Method and device for detecting and removing computer macro viruses

Abstract

The invention discloses a method and a device for detecting and removing computer macro viruses. The method comprises the following steps of: traversing a preliminarily defined list to recognize a document template file; performing virus detection treatment on the recognized document template file based on a preliminarily defined virus database comprising a known macro virus characteristic code; performing virus removal treatment on the document template file from which the viruses are detected; and deleting the document template file which is subjected to the virus removal treatment. According to the embodiment of the invention, the problems such as propagation and variation of the macro viruses in the document template file are substantially solved, and the defect that the macro viruses cannot be easily and effectively scanned and removed by the conventional anti-virus mechanism is overcome.

Description

technical field [0001] The invention relates to the field of computer security, in particular to a method and device for detecting and removing computer macro viruses. Background technique [0002] A computer virus is data inserted into a computer program that destroys computer functions, which affects the normal use of the computer and is capable of self-replication. A computer virus is usually presented in the form of a set of computer instructions or program codes. Computer virus antivirus engine is a technical mechanism to judge whether the behavior of a specific program is a virus program (or a suspicious program). The anti-virus engine is the main part of the anti-virus software, which is a program for detecting and discovering viruses, and the virus database is a collection of features of the viruses that have been found. During the antivirus process, all programs or files in the system are compared with the characteristics in the virus database, and the programs or ...

AI Technical Summary

Problems solved by technology

Because the macro virus is hidden inside the data file, and the script syntax it uses is flexible and changeable, there are many ways to write a function, so it is very difficult to identify whether a file contains a macro virus

[0005] Macro virus infection and attack come first, while the anti-virus mechanism comes later, and the macro language is a kind of script, which can generate variants with slight modification, and even modify itself during the propagation process, changing once every time it is propagated, so , the existing anti-virus mechanism is difficult to keep up with the speed of macro virus changes, basically has no ability to detect unknown macro viruses, and the anti-virus effect is very poor

Images