CN103246847A - Method and device for scanning and killing macro viruses - Google Patents
Method and device for scanning and killing macro viruses Download PDFInfo
- Publication number
- CN103246847A CN103246847A CN201310175309XA CN201310175309A CN103246847A CN 103246847 A CN103246847 A CN 103246847A CN 201310175309X A CN201310175309X A CN 201310175309XA CN 201310175309 A CN201310175309 A CN 201310175309A CN 103246847 A CN103246847 A CN 103246847A
- Authority
- CN
- China
- Prior art keywords
- macrovirus
- document
- checked
- feature
- grand
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/568—Computer malware detection or handling, e.g. anti-virus arrangements eliminating virus, restoring damaged files
Abstract
An embodiment of the invention discloses a method and a device for scanning and killing macro viruses. The method includes: firstly, obtaining the data flow of a document to be scanned; secondly, determining whether to perform further macro virus scanning or not by judging whether macro identification exists in the obtained data flow, and if the macro identification exists in the data flow, judging whether the document to be scanned is a macro virus document; and finally, converting the macro virus document into a virus-free document. The device for scanning and killing the macro viruses is simply used for the virus scanning and killing of the macrocode portion of a computer document, thereby improving the search efficiency of the macro viruses greatly. Meanwhile, macro virus information in infected computer documents can be deleted, so that the information in original computer documents can be preserved intactly to avoid information loss.
Description
Technical field
The present invention relates to the data security technical field, be specifically related to a kind of method and apparatus of macrovirus killing.
Background technology
Along with popularizing and the development of mobile Internet of computing machine, networked information era is arrived.Virus has characteristics such as breeding, infection, destruction, the information security that is threatening the user as a kind of form of information.Computer document, i.e. WORD, the file that copy editor's softwares such as EXCEL produce is extensive use of by people, and macrovirus is come into people's sight gradually as being exclusively used in the new virus that destroys the computer document information security.Wherein, the macrovirus that uses macrolanguage to write mainly acts in the macrocode of computer document, is threatening the safety of computer document.
In the prior art, by the full-text search to computer document, the existence of inquiry macrovirus, at first, obtain the feature code of macrovirus, secondly, mate with the macrovirus feature code that obtains and whole codes of computer document, up to finding the code segment identical with this feature code, can think that namely this computer document has infected macrovirus.Simultaneously, determining that computer document has infected under the situation of macrovirus, just simply with infected computer document deletion.
The method of the full-text search macrovirus of prior art has been ignored the characteristic in the macrocode that macrovirus only acts on computer document, does not have macrovirus searching method targetedly, has blindly enlarged the hunting zone, greatly reduces the search efficiency of macrovirus undoubtedly.Simultaneously, delete infected computer document and cause losing of information easily.
Summary of the invention
The invention provides a kind of method and apparatus of macrovirus killing, only partly carry out the killing of macrovirus at the macrocode of computer document, improve the search efficiency of macrovirus greatly.Simultaneously, with the macrovirus information deletion in the infected computer document, make prime information in the computer document by intact preservation, prevent losing of information.
The invention provides a kind of method of macrovirus killing, described method comprises:
Obtain the data stream of document to be checked;
In described data stream, exist under the situation of grand sign, judge whether described document to be checked is the macrovirus document, if then described macrovirus document is changed into nontoxic document.
Preferably, describedly judge that whether described document to be checked is before the macrovirus document, also comprises:
Default macrovirus feature group, described macrovirus feature group comprises at least one macrovirus feature.
Preferably, describedly judge that whether described document to be checked is the macrovirus document, comprising:
Judge whether described document to be checked comprises the arbitrary macrovirus feature in the described macrovirus feature group.
Preferably, describedly judge that whether described document to be checked comprises the arbitrary macrovirus feature in the described macrovirus feature group, comprising:
Comprise at described document to be checked under the situation of grand son stream, judge the arbitrary macrovirus feature that whether comprises in the described grand son stream in the described macrovirus feature group;
Do not comprise in grand son stream or the described grand son stream at described document to be checked and not comprise under the situation of the arbitrary macrovirus feature in the described macrovirus feature group, judge whether described document to be checked comprises script flow, if judge then whether described script flow comprises the arbitrary macrovirus feature in the described macrovirus feature group;
Perhaps,
Comprise under the situation of script flow at described document to be checked, judge the arbitrary macrovirus feature that whether comprises in the described script flow in the described macrovirus feature group;
Do not comprise under the situation that does not comprise the arbitrary macrovirus feature in the described macrovirus feature group in script flow or the described script flow at described document to be checked, judge whether described document to be checked comprises Hong Ziliu, if judge then whether described grand son stream comprises the arbitrary macrovirus feature in the described macrovirus feature group.
Preferably, described method also comprises:
In described data stream, do not exist under the situation of grand sign, described document to be checked is defined as nontoxic document.
Preferably, described described macrovirus document is changed into nontoxic document, comprising:
Delete the grand information in the described macrovirus document, described grand information comprises grand sub-stream and or script flow, and deletes the grand sign in the described macrovirus document;
Described macrovirus document is defined as nontoxic document.
The present invention also provides a kind of device of macrovirus killing, and described device comprises:
First acquisition module is for the data stream of obtaining document to be checked;
First judge module is used for existing under the situation of grand sign in described data stream, judges whether described document to be checked is the macrovirus document;
Conversion module is used in the result of described first judge module described macrovirus document being changed into nontoxic document when being.
Preferably, described device also comprises:
Presetting module is used for default macrovirus feature group, and described macrovirus feature group comprises at least one macrovirus feature.
Preferably, described first judge module specifically is used for:
In described data stream, exist under the situation of grand sign, judge whether described document to be checked comprises the arbitrary macrovirus feature in the described macrovirus feature group.
Preferably, described first judge module comprises:
First judges submodule, is used for comprising under the situation of grand son stream at described document to be checked, judges the arbitrary macrovirus feature that whether comprises in the described grand son stream in the described macrovirus feature group;
Second judges submodule, is used for not comprising that at described document to be checked grand son stream or described grand son stream do not comprise under the situation of the arbitrary macrovirus feature in the described macrovirus feature group, judge whether described document to be checked comprises script flow;
The 3rd judges submodule, is used in described second result who judges submodule judging whether described script flow comprises the arbitrary macrovirus feature in the described macrovirus feature group when being;
Perhaps,
The 4th judges submodule, is used for comprising under the situation of script flow at described document to be checked, judges the arbitrary macrovirus feature that whether comprises in the described script flow in the described macrovirus feature group;
The 5th judges submodule, is used for not comprising that at described document to be checked script flow or described script flow do not comprise under the situation of the arbitrary macrovirus feature in the described macrovirus feature group, judges whether described document to be checked comprises Hong Ziliu
The 6th judges submodule, is used in the described the 5th result who judges submodule judging that described grand son flows the arbitrary macrovirus feature that whether comprises in the described macrovirus feature group when being.
Preferably, described device also comprises:
Determination module is used for not existing under the situation of grand sign in described data stream, and described document to be checked is defined as nontoxic document.
Preferably, described conversion module comprises:
The first deletion submodule, the grand information that is used for deleting described macrovirus document, described grand information comprises grand sub-stream and or script flow;
The second deletion submodule, the grand sign that is used for deleting described macrovirus document;
Determine submodule, be used for described macrovirus document is defined as nontoxic document.
The present invention at first obtains the data stream of document to be checked, secondly, whether there is grand sign in the data stream of obtaining by judgement, determine whether further to search for macrovirus, in data stream, exist under the situation of grand sign, judge whether described document to be checked is the macrovirus document, last, the macrovirus document is changed into nontoxic document.The present invention only partly carries out the killing of macrovirus at the macrocode of computer document, improves the search efficiency of macrovirus greatly.Simultaneously, with the macrovirus information deletion in the infected computer document, make information in the former computer document by intact preservation, prevent losing of information.
Further, in data stream, do not exist under the situation of grand sign, can determine that document to be checked is nontoxic document, with determine in full that by search the method for virus-free feature code determines that the method for nontoxic document compares in the prior art, the present invention has improved the efficient that definite computer document does not have macrovirus.
Further, the present invention at first judge whether comprise in the document to be checked grand sub-stream and or script flow, secondly at grand sub-stream and or script flow carry out the method for the coupling of virus characteristic, determine the macrovirus document, compared with prior art, the present invention is directed to grand sub-stream and or the method for script flow search macrovirus more targeted, also improved the efficient of search macrovirus simultaneously.
Further, the present invention is by the method with grand information in the macrovirus document and the deletion of grand sign, realized that the macrovirus document is converted into nontoxic document, compared with the method for the direct deletion macrovirus document of prior art that the present invention has effectively prevented losing of former document information.
Description of drawings
In order to be illustrated more clearly in the technical scheme in the embodiment of the present application, the accompanying drawing of required use is done to introduce simply in will describing embodiment below, apparently, accompanying drawing in describing below only is some embodiment of the application, for those of ordinary skills, under the prerequisite of not paying creative work, can also obtain other accompanying drawing according to these accompanying drawings.
Fig. 1 is the method flow diagram of the macrovirus killing of the embodiment of the invention one;
Fig. 2 is the method flow diagram that the macrovirus document is changed into nontoxic document of the embodiment of the invention one;
Fig. 3 is the method flow diagram of the macrovirus killing of the embodiment of the invention two;
Whether Fig. 4 comprises the process flow diagram of one of method of the arbitrary macrovirus feature in the macrovirus feature group for the document to be checked of judging of the embodiment of the invention two;
Whether Fig. 5 comprises the process flow diagram of one of method of the arbitrary macrovirus feature in the macrovirus feature group for the document to be checked of judging of the embodiment of the invention two;
Fig. 6 is the structure drawing of device of the macrovirus killing of the embodiment of the invention three;
Fig. 7 is one of the structural drawing of described first judge module 602 of the embodiment of the invention three;
Fig. 8 is one of the structural drawing of described first judge module 602 of the embodiment of the invention three;
The terminal structure synoptic diagram that Fig. 9 provides for the embodiment of the invention three.
Embodiment
Below in conjunction with the accompanying drawing in the embodiment of the present application, the technical scheme in the embodiment of the present application is clearly and completely described, obviously, described embodiment only is the application's part embodiment, rather than whole embodiment.Based on the embodiment among the application, those of ordinary skills are not making the every other embodiment that obtains under the creative work prerequisite, all belong to the scope of the application's protection.
Embodiment one,
The embodiment of the invention is to infect the problem that causes information dropout that the document of macrovirus causes at the low and direct deletion of the search efficiency of macrovirus in the prior art, proposition judges whether comprise grand sign in the document to be checked by the data stream of obtaining document to be checked, and then determine whether comprise macrovirus in the document to be checked, finally, in document to be checked, comprise under the situation of macrovirus, reach the purpose of macrovirus killing by the grand information in the document to be checked of deleting, thereby improve the search efficiency of macrovirus, also solved the problem that the document information in the killing macrovirus process is lost.
With reference to figure 1, the method flow diagram of the macrovirus killing that Fig. 1 provides for present embodiment specifically comprises:
Step 101, obtain the data stream of document to be checked.
In the present embodiment, before document to be checked is carried out the killing of macrovirus, at first document to be checked is resolved to the form of data stream.Wherein, data stream is the structure of the raw data in the storage document to be checked.
Step 102, in described data stream, exist under the situation of grand sign, judge whether described document to be checked is the macrovirus document, if then enter step 103.
In the present embodiment, at first judge in the data stream of obtaining whether have grand sign, if exist, then continue to judge whether document to be checked is the macrovirus document, wherein, is under the situation of macrovirus document at this document to be checked, enters step 103.Do not have grand sign in the event data stream, then this document to be checked of explanation is nontoxic document, that is to say, does not have grand sign in the document to be checked, does not namely have macrovirus in this document to be checked of proof.
Wherein, grand sign is used for sign document to be checked and whether has executable macrocode, that is to say, if there is not grand sign in the document to be checked, also just do not have executable macrocode in the document to be checked, because macrovirus is also write by macrocode and is formed, so, can be understood as, also just not there is executable macrovirus in the document to be checked that does not have a grand sign, for the macrovirus that can not carry out, it does not have destruction to document to be checked.
Step 103, described macrovirus document is changed into nontoxic document.
In the present embodiment, after definite this document to be checked is the macrovirus document, this macrovirus document is changed into nontoxic document.Wherein, the macrovirus document represents to infect the document of macrovirus, and nontoxic document represents not infect the document of macrovirus.
In a preferred embodiment, with reference to figure 2, Fig. 2 is for changing into the macrovirus document method flow diagram of nontoxic document, and described method can comprise:
Grand information in step 201, the described macrovirus document of deletion, described grand information comprises grand sub-stream and or script flow.
In the present embodiment, after document to be checked is confirmed as the macrovirus document, the grand information in the deletion macrovirus document, grand information comprises grand sub-stream and or script flow.Wherein grand sub-stream can obtain by the sub-stream attribute catalogue in the data stream, wherein, the attribute that each height that sub-stream attribute catalogue comprises for memorying data flow flows, because grand sub-stream has specific attribute, can in sub-stream attribute catalogue, whether there be grand son stream in the data query stream according to the attribute of grand son stream, it should be noted that data stream comprises Hong Ziliu, and script flow can be by the name acquiring of script flow.
In the practical operation, judge whether comprise in this macrovirus document grand sub-stream and or script flow, if exist then with its deletion.Concrete, can at first judge in this macrovirus document whether comprise Hong Ziliu, if exist, should delete by grand son stream, secondly, judge in this macrovirus document whether comprise script flow, if exist, this script flow is also deleted; Also can, judge at first whether script flow exists, next judges whether grand son stream exists, and grand son stream and script flow are deleted; Can also judge simultaneously whether grand son stream and script flow are present in the document to be checked, if exist, with the grand sub-stream that exists and or script flow delete.Judgement order that it should be noted that grand son stream and script flow is unrestricted, and the deterministic process of simultaneously grand son stream and script flow can not influence each other.
Grand sign in step 202, the described macrovirus document of deletion.
In the present embodiment, after document to be checked is confirmed as the macrovirus document, with the grand sign deletion in the macrovirus document.Be under the situation of macrovirus document at definite document to be checked, delete grand sign, to remove the executive condition of macrovirus code.
Execution sequence that it should be noted that step 201 and step 202 is unrestricted, also can while execution in step 201 and step 202.
In the present embodiment, the macrovirus file of the grand information of deletion and grand sign is defined as nontoxic file, can be understood as, after grand information in the document to be checked that infects macrovirus and grand sign are deleted, macrovirus in the document to be checked of this infection macrovirus is killed, that is to say, do not have macrovirus in the document to be checked of this moment, can normally carry out simultaneously.
In the present embodiment, at first obtain the data stream of document to be checked, secondly, whether there is grand sign in the data stream of obtaining by judgement, determine whether further to search for macrovirus, in data stream, exist under the situation of grand sign, judge whether described document to be checked is the macrovirus document, at last, the macrovirus document is changed into nontoxic document.The present invention only partly carries out the killing of macrovirus at the macrocode of computer document, improves the search efficiency of macrovirus greatly.Simultaneously, with the macrovirus information deletion in the infected computer document, make information in the former computer document by intact preservation, prevent losing of information.
Further, in data stream, do not exist under the situation of grand sign, can determine that document to be checked is nontoxic document, with determine in full that by search the method for virus-free feature code determines that the method for nontoxic document compares in the prior art, the present invention has improved the efficient that definite computer document does not have macrovirus.
Embodiment two,
With reference to figure 3, the method flow diagram of the macrovirus killing that Fig. 3 provides for present embodiment specifically can comprise:
In the present embodiment, preestablish macrovirus feature group, wherein, macrovirus feature group comprises at least one macrovirus feature, macrovirus character representation macrovirus is different from the feature of other type virus, and the macrovirus kind is also more simultaneously, and the feature of different types of macrovirus is also different.That is to say, can determine one type macrovirus according to the macrovirus feature.
Step 302 in the present embodiment is identical with step 101 among the embodiment one, does not repeat them here.
In the present embodiment, at first judge in the data stream of obtaining whether comprise grand sign, if, enter step 304, otherwise, step 305 entered.
Wherein, inquire about the restriction that grand label manner is not subjected to present embodiment.Generally speaking, grand sign is positioned at the front portion of document to be checked, so inquiring about the general front portion that only need traverse document to be checked of grand sign can obtain, and does not need as prior art traversal method in full.
In the present embodiment, in the data stream of obtaining, do not exist under the situation of grand sign, document to be checked can be defined as nontoxic document.Can be understood as, do not have grand sign in the document to be checked, then do not have macrovirus in this document to be checked of proof, in fact is the macrovirus carried out that does not exist damaging property of document to be checked.
In the present embodiment, in determining document to be checked, comprise grand sign after, judge whether this document to be checked comprises the arbitrary macrovirus feature in the macrovirus feature group, if then enter step 306.
With reference to figure 4, Fig. 4 for to judge whether document to be checked comprises the process flow diagram of one of method of the arbitrary macrovirus feature in the macrovirus feature group specifically comprises:
In the present embodiment, when document to be checked comprises that grand son flows, enter step 402; Otherwise, in document to be checked, do not comprise when grand son flows, enter step 403.
In the practical operation, data stream comprises Hong Ziliu, has the catalogue that comprises each sub-stream attribute in the data stream, because grand sub-stream has specific attribute, so, can inquire about in this document to be checked whether comprise Hong Ziliu by the attribute catalogue in the data query stream.
Concrete, for how inquiring about the restriction that the process that whether comprises grand son stream in the document to be checked is not subjected to present embodiment.
In the present embodiment, comprise in document to be checked under the situation of grand son stream that judge the arbitrary macrovirus feature that whether comprises in the grand son stream in the macrovirus feature group, wherein the macrovirus feature can comprise one section specific macrovirus code.If comprise the arbitrary macrovirus feature in the macrovirus feature group in the grand son stream, then enter step 306, otherwise, enter step 403.
In the present embodiment, do not comprise in grand son stream or the grand son stream at document to be checked not comprising under the situation of the arbitrary macrovirus feature in the macrovirus feature group, judge whether this document to be checked comprises script flow, if, then enter step 306, if not, then this document to be checked of proof is nontoxic document.
In the practical operation, script flow has specific title, for example _ VBA_PROJECT_CUR, can flow title by query script and determine whether this document to be checked comprises script flow.
Concrete, for how inquiring about the restriction that the process that whether comprises script flow in the document to be checked is not subjected to present embodiment.
In the present embodiment, in document to be checked, comprise under the situation of script flow, judge the arbitrary macrovirus feature that whether comprises in the script flow in the macrovirus feature group, if comprise, then enter step 306, otherwise, prove that this document to be checked is nontoxic document.
In the practical operation, the macrovirus feature in the code in the script flow and the macrovirus feature group is mated, exist in script flow under the situation of arbitrary macrovirus feature, this document to be checked is the macrovirus document, otherwise this document to be checked is nontoxic document.
With reference to figure 5, Fig. 5 for to judge whether document to be checked comprises the process flow diagram of one of method of the arbitrary macrovirus feature in the macrovirus feature group specifically comprises:
Above-mentionedly judge whether document to be checked comprises that the difference of the method for the method of the arbitrary macrovirus feature in the macrovirus feature group and Fig. 4 only is, judges that earlier document to be checked comprises script flow, judges earlier that still document to be checked comprises Hong Ziliu.So it is similar that concrete steps and the step among Fig. 4 are described, and do not repeat them here.
Step 306 in the present embodiment is identical with step 103 among the embodiment one, repeats no more equally herein.
In the present embodiment, set in advance macrovirus feature group, comprise at least one macrovirus feature, secondly, whether there is grand sign in the data stream of obtaining by judgement, determines whether further to search for macrovirus, in data stream, exist under the situation of grand sign, judge whether described document to be checked comprises grand son stream and script flow, and then judge the arbitrary macrovirus feature that whether comprises in grand son stream, the script flow in the macrovirus feature group, and then determine that document to be checked is macrovirus document or nontoxic document.Compared with prior art, in the present embodiment at grand sub-stream and or script flow to carry out the matching process of virus characteristic more targeted, improved the efficient of search macrovirus.
Embodiment three,
The embodiment of the invention will be described from the angle of macrovirus killing device, the device of this macrovirus killing specifically can be integrated in the client, this client can be loaded in the terminal, this terminal is specifically as follows smart mobile phone, panel computer, E-book reader, MP3 (Moving Picture Experts Group Audio Layer III, dynamic image expert compression standard audio frequency aspect 3) player, MP4 (Moving Picture Experts Group Audio Layer IV, dynamic image expert compression standard audio frequency aspect 3) player, pocket computer on knee and desk-top computer etc.
With reference to figure 6, the structure drawing of device of the macrovirus killing that Fig. 6 provides for present embodiment specifically comprises:
Described first judge module 602, concrete being used for exists under the situation of grand sign in described data stream, judges whether described document to be checked comprises the arbitrary macrovirus feature in the described macrovirus feature group.
With reference to figure 7, Fig. 7 is one of structural drawing of described first judge module 602, specifically can comprise:
First judges submodule 701, is used for comprising under the situation of grand son stream at described document to be checked, judges the arbitrary macrovirus feature that whether comprises in the described grand son stream in the described macrovirus feature group;
Second judges submodule 702, is used for not comprising that at described document to be checked grand son stream or described grand son stream do not comprise under the situation of the arbitrary macrovirus feature in the described macrovirus feature group, judge whether described document to be checked comprises script flow;
The 3rd judges submodule 703, is used in described second result who judges submodule judging whether described script flow comprises the arbitrary macrovirus feature in the described macrovirus feature group when being;
With reference to figure 8, Fig. 8 is one of structural drawing of described first judge module 602, specifically can comprise:
The 4th judges submodule 801, is used for comprising under the situation of script flow at described document to be checked, judges the arbitrary macrovirus feature that whether comprises in the described script flow in the described macrovirus feature group;
The 5th judges submodule 802, is used for not comprising that at described document to be checked script flow or described script flow do not comprise under the situation of the arbitrary macrovirus feature in the described macrovirus feature group, judges whether described document to be checked comprises Hong Ziliu.
The 6th judges submodule 803, is used in the described the 5th result who judges submodule judging that described grand son flows the arbitrary macrovirus feature that whether comprises in the described macrovirus feature group when being.
Described conversion module 603 can comprise:
The first deletion submodule, the grand information that is used for deleting described macrovirus document, described grand information comprises grand sub-stream and or script flow;
The second deletion submodule, the grand sign that is used for deleting described macrovirus document;
Determine submodule, be used for described macrovirus document is defined as nontoxic document.
Described device can also comprise:
Presetting module is used for default macrovirus feature group, and described macrovirus feature group comprises at least one macrovirus feature.
Determination module is used for not existing under the situation of grand sign in described data stream, and described document to be checked is defined as nontoxic document.
The embodiment of the invention also provides a kind of terminal, as shown in Figure 9, for convenience of explanation, only shows the part relevant with the embodiment of the invention, and concrete ins and outs do not disclose, and please refer to embodiment of the invention method part.This terminal can comprise terminal device arbitrarily such as mobile phone, panel computer, PDA (Personal Digital Assistant, personal digital assistant), POS (Point of Sales, point-of-sale terminal), vehicle-mounted computer, is that mobile phone is example with the terminal:
Shown in Fig. 9 is the block diagram of the part-structure of the relevant mobile phone of the terminal that provides with the embodiment of the invention.With reference to figure 9, mobile phone comprises: radio frequency (Radio Frequency, RF) circuit 910, storer 920, input block 930, display unit 940, sensor 950, voicefrequency circuit 960, Wireless Fidelity (wireless fidelity, WiFi) parts such as module 970, processor 980 and power supply 990.It will be understood by those skilled in the art that the handset structure shown in Fig. 9 does not constitute the restriction to mobile phone, can comprise than the more or less parts of diagram, perhaps make up some parts, perhaps different arrangements of components.
Each component parts below in conjunction with the mobile phone of Fig. 9 carries out concrete introduction:
Input block 930 can be used for receiving numeral or the character information of input, and generation is imported with the key signals that the user arranges and function control is relevant of mobile phone 900.Particularly, input block 930 can comprise contact panel 931 and other input equipments 932.Contact panel 931, be also referred to as touch-screen, can collect the user thereon or near touch operation (use such as the user any suitable objects such as finger, stylus or annex on the contact panel 931 or near the operation contact panel 931), and drive corresponding coupling arrangement according to predefined formula.Optionally, contact panel 931 can comprise touch detecting apparatus and two parts of touch controller.Wherein, touch detecting apparatus detects user's touch orientation, and detects the signal that touch operation is brought, and sends signal to touch controller; Touch controller receives touch information from touch detecting apparatus, and converts it to contact coordinate, gives processor 980 again, and the order that energy receiving processor 980 is sent is also carried out.In addition, can adopt polytypes such as resistance-type, condenser type, infrared ray and surface acoustic wave to realize contact panel 931.Except contact panel 931, input block 930 can also comprise other input equipments 932.Particularly, other input equipments 932 can include but not limited to one or more in physical keyboard, function key (such as volume control button, switch key etc.), trace ball, mouse, the control lever etc.
Mobile phone 900 also can comprise at least a sensor 950, such as optical sensor, motion sensor and other sensors.Particularly, optical sensor can comprise ambient light sensor and proximity transducer, and wherein, ambient light sensor can be regulated the brightness of display panel 941 according to the light and shade of ambient light, proximity transducer can cut out display panel 941 and/or backlight when mobile phone moves in one's ear.A kind of as motion sensor, accelerometer sensor can detect the size of the acceleration that (is generally three) on all directions, size and the direction of gravity be can detect when static, the application (such as shielding switching, dependent game, the calibration of magnetometer attitude anyhow), Vibration identification correlation function (such as passometer, knock) etc. of mobile phone attitude can be used for identifying; As for mobile phone other sensors such as configurable gyroscope, barometer, hygrometer, thermometer, infrared ray sensor also, do not repeat them here.
WiFi belongs to the short range wireless transmission technology, mobile phone by WiFi module 970 can help that the user sends and receive e-mail, browsing page and visit streaming video etc., it provides wireless broadband internet visit for the user.Though Fig. 9 shows WiFi module 970, be understandable that it does not belong to must constituting of mobile phone 900, fully can be as required in the scope of the essence that does not change invention and omit.
Mobile phone 900 comprises that also preferred, power supply can link to each other with processor 980 logics by power-supply management system to the power supply 990 (such as battery) of each parts power supply, thereby realizes functions such as management charging, discharge and power managed by power-supply management system.
Although not shown, mobile phone 900 can also comprise camera, bluetooth module etc., does not repeat them here.
Specifically in the present embodiment, processor 980 in the terminal can be according to following instruction, the executable file of the process correspondence of one or more application program is loaded in the storer 920, and move the application program that is stored in the storer 920 by processor 980, thus realize various functions:
Obtain the data stream of document to be checked;
In described data stream, exist under the situation of grand sign, judge whether described document to be checked is the macrovirus document, if then described macrovirus document is changed into nontoxic document.
Preferably, describedly judge that whether described document to be checked is before the macrovirus document, also comprises:
Default macrovirus feature group, described macrovirus feature group comprises at least one macrovirus feature.
Preferably, describedly judge that whether described document to be checked is the macrovirus document, comprising:
Judge whether described document to be checked comprises the arbitrary macrovirus feature in the described macrovirus feature group.
Preferably, describedly judge that whether described document to be checked comprises the arbitrary macrovirus feature in the described macrovirus feature group, comprising:
Comprise at described document to be checked under the situation of grand son stream, judge the arbitrary macrovirus feature that whether comprises in the described grand son stream in the described macrovirus feature group;
Do not comprise in grand son stream or the described grand son stream at described document to be checked and not comprise under the situation of the arbitrary macrovirus feature in the described macrovirus feature group, judge whether described document to be checked comprises script flow, if judge then whether described script flow comprises the arbitrary macrovirus feature in the described macrovirus feature group;
Perhaps,
Comprise under the situation of script flow at described document to be checked, judge the arbitrary macrovirus feature that whether comprises in the described script flow in the described macrovirus feature group;
Do not comprise under the situation that does not comprise the arbitrary macrovirus feature in the described macrovirus feature group in script flow or the described script flow at described document to be checked, judge whether described document to be checked comprises Hong Ziliu, if judge then whether described grand son stream comprises the arbitrary macrovirus feature in the described macrovirus feature group.
Preferably, described method also comprises:
In described data stream, do not exist under the situation of grand sign, described document to be checked is defined as nontoxic document.
Preferably, described described macrovirus document is changed into nontoxic document, comprising:
Delete the grand information in the described macrovirus document, described grand information comprises grand sub-stream and or script flow, and deletes the grand sign in the described macrovirus document;
Described macrovirus document is defined as nontoxic document.
In the present embodiment, after obtaining the data stream of document to be checked, whether there is grand sign in the data stream of obtaining by judgement, determine whether further to search for macrovirus, in data stream, exist under the situation of grand sign, judge whether described document to be checked is the macrovirus document, after definite document to be checked is the macrovirus document, the macrovirus document is changed into nontoxic document.Present embodiment only partly carries out the killing of macrovirus at the macrocode of computer document, improves the search efficiency of macrovirus greatly.Simultaneously, with the macrovirus information deletion in the infected computer document, make information in the former computer document by intact preservation, prevent losing of information.
Further, in data stream, do not exist under the situation of grand sign, can determine that document to be checked is nontoxic document, with determine in full that by search the method for virus-free feature code determines that the method for nontoxic document compares in the prior art, the present invention has improved the efficient that definite computer document does not have macrovirus.
Further, the present invention at first judge whether comprise in the document to be checked grand sub-stream and or script flow, secondly at grand sub-stream and or script flow carry out the method for the coupling of virus characteristic, determine the macrovirus document, compared with prior art, the present invention is directed to grand sub-stream and or the method for script flow search macrovirus more targeted, also improved the efficient of search macrovirus simultaneously.
Further, the present invention is by the method with grand information in the macrovirus document and the deletion of grand sign, realized that the macrovirus document is converted into nontoxic document, compared with the method for the direct deletion macrovirus document of prior art that the present invention has effectively prevented losing of former document information.
Need to prove that each embodiment adopts the mode of going forward one by one to describe in this instructions, what each embodiment stressed is and the difference of other embodiment that identical similar part is mutually referring to getting final product between each embodiment.For the disclosed system of embodiment or device, because it is corresponding with the embodiment disclosed method, so description is fairly simple, relevant part partly illustrates referring to method and gets final product.
For device embodiment, because it corresponds essentially to method embodiment, so relevant part gets final product referring to the part explanation of method embodiment.Device embodiment described above only is schematic, wherein said unit as the separating component explanation can or can not be physically to separate also, the parts that show as the unit can be or can not be physical locations also, namely can be positioned at a place, perhaps also can be distributed on a plurality of network element.Can select wherein some or all of module to realize the purpose of present embodiment scheme according to the actual needs.Those of ordinary skills namely can understand and implement under the situation of not paying creative work.
Need to prove, in this article, relational terms such as first and second grades only is used for an entity or operation are made a distinction with another entity or operation, and not necessarily requires or hint and have the relation of any this reality or in proper order between these entities or the operation.And, term " comprises ", " comprising " or its any other variant are intended to contain comprising of nonexcludability, thereby make and comprise that process, method, article or the equipment of a series of key elements not only comprise those key elements, but also comprise other key elements of clearly not listing, or also be included as the intrinsic key element of this process, method, article or equipment.Do not having under the situation of more restrictions, the key element that is limited by statement " comprising ... ", and be not precluded within process, method, article or the equipment that comprises described key element and also have other identical element.
More than the method and apparatus of macrovirus killing that the embodiment of the invention is provided be described in detail, used specific case herein principle of the present invention and embodiment are set forth, the explanation of above embodiment just is used for helping to understand method of the present invention and core concept thereof; Simultaneously, for one of ordinary skill in the art, according to thought of the present invention, the part that all can change in specific embodiments and applications, in sum, this description should not be construed as limitation of the present invention.
Claims (12)
1. the method for a macrovirus killing is characterized in that, described method comprises:
Obtain the data stream of document to be checked;
In described data stream, exist under the situation of grand sign, judge whether described document to be checked is the macrovirus document, if then described macrovirus document is changed into nontoxic document.
2. method according to claim 1 is characterized in that, describedly judges that whether described document to be checked is before the macrovirus document, also comprises:
Default macrovirus feature group, described macrovirus feature group comprises at least one macrovirus feature.
3. method according to claim 2 is characterized in that, describedly judges that whether described document to be checked is the macrovirus document, comprising:
Judge whether described document to be checked comprises the arbitrary macrovirus feature in the described macrovirus feature group.
4. method according to claim 3 is characterized in that, describedly judges that whether described document to be checked comprises the arbitrary macrovirus feature in the described macrovirus feature group, comprising:
Comprise at described document to be checked under the situation of grand son stream, judge the arbitrary macrovirus feature that whether comprises in the described grand son stream in the described macrovirus feature group;
Do not comprise in grand son stream or the described grand son stream at described document to be checked and not comprise under the situation of the arbitrary macrovirus feature in the described macrovirus feature group, judge whether described document to be checked comprises script flow, if judge then whether described script flow comprises the arbitrary macrovirus feature in the described macrovirus feature group;
Perhaps,
Comprise under the situation of script flow at described document to be checked, judge the arbitrary macrovirus feature that whether comprises in the described script flow in the described macrovirus feature group;
Do not comprise under the situation that does not comprise the arbitrary macrovirus feature in the described macrovirus feature group in script flow or the described script flow at described document to be checked, judge whether described document to be checked comprises Hong Ziliu, if judge then whether described grand son stream comprises the arbitrary macrovirus feature in the described macrovirus feature group.
5. method according to claim 1 is characterized in that, described method also comprises:
In described data stream, do not exist under the situation of grand sign, described document to be checked is defined as nontoxic document.
6. method according to claim 1 is characterized in that, described described macrovirus document is changed into nontoxic document, comprising:
Delete the grand information in the described macrovirus document, described grand information comprises grand sub-stream and or script flow, and deletes the grand sign in the described macrovirus document;
Described macrovirus document is defined as nontoxic document.
7. the device of a macrovirus killing is characterized in that, described device comprises:
First acquisition module is for the data stream of obtaining document to be checked;
First judge module is used for existing under the situation of grand sign in described data stream, judges whether described document to be checked is the macrovirus document;
Conversion module is used in the result of described first judge module described macrovirus document being changed into nontoxic document when being.
8. method according to claim 7 is characterized in that, described device also comprises:
Presetting module is used for default macrovirus feature group, and described macrovirus feature group comprises at least one macrovirus feature.
9. method according to claim 8 is characterized in that, described first judge module specifically is used for:
In described data stream, exist under the situation of grand sign, judge whether described document to be checked comprises the arbitrary macrovirus feature in the described macrovirus feature group.
10. method according to claim 9 is characterized in that, described first judge module comprises:
First judges submodule, is used for comprising under the situation of grand son stream at described document to be checked, judges the arbitrary macrovirus feature that whether comprises in the described grand son stream in the described macrovirus feature group;
Second judges submodule, is used for not comprising that at described document to be checked grand son stream or described grand son stream do not comprise under the situation of the arbitrary macrovirus feature in the described macrovirus feature group, judge whether described document to be checked comprises script flow;
The 3rd judges submodule, is used in described second result who judges submodule judging whether described script flow comprises the arbitrary macrovirus feature in the described macrovirus feature group when being;
Perhaps,
The 4th judges submodule, is used for comprising under the situation of script flow at described document to be checked, judges the arbitrary macrovirus feature that whether comprises in the described script flow in the described macrovirus feature group;
The 5th judges submodule, is used for not comprising that at described document to be checked script flow or described script flow do not comprise under the situation of the arbitrary macrovirus feature in the described macrovirus feature group, judges whether described document to be checked comprises Hong Ziliu;
The 6th judges submodule, is used in the described the 5th result who judges submodule judging that described grand son flows the arbitrary macrovirus feature that whether comprises in the described macrovirus feature group when being.
11. method according to claim 7 is characterized in that, described device also comprises:
Determination module is used for not existing under the situation of grand sign in described data stream, and described document to be checked is defined as nontoxic document.
12. method according to claim 7 is characterized in that, described conversion module comprises:
The first deletion submodule, the grand information that is used for deleting described macrovirus document, described grand information comprises grand sub-stream and or script flow;
The second deletion submodule, the grand sign that is used for deleting described macrovirus document;
Determine submodule, be used for described macrovirus document is defined as nontoxic document.
Priority Applications (3)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310175309.XA CN103246847B (en) | 2013-05-13 | 2013-05-13 | A kind of method and apparatus of macrovirus killing |
| TW102146233A TW201443683A (en) | 2013-05-13 | 2013-12-13 | Apparatus and method for searching and deleting macro virus |
| PCT/CN2013/089563 WO2014183434A1 (en) | 2013-05-13 | 2013-12-16 | Method and device for removing macro virus |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310175309.XA CN103246847B (en) | 2013-05-13 | 2013-05-13 | A kind of method and apparatus of macrovirus killing |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN103246847A true CN103246847A (en) | 2013-08-14 |
| CN103246847B CN103246847B (en) | 2016-03-23 |
Family
ID=48926361
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201310175309.XA Active CN103246847B (en) | 2013-05-13 | 2013-05-13 | A kind of method and apparatus of macrovirus killing |
Country Status (3)
| Country | Link |
|---|---|
| CN (1) | CN103246847B (en) |
| TW (1) | TW201443683A (en) |
| WO (1) | WO2014183434A1 (en) |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2014183434A1 (en) * | 2013-05-13 | 2014-11-20 | Tencent Technology (Shenzhen) Company Limited | Method and device for removing macro virus |
| CN105488410A (en) * | 2015-05-19 | 2016-04-13 | 哈尔滨安天科技股份有限公司 | Detection method and system of excel macro sheet virus |
| CN107025407A (en) * | 2017-03-22 | 2017-08-08 | 国家计算机网络与信息安全管理中心 | The malicious code detecting method and system of a kind of office document files |
| CN109033831A (en) * | 2018-06-22 | 2018-12-18 | 珠海市君天电子科技有限公司 | A kind of method for detecting virus, device, electronic equipment and storage medium |
| CN111191233A (en) * | 2019-07-31 | 2020-05-22 | 腾讯科技（深圳）有限公司 | Macro virus processing method, macro virus processing device and storage medium |
| CN111400707A (en) * | 2020-03-10 | 2020-07-10 | 深信服科技股份有限公司 | File macro virus detection method, device, equipment and storage medium |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US5951698A (en) * | 1996-10-02 | 1999-09-14 | Trend Micro, Incorporated | System, apparatus and method for the detection and removal of viruses in macros |
| CN101547126A (en) * | 2008-03-27 | 2009-09-30 | 北京启明星辰信息技术股份有限公司 | Network virus detecting method based on network data streams and device thereof |
| CN102694801A (en) * | 2012-05-21 | 2012-09-26 | 华为技术有限公司 | Method and device for detecting virus and firewall equipment |
| CN102841999A (en) * | 2012-07-16 | 2012-12-26 | 北京奇虎科技有限公司 | Method and device for detecting macro virus of files |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6577920B1 (en) * | 1998-10-02 | 2003-06-10 | Data Fellows Oyj | Computer virus screening |
| US6697950B1 (en) * | 1999-12-22 | 2004-02-24 | Networks Associates Technology, Inc. | Method and apparatus for detecting a macro computer virus using static analysis |
| US7210041B1 (en) * | 2001-04-30 | 2007-04-24 | Mcafee, Inc. | System and method for identifying a macro virus family using a macro virus definitions database |
| CN103246847B (en) * | 2013-05-13 | 2016-03-23 | 腾讯科技（深圳）有限公司 | A kind of method and apparatus of macrovirus killing |
-
2013
- 2013-05-13 CN CN201310175309.XA patent/CN103246847B/en active Active
- 2013-12-13 TW TW102146233A patent/TW201443683A/en unknown
- 2013-12-16 WO PCT/CN2013/089563 patent/WO2014183434A1/en active Application Filing
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US5951698A (en) * | 1996-10-02 | 1999-09-14 | Trend Micro, Incorporated | System, apparatus and method for the detection and removal of viruses in macros |
| CN101547126A (en) * | 2008-03-27 | 2009-09-30 | 北京启明星辰信息技术股份有限公司 | Network virus detecting method based on network data streams and device thereof |
| CN102694801A (en) * | 2012-05-21 | 2012-09-26 | 华为技术有限公司 | Method and device for detecting virus and firewall equipment |
| CN102841999A (en) * | 2012-07-16 | 2012-12-26 | 北京奇虎科技有限公司 | Method and device for detecting macro virus of files |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2014183434A1 (en) * | 2013-05-13 | 2014-11-20 | Tencent Technology (Shenzhen) Company Limited | Method and device for removing macro virus |
| CN105488410A (en) * | 2015-05-19 | 2016-04-13 | 哈尔滨安天科技股份有限公司 | Detection method and system of excel macro sheet virus |
| CN107025407A (en) * | 2017-03-22 | 2017-08-08 | 国家计算机网络与信息安全管理中心 | The malicious code detecting method and system of a kind of office document files |
| CN109033831A (en) * | 2018-06-22 | 2018-12-18 | 珠海市君天电子科技有限公司 | A kind of method for detecting virus, device, electronic equipment and storage medium |
| CN111191233A (en) * | 2019-07-31 | 2020-05-22 | 腾讯科技（深圳）有限公司 | Macro virus processing method, macro virus processing device and storage medium |
| CN111400707A (en) * | 2020-03-10 | 2020-07-10 | 深信服科技股份有限公司 | File macro virus detection method, device, equipment and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| WO2014183434A1 (en) | 2014-11-20 |
| CN103246847B (en) | 2016-03-23 |
| TW201443683A (en) | 2014-11-16 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104978115A (en) | Content display method and device | |
| CN103258163B (en) | A kind of script virus recognition methods, Apparatus and system | |
| CN103368958A (en) | Method, device and system for detecting webpage | |
| CN103400076A (en) | Method, device and system for detecting malicious software on mobile terminal | |
| CN103246847B (en) | A kind of method and apparatus of macrovirus killing | |
| CN104518953A (en) | Message deleting method, instant messaging terminal and system | |
| CN104063362B (en) | A kind of truncation of a string method and device | |
| CN104468101A (en) | User identity authentication method and device and authentication service system | |
| CN103336925A (en) | Scanning acceleration method and device | |
| CN104301315A (en) | Method and device for limiting information access | |
| CN106921791A (en) | The storage and inspection method of a kind of multimedia file, device and mobile terminal | |
| CN104123276A (en) | Method, device and system for intercepting popup windows in browser | |
| CN103607377B (en) | Information sharing method, Apparatus and system | |
| CN105530239A (en) | Multimedia data obtaining method and device | |
| CN106502824A (en) | Data back up method and Cloud Server | |
| CN103678502A (en) | Information collection method and device | |
| CN103945241A (en) | Streaming data statistical method, system and related device | |
| CN104735132A (en) | Information inquiry method, servers and terminal | |
| CN105512150A (en) | Method and device for information search | |
| CN104516888A (en) | Authority query method and device of multi-dimensional data | |
| CN103177217A (en) | File scan method, file scan system, client-side and server | |
| CN104699501A (en) | Method and device for running application program | |
| CN103327029A (en) | Malicious URL (Uniform Resource Locator) detection method and malicious URL detection device | |
| CN104281610A (en) | Method and device for filtering microblogs | |
| CN105047185A (en) | Method, device and system for obtaining audio frequency of accompaniment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant |