Course handling method and device

Abstract

The invention provides a course handling method and a device. By the method and device, hostile courses can be prevented from invading security software by using dynamic link library (DLL) files and global message hooks, so that the detection of security software cannot be restrained by hostile courses. The method comprises the following steps of: during creation of threads, registering various local message hooks in the system, wherein correspondence is established between the local message hook and the message function in the system; calling the corresponding local message hook through the message function when the message function is called by the thread, wherein the message function includes a window creating function; and calling a callback function of the local message hook to prevent the global message hook from being called and returning to execute the message function.

Description

technical field [0001] The present application relates to computer security technology, in particular to a process processing method and device. Background technique [0002] When a thread in the process creates or closes a window, it will check whether the thread has a message hook, and the message hook includes a local message hook and a global message hook, wherein the priority of the local message hook is higher than that of the global message hook. That is, if both message hooks exist, the local message hook is called first, and then the global message hook is called; if only one message hook exists, the existing message hook is called. [0003] Malicious processes (such as Trojan horse processes) can prevent detection by security software by loading dynamic link library files to avoid detection and killing. Among them, the dynamic link library (Dynamic Link Library, DLL) file, which allows programs to share code and other resources necessary to perform special tasks. ...

AI Technical Summary

Problems solved by technology

[0006] Therefore, a technical problem to be urgently solved by those skilled in the art is to propose a process processing method, which can prevent malicious processes from invading security software by using DLL files and global message hooks, so that malicious processes cannot prevent security software detection

Images