Method and device for detecting and clearing infective virus in PE (portable executable) file

Abstract

The invention discloses a method and a device for detecting and clearing an infective virus in a PE (portable executable) file. The method comprises the following steps of judging whether an PE file head of a target PE file contains a preset feature which is suspected to infect with the infective virus or not; when the PE file head of the target PE file contains the preset feature, preprocessing the target PE file; executing the corresponding file in a debug type, and setting an int3 breakpoint at an entrance point of the corresponding file; when the file is executed to the entrance point, if an invalid API (application program interface) call is detected, removing the call; processing a debug event, and finishing the executing process until the abnormal condition occurs and the debug event cannot be processed; matching the content of a final valid byte in the PE structure of the target PE file in a current memory and the virus feature of a preset virus base; according to the matching result, determining whether the target PE file is infected with the infectious virus or not, and clearing the virus of the target PE file infected with the infective virus. The method has the advantage the virus defection efficiency is improved.

Description

technical field [0001] The invention belongs to the technical field of safety defense, and in particular relates to a method and a device for detecting and removing infectious viruses in portable executable files. Background technique [0002] Usually, when an infectious virus infects a normal portable executable PE (Portable Executable, PE) file, the codes implanted in different PE files may be different, and the shape is changeable, and when the infectious virus infects a PE file, Usually a section of code at the entry point of the original PE file is overwritten, and the overwritten code at the entry point of the original PE file is encrypted and stored in the infected PE file. In this way, on the one hand, the infected virus When an infected PE file is executed, the encrypted code needs to be decrypted first, which makes it difficult for traditional signature-based scanning and killing techniques to extract general signatures for this type of infected virus. On the othe...

AI Technical Summary

Problems solved by technology

[0005] In view of this, an object of the present invention is to propose a method for detecting and removing infectious viruses in portable executable files, to solve the problem of detecting and removing infectious viruses in existing portable executable files. And the difficulty of removing the virus, the problem of a long cycle

Images