JP2007034623A - Detection method for computer virus, program, recording medium with its program stored and detection device for computer virus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide the detection method of a computer virus whose load to an information processor is low, a program for performing the detection method, a storage medium with its program stored and the detection device of the computer virus. <P>SOLUTION: When updating virus check data, pre-update virus check data and added virus check data are discriminately stored, and virus check is not performed to post-update checked data (D2). Also, virus check is performed to the pre-update checked data by using only the added virus check data, and virus check is performed to unchecked data by using the pre-update virus check data and the added virus check data (D3, D5 and D7). <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a computer virus detection method for detecting whether or not internal data stored in an information processing apparatus includes a computer virus, a program for executing this detection method, a recording medium storing this program, and The present invention relates to a computer virus detection device.

  As a method for checking whether or not the data stored in the computer contains a computer virus, a pattern matching method for extracting unique pattern data from a computer virus as virus check data and comparing the internal data with the pattern data is known. It has been. Such a pattern matching method checks whether or not all data includes a computer virus. Therefore, when there are many computer viruses to be checked, it takes a long time to compare the internal data with the pattern data. As a result, the load on the information processing apparatus such as a computer increases.

  Patent Document 1 discloses a conventional technique for reducing the load on the information processing apparatus. In the computer virus check method of Patent Literature 1, after checking that the data inside the computer is infected with a virus and confirming that the data inside the computer is not infected with a computer virus, Rather than checking whether the data is infected with a computer virus, check whether the data read from outside the computer and the data read outside the computer are infected by a computer virus. Do.

  FIG. 11 is a flowchart showing a data reading process in the computer virus check method according to the prior art, and FIG. 12 is a diagram showing an example of the data list 41 inside the computer in the computer virus check method as the prior art. is there. As shown in FIG. 12, in the data list 41 inside the computer, a file name 42 indicating the data inside the computer and a virus check flag 43 respectively corresponding to the data inside the computer are set.

  When the central processing unit (CPU) instructs a reading process, the process of step H1 is performed. In step H1, the CPU determines whether or not the read data is internal data depending on whether or not the file name 42 shown in FIG. 12 has the same file name as that of the read data. . If it is determined that the data to be read is internal data of the computer, the process proceeds to step H2. If it is determined that the data is not internal data, the process proceeds to step H4. In step H2, the CPU determines whether or not the virus check flag corresponding to the data to be read as shown in FIG. 12 is set (“completed”) or not (“not yet”). It is determined whether or not the data to be read is data that has been confirmed by a virus check that the computer virus is not infected. If it is determined that the data has not been infected with a computer virus, the process proceeds to step H3. If it is determined that the data is not confirmed, the process proceeds to step H5. In step H3, a virus check flag corresponding to the data is set, and the process proceeds to step H4. In Step H4, a virus check is executed using the pattern data as data, and the process proceeds to Step H5. In step H5, data is read and the reading process is terminated.

  Therefore, for data that has been confirmed by a virus check that it is not infected with a computer virus, a read process is executed without executing the virus check. On the other hand, for data that has not been confirmed by a virus check that it is not infected with a computer virus, a virus check is executed and a read process is executed. As described above, the computer virus check method according to the prior art can check for virus infection without imposing a large load on the information processing apparatus even when there are many computer viruses to be checked.

JP 2003-216445 A

  New computer viruses are discovered every day, and computer viruses are increasing. In order to reliably check whether the data contains a computer virus from such a situation, it is necessary to frequently update pattern data corresponding to a new computer virus. The pattern data is frequently updated by auxiliary storage devices such as FD (Flexible Disk), CD (Compact Disc) and DVD (Digital Versatile Disk), and communication means such as the Internet.

  According to the computer virus check method of Patent Document 1, as shown in FIG. 12, there is one virus check flag for indicating whether or not data is confirmed by virus check that the data is not infected with a computer virus. Only the configuration is set. Therefore, when the pattern data is updated, the virus check flag is reset as shown in FIG. 13 in order to check the virus using the updated pattern data.

  FIG. 13 is a flowchart showing pattern data update processing in the computer virus check method according to the prior art. By adding the pattern data, the process of step I1 is performed. In step I1, the added pattern data is acquired by storing the added pattern data in the main memory, and the process proceeds to step I2. In step I2, the CPU determines whether or not the acquired pattern data matches the pattern data stored in the fixed disk that is an auxiliary storage device inside the computer. If they match, the CPU proceeds to step I4. If not, go to step I3. In step I3, the acquired pattern data is stored in the fixed disk, and the process proceeds to step I4. In step I4, the CPU determines whether or not all pattern data has been acquired. If it is determined that the pattern data has been acquired, the process proceeds to step I5. If it is determined that it has not been acquired, the CPU returns to step I1. In step I5, the CPU resets the virus check flag and ends the pattern data update process.

  Therefore, the computer virus check method of the prior art is configured to reset the virus check flag when the pattern data is updated. Therefore, using the updated pattern data, all data in the computer is checked. Check for viruses. For this reason, if the pattern data is frequently updated, the time for checking for virus infection increases, and the load on the information processing apparatus does not decrease.

  An object of the present invention is to provide a computer virus detection method having a low load on an information processing device, a program for executing the detection method, a recording medium storing the program, and a computer virus detection device.

The present invention relates to a computer virus detection method for detecting whether internal data stored in an information processing apparatus includes a computer virus using virus check data.
A first flag corresponding to each of the internal data is set, and the first flag is set for the internal data detected as not including a computer virus based on a detection result of whether or not the computer virus is included. Aside,
When updating the virus check data, the pre-update virus check data stored from before the update and the newly stored additional virus check data are stored in a distinguishable manner,
In the internal data in which the first flag is not set, detection of whether or not a computer virus is included using the pre-update virus check data and the additional virus check data is performed,
In the computer virus detection method, the internal data in which the first flag is set is detected using the additional virus check data to determine whether or not a computer virus is included.

  In the present invention, when the virus check data is updated, updated virus check data including the additional virus check data is newly stored, and the additional virus check data is extracted from the updated virus check data. And

  The present invention is characterized in that, prior to executing data processing using the internal data, detection is performed as to whether or not the internal data used for the data processing includes a computer virus.

According to the present invention, a second flag corresponding to each of the internal data is set, and based on a result of detecting whether or not a computer virus is included using the additional virus check data, it is detected that the computer virus is not included. The second flag is set for the internal data that has been
The data processing is executed without detecting whether the internal data in which the second flag is set includes a computer virus.

  According to the present invention, the data processing is processing for reading the internal data to the outside of the information processing apparatus.

  Further, the present invention is characterized by detecting whether or not the internal data includes a computer virus in accordance with an instruction from a user.

Further, the present invention detects a processing occupancy ratio that is a ratio of a currently executed processing amount to a maximum processing amount that can be executed by the information processing apparatus,
Based on the detected processing occupancy, it is detected whether the internal data includes a computer virus.

  The present invention is also a program for causing an information processing apparatus to execute the computer virus detection method.

  The present invention is also a storage medium readable by an information processing apparatus in which the program is recorded.

Further, the present invention provides a computer virus detection device that detects whether internal data stored in an information processing device includes a computer virus using virus check data.
Storage means for storing a first flag corresponding to each of the virus check data, the internal data, and the internal data;
Flag setting means for setting the first flag for the internal data detected as not containing a computer virus using the virus check data;
When updating the virus check data, storage control means for storing the pre-update virus check data stored from before the update and the newly stored additional virus check data in the storage means in a distinguishable manner,
The internal data in which the first flag is not set is detected by using the pre-update virus check data and the additional virus check data to determine whether or not a computer virus is included, and the first flag is set. The internal virus data includes a detection unit that detects whether or not a computer virus is included using the additional virus check data.

  According to the present invention, there is provided a computer virus detection method for detecting whether or not internal data stored in an information processing apparatus includes a computer virus using virus check data. This computer virus detection method sets a first flag corresponding to each internal data, and detects internal data that does not contain a computer virus based on the detection result of whether or not it contains a computer virus. The first flag is set, and when the virus check data is updated, the pre-update virus check data stored before the update and the newly stored additional virus check data are stored so as to be distinguishable.

  Then, the internal data in which the first flag is not set is detected by using the pre-update virus check data and the additional virus check data to determine whether or not a computer virus is included, and the first flag is set. For internal data, detection of whether or not a computer virus is included is performed using additional virus check data.

  Therefore, this computer virus detection method uses the pre-update virus check data after updating the virus check data, and detects the pre-update virus check data and internal data that is not detected as not containing a computer virus. Performs detection of whether or not a computer virus is included using both virus check data in the additional virus check data, but for internal data detected as not including a computer virus using pre-update virus check data In this case, only the additional virus check data is used to detect whether or not a computer virus is included.

  By doing so, every time the virus check data is updated, all the internal data will be detected using both virus check data to detect whether it contains a computer virus. Even if it is not confirmed, it can be confirmed that all internal data does not contain a computer virus, and the load on the information processing apparatus can be reduced.

  According to the present invention, when the virus check data is updated, the updated virus check data including the additional virus check data is newly stored, and the additional virus check data is extracted from the updated virus check data. By doing so, the additional virus check data can be stored in a distinguishable manner from the pre-update virus check data, so whether or not all internal data includes a computer virus using the updated virus check data. Even if detection is not performed, it is possible to detect whether or not a computer virus is included using only the additional virus check data. Therefore, the load on the information processing apparatus can be reduced.

  In addition, according to the present invention, detection of whether or not internal data used for data processing includes a computer virus is performed before executing data processing using the internal data. By doing so, it is possible to reliably prevent data processing using internal data including a computer virus without increasing the load on the information processing apparatus.

  Further, according to the present invention, the second flag corresponding to each internal data is set, and it is detected that the computer virus is not included based on the result of detecting whether or not the computer virus is included using the additional virus check data. The second flag is set for the internal data. Then, data processing is executed on the internal data in which the second flag is set without detecting whether or not a computer virus is included.

  Internal data detected using such additional virus check data as not containing a computer virus has been confirmed not to contain a computer virus, so detection of whether or not it contains a computer virus is performed. Data processing can be executed without Therefore, the load on the information processing apparatus can be further reduced.

  In addition, according to the present invention, the data processing is processing for reading internal data to the outside of the information processing apparatus, so that data including a computer virus can be read to the outside of the information processing apparatus without increasing the load on the information processing apparatus. It can be surely prevented.

  According to the present invention, since it is detected whether or not the internal data contains a computer virus in accordance with an instruction from the user, it is necessary to detect whether or not the internal data contains a computer virus. Can determine whether the internal data contains a computer virus.

  Further, according to the present invention, a processing occupancy ratio that is a ratio of a currently executed processing amount to a maximum processing amount that can be executed by the information processing apparatus is detected, and based on the detected processing occupancy rate, internal data is stored in a computer Performs detection of whether or not it contains a virus. By doing so, when the amount of processing executed by the information processing device is small, for example, it is possible to detect whether or not internal data contains a computer virus during the CPU idle time. The load can be further reduced.

  According to the present invention, a computer virus detection method is provided as a program for causing an information processing apparatus to execute the method. This makes it possible to use the computer virus detection method described above for general purposes.

  According to the invention, the computer virus detection method is supplied as a computer-readable recording medium on which a program for causing an information processing apparatus to execute is recorded. Thus, the information processing apparatus can easily execute the computer virus detection method described above.

  According to the present invention, there is also provided a computer virus detection device that uses virus check data to detect whether or not internal data stored in the information processing device includes a computer virus. This computer virus detection device has storage means for storing virus check data, internal data, and first flags respectively corresponding to the internal data, and does not contain a computer virus using the virus check data by the flag setting means. The first flag is set for the detected internal data, and when the virus check data is updated by the storage control means, the pre-update virus check data stored before the update is newly stored. The virus check data is stored in the storage means in a distinguishable manner.

  The detection means detects whether or not the internal data for which the first flag is not set includes a computer virus using the pre-update virus check data and the additional virus check data, and the first flag is The set internal data is subjected to detection of whether or not it contains a computer virus using the additional virus check data.

  Therefore, after the virus check data is updated, the detection means of this computer virus detection device uses the pre-update virus check data for internal data that has not been detected as not containing a computer virus. Uses virus check data for both virus check data and additional virus check data to detect whether a computer virus is included, but uses pre-update virus check data to detect that it does not contain a computer virus For internal data, only the additional virus check data is used to detect whether a computer virus is included.

  By doing so, every time the virus check data is updated, all the internal data will be detected using both virus check data to detect whether it contains a computer virus. You can be sure that all internal data does not contain a computer virus without having to check that it is not. Therefore, this computer virus detection device can realize a reduction in load for detecting whether or not a computer virus is included.

  Embodiments according to the present invention will be described below. The present invention provides information for performing information processing such as browsing web pages published on the Internet, sending and receiving e-mails, displaying images, creating documents with document creation software, and summing up numerical data with spreadsheet software. It can be used for a general personal computer which is a processing apparatus. The computer virus detection method according to the present invention uses virus check data such as pattern data to determine whether internal data such as program data, image data, numerical data, and character data used for information processing includes a computer virus. Detection (hereinafter referred to as virus check).

  FIG. 1 is a block diagram showing an electrical configuration of a computer 10 that executes a computer virus detection method. The computer 10 includes a CPU 11, a fixed disk 12, a main storage means 13, and the like, and a peripheral device 14 is connected thereto. The peripheral device 14 includes a communication unit 15, an external disk 16, an input unit 17, and an output unit 18.

  The computer 10 is a general personal computer as described above, and is a device in which a virus check program for executing a virus check can be installed. The CPU 11 controls the entire computer 10 and executes information processing or the like for the internal data stored in the fixed disk 12 and the main storage unit 13 and the external data stored in the external disk 16. The fixed disk 12 is an auxiliary storage device that stores internal data, and is realized by a hard disk device or the like. Further, the fixed disk 12 stores a first flag and a second flag respectively corresponding to the internal data. The main storage means 13 can directly read from and write to the CPU 11 and can call and store data and programs necessary for information processing from the fixed disk 12 and the external disk 16. The fixed disk 12 and the main storage means 13 are in the computer 10 and correspond to storage means.

  The communication means 15 transmits / receives information to / from an external information processing apparatus according to a communication control procedure. The communication means 15 has a function of reading virus check data from an external information processing apparatus connected to the Internet, and is realized by a network card such as a LAN (Local Area Network) board, a LAN card, and a modem device. The external disk 16 is an auxiliary storage device that stores data such as a program for causing the computer 10 to execute the above data processing, virus check data, and internal data, and is realized by an FD, a CD, a DVD, or the like. The input unit 17 inputs predetermined information by a user operation and is realized by a keyboard or the like. The output unit 18 displays characters and the like input by the input unit 17 and is realized by an LCD (Liquid Crystal Display) or the like.

  Further, when updating the virus check data, the CPU 11 performs a storage control process for storing the pre-update virus check data stored before the update and the newly stored additional virus check data in the fixed disk 12 in a distinguishable manner. Execute. The CPU 11 sets the first flag and uses additional virus check data for internal data (hereinafter referred to as pre-update check data) that is detected not to contain a computer virus using the pre-update virus check data. Then, a flag setting process for setting the second flag is executed for the internal data that is detected not to contain the computer virus (hereinafter referred to as post-update checked data). The CPU 11 executes the virus check using the pre-update virus check data and the additional virus check data for the internal data for which the first flag is not set, and adds to the internal data for which the first flag is set. Perform virus checks using virus check data. The storage control process, the flag setting process, and the detection process are all executed by the CPU 11, and the storage control means, the flag setting means, and the detection means correspond to the CPU 11.

  As described above, the computer 10 is controlled by the CPU 11 as follows. After the virus check data has been updated, for the internal data that has not been virus checked using the pre-update virus check data (hereinafter referred to as unchecked data), the virus check data before update and the additional virus check data Run virus checks using both virus check data. For the data that has been checked before update, virus check is executed using only the additional virus check data. Furthermore, virus check is not performed on the updated data after update.

  Therefore, every time you update virus check data, you do not need to run a virus check on both internal data using both virus check data to make sure that it does not contain a computer virus. Since it can be confirmed that all internal data does not contain a computer virus, it is possible to realize a reduction in the load for executing the virus check.

  Note that a computer virus is a program that enters an information processing apparatus such as a computer to make the screen display random, display meaningless words, or destroy files stored on a disk. Computer viruses are included in data downloaded from the Internet and data stored in auxiliary storage means such as a floppy (registered trademark) disk. By storing such data including a computer virus in the fixed disk 12 or the like in the information processing apparatus, the data including the computer virus exists in the information processing apparatus such as a computer.

  Next, an installation process for installing a virus check program for causing the computer 10 to execute a virus check and a data update process for updating virus check data used when executing the virus check will be described.

  FIG. 2 is a flowchart showing the installation process, and FIG. 3 is a diagram showing an example of the data list 21 stored in the fixed disk 12. As shown in FIG. 3, in the data list 21 stored in the fixed disk 12, a file name 22 indicating internal data and a first flag 23 and a second flag 24 corresponding to the internal data are set.

  When the CPU 11 recognizes an instruction to start the installation process from the user, the process of step A1 is performed. In step A1, the virus check program read from the external disk 16 or the virus check program downloaded by the communication means 15 is written in the fixed disk 12, and the process proceeds to step A2. In step A2, the data list shown in FIG. 3 is created, and the process proceeds to step A3. In step A3, the first check flag 23 is reset, and the process proceeds to step A4. In step A4, the second check flag 24 is reset and the installation process is terminated. The computer 10 in which the virus check program is installed is set so that when the computer 10 is started, the virus check program is automatically started and the virus check program is made resident.

  FIG. 4 is a flowchart showing virus check data update processing, and FIG. 5 shows a database for storing virus check data. As shown in FIG. 5, an additional database 31 that can store additional virus check data and a pre-update database 32 that can store pre-update virus check data are set in the fixed disk 12.

  When the CPU 11 recognizes the virus check data update instruction, the process of step B1 is performed. The virus check data update instruction may be an instruction from the user or an instruction of the CPU 11 itself based on the virus check program. The instructions from the user include an instruction to read virus check data stored in the external disk 16 and an instruction to download virus check data by the communication unit 15. The instruction of the CPU 11 itself is an instruction at a preset timing such as when the computer 10 is activated.

  In step B1, the virus check data stored in the additional database 31 shown in FIG. 5 is stored in the pre-update database 32, and the process proceeds to step B2. In step B2, the initialization process of the additional database 31 for deleting the virus check data stored in the additional database 31 is performed, and the process proceeds to step B3.

  In step B3, the virus check data read from the external disk 16 and the virus check data after update such as virus check data downloaded by the communication means 15 are stored in the main storage means 13, thereby obtaining the virus check data after update. The process proceeds to step B4. In step B4, the CPU 11 determines whether or not the acquired updated virus check data matches the virus check data stored in the pre-update database 32. If they match, the CPU 11 returns to step B3 and must match. If so, the process proceeds to step B5.

  In step B5, the obtained updated virus check data is stored in the additional database 31, and the process proceeds to step B6. In step B6, the CPU 11 determines whether or not all post-update virus check data has been acquired. If it is determined that the virus check data has not been acquired, the process returns to step B3. Proceed to B7. In step B7, a flag operation process described later is performed, and the virus check data update process is terminated.

  When virus check data is updated as described above, additional virus check data can be stored separately from pre-update virus check data.

  Further, in the data update process immediately after the installation process, all the updated virus check data is stored in the additional database 31.

  FIG. 6 is a flowchart showing the flag operation process. When the flag operation process is started, the process of step C1 is performed. In step C1, one of the internal data stored in the fixed disk 12 is extracted to the main storage means 13, and the process proceeds to step C2. In step C2, the CPU 11 determines whether or not the second flag corresponding to the extracted internal data is set. If it is determined that the second flag is set, the CPU 11 proceeds to step C3 and is determined not to be set. If so, the process proceeds to Step C5.

  In step C3, the second flag corresponding to the extracted internal data is reset, and the process proceeds to step C4. In step C4, the first flag corresponding to the extracted internal data is set, and the process proceeds to step C6. In step C4, the first flag corresponding to the extracted internal data is reset, and the process proceeds to step C6.

  In step C6, the CPU 11 determines whether or not all internal data stored in the fixed disk 12 has been extracted. If it is determined that it has not been extracted, the CPU 11 returns to step C1 and determines that it has been extracted. Then, the flag operation process is terminated.

  When performing virus check, before performing data processing such as reading outside the computer 10 with internal data and writing to the computer 10, performing virus check on data used for data processing, and the computer 10 Virus checks may be performed on all internal data stored in. Therefore, there are two types of data for executing the virus check: data used for data processing and internal data.

  Hereinafter, a virus check process for executing a virus check on data used for data processing before executing data processing using internal data will be described. FIG. 7 is a flowchart illustrating an example of virus check processing.

  When the CPU 11 confirms the data processing instruction from the user, the process of step D1 is performed. In step D1, the CPU 11 determines whether or not the data used for this data processing is internal data depending on whether or not the same file name as the data used for data processing exists in the file name 22 shown in FIG. Determine whether. If it is determined that the data used for data processing is internal data, the process proceeds to step D2, and if it is determined not to be internal data, the process proceeds to step D5.

  In step D2, the CPU 11 determines whether or not the second flag corresponding to the data as shown in FIG. 3 is set (“completed”) or not (“not yet”). It is determined whether the data is checked. If it is determined that the updated data has been checked, the process proceeds to step D8, and if it is determined that the data has not been updated, the process proceeds to step D3.

  In step D3, the CPU 11 determines whether the first flag corresponding to the data as shown in FIG. 3 is set (“completed”) or not (“not yet”). It is determined whether the data is checked or not. If it is determined that the data has been checked before update, the process proceeds to step D6, and if it is determined that the data is unchecked, the process proceeds to step D4.

  In step D4, the second flag is set and the process proceeds to step D5. In step D5, a virus check using the pre-update virus check data is executed, and the process proceeds to step D7. In step D6, the second flag is set and the process proceeds to step D7. In step D7, the virus check is executed using the additional virus check data, and the process proceeds to step D8.

  In step D8, a data deletion process described later is executed, and the process proceeds to step D9. In step D9, data processing described later is executed, and the process proceeds to step D10. In step D10, the CPU 11 determines whether virus check has been performed on all data used for data processing, based on whether all the second flags corresponding to the data used for data processing are set. If it is determined that virus check has not been executed for all data, the process returns to step D1, and if it is determined that virus check has been executed, the virus check process is terminated.

  As described above, virus checking is performed on data used for data processing before data processing is executed. By doing so, it is possible to reliably prevent data processing using data including a computer virus without increasing the load on the computer 10.

  FIG. 8 is a flowchart showing data deletion processing. When the data deletion process is started, the process of step E1 is performed. In step E1, the CPU 11 determines whether or not the data includes a computer virus based on the detection result of the virus check. If it is determined that the data includes a computer virus, the CPU 11 proceeds to step E2 and proceeds to the computer. If it is determined that the data does not contain a virus, the data deletion process is terminated.

  In step E2, the CPU 11 determines whether the data to be deleted is internal data. If it is determined that the data is not internal data, the process proceeds to step E5. If it is determined that the data is internal data, the process proceeds to step E3. . In step E3, the data is deleted from the fixed disk 12, and the process proceeds to step E4. In step E4, the data after the deleted data is shifted and stored in the data list as shown in FIG. 3, and the data deletion process is terminated. In step E5, the data is deleted and the data deletion process is terminated.

  In the data processing, data processing is performed using data that has not been deleted by the data deletion processing. Data processing includes, for example, reading processing for reading internal data to the outside of the computer 10 and writing processing for writing external data to the computer 10. The reading process is a process of uploading internal data by the communication means 15 and a process of reading internal data to the external disk 16. The writing process is a process of downloading external data by the communication means 15 and a process of writing external data stored in the external disk 16 to the fixed disk 12. Write processing will be described as an example of data processing.

  FIG. 9 is a flowchart showing a writing process for writing external data to the fixed disk 12. When data processing that is writing processing is started, processing in step F1 is performed. In step F1, it is searched whether the file name of the data to be written to the fixed disk 12 is the same as the file name 22 in the data list shown in FIG. 3, and the process proceeds to step F2. In step F2, if the CPU 11 determines from the search result that the same file name as the data to be written exists in the data list, the process of writing the data is terminated. If it is determined that there is no file name, the process proceeds to step F3. In step F3, the data to be written is stored in the fixed disk 12 so as to be inserted at the head of the data list, and the process proceeds to step F4. In step F4, the first flag corresponding to the written internal data is set, and the process proceeds to step F5. In step F5, the second flag corresponding to the written internal data is set, and the writing process is terminated.

  Hereinafter, a computer virus detection method for executing a virus check on all internal data stored in the computer 10 will be described. FIG. 10 is a flowchart illustrating an example of virus check processing.

  When the computer 10 is activated, the process of step G1 is performed. In step G1, the CPU 11 stands by until there is an instruction to start virus checking processing. If there is an instruction, the process proceeds to step G2. The instruction to start virus check may be an instruction from the user or an instruction of the CPU 11 itself. The CPU 11 itself indicates that the CPU 11 detects a processing occupancy ratio that is the ratio of the currently executed processing amount to the maximum processing amount that can be executed by the computer 10, and the CPU 11 performs the instruction by itself based on the detected processing occupancy rate. Instructions. Specifically, when the processing occupancy rate is low so as not to affect other information processing, so-called virus check processing is started during the CPU 11 idle time.

  In step G2, the CPU 11 determines whether or not the second flag corresponding to the data as shown in FIG. 3 is set (“completed”) or not (“not yet”). It is determined whether the data is checked. If it is determined that the data has been checked after the update, the process proceeds to step G8. If it is determined that the data has not been checked after the update, the process proceeds to step G3.

  In step G3, the CPU 11 determines whether the first flag corresponding to the data as shown in FIG. 3 is set (“completed”) or not (“not yet”). It is determined whether the data is checked or not. If it is determined that the data has been checked before update, the process proceeds to step G6, and if it is determined to be unchecked data, the process proceeds to step G4.

  In step G4, the second flag is set, and the process proceeds to step G5. In step G5, virus check is executed using the pre-update virus check data, and the process proceeds to step G7. In Step G6, the second flag is set and the process proceeds to Step G7. In step G7, a virus check is executed using the additional virus check data, and the process proceeds to step G8.

  In step G8, a data deletion process described later is executed, and the process proceeds to step G9. In step G9, the CPU 11 determines whether or not virus checking has been performed on all internal data depending on whether or not all the second flags corresponding to the internal data are set. If it is determined that the virus check has not been executed for all internal data, the process returns to step G1, and if it is determined that the virus check has been executed, the virus check process is terminated.

  As described above, when the user determines that it is necessary to detect whether or not the data includes a computer virus, it is possible to detect whether or not the internal data includes a computer virus. In addition, when the amount of processing executed by the information processing apparatus is small, for example, it is possible to detect whether or not the internal data includes a computer virus during the CPU idle time, so that the load on the information processing apparatus is further increased. Can be reduced.

  In the above embodiment, the computer is described as the information processing apparatus. However, the present invention may be applied to a portable information terminal such as a cellular phone.

  Further, the present invention may be a program for causing an information processing apparatus to execute the above-described computer virus detection method. This makes it possible to use the computer virus detection method described above for general purposes. Furthermore, the present invention can also be applied to a computer-readable recording medium that records this program. Thus, the information processing apparatus can easily execute the computer virus detection method described above.

It is a block diagram which shows the electric constitution of the computer 10 which performs the detection method of a computer virus. It is a flowchart which shows an installation process. 4 is a diagram showing an example of a data list 21 stored in a fixed disk 12. FIG. It is a flowchart which shows a virus check data update process. The database which memorize | stores virus check data is shown. It is a flowchart which shows flag operation processing. It is a flowchart which shows an example of a virus check process. It is a flowchart which shows a data deletion process. 4 is a flowchart showing a writing process for writing external data to a fixed disk 12. It is a flowchart which shows an example of a virus check process. It is a flowchart which shows the read-out process of the data in the check method of the computer virus which is a prior art. It is a figure which shows the example of the data list 41 inside a computer in the check method of the computer virus which is a prior art. It is a flowchart which shows the pattern data update process in the check method of the computer virus which is a prior art.

Explanation of symbols

10 Computer 11 CPU
12 fixed disk 13 main storage means 14 peripheral device 15 communication means 16 external disk 17 input means 18 output means 21, 41 data list 22, 42 file name 23 first flag 24 second flag 31 additional database 32 database before update 43 virus check flag

Claims (10)

In a computer virus detection method for detecting whether internal data stored in an information processing device includes a computer virus using virus check data,
A first flag corresponding to each of the internal data is set, and the first flag is set for the internal data detected as not including a computer virus based on a detection result of whether or not the computer virus is included. Aside,
When updating the virus check data, the pre-update virus check data stored from before the update and the newly stored additional virus check data are stored in a distinguishable manner,
In the internal data in which the first flag is not set, detection of whether or not a computer virus is included using the pre-update virus check data and the additional virus check data is performed,
A computer virus detection method, wherein the internal data in which the first flag is set uses the additional virus check data to detect whether or not a computer virus is included.   The updated virus check data including the additional virus check data is newly stored when the virus check data is updated, and the additional virus check data is extracted from the updated virus check data. The detection method of the computer virus as described.   3. The computer virus according to claim 1, wherein detection of whether or not the internal data used for the data processing includes a computer virus is performed before executing the data processing using the internal data. Detection method. The internal data detected not to contain a computer virus based on the result of detecting whether or not it contains a computer virus by setting a second flag corresponding to each of the internal data and using the additional virus check data For the above, the second flag is set,
4. The computer virus detection method according to claim 3, wherein the data processing is executed without detecting whether or not the internal data in which the second flag is set includes a computer virus. .   5. The computer virus detection method according to claim 3, wherein the data processing is processing of reading the internal data to the outside of the information processing apparatus.   2. The computer virus detection method according to claim 1, wherein detection of whether or not the internal data includes a computer virus is executed according to an instruction from a user. Detecting a processing occupancy ratio that is a ratio of a currently executed processing amount to a maximum processing amount that can be executed by the information processing apparatus;
2. The computer virus detection method according to claim 1, wherein detection of whether or not the internal data includes a computer virus is executed based on the detected processing occupation rate.   The program for making an information processing apparatus perform the detection method of the computer virus in any one of Claims 1-7.   A storage medium readable by an information processing apparatus on which the program according to claim 8 is recorded. In a computer virus detection device that detects whether internal data stored in an information processing device includes a computer virus using virus check data,
Storage means for storing a first flag corresponding to each of the virus check data, the internal data, and the internal data;
Flag setting means for setting the first flag for the internal data detected as not containing a computer virus using the virus check data;
When updating the virus check data, storage control means for storing the pre-update virus check data stored from before the update and the newly stored additional virus check data in the storage means in a distinguishable manner,
The internal data in which the first flag is not set is detected by using the pre-update virus check data and the additional virus check data to determine whether or not a computer virus is included, and the first flag is set. The computer virus detection apparatus, wherein the internal data includes detection means for detecting whether or not a computer virus is included using the additional virus check data.

Images