Method, device and system for processing computer virus

Patent metadata

Field	Value
Publication number	US-9626510-B2
Application number	US-201214123737-A
Country	US
Kind code	B2
Filing date	Jun 1, 2012
Priority date	Jun 3, 2011
Publication date	Apr 18, 2017
Grant date	Apr 18, 2017

Abstract

A method, an apparatus and a system for processing a computer virus. The method comprises: obtaining the file type of a file which is infected with a computer virus and the process information of a process which is used by the virus when accessing the file; monitoring whether a malicious event occurs in s system, wherein the malicious event is an event which is triggered when the process corresponding to the process information accesses the file of the file type; and refusing the process to access the file of the file type when it is monitored that the malicious event occurs.

First claim

The invention claimed is:

1. A method for processing a computer virus, comprising:
extracting, from a scanning result, a file type of a first file infected with a computer virus;
obtaining process information of a first process used by the computer virus to access the first file;
storing a correspondence between the file type and the process information;
refusing access to a second file by a second process based at least in part on the stored correspondence, wherein a file type of the second file matches the file type of the stored correspondence, and process information of the second process matches the process information of the stored correspondence;
sending, by a first antivirus engine among a plurality of antivirus engines included in a system, the stored correspondence between the file type and the process information to a second antivirus engine among the plurality of antivirus engines;
storing, by the second antivirus engine, the correspondence between the file type and the process information; and
refusing, by the second antivirus engine, access to a third file by a third process based at least in part on the correspondence stored by the second antivirus engine, wherein a file type of the third file matches the file type of the correspondence stored by the second antivirus engine, and process information of the third process matches the process information of the correspondence stored by the second antivirus engine.

2. The method of claim 1 , wherein the obtaining process information of a first process used by the computer virus to access the first file further comprises:
obtaining, from a file filter driver, a process ID of the first process used by the computer virus to access the first file.

3. The method of claim 2 , wherein the refusing access to a second file by a second process based at least in part on the stored correspondence further comprises:
obtaining a process ID of the second process and a file type of the second file;
performing a search of a stored correspondence between the file type of the first file and the process ID of the first process according to the process ID of the second process and the file type of the second file; and
refusing access to the second file by the second process when the process ID of the second process and the file type of the second file are in conformity to the stored correspondence between the file type and the process ID.

4. The method of claim 1 , further comprising:
before extracting the file type of the first file which is infected with the computer virus, scanning files to obtain the scanning result, the scanning result recording files infected with computer viruses.

5. The method of claim 4 , further comprising: cleaning the computer viruses recorded in the scanning result.

6. The method of claim 1 , wherein the refusing access to a second file by a second process further comprises:
returning, by a file filter driver, an instruction of refusing access to the second file by the second process.

7. An apparatus for processing a computer virus, comprising:
at least a processor; and
at least a memory communicatively coupled to the at least a processor, the at least a memory bearing processor-executable instructions that upon execution by the at least a processor cause the apparatus at least to:
extract the file type of the first file which is infected with the computer virus from a scanning result of scanning files in the system;
obtain process information of a first process which is used by the computer virus to access the first file;
store a correspondence between the file type and the process information; and
refuse access to a second file by a second process based at least in part on the stored correspondence, wherein a file type of the second file matches the file type of the stored correspondence, and process information of the second process matches the process information of the stored correspondence;
send, by a first antivirus engine among a plurality of antivirus engines, the stored correspondence between the file type and the process information to a second antivirus engine among the plurality of antivirus engines;
store, by the second antivirus engine, the correspondence between the file type and the process information; and
refuse, by the second antivirus engine, access to a third file by a third process based at least in part on the correspondence stored by the second antivirus engine, wherein a file type of the third file matches the file type of the correspondence stored by the second antivirus engine, and process information of the third process matches the process information of the correspondence stored by the second antivirus engine.

8. The apparatus of claim 7 , wherein the processor-executable instructions that upon execution by the at least a processor cause the apparatus at least to obtain the process information of the first process further cause the apparatus at least to:
record, by a file filter driver, a process ID of the first process which is used by the computer virus when accessing the first file.

9. The apparatus of claim 8 , wherein the processor-executable instructions that upon execution by the at least a processor cause the apparatus at least to refuse access to the second file by the second process further cause the apparatus at least to:
obtain a process ID of the second process and a file type of the second file;
perform a search of a stored correspondence between the file type of the first file and the process ID of the first process according to the process ID of the second process and the file type of the second file.

10. The apparatus of claim 8 , wherein the at least a memory further bears processor-executable instructions that upon execution by the at least a processor cause the apparatus at least to:
scan files to obtain the scanning result, the scanning result recording files infected with computer viruses.

11. The apparatus of claim 10 , wherein the at least a memory further bears processor-executable instructions that upon execution by the at least a processor cause the apparatus at least to:
clean the computer viruses recorded in the scanning result.

12. The apparatus of claim 7 , wherein the processor-executable instructions that upon execution by the at least a processor cause the apparatus at least to refuse the second process to access the second file further cause the apparatus at least to:
return, by a file filter driver, an instruction of refusing access to the second file by the second process.

13. A computing system, comprising a first antivirus engine device, the first antivirus engine device is configured to at least:
extract a file type of a first file which is infected with a computer virus from a scanning result;
obtain process information of a first process used by the computer virus to access the first file;
store a correspondence between the file type and the process information; and
refuse access to a second file by a second process based at least in part on the stored correspondence, wherein a file type of the second file matches the file type of the stored correspondence, and process information of the second process matches the process information of the stored correspondence;
wherein the computing system further comprises at least a second antivirus engine device, wherein the first antivirus engine device is further configured to send the stored correspondence between the file type and the process information to the at least a second antivirus engine device;
wherein the at least a second antivirus engine device is configured to at least:
store the correspondence between the file typ

Assignees

• Li Bo
• Zou Guiqiang
• Beijing Qihoo Technology Co

Inventors

• Li Bo
• Zou Guiqiang

Classifications

• G06F21/561 Primary

  Virus type analysis · CPC title

• G06F21/568 Primary

  eliminating virus, restoring damaged files · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/565

  by checking file integrity · CPC title

• G06F21/564

  by virus signature recognition · CPC title