Method and system for processing virus-infected files

Abstract

The invention discloses an infected file processing method and system. The method specifically comprises acquiring a file which is failed to be read by a file system as the to-be-processed file; acquiring the cluster distribution information of the to-be-processed file on a disc; reading data of the to-be-processed file from the disc according to the cluster distribution information; writing the read-out data into a temporary file; analyzing the security of the temporary file; and cleaning the temporary file and the corresponding to-be-processed file if the temporary file is insecure. The method and system provided by the invention can improve the antivirus efficiency.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a processing method and system for virus-infected files. Background technique [0002] With the continuous development of computer technology, computers have become an indispensable partner for people no matter in daily life or work, and have brought a lot of convenience to people's work and life, but there is one The discordant factor, that is the computer virus. [0003] A computer virus refers to a set of computer instructions or program codes compiled or inserted into computer programs that destroy computer functions or data, affect computer use, and are capable of self-replication. Once infected with a virus, the computer usually shows that its files are added, deleted, changed names or attributes, and moved to other directories. These operations of viruses on computer files may cause normal programs to fail to run, computer operating systems to crash, and compute...

AI Technical Summary

Problems solved by technology

Viruses in the prior art often lock the virus-infected file by occupying the file handle, setting the read-only attribute of the file, and making the file in a deleted state. The lock cannot be cracked by conventional means.

[0005] A kind of virus-killing method of prior art, enumerates all processes under the operating system, and enumerates the file handle that each process opens, finds the virus-infected file that adds exclusive lock by checking file handle; Virus-infected files with exclusive locks, but the enumeration of processes and file handles is time-consuming, and the anti-virus efficiency is not high

[0006] Another anti-virus method in the prior art uses some undisclosed methods to check and kill virus-infected files with kernel locks; however, the undisclosed methods are easily incompatible with other programs in the operating system, causing unstable problems such as blue screens in the operating system , thus affecting the antivirus efficiency

Images