Method and system for detecting and removing files infected by Crytex virus

Abstract

The present invention discloses a method and system for detecting and clearing files infected by Crytex infected viruses, the method comprising: traversing all disk files of a computer, searching for executable files for detection; detecting whether the entry point data of the executable files are infected; wherein, when the executable files are infected, clearing the infected files. Through the processing scheme disclosed in the present invention, file infection by Crytex infected viruses can be cleared, helping to block the spread and residence of the virus family, restoring the normal functions of normal software, and improving the stability and reliability of the system.

Description

Technical Field

[0001] The present invention relates to the technical field of virus detection, and in particular to a method and system for detecting and removing files infected by a Crytex virus. Background Art

[0002] Infectious viruses are an old type of computer virus that can insert its own code into normal programs and run when the host program is started. Once the user shares the infected program with other users through USB flash drives, CDs, networks, etc., an infection outbreak will occur.

[0003] Since infectious viruses have the ability to infect normal executable files, once a computer is infected, tens of thousands of executable programs in the computer will be infected. The traditional processing method of "extracting features from virus files, scanning and deleting files" is not suitable for infectious viruses. The first reason is that there are too many files that need to be extracted for features. The number of infected files that can be infected by each infectious virus is theoretically unlimited, depending on the number of normal files. The second reason is that deleting infected files will cause the system or software to crash directly.

[0004] It can be seen that the above existing virus detection methods still have inconveniences and defects in use, and are in urgent need of further improvement. How to create a new virus detection method has become a goal that the industry urgently needs to improve. Summary of the invention

[0005] In view of this, the embodiments of the present disclosure provide a method for detecting and removing files infected by a Crytex virus, which at least partially solves the problems existing in the prior art.

[0006] In a first aspect, the present disclosure provides a method for detecting and removing files infected by a Crytex virus, the method comprising the following steps:

[0007] Traverse all disk files on the computer and search for executable files for detection;

[0008] Detecting whether the executable file entry point data is infected; wherein,

[0009] When the executable file is infected, a cleaning operation is performed on the infected file.

[0010] According to a specific implementation of the embodiment of the present disclosure, the detecting whether the executable file entry point data is infected includes:

[0011] Get the 2 bytes at offset 0 of the executable file and determine whether it is 0x4d 0x5a; when it is 0x4d0x5a, read the 0x8f bytes at the file offset ntfo, and set the first address of the 0x8f bytes at ntfo as buf1; when it is not 0x4d 0x5a, end directly; ntfo is the 4-byte value at the executable file offset 0x3c;

[0012] Determine whether the two bytes starting with buf1 are 0x450x50; when it is 0x450x50, set the four bytes starting with buf1+0x28 as oeprva, convert oeprva from rva to fo, and get oepfo; when it is not 0x450x50, end directly; rva is the relative virtual address; fo is the file offset address;

[0013] Read 0x56 bytes at the offset oepfo of the executable file, calculate crc32, init is 0xffffffff, and the result is not negated;

[0014] Determine whether crc32 is equal to 0xd906817b; when it is equal, determine that the executable file entry point data is infected; when it is not equal, end directly.

[0015] According to a specific implementation of the embodiment of the present disclosure, the conversion of oeprva from rva to fo includes the following steps:

[0016] Step 1: Input rva, read numofsections*0x28 bytes of data from sectiontablefo, set it as sectionheaderdata, set i=0; among them, the 2-byte value at the offset ntfo+0x14 of the executable file is sizeofoptionalheader; the 2-byte value at the offset ntfo+0x6 is numofsections, and the value of ntfo+0x18+sizeofoptionalheader is sectiontablefo;

[0017] Step 2: Take the 4-byte data at sectionheaderdata+i*0x28+0xc as secstartrva; take the 4-byte data at sectionheaderdata+i*0x28+0x10 as secrawsize; take the 4-byte data at sectionheaderdata+i*0x28+0x14 as secfo;

[0018] Step 3: Determine whether rva is greater than or equal to secstartrva and less than

[0019] secstartrva+secrawsize; when satisfied, output fo=rva-secstartrva+secfo;

[0020] If it is not satisfied, i is incremented by 1, and it is determined whether i is less than numofsections; if it is not satisfied, 0 is output;

[0021] When satisfied, proceed to step 2.

[0022] According to a specific implementation of the embodiment of the present disclosure, when the executable file is infected, the infected file is cleared, including:

[0023] Step 1: Read 0x50a bytes starting from oepfo, and set the first address to data;

[0024] Step 2: Read 4 bytes at data+0x56 as decryption key1; set i2=0;

[0025] Step 3: Execute key1=(0x10DCD*key1+0x116C5)%0x7FFFFFFF in sequence; decrypt the 4 bytes at (data+0x5a+i2*4) as a double word with key1; i2 increments by 1;

[0026] Step 4: Determine whether i2 is greater than 0x12c; if not, proceed to step 3; if greater, proceed to step 5;

[0027] Step 5: Read 4 bytes at data+0x3d2, recorded as oldoepva;

[0028] Step 6: Read 0xf8 bytes starting from ntfo, and set the first byte address to ntdata; read 0x28 bytes at sectiontablefo+(numofsections-1)*0x28, and set the first address to lastsecdata;

[0029] Step 7: Change the 4-byte value at ntdata+0x28 to the 4-byte value at oldoepva minus (ntdata+0x34); change the 4-byte value at ntdata+4c to 0; reduce the 4-byte value at ntdata+0x50 by 0xb00 bytes; reduce the 4-byte value at lastsecdata+0x8 by 0xb00 bytes; reduce the 4-byte value at lastsecdata+0x10 by 0x600 bytes; write the updated ntdata to the file offset ntfo; write the updated lastsecdata to the file offset

[0030] sectiontablefo+(numofsections-1)*0x28;

[0031] Step 8: Truncate the virus data at the end of the file and set the new file size to the 4-byte data at lastsecdata+0x10 plus the 4-byte data at lastsecdata+0x14;

[0032] Step 9: Clearing is complete.

[0033] According to a specific implementation of the embodiment of the present disclosure, the byte value is read in a little-endian manner.

[0034] In a second aspect, the embodiments of the present disclosure provide a system for detecting and removing files infected by a Crytex virus, the system comprising:

[0035] A file traversal module is configured to traverse all disk files of the computer and search for executable files for detection;

[0036] A detection module is configured to detect whether the executable file entry point data is infected; wherein,

[0037] The cleaning module is configured to clean the infected file when the executable file is infected.

[0038] According to a specific implementation of the embodiment of the present disclosure, the system further includes:

[0039] The clear execution module is configured to perform the following operations:

[0040] Step 1: Read 0x50a bytes starting from oepfo, and set the first address to data;

[0041] Step 2: Read 4 bytes at data+0x56 as decryption key1; set i2=0;

[0042] Step 3: Execute key1=(0x10DCD*key1+0x116C5)%0x7FFFFFFF in sequence; decrypt the 4 bytes at (data+0x5a+i2*4) as a double word with key1; i2 increments by 1;

[0043] Step 4: Determine whether i2 is greater than 0x12c; if not, proceed to step 3; if greater, proceed to step 5;

[0044] Step 5: Read 4 bytes at data+0x3d2, recorded as oldoepva;

[0045] Step 6: Read 0xf8 bytes starting from ntfo, and set the first byte address to ntdata; read 0x28 bytes at sectiontablefo+(numofsections-1)*0x28, and set the first address to lastsecdata;

[0046] Step 7: Change the 4-byte value at ntdata+0x28 to the 4-byte value at oldoepva minus (ntdata+0x34); change the 4-byte value at ntdata+4c to 0; reduce the 4-byte value at ntdata+0x50 by 0xb00 bytes; reduce the 4-byte value at lastsecdata+0x8 by 0xb00 bytes; reduce the 4-byte value at lastsecdata+0x10 by 0x600 bytes; write the updated ntdata to the file offset ntfo; write the updated lastsecdata to the file offset

[0047] sectiontablefo+(numofsections-1)*0x28;

[0048] Step 8: Truncate the virus data at the end of the file and set the new file size to the 4-byte data at lastsecdata+0x10 plus the 4-byte data at lastsecdata+0x14;

[0049] Step 9: Clearing is complete.

[0050] In a third aspect, an embodiment of the present disclosure further provides an electronic device, the electronic device comprising:

[0051] at least one processor; and,

[0052] a memory communicatively connected to the at least one processor; wherein,

[0053] The memory stores instructions that can be executed by the at least one processor. When the instructions are executed by the at least one processor, the at least one processor implements the method for detecting and clearing files infected by Crytex virus as described in any one of the first aspect or any one of the implementations of the first aspect.

[0054] In a fourth aspect, an embodiment of the present disclosure further provides a non-transitory computer-readable storage medium, which stores computer instructions. When the computer instructions are executed by at least one processor, the at least one processor executes the method for detecting and clearing files infected by Crytex-infected viruses in the aforementioned first aspect or any implementation of the first aspect.

[0055] In a fifth aspect, an embodiment of the present disclosure further provides a computer program product, comprising a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises program instructions, and when the program instructions are executed by a computer, the computer executes the method for detecting and removing files infected by a Crytex virus in the aforementioned first aspect or any implementation of the first aspect.

[0056] The method for detecting and removing files infected by Crytex virus in the disclosed embodiment can remove file infection by Crytex virus by using the present invention, help block the spread and residence of the virus family, restore the normal functions of normal software, and improve the stability and reliability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] The above is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0058] Figure 1 A schematic flow chart of a method for detecting and removing files infected by a Crytex virus provided in an embodiment of the present disclosure;

[0059] Figure 2 A flowchart of a method for detecting and removing files infected by a Crytex virus provided in an embodiment of the present disclosure;

[0060] Figure 3 A schematic diagram of an infection detection algorithm flow provided by an embodiment of the present disclosure;

[0061] Figure 4 A schematic diagram of an RVA to FO algorithm flow provided in an embodiment of the present disclosure;

[0062] Figure 5A schematic diagram of an infection removal algorithm flow chart provided in an embodiment of the present disclosure;

[0063] Figure 6 A schematic diagram of the structure of a system for detecting and removing files infected by a Crytex virus provided in an embodiment of the present disclosure; and

[0064] Figure 7 A schematic diagram of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0065] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0066] The following describes the embodiments of the present disclosure through specific examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all of the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present disclosure.

[0067] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement a device and / or practice a method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0068] Additionally, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, it will be understood by those skilled in the art that the aspects described may be practiced without these specific details.

[0069] With the popularization of computers, all walks of life have their own information systems. For information systems, stability and reliability are very important. However, due to the spread of various viruses, computer systems have suffered great harm. Infectious viruses in particular can insert their own codes into the codes of other normal programs, causing instability in the target program, resulting in a blue screen of the operating system or software crashes.

[0070] Therefore, the present invention proposes a method that needs to study the common features of infected files through reverse means to avoid extracting a large number of common features, and write a cleanup code to remove the infection to avoid system downtime. It can detect and remove executable files infected by Crytex infection viruses, effectively terminate the spread of infection viruses and remove virus residence, so that the system or software can be restored to stability.

[0071] The embodiment of the present invention provides a method for detecting and removing files infected by Crytex virus, which is based on information obtained by studying the infection process of Crytex virus by reverse engineering, and matches the data around the entry point of the executable file to determine whether the file is infected. For the infected file, the original file data saved by the virus is obtained, and the infection removal operation is performed on the infected file.

[0072] Infectious virus: A computer virus that inserts its own code into other executable files and runs when the target file is run.

[0073] Reverse engineering: View the assembly instructions of the executable program through disassembly to understand the implementation details of the program functions.

[0074] Original file data: After executing its own functions, the infective virus will execute the normal functions of the host program, so the virus will save the original file information required to transfer the program execution flow to the normal code, which can be used to de-infect the file.

[0075] Executable file entry point: The location of the first line of instruction code that starts executing after the executable file is loaded by the operating system.

[0076] Figure 1 A schematic diagram of the process of a method for detecting and removing files infected by a Crytex virus provided in an embodiment of the present disclosure.

[0077] Figure 2 For Figure 1 Corresponding flowchart of the method for detecting and removing files infected by Crytex virus.

[0078] like Figure 1 As shown, at step S110, all disk files of the computer are traversed to find executable files for detection.

[0079] More specifically, the process proceeds to step S120.

[0080] In step S120, it is detected whether the executable file entry point data is infected.

[0081] More specifically, the executable file entry point data is detected to determine whether the file is infected.

[0082] In an embodiment of the present invention, the step of detecting whether the executable file entry point data is infected includes:

[0083] Get the 2 bytes at offset 0 of the executable file and determine whether it is 0x4d 0x5a; when it is 0x4d0x5a, read the 0x8f bytes at the file offset ntfo, and set the first address of the 0x8f bytes at ntfo as buf1; when it is not 0x4d 0x5a, end directly; ntfo is the 4-byte value at the executable file offset 0x3c;

[0084] Determine whether the two bytes starting with buf1 are 0x450x50; when it is 0x450x50, set the four bytes starting with buf1+0x28 as oeprva, convert oeprva from rva to fo, and get oepfo; when it is not 0x450x50, end directly; rva is the relative virtual address; fo is the file offset address;

[0085] Read 0x56 bytes at the offset oepfo of the executable file, calculate crc32, init is 0xffffffff, and the result is not negated; wherein Init is the initial value to be set by the algorithm.

[0086] Determine whether crc32 is equal to 0xd906817b; when it is equal, determine that the executable file entry point data is infected; when it is not equal, end directly.

[0087] In an embodiment of the present invention, converting oeprva from rva to fo comprises the following steps:

[0088] Step 1: Input rva, read numofsections*0x28 bytes of data from sectiontablefo, set it as sectionheaderdata, set i=0; among them, the 2-byte value at the offset ntfo+0x14 of the executable file is sizeofoptionalheader; the 2-byte value at the offset ntfo+0x6 is numofsections, and the value of ntfo+0x18+sizeofoptionalheader is sectiontablefo;

[0089] Step 2: Take the 4-byte data at sectionheaderdata+i*0x28+0xc as secstartrva; take the 4-byte data at sectionheaderdata+i*0x28+0x10 as secrawsize; take the 4-byte data at sectionheaderdata+i*0x28+0x14 as secfo;

[0090] Step 3: Determine whether rva is greater than or equal to secstartrva and less than

[0091] secstartrva+secrawsize; when satisfied, output fo=rva-secstartrva+secfo;

[0092] If it is not satisfied, i is incremented by 1, and it is determined whether i is less than numofsections; if it is not satisfied, 0 is output;

[0093] When satisfied, proceed to step 2.

[0094] In an embodiment of the present invention, byte values ​​are read in little-endian fashion.

[0095] like Figure 3 As shown, the detection module first determines the 0x4d 0x5a flag at file offset 0 and the 0x450x50 header flag at file offset ntfo. Both flags are flags of PE (Portable Executable) executable files, which are used to determine whether the target file may be infected, because the Crytex virus only infects executable files.

[0096] Then, 4 bytes of oeprva data are obtained from buf1+0x28, and the rva (relative virtual address) to fo (file offset address) algorithm is used (such as Figure 4 as shown), convert it to oepfo.

[0097] Read 0x56 bytes from the file offset oepfo, perform crc32 calculation on the 0x56-byte data, and compare the result with 0xd906817b. If they are different, it means that the executable file is not infected with the Crytex infection virus. If they are the same, it means that the executable file is infected with the Crytex infection virus.

[0098] Next, go to step S130.

[0099] In step S130, when the executable file is infected, a cleaning operation is performed on the infected file.

[0100] In the embodiment of the present invention, when the executable file is infected, the infected file is cleared, including:

[0101] Let the 4-byte value at file offset 0x3c (read in little-endian format, the same below) be ntfo.

[0102] Step 1: Read 0x50a bytes starting from oepfo, and set the first address to data;

[0103] Step 2: Read 4 bytes at data+0x56 as decryption key1; set i2=0;

[0104] Step 3: Execute key1=(0x10DCD*key1+0x116C5)%0x7FFFFFFF in sequence; decrypt the 4 bytes at (data+0x5a+i2*4) as a double word with key1; i2 increments by 1;

[0105] Step 4: Determine whether i2 is greater than 0x12c; if not, proceed to step 3; if greater, proceed to step 5;

[0106] Step 5: Read 4 bytes at data+0x3d2, recorded as oldoepva;

[0107] Step 6: Read 0xf8 bytes starting from ntfo, and set the first byte address to ntdata; read 0x28 bytes at sectiontablefo+(numofsections-1)*0x28, and set the first address to lastsecdata;

[0108] Step 7: Change the 4-byte value at ntdata+0x28 to the 4-byte value at oldoepva minus (ntdata+0x34); change the 4-byte value at ntdata+4c to 0; reduce the 4-byte value at ntdata+0x50 by 0xb00 bytes; reduce the 4-byte value at lastsecdata+0x8 by 0xb00 bytes; reduce the 4-byte value at lastsecdata+0x10 by 0x600 bytes; write the updated ntdata to the file offset ntfo; write the updated lastsecdata to the file offset

[0109] sectiontablefo+(numofsections-1)*0x28;

[0110] Step 8: Truncate the virus data at the end of the file and set the new file size to the 4-byte data at lastsecdata+0x10 plus the 4-byte data at lastsecdata+0x14;

[0111] Step 9: Clearing is complete.

[0112] Let the 2-byte value at file offset ntfo+0x14 be sizeofoptionalheader, let the 2-byte value at file offset ntfo+0x6 be numofsections, and record the value of ntfo+0x18+sizeofoptionalheader as sectiontablefo.

[0113] like Figure 5 As shown, read 0x50a bytes starting from oepfo, and set the first address of the storage location of the read data to data. At this time, a key required for decryption is stored at data+0x56, which is a 4-byte key, set to key1; set i2=0.

[0114] Get the new key1 with (key1*0x10dcd+0x116c5)%0x7fffffff, XOR-decrypt the 4-byte data starting at data+0x5a+i2*4 with the new key1, and increment i2 by 1.

[0115] Judge i2>0x12c, if not, return to the previous step, if so, go to the next step.

[0116] Read 4 bytes of data at data+0x3d2, record it as oldoepva, read 0xf8 bytes starting from ntfo, and set the first byte address to ntdata.

[0117] 0x28 bytes at sectiontablefo+(numofsections-1)*0x28, with the first address set to lastsecdata; change the 4-byte value at ntdata+0x28 to the 4-byte value at oldoepva minus (ntdata+0x34); change the 4-byte value at ntdata+4c to 0; reduce the 4-byte value at ntdata+0x50 by 0xb00 bytes; reduce the 4-byte value at lastsecdata+0x8 by 0xb00 bytes; reduce the 4-byte value at lastsecdata+0x10 by 0x600 bytes; write the updated ntdata to the file offset ntfo; write the updated lastsecdata to the file offset

[0118] sectiontablefo+(numofsections-1)*0x28.

[0119] Truncate the virus data at the end of the file and set the new file size to the 4-byte data at lastsecdata+0x10 plus the 4-byte data at lastsecdata+0x14.

[0120] Figure 6 The system 600 for detecting and removing files infected by Crytex virus provided by the present invention includes a file traversal module 610 , a detection module 620 and a removal module 630 .

[0121] The file traversal module 610 is used to traverse all disk files of the computer and find executable files for detection;

[0122] The detection module 620 is used to detect whether the executable file entry point data is infected; wherein,

[0123] The cleaning module 630 is used to clean the infected file when the executable file is infected.

[0124] In an embodiment of the present invention, the system further includes:

[0125] The clear execution module is configured to perform the following operations:

[0126] Step 1: Read 0x50a bytes starting from oepfo, and set the first address to data;

[0127] Step 2: Read 4 bytes at data+0x56 as decryption key1; set i2=0;

[0128] Step 3: Execute key1=(0x10DCD*key1+0x116C5)%0x7FFFFFFF in sequence; decrypt the 4 bytes at (data+0x5a+i2*4) as a double word with key1; i2 increments by 1;

[0129] Step 4: Determine whether i2 is greater than 0x12c; if not, proceed to step 3; if greater, proceed to step 5;

[0130] Step 5: Read 4 bytes at data+0x3d2, recorded as oldoepva;

[0131] Step 6: Read 0xf8 bytes starting from ntfo, and set the first byte address to ntdata; read 0x28 bytes at sectiontablefo+(numofsections-1)*0x28, and set the first address to lastsecdata;

[0132] Step 7: Change the 4-byte value at ntdata+0x28 to the 4-byte value at oldoepva minus (ntdata+0x34); change the 4-byte value at ntdata+4c to 0; reduce the 4-byte value at ntdata+0x50 by 0xb00 bytes; reduce the 4-byte value at lastsecdata+0x8 by 0xb00 bytes; reduce the 4-byte value at lastsecdata+0x10 by 0x600 bytes; write the updated ntdata to the file offset ntfo; write the updated lastsecdata to the file offset

[0133] sectiontablefo+(numofsections-1)*0x28;

[0134] Step 8: Truncate the virus data at the end of the file and set the new file size to the 4-byte data at lastsecdata+0x10 plus the 4-byte data at lastsecdata+0x14;

[0135] Step 9: Clearing is complete.

[0136] See also Figure 7 The present disclosure also provides an electronic device 70, which includes:

[0137] at least one processor; and,

[0138] a memory communicatively connected to the at least one processor; wherein,

[0139] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method for detecting and clearing files infected by Crytex virus in the aforementioned method embodiment.

[0140] The embodiments of the present disclosure also provide a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable the computer to execute the method for detecting and clearing files infected by Crytex virus in the aforementioned method embodiment.

[0141] The embodiments of the present disclosure also provide a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the method for detecting and removing files infected by Crytex virus in the aforementioned method embodiment.

[0142] Reference below Figure 7 , which shows a schematic diagram of the structure of an electronic device 70 suitable for implementing the embodiment of the present disclosure. The electronic device in the embodiment of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0143] like Figure 7 As shown, the electronic device 70 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage device 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the electronic device 70 are also stored. The processing device 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0144] Typically, the following devices may be connected to the I / O interface 705: input devices 706 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 707 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 708 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 709. The communication device 709 may allow the electronic device 70 to communicate with other devices wirelessly or by wire to exchange data. Although the electronic device 70 with various devices is shown in the figure, it should be understood that it is not required to implement or have all the devices shown. More or fewer devices may be implemented or have alternatively.

[0145] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 709, or installed from a storage device 708, or installed from a ROM 702. When the computer program is executed by the processing device 701, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0146] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0147] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0148] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: obtains at least two Internet Protocol addresses; sends a node evaluation request including the at least two Internet Protocol addresses to a node evaluation device, wherein the node evaluation device selects an Internet Protocol address from the at least two Internet Protocol addresses and returns it; receives the Internet Protocol address returned by the node evaluation device; wherein the obtained Internet Protocol address indicates an edge node in a content distribution network.

[0149] Alternatively, the computer-readable medium carries one or more programs, and when the one or more programs are executed by the electronic device, the electronic device: receives a node evaluation request including at least two Internet Protocol addresses; selects an Internet Protocol address from the at least two Internet Protocol addresses; and returns the selected Internet Protocol address; wherein the received Internet Protocol address indicates an edge node in a content distribution network.

[0150] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0151] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0152] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of a unit does not limit the unit itself in some cases. For example, the first acquisition unit may also be described as a "unit for acquiring at least two Internet Protocol addresses".

[0153] It should be understood that various parts of the present disclosure may be implemented in hardware, software, firmware, or a combination thereof.

[0154] The above is only a specific implementation of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present disclosure should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. A method for detecting and removing files infected by Crytex virus, characterized in that: The method comprises the following steps: Traverse all disk files on the computer and search for executable files for detection; Detecting whether the entry point data of the executable file is infected includes: Get the 2 bytes at offset 0 of the executable file and determine whether it is 0x4d 0x5a; if it is 0x4d 0x5a, read the 0x8f bytes at the file offset ntfo, and set the first address of the 0x8f bytes at ntfo as buf1; if it is not 0x4d 0x5a, end directly; ntfo is the 4-byte value at the executable file offset 0x3c; Determine whether the two bytes starting with buf1 are 0x450x50; when it is 0x450x50, set the four bytes starting with buf1+0x28 as oeprva, convert oeprva from rva to fo, and get oepfo; when it is not 0x450x50, end directly; rva is the relative virtual address; fo is the file offset address; Read 0x56 bytes at the offset oepfo of the executable file, calculate crc32, init is 0xffffffff, and the result is not negated; Determine whether crc32 is equal to 0xd906817b; if it is equal, determine that the executable file entry point data is infected; if it is not equal, end directly; When the executable file is infected, the infected file is cleared.

2. The method for detecting and removing files infected by Crytex virus according to claim 1, characterized in that: The conversion of oeprva from rva to fo includes the following steps: Step 1: Input the RVA of oeprva, read the data of numofsections*0x28 bytes from sectiontablefo, set it as sectionheaderdata, set i=0; among them, the 2-byte value at the offset ntfo+0x14 of the executable file is sizeofoptionalheader; the 2-byte value at the offset ntfo+0x6 is numofsections, and the value of ntfo+0x18+sizeofoptionalheader is sectiontablefo; Step 2: Take the 4-byte data at sectionheaderdata+i*0x28+0xc as secstartrva; take the 4-byte data at sectionheaderdata+i*0x28+0x10 as secrawsize; take the 4-byte data at sectionheaderdata+i*0x28+0x14 as secfo; Step 3: Determine whether rva satisfies greater than or equal to secstartrva and less than secstartrva+secrawsize; when satisfied, output fo=rva-secstartrva+secfo; If it is not satisfied, i is incremented by 1, and it is determined whether i is less than numofsections; if it is not satisfied, 0 is output; When satisfied, proceed to step 2.

3. The method for detecting and removing files infected by Crytex virus according to claim 1, characterized in that: When the executable file is infected, the infected file is cleared, including: Step 1: Read 0x50a bytes starting from oepfo, and set the first address to data; Step 2: Read 4 bytes at data+0x56 as decryption key1; set i2=0; Step 3: Execute key1=(0x10DCD*key1+0x116C5)%0x7FFFFFFF in sequence; decrypt the 4 bytes at (data+0x5a+i2*4) as a double word with key1; i2 increments by 1; Step 4: Determine whether i2 is greater than 0x12c; if not, proceed to step 3; if greater, proceed to step 5; Step 5: Read 4 bytes at data+0x3d2, recorded as oldoepva; Step 6: Read 0xf8 bytes starting from ntfo, and set the first byte address to ntdata; read 0x28 bytes at sectiontablefo+(numofsections-1)*0x28, and set the first address to lastsecdata; Step 7: Change the 4-byte value at ntdata+0x28 to the 4-byte value at oldoepva minus (ntdata+0x34); change the 4-byte value at ntdata+4c to 0; reduce the 4-byte value at ntdata+0x50 by 0xb00 bytes; reduce the 4-byte value at lastsecdata+0x8 by 0xb00 bytes; reduce the 4-byte value at lastsecdata+0x10 by 0x600 bytes; write the updated ntdata to the file offset ntfo; write the updated lastsecdata to the file offset sectiontablefo+(numofsections-1)*0x28; Step 8: Truncate the virus data at the end of the file and set the new file size to the 4-byte data at lastsecdata+0x10 plus the 4-byte data at lastsecdata+0x14; Step 9: Clearing is complete.

4. The method for detecting and removing files infected by a Crytex virus according to any one of claims 1 to 3, characterized in that: Read byte value in little-endian fashion.

5. A system for detecting and removing files infected by Crytex virus, characterized in that: The system comprises: A file traversal module is configured to traverse all disk files of the computer and search for executable files for detection; The detection module is configured to detect whether the executable file entry point data is infected, including: Get the 2 bytes at offset 0 of the executable file and determine whether it is 0x4d 0x5a; if it is 0x4d 0x5a, read the 0x8f bytes at the file offset ntfo, and set the first address of the 0x8f bytes at ntfo as buf1; if it is not 0x4d 0x5a, end directly; ntfo is the 4-byte value at the executable file offset 0x3c; Determine whether the two bytes starting with buf1 are 0x450x50; when it is 0x450x50, set the four bytes starting with buf1+0x28 as oeprva, convert oeprva from rva to fo, and get oepfo; when it is not 0x450x50, end directly; rva is the relative virtual address; fo is the file offset address; Read 0x56 bytes at the offset oepfo of the executable file, calculate crc32, init is 0xffffffff, and the result is not negated; Determine whether crc32 is equal to 0xd906817b; if it is equal, determine that the executable file entry point data is infected; if it is not equal, end directly; The cleaning module is configured to clean the infected file when the executable file is infected.

6. The system for detecting and removing files infected by Crytex virus according to claim 5, characterized in that: The system further comprises: The clear execution module is configured to perform the following operations: Step 1: Read 0x50a bytes starting from oepfo, and set the first address to data; Step 2: Read 4 bytes at data+0x56 as decryption key1; set i2=0; Step 3: Execute key1=(0x10DCD*key1+0x116C5)%0x7FFFFFFF in sequence; decrypt the 4 bytes at (data+0x5a+i2*4) as a double word with key1; i2 increments by 1; Step 4: Determine whether i2 is greater than 0x12c; if not, proceed to step 3; if greater, proceed to step 5; Step 5: Read 4 bytes at data+0x3d2, recorded as oldoepva; Step 6: Read 0xf8 bytes starting from ntfo, and set the first byte address to ntdata; read 0x28 bytes at sectiontablefo+(numofsections-1)*0x28, and set the first address to lastsecdata; Step 7: Change the 4-byte value at ntdata+0x28 to the 4-byte value at oldoepva minus (ntdata+0x34); change the 4-byte value at ntdata+4c to 0; reduce the 4-byte value at ntdata+0x50 by 0xb00 bytes; reduce the 4-byte value at lastsecdata+0x8 by 0xb00 bytes; reduce the 4-byte value at lastsecdata+0x10 by 0x600 bytes; write the updated ntdata to the file offset ntfo; write the updated lastsecdata to the file offset sectiontablefo+(numofsections-1)*0x28; Step 8: Truncate the virus data at the end of the file and set the new file size to the 4-byte data at lastsecdata+0x10 plus the 4-byte data at lastsecdata+0x14; Step 9: Clearing is complete.

7. An electronic device, characterized in that: The electronic device includes: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor. When the instructions are executed by the at least one processor, the at least one processor executes the method for detecting and clearing files infected by Crytex virus as described in any one of claims 1 to 4.

8. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, which, when executed by at least one processor, cause the at least one processor to execute the method for detecting and removing files infected by a Crytex-infected virus as described in any one of claims 1 to 4.

Images