Windows system antivirus software scanning conflict control method and device

Abstract

The invention discloses a windows system antivirus software scanning conflict control method and device, and the method comprises the steps: obtaining a first file handle of a newly created file in a window s system based on the FILEREADATTRIBUTES authority and a read-write deletion sharing attribute, and requesting a Filter oplo ck based on the first file handle; based on the GENERICREAD authority and the read-write deletion sharing attribute, obtaining a second file handle of the newly created file, and reading and scanning the newly created file through the second file handle; if the Filter op lock is interrupted, judging that another process accesses the newly created file in an exclusive mode, closing the second file handle, and enabling the other processes to access the newly created file in the exclusive mode; if the Filter oplock is not interrupted, the second file handle and the first file handle are sequentially closed after scanning is finished.

Description

Technical Field

[0001] The present invention relates to the technical field of software detection, and in particular to a method and device for controlling scanning conflicts of Windows system antivirus software. Background Art

[0002] In today's Windows operating system environment, the file scanning mechanism of antivirus software is mainly divided into two completely different methods: synchronous scanning and asynchronous scanning.

[0003] In synchronous scanning mode, once a process creates a file, the antivirus software will immediately intervene, blocking the further execution of the current process and focusing all its energy on scanning the newly created file. During this period, the process is in a waiting state. Only when the antivirus software completes a detailed scan of the file and determines that the file has no security risks or has dealt with all potential threats, the process is allowed to proceed with subsequent operations. Although this method can ensure that the file has been thoroughly checked before the process continues to execute, it may cause the process to stagnate due to the scanning process, which in turn affects the overall operating efficiency of the system to a certain extent. Especially in multi-tasking scenarios, frequent process blocking may cause users to feel obvious system lag.

[0004] In contrast, the asynchronous scanning mode adopts a more flexible strategy with less impact on system performance. When a process creates a file, the antivirus software will not hinder the normal progress of the process, but quietly start the scanning process of the file in the background in a non-blocking manner, which means that the process can continue to perform its original task without being disturbed by the scanning operation, so that the system can maintain a relatively smooth multi-tasking state. However, since the scanning and the process's access to the file are carried out at the same time, when the antivirus software is scanning the file, if the user tries to access the file in an exclusive manner, such as writing, modifying or deleting, it is very likely to cause an access conflict. This is because the antivirus software has imposed certain access restrictions or resource occupation on the file during the scanning process, and the user's exclusive access request is not compatible with these existing scanning operations. Once such an access conflict occurs, the user's access request will fail, which will not only interrupt the user's operation process and affect their normal use experience, but may also lead to adverse consequences such as user data loss or task interruption. For example, when a user urgently needs to modify an important document and save it, if the save fails due to an access conflict caused by asynchronous scanning of the antivirus software, the content that the user has worked hard to edit may be lost, causing great trouble and loss to the user. Summary of the invention

[0005] The purpose of the embodiment of the present invention is to provide a method and device for controlling scanning conflicts of anti-virus software of a Windows system. By reasonably utilizing different permissions and corresponding sharing attributes to obtain the first file handle and the second file handle of a file, it can not only ensure that the anti-virus software can scan the newly created file, but also coordinate the access relationship with other processes to the file to a certain extent; with the help of the request Filter oplock mechanism, the coordination of file access is further optimized, so that the anti-virus software scanning the file and the other processes accessing the file can be as parallel as possible, reducing the possibility of conflicts due to mutual interference.

[0006] To solve the above technical problems, a first aspect of an embodiment of the present invention provides a method for controlling scanning conflicts of Windows system antivirus software, comprising the following steps:

[0007] Obtain the first file handle of the newly created file in the Windows system based on the FILE_READ_ATTRIBUTES permission and the FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE sharing attributes, and request a Filter oplock based on the first file handle;

[0008] Based on the GENERIC_READ permission and the FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE sharing attributes, a second file handle of the newly created file is obtained, and the newly created file is read and scanned through the second file handle;

[0009] If the Filter oplock is interrupted, it is determined that another process exclusively accesses the newly created file, and the second file handle is closed, so that the other process exclusively accesses the newly created file;

[0010] If the Filter oplock is not interrupted, the second file handle and the first file handle are closed in sequence after the scan is completed.

[0011] Furthermore, after closing the second file handle, the method further includes:

[0012] Use the NtFsControlFile function to send the FSCTL_OPLOCK_BR EAK_ACKNOWLEDGE instruction to the newly created file to notify the file system that the conflict has been resolved;

[0013] Closing the first file handle, and saving the newly created file with conflict to a list to be scanned;

[0014] Newly created files in the to-be-scanned list are acquired based on a first preset time interval, and the scan is performed again.

[0015] Furthermore, after saving the newly created file with conflicts to the to-be-scanned list, the method further includes:

[0016] Prioritize the newly created files in the to-be-scanned list, and rescan the newly created files according to the priorities;

[0017] The priority sorting principle is as follows: a newly created file has a higher priority than a conflicting file.

[0018] Further, the requesting Filter oplock based on the first file handle includes:

[0019] When requesting Filter oplock fails, get the failure reason type;

[0020] If the failure reason type is insufficient system resources, then request Filteroplock again after the second preset time interval;

[0021] If the failure reason type is temporarily locked by other processes, the newly created file is added to the request waiting queue, and the Filter op lock is requested again after it is detected that the process of the newly created file releases the lock.

[0022] Further, reading and scanning the newly created file through the second file handle includes:

[0023] Based on the size of the newly created file, the newly created file is scanned by a multi-threaded scanning method.

[0024] Further, when the newly created file is smaller than a first preset size, the newly created file is scanned by a single-thread scanning method;

[0025] When the newly created file is larger than or equal to a first preset size, the newly created file is scanned by a multi-thread scanning method.

[0026] Further, reading and scanning the newly created file through the second file handle includes:

[0027] Detecting an external network access request for the newly created file;

[0028] If the newly created file makes an external network connection, the external network connection is blocked and the newly created file is marked as a high-risk file.

[0029] Accordingly, a second aspect of an embodiment of the present invention provides a Windows system antivirus software scanning conflict control device, comprising:

[0030] A handle acquisition module, which is used to obtain a first file handle of a newly created file in the Windows system based on the FILE_READ_ATTRIBUTES permission and the FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE sharing attributes, and request a Filter oplock based on the first file handle;

[0031] A file scanning module, which is used to obtain a second file handle of the newly created file based on the GENERIC_READ permission and the FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE sharing attributes, and read and scan the newly created file through the second file handle;

[0032] A process control module, which is used for determining that another process exclusively accesses the newly created file if the filter oplock is interrupted, closing the second file handle, and allowing the other process to exclusively access the newly created file;

[0033] The process control module is further configured to close the second file handle and the first file handle in sequence after the scanning is completed if the Filter oplock is not interrupted.

[0034] Correspondingly, a third aspect of an embodiment of the present invention provides an electronic device, comprising: at least one processor; and a memory connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the above-mentioned Windows system antivirus software scanning conflict control method.

[0035] Correspondingly, a fourth aspect of an embodiment of the present invention provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the above-mentioned Windows system antivirus software scanning conflict control method.

[0036] The above technical solution of the embodiment of the present invention has the following beneficial technical effects:

[0037] 1. During the asynchronous scanning process, by properly using different permissions (such as FILE_READ_ATTRIBUTES, GENERIC_READ, etc.) and corresponding sharing attributes to obtain the first and second file handles of the file, it can ensure that the antivirus software can scan the newly created file and coordinate the access relationship with other processes to the file to a certain extent;

[0038] 2. With the help of the request filter oplock mechanism, the coordination of file access is further optimized, so that the antivirus software scanning files and other processes accessing files can be as parallel as possible, reducing the possibility of conflicts caused by mutual interference;

[0039] 3. When a Filter oplock interruption occurs, which means that other processes want to access files exclusively, the second file handle used for scanning is closed in time to allow other processes to access the file exclusively. This effectively avoids the problem mentioned in the background technology that the user's exclusive access request fails due to access conflicts during asynchronous scanning, affecting normal use. This ensures the user's need to perform exclusive operations on files during the use of the system, and improves the stability of the entire system and user experience in the asynchronous scanning scenario of antivirus software. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a flow chart of a method for controlling scanning conflicts of Windows system antivirus software provided by an embodiment of the present invention;

[0041] Figure 2 It is a logical diagram of scanning conflict control of Windows system antivirus software provided by an embodiment of the present invention;

[0042] Figure 3 The present invention is a block diagram of a module of a Windows system antivirus software scanning conflict control device provided by an embodiment of the present invention.

[0043] Reference numerals:

[0044] 1. Handle acquisition module, 2. File scanning module, 3. Process control module. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings. It should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present invention. In addition, in the following description, the description of well-known structures and technologies is omitted to avoid unnecessary confusion of the concept of the present invention.

[0046] Please refer to Figure 1 and Figure 2A first aspect of an embodiment of the present invention provides a method for controlling scanning conflicts of Windows system antivirus software, comprising the following steps:

[0047] Step S100, obtaining the first file handle of the newly created file in the Windows system based on the FILE_READ_ATTRIBUTES permission and the FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE sharing attributes, and requesting a Filter oplock based on the first file handle.

[0048] The first file handle of the newly created file is obtained through specific permissions (FILE_READ_ATTRIBUTES) and sharing attributes (FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE). The FILE_READ_ATTRIBUTES permission is mainly used to read the basic attribute information of the file, and the set sharing attribute indicates that after obtaining the handle, other processes can still read, write and delete the newly created file. This setting not only ensures that the antivirus software can know the relevant information of the file, but also does not excessively restrict the normal use of the file by other processes. On this basis, based on the first file handle obtained, the Filter oplock is requested. As a file access coordination mechanism, the Filter oplock can help optimize the processing flow of files in multi-process access scenarios, so that the antivirus software scanning and other process access can interact more reasonably and reduce potential conflicts.

[0049] Step S200: Based on the GENERIC_READ permission and the FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE sharing attributes, a second file handle of the newly created file is obtained, and the newly created file is read and scanned through the second file handle.

[0050] The second file handle of the newly created file is obtained by using the GENERIC_READ permission and the same FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE sharing attributes. The GENERIC_READ permission specifies that the handle is mainly used to read the file content, and the sharing attribute continues to maintain a multi-process friendly access environment. Subsequently, with the help of this second file handle, the antivirus software can read and scan the newly created file, check whether the file has security threats in the background without blocking the normal operation of other processes, realize the asynchronous scanning function, and minimize the impact on the overall operation efficiency of the system.

[0051] Step S300, if the Filter oplock is interrupted, it is determined that another process has exclusive access to the newly created file, and the second file handle is closed, so that the other process has exclusive access to the newly created file.

[0052] When the Filter oplock is interrupted, it means that other processes are trying to access the newly created file exclusively. In order to avoid other processes being unable to operate normally due to access conflicts, the second file handle used for scanning is closed to release the file access rights, so that other processes can successfully access the newly created file exclusively. The above method effectively solves the problem of conflicts with other processes' exclusive access requirements when the antivirus software scans files asynchronously, ensures the normal operation of file operations by various processes in the system, and improves the fluency and experience of users in using the system.

[0053] Step S400: If the Filter oplock is not interrupted, the second file handle and the first file handle are closed in sequence after the scan is completed.

[0054] The fact that the filter oplock is not interrupted means that during the entire process of the antivirus software reading and scanning the newly created file through the second file handle, no other process interferes with the access to the file in an exclusive manner. Therefore, the file scanning work is carried out smoothly in a relatively stable and conflict-free environment, and the antivirus software can complete a comprehensive check of the file according to the established plan to determine whether the file has security risks. For example, during the period when the system load is low and the file access needs of various processes do not conflict, the filter oplock can remain uninterrupted, allowing the scanning operation to proceed smoothly.

[0055] After the scan is completed, because the second file handle is mainly responsible for reading and scanning the file content, after the scanning task has been completed, the file content reading operation is no longer needed. Closing the handle in time can release related system resources, such as the cache area associated with the handle in the memory, the control structure for file reading and writing, etc., to avoid waste of resources and potential problems that may be caused by holding the handle for a long time (such as handle leakage, etc., affecting the stability of the system and subsequent access to the file by other processes).

[0056] The first file handle is initially used to request the Filter oplock. When the scanning work is all completed, closing the first file handle can completely complete the cleanup of all resources related to the file and release the access coordination mechanism. Moreover, after closing the first file handle, the system can know that the antivirus software has ended the relevant operations on this file, which is convenient for other subsequent processes to process the file according to normal file access rules, and will not be affected by the relevant mechanisms set up for scanning before, and restore the normal access status of the file in the system.

[0057] Furthermore, after closing the second file handle in step S300, the method further includes:

[0058] Step S310, using the NtFsControlFile function to send a FSCTL_OPLOCK_BREAK_ACKNOWLEDGE instruction to the newly created file, notifying the file system that the conflict has been resolved.

[0059] After closing the second file handle to allow other processes to have exclusive access to the file, it is important to use the NtFsCon trolFile function to send the FSCTL_OPLOCK_BREAK_ACKNOWLEDGE instruction to the newly created file. The above instruction is mainly used to interact with the file system to inform the antivirus software that it has known and handled the conflict caused by the breaking of the Filter oplock. It helps the system update its internal access status record and coordination mechanism for the file, so that the system can more reasonably arrange the operations of each process on the file in subsequent file access scheduling, ensuring the stability and consistency of the entire file access system.

[0060] Step S320, closing the first file handle, and saving the newly created file with conflicts to a list to be scanned.

[0061] When the second file handle is closed, the task of the first file handle is also completed accordingly; the first file handle occupies certain system resources in the process of obtaining the newly created file and requesting the Filter oplock, including memory space to store file-related information structures (such as file object attributes, etc.) and system internal resources for managing file access coordination.

[0062] Closing the first file handle can release these resources back to the system resource pool, allowing the system to allocate these resources to other processes or tasks, effectively avoiding resource waste and system performance degradation caused by excessive resource usage. For example, in a resource-constrained system environment, timely closing the file handle can provide more memory and processing resources for other running applications, ensuring the smooth operation of the entire system.

[0063] Although the scan is currently interrupted due to exclusive access requirements of other processes, since the security of the file has not been fully determined, it is necessary to record it for subsequent re-examination. This can avoid missing the detection of files that may pose security risks due to temporary conflicts, ensure the integrity of the antivirus software's security check of system files, and prevent potential malicious files or security vulnerabilities from spreading or occurring in the system without being detected.

[0064] Step S330: acquiring newly created files in the to-be-scanned list based on a first preset time interval, and re-scanning.

[0065] By obtaining newly created files in the to-be-scanned list based on the first preset time interval and rescanning them, the file scanning task can be reasonably planned and resources allocated. By setting a suitable time interval, it is possible to avoid, to a certain extent, unnecessary continuous impact on system performance caused by too frequent attempts to scan files, especially when the system is under high load or the file is being frequently used by other processes. After a predetermined time interval, scanning these files that have caused conflicts again helps ensure that a comprehensive security check of the files is completed when system resources are relatively loose and the file status is relatively stable, thereby effectively improving the security and reliability of the antivirus software during the entire system operation process, while also taking into account the balance between system performance and user experience.

[0066] Furthermore, after the newly created file with conflicts is saved to the to-be-scanned list in step S320, the method further includes:

[0067] Step S321, sorting the newly created files in the to-be-scanned list by priority, and rescanning the newly created files according to the priority.

[0068] In the asynchronous scanning process of antivirus software, saving newly created files with conflicts to the list to be scanned, prioritizing them and rescanning them is an effective strategy to optimize resource allocation and improve detection efficiency, allowing antivirus software to process files that may pose security risks in a targeted manner based on factors such as the importance and suspiciousness of the files, rather than blindly scanning all the files in the list to be scanned in order. This helps to ensure the security of key parts of the system while promptly discovering and processing files that are more likely to hide malicious code or be attacked, thereby improving the security and stability of the entire system.

[0069] The priority sorting principle is as follows: a newly created file has a higher priority than a conflicting file.

[0070] Newly created files have a high degree of uncertainty. On the one hand, they may be legitimate files generated by normal applications or user operations; on the other hand, they may be newly generated by malware after invading the system to store stolen data, spread malicious code, or establish backdoor connections. Due to their newly created characteristics, they have not yet been fully checked by the system's long-term operation verification and other security detection mechanisms. For example, a new executable file that suddenly appears in a temporary folder, without a clear source and purpose description, can be scanned first to timely discover and deal with malware that has just entered the system and may not have yet occurred, effectively controlling security risks at an early stage and preventing malicious files from lurking in the system and launching large-scale attacks at the right time.

[0071] Further, requesting Filter oplock based on the first file handle in step S100 includes:

[0072] Step S110: when the request for Filter oplock fails, obtain the failure reason type.

[0073] In the process of requesting Filter oplock based on the first file handle, the request may fail due to various factors. Therefore, it is particularly important to first perform step S110, that is, to obtain the type of failure reason. By accurately determining the reason why the Filter oplock request failed, the antivirus software can subsequently take targeted countermeasures to achieve the effective acquisition of the Filter oplock as much as possible, thereby ensuring that the file scanning process can be carried out smoothly under a more optimized file access coordination mechanism.

[0074] Step S120: If the failure reason type is insufficient system resources, then re-request the Filter oplock after a second preset time interval.

[0075] When the analysis shows that the failure reason is insufficient system resources, it is more reasonable to adopt the strategy of re-requesting the Filter oplock after the second preset time interval. Insufficient system resources may be caused by the current high CPU usage, excessive memory usage, or busy disk I / O. Under such resource-constrained conditions, the file system is temporarily unable to allocate sufficient resources to meet the request conditions of the Filter oplock. By setting a second preset time interval, such as a few hundred milliseconds or a few seconds according to the average resource load fluctuation of the system, wait until the system has relatively sufficient resources before retrying the request. This not only avoids further increasing the system burden by repeatedly and ineffectively requesting the Filter oplock when resources are tight, but also gives the system the opportunity to self-regulate and release resources, thereby increasing the probability of subsequent requests being successful, and ensuring that the antivirus software can better use the Filter oplock mechanism to coordinate file scanning and other processes' access to files.

[0076] Step S130, if the failure reason type is temporarily locked by other processes, the newly created file is added to the request waiting queue, and the Filter oplock is requested again after it is detected that the process that created the newly created file releases the lock.

[0077] If it is determined that the failure reason is that other processes temporarily lock the newly created file, then adding the newly created file to the request waiting queue is an effective way to deal with it. Because in the Windows system environment where multiple processes access files concurrently, other processes may impose temporary locks on files due to their own operation needs (such as writing or modifying file contents) to ensure the exclusivity of the operation and the integrity of the data. In this case, the antivirus software needs to wait for the process to complete the operation and release the lock before it has the opportunity to request the Filter oplock again. Adding files to the request waiting queue allows the antivirus software to manage these files that are temporarily unable to obtain the Filter oplock because they are locked by other processes in an orderly manner. Once it is detected that the relevant process has released the lock, it can initiate a request again in time, so that the file scanning process can continue to proceed in an orderly manner with the assistance of the Filter oplock mechanism, reducing the interference caused by file access conflicts between processes, ensuring the smoothness of file access in the entire system and the normal implementation of the asynchronous scanning function of the antivirus software.

[0078] Specifically, the reading and scanning of the newly created file by using the second file handle in step S200 includes:

[0079] Step S210 , based on the size of the newly created file, the newly created file is scanned by a multi-threaded scanning method.

[0080] Furthermore, when the newly created file is smaller than a first preset size, the newly created file is scanned by a single-thread scanning method; when the newly created file is larger than or equal to the first preset size, the newly created file is scanned by a multi-thread scanning method.

[0081] For smaller files, such as those with a size of a few KB or tens of KB, single-threaded scanning is often sufficient to quickly complete the reading and security check of its content. Because the content of a small file is limited, enabling multi-threaded scanning may bring additional thread creation, scheduling, and resource allocation overhead, which is not worth the cost. A single thread can efficiently determine whether there are security risks in the file by sequentially reading and analyzing the file content.

[0082] When facing newly created files of larger sizes, such as files with a size of tens or even hundreds of MB or even larger, the multi-threaded scanning method shows significant advantages. Multi-threading can make full use of the system's multi-core processor resources to divide the file content into multiple parts, each thread is responsible for scanning a part of the content, and these threads can be executed in parallel, greatly shortening the overall scanning time.

[0083] When it is determined to scan a newly created file based on multi-threaded scanning, the antivirus software will first determine the number of threads based on the actual size of the file and the current available resources of the system (such as the number of CPU cores, free memory, etc.). Generally speaking, the number of threads will be matched with the number of system cores as much as possible or set according to a certain ratio to ensure that each thread can obtain a relatively sufficient CPU time slice to perform scanning tasks, while not causing system performance problems due to excessive consumption of resources such as memory due to too many threads.

[0084] In addition, reading and scanning the newly created file through the second file handle in step S200 includes:

[0085] Step S221, detecting an external network access request for a newly created file.

[0086] As network environments become increasingly complex, malware often uses files as carriers to attempt to connect to control servers in external networks after entering the system, in order to transmit stolen data, receive updated malicious instructions, or spread itself to other systems. Real-time detection of newly created files to see if there are external network access requests can timely discover potential malicious network behaviors of files, becoming a key means of early warning and intercepting security threats.

[0087] Step S222: If the newly created file makes an external network connection, the external network connection is blocked and the newly created file is marked as a high-risk file.

[0088] Blocking external network connections can directly cut off the communication link between the file and possible external malicious servers or attackers, preventing the file from further carrying out malicious behaviors such as data transmission and command reception, and minimizing the risks of data leakage and further system intrusion that may be brought to users. For example, if it is a newly created file with a backdoor program implanted in it, blocking its network connection can prevent the attacker from remotely controlling the user's computer system through the backdoor, thus ensuring the security of the system and the privacy of the user.

[0089] Marking the newly created file as a high-risk file will help the antivirus software to conduct a more in-depth and comprehensive security analysis on it. The marked file will receive special attention in the subsequent processing process (such as rescanning, manual review, etc.). The antivirus software can call on more powerful detection tools and use more analysis methods (such as deep behavioral analysis, sandbox simulation operation, etc.) to determine whether there are indeed malicious codes and hidden malicious functions in the file, so as to make accurate disposal decisions, such as completely deleting the file, isolating the file, or prompting the user to operate with caution, etc., so as to more effectively respond to potential network security threats and protect the security of the entire Windows system and user information.

[0090] Accordingly, please refer to Figure 3 A second aspect of an embodiment of the present invention provides a Windows system antivirus software scanning conflict control device, comprising:

[0091] A handle acquisition module 1 is used to acquire a first file handle of a newly created file in the Windows system based on the FILE_READ_ATTRIBUTES permission and the FILE_SH ARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE sharing attributes, and request a Filter operation based on the first file handle;

[0092] A file scanning module 2, which is used to obtain a second file handle of a newly created file based on the GENERIC_READ permission and the FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE sharing attributes, and read and scan the newly created file through the second file handle;

[0093] The process control module 3 is used for determining that another process has exclusive access to the newly created file if the filter oplock is interrupted, closing the second file handle, and allowing the other process to have exclusive access to the newly created file;

[0094] The process control module 3 is further configured to close the second file handle and the first file handle in sequence after the scanning is completed if the Filter oplock is not interrupted.

[0095] Accordingly, a third aspect of an embodiment of the present invention provides an electronic device, comprising: at least one processor; and a memory connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the above-mentioned Windows system antivirus software scanning conflict control method.

[0096] Correspondingly, a fourth aspect of an embodiment of the present invention provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the above-mentioned Windows system antivirus software scanning conflict control method.

[0097] The embodiment of the present invention aims to protect a method and device for controlling scanning conflicts of anti-virus software in a Windows system, and the method includes the following steps: obtaining the first file handle of a newly created file in the Windows system based on the FILE_READ_ATTRIBUTES permission and the FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE sharing attributes, and requesting a Filter oplock based on the first file handle; obtaining the second file handle of the newly created file based on the GENERIC_READ permission and the FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE sharing attributes, and reading and scanning the newly created file through the second file handle; if the oplock is interrupted, determining that another process has exclusive access to the newly created file, closing the second file handle, and allowing other processes to have exclusive access to the newly created file; if the Filter oplock is not interrupted, closing the second file handle and the first file handle in sequence after the scan is completed. The above technical solution has the following effects:

[0098] 1. During the asynchronous scanning process, by properly using different permissions (such as FILE_READ_ATTRIBUTES, GENERIC_READ, etc.) and corresponding sharing attributes to obtain the first and second file handles of the file, it can ensure that the antivirus software can scan the newly created file and coordinate the access relationship with other processes to the file to a certain extent;

[0099] 2. With the help of the request filter oplock mechanism, the coordination of file access is further optimized, so that the antivirus software scanning files and other processes accessing files can be as parallel as possible, reducing the possibility of conflicts caused by mutual interference;

[0100] 3. When a Filter oplock interruption occurs, which means that other processes want to access files exclusively, the second file handle used for scanning is closed in time to allow other processes to access the file exclusively. This effectively avoids the problem mentioned in the background technology that the user's exclusive access request fails due to access conflicts during asynchronous scanning, affecting normal use. This ensures the user's need to perform exclusive operations on files during the use of the system, and improves the stability of the entire system and user experience in the asynchronous scanning scenario of antivirus software.

[0101] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0102] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0103] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0104] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0105] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for controlling scanning conflicts of Windows system antivirus software, characterized in that: The steps include: Based on the FILE_READ_ATTRIBUTES permission and the FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE sharing attributes, obtain the first file handle of the newly created file in the Windows system, and request a Filter oplock based on the first file handle; Based on the GENERIC_READ permission and the FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE sharing attributes, a second file handle of the newly created file is obtained, and the newly created file is read and scanned through the second file handle; If the Filter oplock is interrupted, it is determined that another process exclusively accesses the newly created file, and the second file handle is closed, so that the other process exclusively accesses the newly created file; If the Filter oplock is not interrupted, the second file handle and the first file handle are closed in sequence after the scan is completed.

2. The Windows system antivirus software scanning conflict control method according to claim 1, characterized in that: After closing the second file handle, the method further includes: Use the NtFsControlFile function to send the FSCTL_OPLOCK_BR EAK_ACKNOWLEDGE instruction to the newly created file to notify the file system that the conflict has been resolved; Closing the first file handle, and saving the newly created file with conflict to a list to be scanned; Newly created files in the to-be-scanned list are acquired based on a first preset time interval, and the scan is performed again.

3. The Windows system antivirus software scanning conflict control method according to claim 2, characterized in that: After saving the newly created file with conflicts to the to-be-scanned list, the method further includes: Prioritize the newly created files in the to-be-scanned list, and rescan the newly created files according to the priorities; The priority sorting principle is as follows: a newly created file has a higher priority than a conflicting file.

4. The method for controlling scanning conflicts of Windows system antivirus software according to any one of claims 1 to 3, characterized in that: The requesting a Filter oplock based on the first file handle includes: When requesting Filter oplock fails, get the failure reason type; If the failure reason type is insufficient system resources, then request Filteroplock again after the second preset time interval; If the failure reason type is temporarily locked by other processes, the newly created file is added to the request waiting queue, and the Filter op lock is requested again after it is detected that the process of the newly created file releases the lock.

5. The Windows system antivirus software scanning conflict control method according to claim 1, characterized in that: The reading and scanning the newly created file through the second file handle includes: Based on the size of the newly created file, the newly created file is scanned by a multi-threaded scanning method.

6. The Windows system antivirus software scanning conflict control method according to claim 5, characterized in that: When the newly created file is smaller than a first preset size, scanning the newly created file by a single-thread scanning method; When the newly created file is larger than or equal to a first preset size, the newly created file is scanned by a multi-thread scanning method.

7. The Windows system antivirus software scanning conflict control method according to claim 1, characterized in that: The reading and scanning the newly created file through the second file handle includes: Detecting an external network access request for the newly created file; If the newly created file makes an external network connection, the external network connection is blocked and the newly created file is marked as a high-risk file.

8. A device for controlling scanning conflicts of anti-virus software in Windows system, characterized in that: include: A handle acquisition module, which is used to obtain a first file handle of a newly created file in the Windows system based on the FILE_READ_ATTRIBUTES permission and the FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE sharing attributes, and request a Filter oplock based on the first file handle; A file scanning module, which is used to obtain a second file handle of the newly created file based on the GENERIC_READ permission and the FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE sharing attributes, and read and scan the newly created file through the second file handle; A process control module, which is used for determining that another process exclusively accesses the newly created file if the filter oplock is interrupted, closing the second file handle, and allowing the other process to exclusively access the newly created file; The process control module is further configured to close the second file handle and the first file handle in sequence after the scanning is completed if the Filter oplock is not interrupted.

9. An electronic device, characterized in that: include: at least one processor; And a memory connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the Windows system antivirus software scanning conflict control method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: Computer instructions are stored thereon, and when the instructions are executed by a processor, a Windows system antivirus software scanning conflict control method as described in any one of claims 1-7 is implemented.

Images