CN1581088A - Method and device for preventing computer virus - Google Patents

Abstract

The invention provides a method for preventing computer viruses, the method comprises the steps of: establishing an original information file containing information of an application program file not infected with a virus; when the application program file requests to run, extracting the information of the application program file to generate a new Information files; compare the old and new information files, and control the operation of the application file according to the comparison result. The present invention also provides a device for implementing the above method, which includes: a control device, a detection device and an information generation device. When an application program file is requested to run, the control device controls the detection device to mobilize the information generation device to complete the program. Detect whether the file has been changed, and control the operation of the application file according to the detection result. The invention can effectively control the virus spreading through the program file infecting the computer application program without frequent upgrades, and especially plays a very good protective effect on the undiscovered new virus, which is simple and effective.

Description

Method and device for preventing computer virus

technical field

The invention relates to computer virus prevention technology, in particular to a method and device for preventing computer viruses.

Background technique

With the development of computer technology, there are more and more types and hazards of computer viruses, which cause hardware damage, data loss, or abnormal use, etc., which have brought great impact and losses to computer users. Computer viruses are highly contagious and contagious, and are mainly spread through the network or by infecting executable programs in computers. At present, antivirus software is mostly used to check and kill computer viruses, and antivirus software is generally composed of a virus inspection engine (Scan Engine) and a virus signature database (Virus Definition). The virus checking engine checks the computer files according to the virus signature codes in the virus signature database, and checks the files under computer coordination. If a corresponding signature code is found, it indicates that the file is infected by a specific virus, and the antivirus software adopts relevant measures to detect Viruses are removed. Using anti-virus software to prevent and control computer viruses requires frequently updating the virus signature database, because each new computer virus will have a signature code different from known viruses. After the new virus is generated, it can be found out by analyzing it Its signature code is added to the original virus signature database, and new viruses can only be checked and killed by constantly upgrading the antivirus software. It can be seen that this method always lags behind the emergence of new viruses, and cannot find new viruses that have not yet taken place in normal programs or data files, and cannot prevent new viruses. When the attack conditions are met, it will cause damage to the computer system, affecting the normal operation of the system at least, and causing system paralysis or even destroying the hardware of the system, causing serious economic losses.

Contents of the invention

The purpose of the present invention is to overcome the above-mentioned shortcoming of prior art, provide a kind of method and device for preventing computer virus, prohibit the operation of the application program that is infected by computer virus, thereby cut off the spread that virus carries out through the program file that infects application program.

The invention provides a method for preventing computer viruses, said method comprising the steps of:

Create an original information file containing information about the application file that is not infected with a virus;

When the application file requests to run, extract the information of the application file to generate a new information file;

judging whether the new information file is the same as the original information file;

If the same, it indicates that the application file is normal, and the application file is started normally;

If not, it indicates that the application program file may be infected with a virus, and it is forbidden to start the application program file to run.

Preferably, the step of creating the original information file containing the information of the application program file not infected with the virus comprises: using a predetermined algorithm to generate a checksum file for the application program file not infected with the virus, as the Raw information file.

Preferably, when the application file requests to run, the step of extracting the information of the application file to generate a new information file includes the steps of:

Registering with the system for notifications of the need to obtain execution of said application file;

When the application program file requests to run, obtain a notification of the application program file running;

A new information file of the application program file is created based on the notification.

Further, the step of creating a new information file of the application file according to the notification includes the steps of:

judging whether there is an original information file corresponding to the application file;

If there is an original information file of the application file, then establishing a new information file of the application file;

If the original information file of the application program file does not exist, an error message is returned to the system.

Preferably, if the original information file of the application file exists, the step of creating a new information file of the application file includes: using the same algorithm as that used to create the original information file of the application file for all The above application program file generates a new checksum file as the new information file of the application program file.

Preferably, if the original information file of the application file does not exist, the step of returning an error message to the system includes: after the system receives the error message, prohibiting the application file from starting.

The present invention also provides a device for realizing the above method, the device comprising:

An information generating device, configured to read the application file, and generate an original information file containing the information of the application file according to a predetermined algorithm, and generate an original information file containing the information of the application file when the application file is applied for running. new information files;

detection means, for detecting whether the application program file has been changed according to the information file generated by the information generation means;

The control device is used to receive the registration and cancellation of the application file that needs to be detected by the detection device; and when the application file requests to run, notify the detection device to detect the application file, and The operation of the application program file is controlled according to the detection result of the detection device.

Wherein, the information generation device further includes: an information generation control device, configured to control and generate the content of the information file according to a predetermined algorithm according to system requirements.

Preferably, the detection device further includes:

registration/revocation means, for registering the original information file of the application program file with the control means when the system is started, so that the control means sends a notification to the detection means when there is an application file request to run , canceling the registration to the control device when the system ceases to operate;

A message interaction/processing device, configured to perform message interaction with the control device and complete the control of the information generation device according to the message from the control device;

The verifying means is used for comparing the new information file of the application file generated by the information generating means with the original information file corresponding to the application file when the application file is requested to run.

Preferably, the message interaction/processing device includes:

Notification processing means, configured to control the information generation means to invoke the information generation control means to generate a new information file of the application file after the detection means receives the application file running notification from the control means;

The verification result transmission device is used to transmit the verification result of the verification device to the control device.

The invention can effectively control the virus transmitted by infecting the program file of the computer application program without frequent upgrades, and especially plays a very good protective effect on the new virus that has not been discovered yet, which is simple and effective.

Description of drawings

Fig. 1 is the flowchart of the step of the method for preventing computer virus in the preferred embodiment of the present invention;

Fig. 2 is a compositional block diagram of the device for preventing computer viruses of the present invention.

Detailed ways

In order to make those skilled in the art better understand the present invention, the present invention will be described in further detail below in conjunction with accompanying drawing and embodiment:

Since the virus that spreads by infecting the executable program must parasitize itself in the program file of the executable program, the corresponding checksum file is generated for the executable program file before being infected with the virus, and then verified when the program is executed , comparison, it can be found whether it is infected by the virus, thereby controlling and preventing the outbreak of the virus.

With reference to Fig. 1, Fig. 1 has described the flow process of the step of the method that preferred embodiment of the present invention prevents computer virus:

First, in step 10, before the system runs, use a predetermined algorithm to generate a checksum file for the program file of the application program that needs to be executed, and the application program file at this time is a file that is not infected with a virus;

Proceed to step 11 and register with the system to obtain the notification that the application file is running;

Then, go to step 12 and wait for the notification that the application file is running;

Proceed to step 13, when the application file requests to run, receive a notification that the application file is running;

After receiving the notification that the application file is running, you first need to go to step 14 to search whether the checksum file corresponding to the application file exists;

If the checksum file corresponding to this application program file does not exist, then proceed to step 18, and return a failure message to the operating system. After the operating system receives this message, the application program file is prohibited to prevent the outbreak of viruses that may exist therein, thereby Protect computer resources from damage;

Then, return to step 12 and wait for the next program running notification;

If the checksum file corresponding to the application file exists, proceed to step 15 to obtain the application file, and calculate the new checksum of the application file according to a predetermined algorithm;

Then, proceed to step 16, compare whether the new checksum of the application file after the calculation is consistent with the checksum stored in the checksum file corresponding to the application file;

If consistent, it shows that the application program file has not changed, proceed to step 17, return a success message to the operating system, and allow the application program to start and run normally;

If inconsistent, then show that this application program file has changed, may be infected by virus, advances to step 18, returns failure message to operating system, after operating system receives this message, prohibits this application program file, prevents the outbreak of virus that may exist wherein , thereby preventing corruption of computer resources.

The present invention also provides a device corresponding to the method for preventing computer viruses, which will be described in detail below with reference to FIG. 2 .

Fig. 2 is the composition block diagram of the device that the present invention prevents computer virus:

The device is composed of three parts, namely a control device 10 , a detection device 20 and an information generation device 30 . Wherein, the detection device 20 includes: a registration/cancellation device 201, a notification processing device 202, a verification result transmission device 203, and a verification device 204. In the present invention, the notification processing device 202 and the verification result transmission device 203 are integrated into a message interaction /processing device; the information generation device 30 includes: an information generation control device 301 . The technical characteristics of each component are introduced as follows:

The control device 10 is used to accept the registration of the registration/revocation device 201 in the detection device 20 to the registration of the original information file containing the original information of the application program file and the cancellation of the registration after the system stops running when the system starts; and when there is an application program When the file is requested to run, the detection device 20 is notified to detect the application program file, and the operation of the application program file is controlled according to the detection result transmitted by the verification result transmission device 203 in the detection device 20 .

The information generation device 30 is used to read the application program file, and generate an information file containing the application program file information according to a predetermined algorithm; and when there is an application program file application for running, generate a new information file containing the application program file information document. Wherein, the information generation control means 301 is used to control and generate the content of the information file according to a predetermined algorithm according to the requirements of the system.

The detection means 20 is configured to detect whether the application program file requested to run has been changed according to the information file generated by the information generation means 30 . These include:

The registration/cancellation device 201 is coupled to the control device 10, and is used to register the original information file of the application program file with the control device 10 when the system starts, so that the control device 10 sends a notification to the detection device 20 when there is an application program file request to run , cancel the registration to the control device 10 when the system stops running;

The notification processing device 202 is coupled to the control device 10, and is used for controlling the information generation device 30 to call the information generation control device 301 to generate a new information file of the application file after the detection device 20 receives the application program file running notification of the control device 10 ;

Checking means 204, coupled to the information generating means 30, for comparing the new information file of the application file generated by the information generating means 10 with the original information corresponding to the application file when the application file is requested to run document;

The checking result transmitting means 203 is used for transmitting the comparison result of the checking means 204 to the control means 10 .

The detailed work process of device of the present invention is described in detail below by an example:

First, use the information generation device 30 to calculate and generate the checksum file mspaint.CRC32 by the CRC32 algorithm provided by the information generation control device 301 for the executable program file mspaint.exe that is not infected with viruses, and send it to the control device 10 by the registration/revocation device 201 register the document;

When starting the infected mspaint.exe file, the detection device 20 is notified by the control device 10. After the detection device 20 receives the notification, it searches whether there is a mspaint.CRC32 file. If it does not exist, it sends a search failure message to the control device 10. After the control device 10 receives this message, the operation of the mspaint.exe file is prohibited; if the mspaint.CRC32 file exists, the notification processing device 203 controls the information generation device 30 to read the content of the file mspaint.exe, and calls the information generation control device 301 The provided CRC32 algorithm performs CRC32 verification calculation on the content of the file, and transmits the calculated checksum to the verification device 204, and the verification device 204 compares the checksum with the checksum stored in mspaint.CRC32 Compare. If the comparison result is inconsistent, then send a failure message to the control device 10, after the control device 10 receives this message, notify the operating system to prohibit mspaint.exe from running; if the comparison result is consistent, then send a success message to the control device 10, and the control device 10 receives After seeing this message, allow mspaint.exe to run normally. When the device exits, the registration/deregistration module is invoked to cancel the registration with the operating system.

The device can detect Kziz (Christmas CIH), I-Worm.Klez.E worms and other viruses that infect executable program files. When they infect executable program files, they will rewrite the contents of the file. The device does not distinguish which one Virus infection, after installing the device, the application files that need to be executed in the system must use the information generation device in the device to generate the original information file containing the application file information before being infected with the virus, and each application file corresponds to a unique For example, the information file corresponding to the mspaint.exe file in the above example is mspaint.CRC32, and these original information files are saved in the system. When there is an application program file to run, the algorithm adopted by the information generation device in the device to generate the new information file of the application program file requested to run is provided by the information generation control device in the information generation device, and is related to the generation The algorithm adopted by the original information file of the application file remains the same. In this way, by comparing the old and new information of the application program file, it can be known whether the application program file has been modified, so as to control whether the application program file is running. Effectively avoid the spread of some computer viruses by infecting application programs, and the damage to the system caused by virus outbreaks.

Although the present invention has been described by the embodiments, those skilled in the art know that the present invention has many modifications and changes without departing from the spirit of the present invention. For example, in the present invention, there may be Various methods, similarly, the algorithm provided by the information generation control device can also have various forms, and it is hoped that the appended claims include these deformations and changes without departing from the spirit of the present invention.

Claims (10)

1, a kind of method for preventing computer virus, it is characterized in that, described method comprises steps: Create an original information file containing information about the application file that is not infected with a virus; When the application file requests to run, extract the information of the application file to generate a new information file; judging whether the new information file is the same as the original information file; If the same, it indicates that the application file is normal, and the application file is started normally; If not, it indicates that the application program file may be infected with a virus, and it is forbidden to start the application program file to run. 2. The method for preventing computer viruses as claimed in claim 1, characterized in that the step of establishing the original information file containing the information of the application program file information not infected with the virus comprises: using a predetermined algorithm for the The application file generates a checksum file as the original information file of the application file. 3. The method for preventing computer viruses as claimed in claim 2, wherein the step of extracting the information of the application file to generate a new information file when the application file requests to run comprises the steps of : Registering with the system for notifications of the need to obtain execution of said application file; When the application program file requests to run, obtain a notification of the application program file running; A new information file of the application program file is created based on the notification. 4. The method for preventing computer viruses as claimed in claim 3, wherein said step of establishing a new information file of said application file according to said notification comprises the steps of: judging whether there is an original information file corresponding to the application file; If there is an original information file of the application file, then establishing a new information file of the application file; If the original information file of the application program file does not exist, an error message is returned to the system. 5. The method for preventing computer viruses as claimed in claim 4, wherein if the original information file of the application program file exists, the step of establishing a new information file of the application program file comprises: using The same algorithm used to create the original information file of the application file generates a new checksum file for the application file as the new information file of the application file. 6. The method for preventing computer viruses as claimed in claim 4, wherein if the original information file of the application file does not exist, the step of returning an error message to the system comprises: the system receiving After receiving the error message, it is prohibited to start the application file. 7. A device for preventing computer viruses, characterized in that the device includes: An information generating device, configured to read the application file, and generate an original information file containing the information of the application file according to a predetermined algorithm, and generate an original information file containing the information of the application file when the application file is applied for running. new information files; detection means for detecting whether the application program file has been changed according to the information file generated by the information generation means; The control device is used to receive the registration and cancellation of the application file that needs to be detected by the detection device; and when the application file requests to run, notify the detection device to detect the application file, and The operation of the application program file is controlled according to the detection result of the detection device. 8. The device for preventing computer viruses according to claim 7, wherein the information generation device further comprises: an information generation control device, which is used to control and generate the content of the information file according to a predetermined algorithm according to the needs of the system . 9. The device for preventing computer viruses according to claim 7, wherein the detection device further comprises: registration/revocation means, for registering the original information file of the application program file with the control means when the system is started, so that the control means sends a notification to the detection means when there is an application file request to run , canceling the registration to the control device when the system ceases to operate; A message interaction/processing device, configured to perform message interaction with the control device and complete the control of the information generation device according to the message from the control device; The verifying means is used for comparing the new information file of the application file generated by the information generating means with the original information file corresponding to the application file when the application file is requested to run. 10. The device for preventing computer viruses as claimed in claim 9, wherein the message interaction/processing device comprises: Notification processing means, configured to control the information generation means to invoke the information generation control means to generate a new information file of the application file after the detection means receives the application file running notification from the control means; The verification result transmission device is used to transmit the verification result of the verification device to the control device.

Images