File unlocking and shredding method and device

Abstract

The invention provides a file unlocking and shredding method. The method comprises the following steps of: judging whether an object file can be opened and meet the preset conditions; if so, obtaining a handle of the object file and obtaining an object of the object file based on the handle; and searching the object of the object file for the corresponding file reference information base and assigning the reference count value in the file reference information base as the preset value. The file unlocking and shredding mechanism provided by the invention not only is safe and reliable and has high success rate but also can distinguish and counter the self-protection behaviors of the files with malicious programs in the complex client environments, thus enhancing the counterforce of attacking and defending the drive stage malicious programs.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a file unlocking and shredding method and a file unlocking and shredding device. Background technique [0002] A computer virus refers to a set of computer instructions or program codes that are inserted into a computer program by the compiler to destroy computer functions or data, affect the use of the computer, and are capable of self-replication. Once a computer is infected with a virus, the computer usually shows that its files are increased , delete, change the name or attribute, and move to other directories. These operations of the virus on the computer files may cause a series of problems such as the inability to run normal programs, the crash of the computer operating system, the remote control of the computer, and the theft of user information. question. [0003] In order to ensure the safe operation of the computer, it is necessary to scan and kill the virus...

AI Technical Summary

Problems solved by technology

Existing security software has a single means of unlocking and shredding virus-infected files, and cannot break through the layers of protection set up for virus-infected files, and the ability to resist is not strong

Traditional security software vendors have only solved part of the "undelete" problem, and often show a certain lack of ability in the attack and defense of the operating system kernel state, and the ability to resist driver-level malicious programs (Rootkit) is relatively weak

Images