer functions or destroy data, affecting its use. Unlike medical "viruses," computer viruses do not exist naturally; rather, they are sets of instructions or program code created by individuals who exploit inherent vulnerabilities in computer software and hardware. They can somehow lodge within a computer's storage media (or program) and become activated when certain conditions are met. They modify other programs to insert an exact copy or a modified version of themselves, thereby infecting them and damaging computer resources.

[0004] In order to solve the above problems, the current solution is to detect and kill computer viruses through anti-virus software. However, current anti-virus software generally has the technical problem of slow computer virus detection.

[0005] Therefore, how to improve the detection speed of computer viruses has become a technical problem that needs to be solved urgently. Summary of the Invention

[0006] In view of this, embodiments of the present invention provide a computer virus detection method, apparatus, electronic device, and storage medium, which can improve the detection speed of computer viruses.

[0007] In a first aspect, an embodiment of the present invention provides a computer virus detection method, the method comprising: opening a first file in response to a virus detection instruction; executing a first process of reading the first file, and executing a first task for a second file; after completing the first task, determining whether the first process has ended; if the first process has ended, executing a second process of sending the first file to an antivirus engine, and executing a second task for a third file; after completing the second task, determining whether the antivirus engine has completed virus detection; if the antivirus engine has completed virus detection, closing the first file.

[0008] Optionally, opening the first file in response to the virus detection instruction includes: opening the first file in response to the virus detection instruction, and receiving a file descriptor corresponding to the first file;

[0009] Correspondingly, executing the first process of reading the first file and executing the first task for the second file includes: changing the attribute of the file descriptor to non-blocking and registering the file descriptor into the input and output multiplexing model; executing the first process of reading the first file and executing the first task for the second file.

[0010] Optionally, the first process of executing reading the first file includes: registering the first callback function corresponding to the file descriptor into the input-output multiplexing model; determining the first callback function corresponding to the file descriptor; and calling the first callback function to execute the first process of reading the first file.

[0011] Optionally, the second process of executing the first file to the antivirus engine includes: registering the second callback function corresponding to the file descriptor into the input-output multiplexing model; determining the second callback function corresponding to the file descriptor; calling the second callback function to execute the second process of sending the first file to the antivirus engine.

[0012] Optionally, after completing the first task and determining whether the first process has ended, the method further includes: if the first process has not ended, executing a third task for the fourth file; and after completing the third task, determining whether the first process has ended.

[0013] Optionally, if the antivirus engine has completed virus detection, after closing the first file, the method further includes: deregistering the file descriptor in the input-output multiplexing model.

[0014] In a second aspect, an embodiment of the present invention provides a computer virus detection device, comprising: an opening module for opening a first file in response to a virus detection instruction; a first execution module for executing a first process of reading the first file and executing a first task for a second file; a first judgment module for judging whether the first process has ended after completing the first task; a second execution module for executing a second process of sending the first file to an antivirus engine and executing a second task for a third file if the first process has ended; a second judgment module for judging whether the antivirus engine has completed virus detection after completing the second task; and a closing module for closing the first file if the antivirus engine has completed virus detection.

[0015] Optionally, the opening module is specifically configured to: open the first file in response to a virus detection instruction, and receive a file descriptor corresponding to the first file;

[0016] Correspondingly, the first execution module includes: a changing unit, used to change the attribute of the file descriptor to non-blocking, and register the file descriptor into the input and output multiplexing model; a first execution unit, used to execute the first process of reading the first file; and a second execution unit, used to execute the first task for the second file.

[0017] Optionally, the first execution unit includes: a registration subunit, used to register the first callback function corresponding to the file descriptor into the input-output multiplexing model; a determination subunit, used to determine the first callback function corresponding to the file descriptor; and a calling subunit, used to call the first callback function to execute the first process of reading the first file.

[0018] Optionally, the second execution module includes: a registration unit, used to register the second callback function corresponding to the file descriptor into the input-output multiplexing model; a determination unit, used to determine the second callback function corresponding to the file descriptor; and a calling unit, used to call the second callback function to execute the second process of sending the first file to the antivirus engine.

[0019] Optionally, the device further includes: a third execution module, configured to execute a third task for a fourth file if the first process has not ended; and a third judgment module, configured to judge whether the first process has ended after completing the third task.

[0020] Optionally, the device further includes: a deregistration module, configured to deregister the file descriptor in the input-output multiplexing model.

[0021] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the housing, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, and is used to execute the computer virus detection method provided by any embodiment of the present invention.

[0022] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method described in any of the aforementioned implementation methods.

[0023] The computer virus detection method, device, electronic device, and storage medium provided by the embodiments of the present invention can, in response to a virus detection instruction, open a first file; execute a first process of reading the first file, and execute a first task for a second file; after completing the first task, determine whether the first process has ended; if the first process has ended, execute a second process of sending the first file to an antivirus engine, and execute a second task for a third file; after completing the second task, determine whether the antivirus engine has completed virus detection; if the antivirus engine has completed virus detection, close the first file. In this way, while reading the first file, the first task for the second file can also be executed, and after sending the first file to the antivirus engine, the antivirus engine can also execute the second task for the third file while performing virus detection on the first file. Therefore, the efficiency of detecting computer viruses in various files can be improved, thereby increasing the speed of detecting computer viruses. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0025] Figure 1 A flowchart of a computer virus detection method provided by an embodiment of the present invention;

[0026] Figure 2 A schematic structural diagram of a computer virus detection device provided by an embodiment of the present invention;

[0027] Figure 3 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0028] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0029] It should be understood that the embodiments described are only a portion of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative work are within the scope of protection of the present invention.

[0030] The embodiment of the present invention provides a computer virus detection method, see Figure 1 The computer virus detection method provided by the embodiment of the present invention may include:

[0031] S11, in response to a virus detection instruction, opening a first file;

[0032] In this step, the user can generate a virus detection instruction by clicking, dragging, or other operations on the corresponding function icon in the graphical interface, or can generate a virus detection instruction by inputting corresponding parameters on the keyboard or in other ways. This embodiment of the present invention does not limit this.

[0033] After receiving the virus detection instruction, the computer can open the first file, where the first file can be any file to be detected.

[0034] S12, executing a first process of reading the first file, and executing a first task for the second file;

[0035] In the prior art, when reading a file to be detected, a synchronous blocking IO (Input and Output) model is adopted. Therefore, when reading the first file, an IO blocking state is entered, and operations on other files cannot be performed.

[0036] In contrast, in this step, when reading the first file, the first task for the second file can be executed at the same time, wherein the second file is another file to be detected that is different from the first file, and the first task can be a step of performing computer virus detection on the second file.

[0037] S13, after completing the first task, determining whether the first process has ended;

[0038] After the first task is completed, it can be determined whether the first process has ended. If it has ended, it means that the reading of the first file has been completed.

[0039] S14, if the first process has ended, executing a second process of sending the first file to an antivirus engine, and executing a second task for a third file;

[0040] After reading the first file, the first file can be sent to an antivirus engine so that the antivirus engine can perform computer virus detection on the first file after receiving the first file. During the process of sending the first file to the antivirus engine and the antivirus engine performing computer virus detection on the first file, a second task for a third file can also be performed simultaneously. The third file is another file to be detected that is different from the first file and the second file, and the second task is a step in performing computer virus detection on the third file. Because the second task for the third file can be performed simultaneously with other processes, the efficiency of computer virus detection is improved.

[0041] S15, after completing the second task, determining whether the antivirus engine has completed virus detection;

[0042] After completing the second task for the third file, it can be determined whether the antivirus engine has completed the virus detection process. For example, if a virus detection completion notification message sent by the antivirus engine is received, it can be determined that the antivirus engine has completed the virus detection process for the first file.

[0043] S16: If the antivirus engine has completed virus detection, close the first file.

[0044] After the antivirus engine completes the virus detection process on the first file, the first file may be closed.

[0045] The computer virus detection method provided by an embodiment of the present invention can, in response to a virus detection instruction, open a first file; execute a first process of reading the first file and perform a first task for a second file; after completing the first task, determine whether the first process has ended; if the first process has ended, execute a second process of sending the first file to an antivirus engine and perform a second task for a third file; after completing the second task, determine whether the antivirus engine has completed virus detection; if the antivirus engine has completed virus detection, close the first file. In this way, while reading the first file, the first task for the second file can also be executed. After sending the first file to the antivirus engine, the antivirus engine can also perform the second task for the third file while performing virus detection on the first file. Therefore, the efficiency of detecting computer viruses in various files can be improved, thereby increasing the speed of computer virus detection.

[0046] Optionally, in one embodiment of the present invention, the step of opening the first file in response to the virus detection instruction (step S11) may include: opening the first file in response to the virus detection instruction, and receiving a file descriptor corresponding to the first file;

[0047] Specifically, a Linux process can open hundreds or even thousands of files. To identify and distinguish open files, Linux assigns each file a number—a non-negative integer called a file descriptor, also known as a file handle. After receiving a virus detection command, the computer opens the first file and receives its corresponding file descriptor from the Linux kernel.

[0048] Correspondingly, executing the first process of reading the first file and executing the first task for the second file (step S12) may include: changing the attribute of the file descriptor to non-blocking and registering the file descriptor into the input-output multiplexing model; executing the first process of reading the first file and executing the first task for the second file.

[0049] Specifically, after receiving the file descriptor corresponding to the first file, the file descriptor's attribute can be changed to non-blocking, and the file descriptor can be registered in the input / output multiplexing model (IO multiplexing model), which can specifically be EPOLL. In this way, when reading the first file, since the file descriptor's attribute is no longer blocking, the system will not enter the input / output wait (IOWAIT) state. Therefore, while reading the first file, the first task for the second file can also be executed.

[0050] Among them, the input and output multiplexing model enables multiple file descriptors to be monitored by one thread. Once a file descriptor is ready, the application can be notified to perform corresponding read and write operations.

[0051] Optionally, in one embodiment of the present invention, the execution of the first process of reading the first file may include: registering the first callback function corresponding to the file descriptor into the input-output multiplexing model; determining the first callback function corresponding to the file descriptor; and calling the first callback function to execute the first process of reading the first file.

[0052] In an embodiment of the present invention, after receiving a file descriptor corresponding to a first file from a Linux kernel, changing the file descriptor's attribute to non-blocking, and registering the file descriptor in an input / output multiplexing model, a first callback function corresponding to the file descriptor can also be registered in the input / output multiplexing model. Because there is a corresponding relationship between the file descriptor and the first callback function, the first callback function corresponding to the file descriptor can be determined in the input / output multiplexing model. By calling the first callback function, a read operation on the first file can be implemented.

[0053] Optionally, in one embodiment of the present invention, executing the second process of sending the first file to the antivirus engine in step S14 may include: registering the second callback function corresponding to the file descriptor into the input-output multiplexing model; determining the second callback function corresponding to the file descriptor; calling the second callback function to execute the second process of sending the first file to the antivirus engine.

[0054] In an embodiment of the present invention, a file descriptor corresponding to a first file is received from a Linux kernel, the file descriptor's attribute is changed to non-blocking, the file descriptor is registered with an input / output multiplexing model, and after reading the first file, a second callback function corresponding to the file descriptor is also registered with the input / output multiplexing model. The second callback function corresponding to the file descriptor can be determined in the input / output multiplexing model. By calling the second callback function, the first file can be sent to an antivirus engine, so that the antivirus engine can receive the first file and perform computer virus detection on the first file.

[0055] The operations of opening the first file, reading it, and sending it to the antivirus engine are not continuous but segmented. Each segment requires a callback function to continue, which is the asynchronous mode. The input / output multiplexing model in asynchronous non-blocking mode can avoid IOWAIT and reduce CPU consumption.

[0056] Optionally, in one embodiment of the present invention, after completing the first task and determining whether the first process has ended, the computer virus detection method provided by the embodiment of the present invention may further include: if the first process has not ended, executing a third task for a fourth file; and after completing the third task, determining whether the first process has ended.

[0057] In an embodiment of the present invention, after completing the first task, if the first process has not yet ended (i.e., the reading of the first file has not yet been completed), a third task for a fourth file may be executed. The fourth file may be another file to be detected that is different from the first file, the second file, and the third file, and the third task is a step of performing computer virus detection on the fourth file.

[0058] After the third task for the fourth file is completed, it is possible to determine again whether the first process is completed. In one example, it is possible to query in the input-output multiplexing model whether the first process is finished.

[0059] Optionally, in one embodiment of the present invention, if the antivirus engine has completed virus detection, after closing the first file (step S16), the computer virus detection method provided by the embodiment of the present invention may further include: canceling the file descriptor in the input-output multiplexing model.

[0060] In an embodiment of the present invention, after the antivirus engine completes virus detection, a deregistration operation may be performed on the file descriptor used in the aforementioned process in an input-output multiplexing model.

[0061] like Figure 2As shown, an embodiment of the present invention further provides a computer virus detection device 2, comprising: an opening module 21, for opening a first file in response to a virus detection instruction; a first execution module 22, for executing a first process of reading the first file and executing a first task for a second file; a first judgment module 23, for judging whether the first process has ended after completing the first task; a second execution module 24, for executing a second process of sending the first file to an antivirus engine and executing a second task for a third file if the first process has ended; a second judgment module 25, for judging whether the antivirus engine has completed virus detection after completing the second task; and a closing module 26, for closing the first file if the antivirus engine has completed virus detection.

[0062] The computer virus detection device provided by an embodiment of the present invention can, in response to a virus detection instruction, open a first file; execute a first process of reading the first file and perform a first task for a second file; after completing the first task, determine whether the first process has ended; if the first process has ended, execute a second process of sending the first file to an antivirus engine and perform a second task for a third file; after completing the second task, determine whether the antivirus engine has completed virus detection; if the antivirus engine has completed virus detection, close the first file. In this way, while reading the first file, the first task for the second file can also be executed. After sending the first file to the antivirus engine, the antivirus engine can also perform the second task for the third file while performing virus detection on the first file. Therefore, the efficiency of detecting computer viruses in various files can be improved, thereby increasing the speed of computer virus detection.

[0063] Optionally, in one embodiment of the present invention, the opening module 21 is specifically used to: open the first file in response to a virus detection instruction, and receive a file descriptor corresponding to the first file; accordingly, the first execution module 22 includes: a changing unit, used to change the attribute of the file descriptor to non-blocking, and register the file descriptor into the input and output multiplexing model; a first execution unit, used to execute a first process of reading the first file; and a second execution unit, used to execute a first task for the second file.

[0064] Optionally, in one embodiment of the present invention, the first execution unit 22 includes: a registration subunit, used to register the first callback function corresponding to the file descriptor into the input-output multiplexing model; a determination subunit, used to determine the first callback function corresponding to the file descriptor; and a calling subunit, used to call the first callback function to execute the first process of reading the first file.

[0065] Optionally, in one embodiment of the present invention, the second execution module 24 includes: a registration unit, used to register the second callback function corresponding to the file descriptor into the input-output multiplexing model; a determination unit, used to determine the second callback function corresponding to the file descriptor; and a calling unit, used to call the second callback function to execute the second process of sending the first file to the antivirus engine.

[0066] Optionally, in one embodiment of the present invention, the computer virus detection device 2 provided in the embodiment of the present invention further includes: a third execution module, used to execute a third task for the fourth file if the first process has not ended; and a third judgment module, used to judge whether the first process has ended after completing the third task.

[0067] Optionally, in one embodiment of the present invention, the computer virus detection device 2 provided by the embodiment of the present invention further includes: a deregistration module, configured to deregister the file descriptor in the input-output multiplexing model.

[0068] The computer virus detection device provided in the embodiment of the present invention and the aforementioned computer virus detection method belong to the same inventive concept. For technical details not described in the computer virus detection device, please refer to the relevant description of the aforementioned computer virus detection method and will not be repeated here.

[0069] Accordingly, an embodiment of the present invention further provides an electronic device, Figure 3 This is a schematic diagram of the structure of an embodiment of the electronic device of the present invention, which can realize the present invention. Figure 1 The process of the embodiment shown. Figure 3 As shown, the above-mentioned electronic device may include: a shell 31, a processor 32, a memory 33, a circuit board 34 and a power supply circuit 35, wherein the circuit board 34 is placed inside the space enclosed by the shell 31, and the processor 32 and the memory 33 are arranged on the circuit board 34; the power supply circuit 35 is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory 33 is used to store executable program code; the processor 32 runs the program corresponding to the executable program code by reading the executable program code stored in the memory 33, so as to execute the method described in any of the above-mentioned embodiments.

[0070] For details on the specific execution process of the above steps by the processor 32 and the steps further executed by the processor 32 by running the executable program code, please refer to the present invention. Figure 1 The description of the illustrated embodiment will not be repeated here.

[0071] This electronic device exists in many forms, including but not limited to:

[0072] (1) Mobile communication devices: These devices are characterized by their mobile communication capabilities and are primarily designed to provide voice and data communications. These terminals include smartphones (e.g., iPhones), multimedia phones, feature phones, and low-end phones.

[0073] (2) Ultra-mobile personal computer devices: These devices fall under the category of personal computers, have computing and processing capabilities, and generally also have mobile Internet access. These terminals include PDAs, MIDs, and UMPCs, such as the iPad.

[0074] (3) Portable entertainment devices: These devices can display and play multimedia content. These devices include audio and video players (such as iPods), handheld game consoles, e-books, smart toys, and portable car navigation devices.

[0075] (4) Server: A device that provides computing services. The server consists of a processor, hard disk, memory, system bus, etc. The server is similar to a general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0076] (5) Other electronic devices with data interaction functions.

[0077] In addition, an embodiment of the present invention also provides a storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the method provided by any embodiment of the present invention, thereby also achieving corresponding beneficial technical effects. The corresponding explanation has been made in the previous text and will not be repeated here.

[0078] The computer virus detection method, apparatus, electronic device, and storage medium provided in embodiments of the present invention can, in response to a virus detection instruction, open a first file; execute a first process for reading the first file and perform a first task for a second file; after completing the first task, determine whether the first process has ended; if the first process has ended, execute a second process for sending the first file to an antivirus engine and perform a second task for a third file; after completing the second task, determine whether the antivirus engine has completed virus detection; and if the antivirus engine has completed virus detection, close the first file. In this way, while reading the first file, the first task for the second file can also be executed. Furthermore, after sending the first file to the antivirus engine, the antivirus engine can also perform the second task for the third file while performing virus detection on the first file. This improves the efficiency of detecting computer viruses in various files, thereby increasing the speed of computer virus detection. Furthermore, embodiments of the present invention can also prevent the system from entering the IOWAIT state by changing the attribute of the file descriptor corresponding to the first file to non-blocking and registering the file descriptor in the input / output multiplexing model, thereby enabling the first task for the second file to be executed in parallel. Furthermore, an embodiment of the present invention can also perform a read operation on the first file by registering a first callback function in the input-output multiplexing model and calling the first callback function. Similarly, an embodiment of the present invention can also perform an operation of sending the first file to the antivirus engine by registering a second callback function in the input-output multiplexing model and calling the second callback function. In addition, an embodiment of the present invention can also execute a third task for the fourth file in parallel with the first process (the read operation on the first file) when the first process has not yet ended. Finally, after the antivirus engine completes virus detection and closes the first file, the file descriptor can also be deregistered in the input-output multiplexing model.

[0079] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0080] In embodiments of the present invention, the term "and / or" describes the association relationship between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0081] Each embodiment in this specification is described in a related manner. The same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

[0082] In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0083] For the convenience of description, the above device is described as being divided into various units / modules based on their functions. Of course, when implementing the present invention, the functions of each unit / module can be implemented in the same or multiple software and / or hardware.

[0084] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing related hardware through a computer program. The program can be stored in a computer-readable storage medium, and when executed, the program can include the processes in the above-described method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0085] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A computer virus detection method, characterized in that: The method comprises: In response to the virus detection instruction, opening the first file; executing a first process of reading the first file and executing a first task for a second file; After completing the first task, determining whether the first process has ended; If the first process is completed, executing a second process of sending the first file to an antivirus engine and executing a second task for a third file; After completing the second task, determining whether the antivirus engine has completed virus detection; If the antivirus engine has completed virus detection, closing the first file; The opening of the first file in response to the virus detection instruction includes: opening the first file in response to the virus detection instruction, and receiving a file descriptor corresponding to the first file; Accordingly, executing the first process of reading the first file and executing the first task for the second file includes: Change the attribute of the file descriptor to non-blocking, and register the file descriptor into the input and output multiplexing model; A first process of reading the first file is executed, and a first task for a second file is executed.

2. The method according to claim 1, characterized in that The first process of executing reading the first file includes: Registering the first callback function corresponding to the file descriptor into the input-output multiplexing model; Determine a first callback function corresponding to the file descriptor; The first callback function is called to execute a first process of reading the first file.

3. The method according to claim 1, characterized in that The second process of sending the first file to the antivirus engine includes: Registering the second callback function corresponding to the file descriptor into the input-output multiplexing model; Determine a second callback function corresponding to the file descriptor; The second callback function is called to execute a second process of sending the first file to the antivirus engine.

4. The method according to claim 1, wherein After completing the first task and determining whether the first process has ended, the method further includes: If the first process is not finished, executing a third task for a fourth file; After completing the third task, it is determined whether the first process has ended.

5. The method according to claim 1, wherein If the antivirus engine has completed virus detection, after closing the first file, the method further includes: In the input / output multiplexing model, the file descriptor is cancelled.

6. A computer virus detection device, characterized in that: The device comprises: an opening module, configured to open the first file in response to a virus detection instruction; A first execution module, configured to execute a first process of reading the first file and executing a first task for a second file; A first judging module, configured to judge whether the first process has ended after completing the first task; a second execution module, configured to execute a second process of sending the first file to an antivirus engine and executing a second task for a third file if the first process has ended; A second judgment module is used to judge whether the antivirus engine has completed virus detection after completing the second task; a closing module, configured to close the first file if the antivirus engine has completed virus detection; The opening module is specifically configured to: open the first file in response to a virus detection instruction, and receive a file descriptor corresponding to the first file; Accordingly, the first execution module includes: a changing unit, configured to change the attribute of the file descriptor to non-blocking, and register the file descriptor into an input / output multiplexing model; A first execution unit, configured to execute a first process of reading the first file; The second execution unit is configured to execute the first task for the second file.

7. An electronic device, characterized in that: The electronic device includes: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the housing, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, and is used to execute any of the methods described in claims 1 to 5 above.

8. A storage medium, characterized in that: A computer program is stored thereon, characterized in that when the program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images