WO2017084557A1 - Procédé et dispositif de balayage de fichier - Google Patents

Procédé et dispositif de balayage de fichier Download PDF

Info

Publication number
WO2017084557A1
WO2017084557A1 PCT/CN2016/105906 CN2016105906W WO2017084557A1 WO 2017084557 A1 WO2017084557 A1 WO 2017084557A1 CN 2016105906 W CN2016105906 W CN 2016105906W WO 2017084557 A1 WO2017084557 A1 WO 2017084557A1
Authority
WO
WIPO (PCT)
Prior art keywords
log
file
scan
scanning
incremental
Prior art date
Application number
PCT/CN2016/105906
Other languages
English (en)
Chinese (zh)
Inventor
汤迪斌
王剑
Original Assignee
北京奇虎科技有限公司
北京奇安信科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京奇虎科技有限公司, 北京奇安信科技有限公司 filed Critical 北京奇虎科技有限公司
Publication of WO2017084557A1 publication Critical patent/WO2017084557A1/fr

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G06F21/565—Static detection by checking file integrity

Definitions

  • the present invention relates to the field of computer technologies, and in particular, to a file scanning method and apparatus.
  • the current anti-virus software scanning virus generally adopts the method of full-disk scanning, that is, enumerating the files in the system to be scanned, for example, enumerating files from the root directory of the C-disk, and transmitting them one by one to the anti-virus engine behind, and multiple anti-viruses.
  • the engine gets a scan after scanning the virus.
  • This scanning method can effectively detect and kill viruses, but because it is used to enumerate files in the system, it is a waste of time and consumes system resources too much. Therefore, it is necessary to create an efficient and safe file scanning method. In the case of ensuring the security of the terminal, not only can the virus be accurately detected, but also the scanning time and system resources can be saved.
  • the present invention has been made in order to provide a document scanning method and corresponding apparatus that overcomes the above problems or at least partially solves the above problems.
  • a file scanning method for performing security scanning on a file in a terminal, wherein the terminal is provided with an incremental log, and when a file in the terminal is changed, the Add a log record to the incremental log, including:
  • the location of the scan-off log is found according to the incremental log, and the scan-off log is used as a starting point, and the file in the terminal is incrementally scanned according to the newly added partial log record in the incremental log.
  • a file scanning apparatus is further provided for performing security scanning on a file in a terminal, wherein the terminal is provided with an incremental log, and when a file in the terminal is changed, Adding a log record to the incremental log, the device includes:
  • a recording module configured to determine a last log record in the incremental log record corresponding to each scan operation, and record as a scan cutoff log
  • An input module adapted to receive a scan triggering operation for scanning a file in the terminal
  • An obtaining module configured to obtain, in the recording module, a scan cutoff log of a previous scan operation record
  • the scanning module searches for the location of the scan-off log according to the incremental log, and uses the scan-off log as a starting point to increment the file in the terminal according to the newly added partial log record in the incremental log. scanning.
  • a computer program comprising computer readable code that, when executed on a computing device, causes the computing device to perform a file scan as described above method.
  • a computer readable medium storing a computer program as described above is provided.
  • an incremental log is set in the terminal, and when a file in the terminal is changed, a log record is added to the incremental log.
  • the scan is triggered, the last log record in the incremental log corresponding to the previous scan operation is obtained, that is, the scan cutoff log, and the terminal only needs to scan the newly added log portion after the cutoff log, so that the file can be safely scanned. Since the incremental log only adds some new logs to the original log, the previously existing logs are not The change occurs, so the present invention only scans the file increments, avoiding the full scan of all the incremental logs from beginning to end, especially in the case of a large number of files, the time spent on file scanning is obviously saved, and the effective improvement is effectively improved. The efficiency of file scanning saves system resources.
  • FIG. 1 is a flow chart showing a file scanning method according to an embodiment of the present invention
  • FIG. 2 is a schematic flow chart of a file scanning method according to another embodiment of the present invention.
  • FIG. 3 is a schematic flow chart of a file scanning method according to another embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of a document scanning apparatus according to an embodiment of the present invention.
  • Figure 5 is a schematic block diagram showing a computing device for performing a file scanning method in accordance with the present invention.
  • Fig. 6 schematically shows a storage unit for holding or carrying program code implementing the document scanning method according to the present invention.
  • FIG. 1 shows a flow chart of a document scanning method according to an embodiment of the present invention.
  • the method includes at least steps S102 to S106.
  • Step S102 receiving a scan triggering operation for scanning a file in the terminal.
  • Step S104 Acquire a scan cutoff log of the previous scan operation record, where the scan cutoff log is the last log record in the incremental log record corresponding to the previous file scan operation.
  • the method of obtaining the scan-off log depends on the incremental log itself. If the incremental log uses the number of logs, the scan-off log is read and judged whether the read log entry is the last log record. By means of indexing, the last log record can be found and obtained by reading the index.
  • the scan cutoff log can be obtained by recording the index number of the scan cutoff log.
  • Step S106 Find the location of the scan-off log according to the incremental log, and use the scan-off log as a starting point to perform incremental scanning on the file in the terminal according to the newly added partial log record in the incremental log.
  • an incremental log is set in the terminal, and when a file in the terminal is changed, a log record is added to the incremental log.
  • the scan is triggered, the last log record in the incremental log corresponding to the previous scan operation is obtained, that is, the scan cutoff log, and the terminal only needs to scan the newly added log portion after the cutoff log, so that the file can be safely scanned.
  • the incremental log only adds some new logs to the original log. Therefore, based on the original log, only the incremental part of the file is scanned for security, which can effectively avoid the entire disk from all the incremental logs. Scanning, especially in the case of a large number of files, significantly saves the time spent on file scanning, effectively improving the efficiency of file scanning.
  • FIG. 2 is a flow chart showing a file scanning method in a specific embodiment of the present invention. Referring to FIG. 2, the method includes at least steps S202 to S210.
  • Step S202 receiving a scan triggering operation for scanning a file in the terminal.
  • Step S204 When the incremental log is indexed by the number, the index number of the scan cutoff log is recorded, wherein the scan cutoff log is the last log record in the incremental log record corresponding to the previous file scan operation.
  • Step S206 finding a position corresponding to the index number of the scan-off log according to the digital index of the increment log.
  • Step S208 starting from the index number corresponding to the scan cutoff log, determining a file for the subsequent scan operation according to the index number corresponding to the newly added partial log record, wherein the file for the file includes the newly added file and/or the existing file. File changes.
  • the changes to the existing file include at least one of: changes to existing file content; changes to existing file attributes; changes to existing file feature parameters.
  • the changes of the existing file attributes do not necessarily need to be scanned, some maliciously modified attributes, such as an IE attribute, are maliciously modified, and the title bar above the IE browser is changed to the "welcome to visit ... website" style. It is included in the scope of the existing file attribute changes.
  • attributes For security-compliant file attribute changes, for example, attributes only involve text type modifications (such as word text type conversion to PDF text type) or attributes only involve changes in text modification time (eg 2015-11-10 changed to 2015-11- 13) These file attribute changes do not need to be scanned again.
  • Step S210 performing incremental scanning on the determined file.
  • an incremental log is set in the terminal, and when a file in the terminal is changed, a log record is added to the incremental log.
  • the last log record in the incremental log corresponding to the previous scan operation is obtained, that is, the scan cutoff log.
  • the incremental log is indexed by the number, and the index number of the scan-off log is recorded.
  • the position corresponding to the index number of the scan-off log is found according to the digital index of the incremental log, and the index number of the scan-off log is used as the starting point, and the log is incremented according to the index.
  • the index number corresponding to the new part of the log is incrementally scanned for the files in the terminal.
  • the file for the subsequent scanning operation of the index number of the scan-off log is determined, the time for scanning all the files is omitted, and the time taken for the overall scan-increment log is further saved, and the scanning efficiency is greatly improved, and Reduce the processing of scanning information, reduce the possibility of scanning information errors, thereby increasing the stability of file scanning Sex.
  • FIG. 3 is a flow chart showing a file scanning method according to another embodiment of the present invention. Referring to FIG. 3, the method includes at least steps S302 to S306.
  • Step S302 Receive a scan trigger operation for scanning a file in the terminal.
  • Step S304 the terminal is divided into multiple areas, and the scan cutoff log of the previous scan operation record of each area is obtained, wherein the scan cutoff log is the last log record in the sub-increment log record corresponding to the previous file scan operation in each area.
  • the storage area of the terminal is divided into a C drive, a D drive, and an E drive. After receiving the scan trigger operation, the scan cutoff logs in the C drive, the D drive, and the E drive are simultaneously acquired.
  • Step S306 searching for the location of the scan-off log in each sub-increment log according to each sub-increment log, and starting from the scan-off log, and performing the file in the corresponding area of the terminal according to the newly added part of the log records in each sub-increment log. Incremental scanning.
  • the storage area of the terminal is divided into a C drive, a D drive, and an E drive.
  • the scan cutoff logs in the C drive, the D drive, and the E drive are simultaneously acquired.
  • the location of the corresponding scan cutoff log is found according to the incremental log in each disk, and the incremental portion of the incremental log in the C disk, the D disk, and the E disk is simultaneously scanned starting from the scan cutoff log in each disk.
  • the sub-increment log of the file change operation of the local area is set in each area, and the words in each area of the terminal are The sub-increment log allows simultaneous incremental scanning of files in each region. By scanning the terminal sub-area, each area does not affect each other, and multiple areas can perform sub-increment log incremental scanning in parallel, which greatly improves the efficiency of file scanning.
  • NTFS New Technology File System
  • USN update sequence number
  • NTFS is a recoverable file system.
  • NTFS partitions users rarely need to run disk repairs.
  • NTFS uses standard transaction logging and recovery techniques to ensure partition consistency.
  • NTFS automatically restores file system consistency using log files and checkpoint information. Therefore, the NTFS file system has good security and is suitable for virus scanning. More secure and reliable.
  • the NTFS file system provides a fault-tolerant structure log that can fully record the user's operations, further protecting the security of the system.
  • the USN file system is a function to record related information in the volume.
  • NTFS 5.0 When Microsoft released NTFS 5.0, it added some new features and improved the old version of the file system. It invited a reliable secretary. That is, the USN file system, which can set the number of files and directories that monitor changes in the partition, and record the modification time and modification contents of the monitoring object.
  • the USN file system uses the USN to record the modified time and identifies it as a log with a specific serial number, that is, USN. Log.
  • USN log does not record the specific modification content. Therefore, the USN log record file is small and easy to find. Therefore, USN logs can only work in the NTFS file system.
  • FIG. 1 refers to the schematic diagram of the file scanning method shown in FIG. 1, which can be applied to various environments such as virus scanning, spatial finishing scanning, and the like.
  • virus scanning if the virus database or the virus engine changes, the scan deadline log recorded in the previous scan is cleared, and the scan in the terminal is scanned due to the change of the virus database or the virus engine during the scan. The security of the previous file may be changed. Therefore, this scan requires a full scan of the files in the terminal to ensure that the virus can be completely and completely detected and prevented, and some files suspected of security are not checked. .
  • FIG. 4 is a block diagram showing the structure of a document scanning apparatus according to an embodiment of the present invention.
  • the apparatus may include at least the following modules: a recording module 410, an input module 420, an acquisition module 430, and a scanning module 440.
  • the recording module 410 is adapted to determine a last log record in the incremental log record corresponding to each scan operation, and record the scan log as a scan cutoff log;
  • the input module 420 is adapted to receive a scan triggering operation for scanning a file in the terminal;
  • the obtaining module 430 is coupled to the recording module 410 and the input module 420 respectively, and is adapted to obtain a scan cutoff log of the previous scan operation record into the recording module 410;
  • the scanning module 440 is coupled with the obtaining module 430, and finds the location of the scan-off log according to the incremental log, and uses the scan-off log as a starting point to perform incremental scanning on the file in the terminal according to the newly added partial log record in the incremental log.
  • the obtaining module 430 is further adapted to acquire an index number of a scan cutoff log recorded by the previous scan operation.
  • the scanning module 440 finds a location corresponding to the index number of the scan-off log based on the digital index of the increment log.
  • the scanning module 440 is further configured to: start with a scan cutoff log, and determine, according to the newly added partial log record, a file for which a subsequent scan operation is performed, where the file for the file includes the newly added file and / or changes to existing documents;
  • the scan trigger operation of the receiving terminal determines the last log record in the incremental log record corresponding to each scan operation, and records the scan as the scan cutoff log, starting from the scan cutoff log, according to the new
  • the partial log record determines the file for which the subsequent scan operation is directed, wherein the file for the change includes a new file and/or a change to the existing file.
  • Changes to existing documents include at least one of the following: changes to existing file content; changes to existing file attributes; changes to existing file feature parameters.
  • the recording module 410 is further adapted to, when the terminal is divided into a plurality of areas, perform a file scanning operation on each area, and set a sub-increment of the file changing operation of the recording area in each area.
  • the recording module 410 determines the last log record in the sub-increment log records in each area corresponding to each scan operation, and records it as a scan cutoff log.
  • the obtaining module 430 acquires the scan cutoff log of the previous scan operation record from the sub-increment log.
  • the scanning module 440 finds the location of the scan-off log according to the sub-increment log in each area, and uses the scan-off log as a starting point to perform incremental scanning on the file in the corresponding area of the terminal according to the newly added part of the log record in the sub-increment log. .
  • the sub-increment log of the file change operation of the local area is set in each area, and the words in each area of the terminal are The sub-increment log allows simultaneous incremental scanning of files in each region. By scanning the terminal sub-areas, each area does not affect each other, and multiple areas can simultaneously scan the sub-increment log increments, which greatly improves the efficiency of file scanning.
  • the log is incremented. Use the USN file system.
  • the file scanning device is adapted for virus scanning and/or spatial finishing scanning. If the file scanning device is used for virus scanning, the recording module 420 is further adapted to: when the file scanning device is applied to the virus scanning, if the virus database or the virus engine changes, the scanning deadline log recorded by the previous scanning is cleared, and the terminal is The incremental log in the scan is performed in a full scan to ensure thorough scanning and killing of the virus.
  • the embodiment of the present invention can achieve the following beneficial effects:
  • an incremental log is set in the terminal, and when a file is changed in the terminal, a log record is added to the incremental log.
  • the scan is triggered, the last log record in the incremental log corresponding to the previous scan operation is obtained, that is, the scan cutoff log is searched, and the position of the scan cutoff log is found according to the incremental log, and the scan cutoff log is taken as the starting point, according to the incremental log.
  • the new part of the log record incrementally scans the files in the terminal.
  • modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment.
  • the modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components.
  • any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined.
  • Each feature disclosed in this specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.
  • the various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof.
  • a microprocessor or digital signal processor may be used in practice to implement some or all of the functionality of some or all of the components of the document scanning device in accordance with embodiments of the present invention.
  • the invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein.
  • a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.
  • Figure 5 illustrates a computing device that can implement a file scanning method in accordance with the present invention.
  • the computing device conventionally includes a processor 510 and a computer program product or computer readable medium in the form of a memory 520.
  • the memory 520 may be, for example, a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM. Electronic storage such as this.
  • Memory 520 has a memory space 530 for program code 531 for performing any of the method steps described above.
  • storage space 530 for program code may include various program code 531 for implementing various steps in the above methods, respectively.
  • the program code can be read from or written to one or more computer program products.
  • These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. Such computer program products are typically portable or fixed storage units as described with reference to FIG.
  • the storage unit may have storage segments, storage spaces, and the like that are similarly arranged to memory 520 in the computing device of FIG.
  • the program code can be compressed, for example, in an appropriate form.
  • the storage unit includes computer readable code 531 ', ie, code readable by a processor, such as 510, that when executed by a computing device causes the computing device to perform each of the methods described above step.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Virology (AREA)
  • General Health & Medical Sciences (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

L'invention concerne un procédé et un dispositif de balayage de fichier. Le procédé comprend les étapes suivantes : recevoir une opération de déclenchement de balayage d'un terminal (S102) ; acquérir un journal de fin de balayage d'un enregistrement d'opération de balayage antérieur, le journal de fin de balayage étant un dernier enregistrement de journal dans un enregistrement de journal incrémentiel correspondant à une opération de balayage de fichier antérieur (S104) ; et trouver un emplacement du journal de fin de balayage selon un journal incrémentiel, et réaliser un balayage de l'incrément sur un fichier dans le terminal selon un enregistrement de journal d'une partie nouvellement augmentée dans le journal incrémentiel, en utilisant le journal de fin de balayage comme point de départ (S106). Par l'intermédiaire du balayage de l'incrément d'un fichier, le schéma économise du temps gaspillé pour un balayage complet de fichier inutile, augmente efficacement l'efficacité de balayage de fichier, et dans le même temps, économise des ressources d'espace d'un système de terminal, assurant ainsi une efficacité élevée et une précision élevée de balayage de fichier.
PCT/CN2016/105906 2015-11-16 2016-11-15 Procédé et dispositif de balayage de fichier WO2017084557A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510785495.8A CN105389509A (zh) 2015-11-16 2015-11-16 文件扫描方法及装置
CN201510785495.8 2015-11-16

Publications (1)

Publication Number Publication Date
WO2017084557A1 true WO2017084557A1 (fr) 2017-05-26

Family

ID=55421785

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/105906 WO2017084557A1 (fr) 2015-11-16 2016-11-15 Procédé et dispositif de balayage de fichier

Country Status (2)

Country Link
CN (1) CN105389509A (fr)
WO (1) WO2017084557A1 (fr)

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105389509A (zh) * 2015-11-16 2016-03-09 北京奇虎科技有限公司 文件扫描方法及装置
CN107437022B (zh) * 2016-05-27 2019-08-20 北京神州泰岳软件股份有限公司 一种弱口令核查方法和装置
CN108153790A (zh) * 2016-12-06 2018-06-12 杭州亿方云网络科技有限公司 一种本地文件监控方法及装置
CN108920949A (zh) * 2018-06-27 2018-11-30 北京奇虎科技有限公司 一种自动查杀文件的方法及终端设备
CN109033313B (zh) * 2018-07-17 2020-09-25 北京明朝万达科技股份有限公司 一种应用usn实现全盘扫描功能的方法和终端设备
CN111930702A (zh) * 2020-08-14 2020-11-13 工银科技有限公司 日志处理方法、装置、***及介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
TW200627279A (en) * 2004-08-13 2006-08-01 Ibm A prioritization system
CN102609653A (zh) * 2012-02-07 2012-07-25 奇智软件（北京）有限公司 一种文件快速扫描方法和***
CN103336925A (zh) * 2013-07-29 2013-10-02 腾讯科技（深圳）有限公司 一种扫描加速的方法和装置
CN105389509A (zh) * 2015-11-16 2016-03-09 北京奇虎科技有限公司 文件扫描方法及装置

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7581250B2 (en) * 2005-02-17 2009-08-25 Lenovo (Singapore) Pte Ltd System, computer program product and method of selecting sectors of a hard disk on which to perform a virus scan
US8122507B1 (en) * 2006-06-28 2012-02-21 Emc Corporation Efficient scanning of objects
US8161556B2 (en) * 2008-12-17 2012-04-17 Symantec Corporation Context-aware real-time computer-protection systems and methods
CN103020521B (zh) * 2011-09-22 2015-10-21 腾讯科技（深圳）有限公司 木马扫描方法及***
CN103679022B (zh) * 2012-09-20 2016-04-20 腾讯科技（深圳）有限公司 病毒扫描方法和装置
CN104133822B (zh) * 2013-07-15 2016-09-14 腾讯科技（深圳）有限公司 一种对存储器上的文件进行扫描的方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
TW200627279A (en) * 2004-08-13 2006-08-01 Ibm A prioritization system
CN102609653A (zh) * 2012-02-07 2012-07-25 奇智软件（北京）有限公司 一种文件快速扫描方法和***
CN103336925A (zh) * 2013-07-29 2013-10-02 腾讯科技（深圳）有限公司 一种扫描加速的方法和装置
CN105389509A (zh) * 2015-11-16 2016-03-09 北京奇虎科技有限公司 文件扫描方法及装置

Also Published As

Publication number Publication date
CN105389509A (zh) 2016-03-09

Similar Documents

Publication Publication Date Title
WO2017084557A1 (fr) Procédé et dispositif de balayage de fichier
WO2017190580A1 (fr) Procédé et dispositif d'accès à une base de données
US20150020203A1 (en) Method and device for processing computer viruses
US20090038011A1 (en) System and method of identifying and removing malware on a computer system
EP2750067B1 (fr) Système et procédé de sélection de méthode d'accès de fichier synchrone ou asynchrone pendant une analyse antivirus
US9626510B2 (en) Method, device and system for processing computer virus
US9819695B2 (en) Scanning method and device, and client apparatus
AU2017201667B2 (en) Secure document importation via portable media
WO2012051802A1 (fr) Dispositif et procédé de balayage de site web
WO2015081791A1 (fr) Procédé et appareil pour balayer et supprimer un logiciel malveillant niveau noyau
US9129109B2 (en) Method and apparatus for detecting a malware in files
US10229267B2 (en) Method and device for virus identification, nonvolatile storage medium, and device
US8549309B1 (en) Asymmetric content fingerprinting with adaptive window sizing
EP3108400B1 (fr) Procédé et appareil de mise en correspondance de signatures de virus
US9239907B1 (en) Techniques for identifying misleading applications
CN102902925B (zh) 一种染毒文件的处理方法和***
US20130312100A1 (en) Electronic device with virus prevention function and virus prevention method thereof
WO2017054731A1 (fr) Procédé et dispositif pour traiter un navigateur détourné
RU2583712C2 (ru) Система и способ обнаружения вредоносных файлов определенного типа
CN103699838A (zh) 病毒的识别方法及设备
KR100977179B1 (ko) 악성코드 탐지 방법 및 시스템
CN102930208B (zh) 一种染毒文件的处理方法和***
US20080028466A1 (en) System and method for retrieving information from a storage medium
CN106971112B (zh) 文件读写方法及装置
CN105468966B (zh) 企业级终端文件扫描方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16865734

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16865734

Country of ref document: EP

Kind code of ref document: A1