Computer virus checking and killing method based on data stream

Abstract

The invention discloses a checking and diminishing method of computer virus in the computer appliance domain, which is characterized by the following: basing on computer virus checking and diminishing method of data flow through matching the virus feature data with the checked and diminished data flow (internal memory mode or file generation data flow); containing internal memory checking and diminishing virus method and file checking and diminishing virus method; providing the identification of new variant of known virus or partial new virus without updating or less updating; analyzing and extracting binary code of known virus as virus feature to find new variant of virus or new virus in the internal memory mode or file; extracting the file feature automatically (if the internal memory mode corresponds to the file)to generate new file virus feature; updating the virus database automatically; finishing checking and diminishing task through scanning the new variant of known virus and partial new virus and other all duplicates.

Description

technical field [0001] The invention relates to the field of computer applications, in particular to a method for checking and killing computer viruses. Background technique [0002] In recent years, computers have been widely used in various fields, but the accompanying computer viruses have brought threats to its practical application. Coupled with the latent, contagious, and destructive nature of computer viruses, the prevention of viruses is more complicated. Today's computer viruses usually have an automatic update function. Virus authors are used to quickly releasing virus variants by means of packing, recompilation, and small-scale modification of virus engineering, and making new viruses by recombining multiple shared virus modules, so that Antivirus software cannot detect and kill the changed virus. Current computer virus scanning and killing methods generally use the method of adding an offset to locate the virus signature code. If the virus adopts the above-ment...

AI Technical Summary

Problems solved by technology

The current computer virus detection and killing method generally uses the method of adding an offset to the entry to locate the virus signature. If the virus adopts the above changes, the virus signature will be completely changed, resulting in the inability to scan and kill.

The current virus detection and killing method can only detect and kill such viruses by updating the characteristics in time

Images