CN106201032A - Processing method and device for modifying double-click interval time of mouse and electronic equipment - Google Patents
Processing method and device for modifying double-click interval time of mouse and electronic equipment Download PDFInfo
- Publication number
- CN106201032A CN106201032A CN201610552278.9A CN201610552278A CN106201032A CN 106201032 A CN106201032 A CN 106201032A CN 201610552278 A CN201610552278 A CN 201610552278A CN 106201032 A CN106201032 A CN 106201032A
- Authority
- CN
- China
- Prior art keywords
- software process
- function
- interval time
- mouse click
- amendment
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
- G06F3/01—Input arrangements or combined input and output arrangements for interaction between user and computer
- G06F3/03—Arrangements for converting the position or the displacement of a member into a coded form
- G06F3/033—Pointing devices displaced or positioned by the user, e.g. mice, trackballs, pens or joysticks; Accessories therefor
- G06F3/0354—Pointing devices displaced or positioned by the user, e.g. mice, trackballs, pens or joysticks; Accessories therefor with detection of 2D relative movements between the device, or an operating part thereof, and a plane or surface, e.g. 2D mice, trackballs, pens or pucks
- G06F3/03541—Mouse/trackball convertible devices, in which the same ball is used to track the 2D relative movement
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
- G06F3/01—Input arrangements or combined input and output arrangements for interaction between user and computer
- G06F3/03—Arrangements for converting the position or the displacement of a member into a coded form
- G06F3/033—Pointing devices displaced or positioned by the user, e.g. mice, trackballs, pens or joysticks; Accessories therefor
- G06F3/0354—Pointing devices displaced or positioned by the user, e.g. mice, trackballs, pens or joysticks; Accessories therefor with detection of 2D relative movements between the device, or an operating part thereof, and a plane or surface, e.g. 2D mice, trackballs, pens or pucks
- G06F3/03543—Mice or pucks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
- G06F3/01—Input arrangements or combined input and output arrangements for interaction between user and computer
- G06F3/03—Arrangements for converting the position or the displacement of a member into a coded form
- G06F3/033—Pointing devices displaced or positioned by the user, e.g. mice, trackballs, pens or joysticks; Accessories therefor
- G06F3/0362—Pointing devices displaced or positioned by the user, e.g. mice, trackballs, pens or joysticks; Accessories therefor with detection of 1D translations or rotations of an operating part of the device, e.g. scroll wheels, sliders, knobs, rollers or belts
Landscapes
- Engineering & Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Human Computer Interaction (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Debugging And Monitoring (AREA)
- User Interface Of Digital Computer (AREA)
Abstract
The invention discloses a processing method and device for modifying double-click interval time of a mouse and electronic equipment, and solves the problem that the prior art can not prevent malicious software from modifying the double-click interval time of the mouse, so that the system safety can not be effectively protected. The method comprises the following steps: detecting the behavior of calling a shutdown prohibition function by a software process; when the behavior that a software process calls a shutdown prohibition function is detected, acquiring a first function index number transmitted when the software process calls the shutdown prohibition function; judging whether the first function index number is the same as a second function index number of a kernel corresponding to the function of modifying the mouse double-click interval time; if not, calling a function for prohibiting shutdown to execute the operation corresponding to the first function index number, otherwise, judging whether the software process is a malicious software process; and if the process is the malicious software process, refusing to modify the mouse double-click interval time operation, and otherwise calling a shutdown forbidding function to execute the mouse double-click interval time modifying operation. The invention is suitable for processing the modification operation of the double-click interval time of the mouse.
Description
Technical field
The present invention relates to technical field of system security, particularly relate to a kind of process side revising double mouse click interval time
Method, device and electronic equipment.
Background technology
In computer systems, it is provided that have SetDoubleClickTime function, for arranging twice even by Mus for mouse
The time interval of mark key, system default double-press time interval is 500 milliseconds, and Malware can use the method change mouse
Double-clicking interval time, if double mouse click is set to 10 seconds interval time, such user operation mouse, 10 seconds press will be spaced
Key just calculates double-click, heavy damage user system environment.
At present, in order to prevent double mouse click to be not modified interval time, it is hook application layer under normal circumstances
SetDoubleClickTime function, SetDoubleClickTime function corresponding to the function of system kernel is
NtUserCallOneParam function.NtUserCallOneParam function is a public function, the function of a lot of application layers
The function of corresponding kernel is all it.NtUserCallOneParam function distinguishes different application layers with a feature index number
Function, rogue program can be by calling the NtUserCallOneParam function of kernel, incoming corresponding feature index number, comes
Amendment double mouse click interval time, such rogue program just can destruction of computer systems environment.
Therefore, the processing method of existing amendment double mouse click interval time, it is impossible to prevent Malware amendment mouse double
Hit interval time, cause security of system not to be effectively protected.
Summary of the invention
In view of this, the embodiment of the present invention provides a kind of and revises the processing method of double mouse click interval time, device and electricity
Subset, it is possible to prevent Malware amendment double mouse click interval time, thus effectively protect security of system.
First aspect, the embodiment of the present invention provides a kind of processing method revising double mouse click interval time, including:
Inspection software process calls the behavior forbidding shut-off function function；
When detecting that software process calls the behavior forbidding shut-off function function, obtain described software process and call taboo
The first only incoming during shut-off function function feature index number；
Judge the second merit of described feature index No. first and the amendment double mouse click corresponding kernel of power function interval time
Energy call number is the most identical；
If differing, then call and forbid that shut-off function function performs the operation corresponding with described feature index No. first,
Otherwise judge whether described software process is malicious software process；
If described software process is malicious software process, then refuse double mouse click operation interval time of modifying, otherwise
Call and forbid that shut-off function function performs amendment double mouse click operation interval time.
In conjunction with first aspect, in the first embodiment of first aspect, described amendment double mouse click merit interval time
Feature index No. second of energy function correspondence kernel is different under different systems.
In conjunction with first aspect, in the second embodiment of first aspect, described judge that whether described software process is
Malicious software process includes:
Obtain the characteristic information of described software process；
The characteristic information of described software process is inquired about in storage has the feature database of malicious software process characteristic information；
If the characteristic information of described software process can be inquired, then judge described software process as malicious software process, no
Then judge that described software process is not malicious software process.
In conjunction with the second embodiment of first aspect, in the third embodiment of first aspect, in described detection
Before software process calls the behavior forbidding shut-off function function, described method also includes:
Set up feature database, the characteristic information of the malicious software process got is stored in described feature database.
Second aspect, the embodiment of the present invention provides a kind of processing means revising double mouse click interval time, including:
Detector unit, calls the behavior forbidding shut-off function function for inspection software process；
Acquiring unit, for forbidding the behavior of shut-off function function when described detector unit detects that software process calls
Time, obtain described software process and call feature index No. the first incoming when forbidding shut-off function function；
First judging unit, is used for judging described feature index No. first and amendment double mouse click power function interval time
Feature index No. second of corresponding kernel is the most identical；
First processing unit, for when the judged result of described first judging unit is for differing, calls and forbids shutdown
Power function performs the operation corresponding with described feature index No. first；
Second judging unit, for when the judged result of described first judging unit is identical, it is judged that described software enters
Whether journey is malicious software process；
Second processing unit, is used for when described second judging unit judges described software process as malicious software process,
Refuse double mouse click operation interval time of modifying；
When described second judging unit, 3rd processing unit, for judging that described software process is not malicious software process
Time, call and forbid that shut-off function function performs amendment double mouse click operation interval time.
In conjunction with second aspect, in the first embodiment of second aspect, described amendment double mouse click merit interval time
Feature index No. second of energy function correspondence kernel is different under different systems.
In conjunction with second aspect, in the second embodiment of second aspect, described second judging unit includes:
Obtain subelement, for obtaining the characteristic information of described software process；
Inquiry subelement, inquires about described software process for having in the feature database of malicious software process characteristic information in storage
Characteristic information；
Judgment sub-unit, for when described inquiry subelement can inquire the characteristic information of described software process, it is determined that
Described software process is malicious software process, otherwise judges that described software process is not malicious software process.
In conjunction with the second embodiment of second aspect, in the third embodiment of second aspect, described device is also
Including:
Set up unit, for described detector unit inspection software process call forbid shut-off function function behavior it
Before, set up feature database, the characteristic information of the malicious software process got is stored in described feature database.
The third aspect, the embodiment of the present invention provides a kind of electronic equipment, and described electronic equipment includes: housing, processor, deposit
Reservoir, circuit board and power circuit, wherein, circuit board is placed in the interior volume that housing surrounds, processor and memorizer and arranges
On circuit boards；Power circuit, powers for each circuit or the device for above-mentioned electronic equipment；Memorizer is used for storing can be held
Line program code；Processor runs and executable program code pair by reading the executable program code of storage in memorizer
The program answered, for performing aforementioned arbitrary described processing method revising double mouse click interval time.
The a kind of of embodiment of the present invention offer revises the processing method of double mouse click interval time, device and electronic equipment,
When detecting that software process calls the behavior forbidding shut-off function function, obtain described software process call forbid shut down merit
Feature index No. the first incoming during energy function, it is judged that described feature index No. first and amendment double mouse click merit interval time
Can feature index No. the second of function correspondence kernel the most identical, if differing, then call forbid shut-off function function perform with
The operation that described feature index No. first is corresponding, otherwise judges whether described software process is malicious software process, if then
Refuse double mouse click operation interval time of modifying, otherwise call and forbid that shut-off function function performs amendment double mouse click interval
Time operation.Compared with prior art, the present invention can forbid, by the way of hook forbids shut-off function function, merit of shutting down
Can function perform before malicious software process revised by the way of kernel the behavior of double mouse click interval time intercept,
Prevent Malware amendment double mouse click interval time, thus effectively protect security of system.
Accompanying drawing explanation
In order to be illustrated more clearly that the embodiment of the present invention or technical scheme of the prior art, below will be to embodiment or existing
In having technology to describe, the required accompanying drawing used is briefly described, it should be apparent that, the accompanying drawing in describing below is only this
Some embodiments of invention, for those of ordinary skill in the art, on the premise of not paying creative work, it is also possible to
Other accompanying drawing is obtained according to these accompanying drawings.
Fig. 1 is the flow chart that the present invention revises the processing method embodiment one of double mouse click interval time；
Fig. 2 is the flow chart that the present invention revises the processing method embodiment two of double mouse click interval time；
Fig. 3 is the structural representation that the present invention revises the processing means embodiment one of double mouse click interval time；
Fig. 4 is the structural representation that the present invention revises the processing means embodiment two of double mouse click interval time；
Fig. 5 is the structural representation of electronic equipment embodiment of the present invention.
Detailed description of the invention
Below in conjunction with the accompanying drawings the embodiment of the present invention is described in detail.
It will be appreciated that described embodiment be only the present invention a part of embodiment rather than whole embodiments.Base
Embodiment in the present invention, those of ordinary skill in the art obtained under not making creative work premise all its
Its embodiment, broadly falls into the scope of protection of the invention.
In following various embodiments of the present invention, NtUserCallOneParam function for forbidding shut-off function function,
SetDoubleClickTime function is amendment double mouse click power function interval time.
Fig. 1 is the flow chart that the present invention revises the processing method embodiment one of double mouse click interval time, as it is shown in figure 1,
The method of the present embodiment may include that
Step S11, inspection software process call the behavior of NtUserCallOneParam function.
In the present embodiment, NtUserCallOneParam function is a public function of inner nuclear layer, a lot of application layers
The function of function correspondence kernel is all this NtUserCallOneParam function.
Step S12, when the behavior that software process calls NtUserCallOneParam function being detected, obtain described
Software process calls feature index No. the first incoming during NtUserCallOneParam function.
In the present embodiment, software process, can be to inner nuclear layer incoming first when calling NtUserCallOneParam function
Feature index number.
Specifically, aforesaid operations can be realized by Hook Function, this Hook Function and NtUserCallOneParam
Function is linked up with, and when having detected that software process calls NtUserCallOneParam function, is performing
Before NtUserCallOneParam function, this Hook Function obtains feature index No. the first of the incoming inner nuclear layer of software process.
Step S13, judge the second of described feature index No. first kernel corresponding with SetDoubleClickTime function
Feature index number is the most identical, if differing, then performs step S14, otherwise performs step S15.
In the present embodiment, described SetDoubleClickTime function is application layer function, the second function of corresponding kernel
Call number is different under different systems.Specifically, the second of described SetDoubleClickTime function correspondence kernel
Feature index number is 60 under XP system, is 63 under Win7 system, is 65, under Win8.1 system is under Win8 system
67, it is 69 under Win10 system.
Specifically, the process of step S13 can be realized by the Hook Function in step S12.
Step S14, call NtUserCallOneParam function and perform the behaviour corresponding with described feature index No. first
Make.
In the present embodiment, if the second of described feature index No. first kernel corresponding with SetDoubleClickTime function
Feature index number differs, and shows that operation that described software process is corresponding is not amendment double mouse click interval time, then can hold
The described software process of row.
Step S15, judge whether described software process is malicious software process, enter if described software process is Malware
Journey, then perform step S16, otherwise perform step S17.
In the present embodiment, Malware refers to perform the malice virus of task, anthelmintic and the journey of Trojan Horse in system
Sequence, implements to control to system by destroying software process.
Specifically, the process of step S17 can be realized by the Hook Function in step S12.
Step S16, refusal are modified operation double mouse click interval time.
In the present embodiment, if described software process is malicious software process, then perform amendment double mouse click behaviour's interval time
Security of system may be damaged by work, it is therefore desirable to intercepts this amendment double mouse click operation interval time, knot
Shu Benci operates.
Specifically, the process of step S17 can be realized by the Hook Function in step S12.
Step S17, call NtUserCallOneParam function and perform amendment operation double mouse click interval time.
In the present embodiment, if described software process is not malicious software process, then show the amendment that this software process is corresponding
Double mouse click operation interval time is normal operating, and this amendment double mouse click operation interval time can be allowed to carry out.
Specifically, the process of step S17 can be realized by the Hook Function in step S12.
The present embodiment, when the behavior that software process calls NtUserCallOneParam function being detected, obtains institute
State software process and call feature index No. the first incoming during NtUserCallOneParam function, it is judged that described first function
Feature index No. second of call number kernel corresponding with SetDoubleClickTime function is the most identical, if differing, then adjusts
Perform the operation corresponding with described feature index No. first with NtUserCallOneParam function, otherwise judge described software
Whether process is malicious software process, if then refusing double mouse click operation interval time of modifying, otherwise calls
NtUserCallOneParam function performs amendment double mouse click operation interval time.Compared with prior art, the present invention can
By the way of hook NtUserCallOneParam function, soft to malice before NtUserCallOneParam function performs
Part process is revised the behavior of double mouse click interval time by the way of kernel and is intercepted, and prevents Malware amendment mouse double
Hit interval time, thus effectively protect security of system.
Fig. 2 is the flow chart that the present invention revises the processing method embodiment two of double mouse click interval time, as in figure 2 it is shown,
The method of the present embodiment may include that
Step S21, set up feature database, the characteristic information of the malicious software process got is stored in described feature database
In.
In the present embodiment, feature database can be set up according to the malicious software process that fail-safe software in system monitors, by
The characteristic information of the malicious software process monitored is stored in described feature database, or, it is soft that user can manually add malice
In the characteristic information of part process extremely described feature database.Wherein, the characteristic information of software process can be characterized code, and each software enters
Journey has unique condition code.
Further, it is also possible to according to the real-time monitoring situation of fail-safe software, described feature database is updated.
Step S22, inspection software process call the behavior of NtUserCallOneParam function.
In the present embodiment, inspection software process calls the process of the behavior of NtUserCallOneParam function and above-mentioned side
Step S11 of method embodiment is similar to, and here is omitted.
Step S23, when the behavior that software process calls NtUserCallOneParam function being detected, obtain described
Software process calls feature index No. the first incoming during NtUserCallOneParam function.
In the present embodiment, obtain described software process and call the first merit incoming during NtUserCallOneParam function
The process of energy call number is similar with step S12 of said method embodiment, and here is omitted.
Step S24, judge the second of described feature index No. first kernel corresponding with SetDoubleClickTime function
Feature index number is the most identical, if differing, then performs step S25, otherwise performs step S26 and step S27.
In the present embodiment, it is judged that the of described feature index No. first kernel corresponding with SetDoubleClickTime function
The process that feature indexs No. two are the most identical is similar with step S13 of said method embodiment, and here is omitted.
Step S25, call NtUserCallOneParam function and perform the behaviour corresponding with described feature index No. first
Make.
In the present embodiment, call NtUserCallOneParam function and perform corresponding with described feature index No. first
The process of operation is similar with step S14 of said method embodiment, and here is omitted.
Step S26, obtain the characteristic information of described software process.
In the present embodiment, the characteristic information of described software process can be characterized code, and each software process has uniquely
Condition code.
Specifically, the process of step S26 can be realized by the Hook Function in step S12.
Step S27, in storage has the feature database of malicious software process characteristic information, inquire about the feature of described software process
Information, if the characteristic information of described software process can be inquired, then judges that described software process, as malicious software process, performs step
Rapid S28, otherwise judges that described software process is not malicious software process, performs step S29.
In the present embodiment, Malware refers to perform the malice virus of task, anthelmintic and the journey of Trojan Horse in system
Sequence, implements to control to system by destroying software process.
Specifically, the process of step S27 can be realized by the Hook Function in step S12.
Step S28, refusal are modified operation double mouse click interval time.
In the present embodiment, refusal is modified the process of operation double mouse click interval time and the step of said method embodiment
Rapid S16 is similar to, and here is omitted.
Step S29, call NtUserCallOneParam function and perform amendment operation double mouse click interval time.
In the present embodiment, call NtUserCallOneParam function and perform the mistake of amendment double mouse click operation interval time
Journey is similar with step S17 of said method embodiment, and here is omitted.
The present embodiment, when the behavior that software process calls NtUserCallOneParam function being detected, obtains institute
State software process and call feature index No. the first incoming during NtUserCallOneParam function, it is judged that described first function
Feature index No. second of call number kernel corresponding with SetDoubleClickTime function is the most identical, if differing, then adjusts
Perform the operation corresponding with described feature index No. first with NtUserCallOneParam function, otherwise have malice in storage
The feature database of software process characteristic information is inquired about the characteristic information of described software process to judge that whether described software process is
Malicious software process, if then refusing double mouse click operation interval time of modifying, otherwise calls
NtUserCallOneParam function performs amendment double mouse click operation interval time.Compared with prior art, the present invention can
By the way of hook NtUserCallOneParam function, soft to malice before NtUserCallOneParam function performs
Part process is revised the behavior of double mouse click interval time by the way of kernel and is intercepted, and prevents Malware amendment mouse double
Hit interval time, thus effectively protect security of system.
Fig. 3 is the structural representation that the present invention revises the processing means embodiment one of double mouse click interval time, such as Fig. 3 institute
Showing, the device of the present embodiment may include that detector unit 11, acquiring unit the 12, first judging unit the 13, first processing unit
14, second judging unit the 15, second processing unit the 16, the 3rd processing unit 17, wherein, detector unit 11, for inspection software
Process calls the behavior of NtUserCallOneParam function；Acquiring unit 12, for having detected when described detector unit 11
When software process calls the behavior of NtUserCallOneParam function, obtain described software process and call
Feature index No. the first incoming during NtUserCallOneParam function；First judging unit 13, is used for judging described
Feature index No. second of feature index No. one kernel corresponding with SetDoubleClickTime function is the most identical；First processes
Unit 14, for when the judged result of described first judging unit 13 is for differing, calls NtUserCallOneParam letter
Number performs the operation corresponding with described feature index No. first；Second judging unit 15, for when described first judging unit
When the judged result of 13 is identical, it is judged that whether described software process is malicious software process；Second processing unit 16, for working as
When described second judging unit 15 judges described software process as malicious software process, refusal modify double mouse click interval time
Between operate；When described second judging unit 15,3rd processing unit 17, for judging that described software process is not that Malware enters
Cheng Shi, calls NtUserCallOneParam function and performs amendment double mouse click operation interval time.
The device of the present embodiment, may be used for performing the technical scheme of embodiment of the method shown in Fig. 1, and it realizes principle and skill
Art effect is similar to, and here is omitted.
Further, feature index No. the second of described SetDoubleClickTime function correspondence kernel different is
Under system different.
Further, feature index No. the second of described SetDoubleClickTime function correspondence kernel is under XP system
It is 60, is 63 under Win7 system, be 65 under Win8 system, be 67 under Win8.1 system, be 69 under Win10 system.
Fig. 4 is the structural representation that the present invention revises the processing means embodiment two of double mouse click interval time, such as Fig. 4 institute
Showing, the device of the present embodiment is on the basis of Fig. 3 shown device structure, and further, described second judging unit 15 includes:
Obtain subelement 151, for obtaining the characteristic information of described software process；
Inquiry subelement 152, inquires about described software for having in the feature database of malicious software process characteristic information in storage
The characteristic information of process；
Judgment sub-unit 153, for inquiring the characteristic information of described software process when described inquiry subelement 152
Time, it is determined that described software process is malicious software process, otherwise judges that described software process is not malicious software process.
Further, described device also includes:
Set up unit 18, for calling NtUserCallOneParam function in described detector unit 11 inspection software process
Behavior before, set up feature database, the characteristic information of the malicious software process got be stored in described feature database.
The device of the present embodiment, may be used for performing the technical scheme of embodiment of the method shown in Fig. 1 or Fig. 2, and it realizes former
Managing similar with technique effect, here is omitted.
It should be noted that in this article, the relational terms of such as first and second or the like is used merely to a reality
Body or operation separate with another entity or operating space, and deposit between not necessarily requiring or imply these entities or operating
Relation or order in any this reality.And, term " includes ", " comprising " or its any other variant are intended to
Comprising of nonexcludability, so that include that the process of a series of key element, method, article or equipment not only include that those are wanted
Element, but also include other key elements being not expressly set out, or also include for this process, method, article or equipment
Intrinsic key element.In the case of there is no more restriction, statement " including ... " key element limited, it is not excluded that
Including process, method, article or the equipment of described key element there is also other identical element.
Each embodiment in this specification all uses relevant mode to describe, identical similar portion between each embodiment
Dividing and see mutually, what each embodiment stressed is the difference with other embodiments.
For device embodiment, owing to it is substantially similar to embodiment of the method, so the comparison described is simple
Single, relevant part sees the part of embodiment of the method and illustrates.
Represent in flow charts or the logic described otherwise above at this and/or step, for example, it is possible to be considered as to use
In the sequencing list of the executable instruction realizing logic function, may be embodied in any computer-readable medium, for
Instruction execution system, device or equipment (system such as computer based system, including processor or other can hold from instruction
Row system, device or equipment instruction fetch also perform the system instructed) use, or combine these instruction execution systems, device or set
Standby and use.For the purpose of this specification, " computer-readable medium " can be any can to comprise, store, communicate, propagate or pass
Defeated program is for instruction execution system, device or equipment or combines these instruction execution systems, device or equipment and the dress that uses
Put.The more specifically example (non-exhaustive list) of computer-readable medium includes following: have the electricity of one or more wiring
Connecting portion (electronic installation), portable computer diskette box (magnetic device), random access memory (RAM), read only memory
(ROM), erasable read only memory (EPROM or flash memory), the fiber device edited, and portable optic disk is read-only deposits
Reservoir (CDROM).It addition, computer-readable medium can even is that and can print the paper of described program thereon or other are suitable
Medium, because then can carry out editing, interpreting or if desired with it such as by paper or other media are carried out optical scanning
His suitable method is processed to electronically obtain described program, is then stored in computer storage.
Should be appreciated that each several part of the present invention can realize by hardware, software, firmware or combinations thereof.
In the above-described embodiment, multiple steps or method can be with storing in memory and by suitably instructing execution
Software or firmware that system performs realize.Such as, if realized with hardware, with the most the same, available
Any one or their combination in following technology well known in the art realize: have for data signal realizes logic merit
The discrete logic of the logic gates of energy, has the special IC of suitable combination logic gate circuit, programmable gate
Array (PGA), field programmable gate array (FPGA) etc..
The embodiment of the present invention also provides for a kind of electronic equipment, and described electronic equipment comprises described in aforementioned any embodiment
Device.
Fig. 5 is the structural representation of electronic equipment embodiment of the present invention, it is possible to achieve implement shown in Fig. 1 or Fig. 2 of the present invention
The flow process of example, as it is shown in figure 5, above-mentioned electronic equipment may include that housing 31, processor 32, memorizer 33, circuit board 34 and electricity
Source circuit 35, wherein, circuit board 34 is placed in the interior volume that housing 31 surrounds, processor 32 and memorizer 33 and is arranged on circuit
On plate 34；Power circuit 35, powers for each circuit or the device for above-mentioned electronic equipment；Memorizer 33 is used for storing can be held
Line program code；Processor 32 runs and executable program generation by reading the executable program code of storage in memorizer 33
The program that code is corresponding, for performing aforementioned arbitrary described processing method revising double mouse click interval time.
Processor 32 to concrete process and the processor 32 of performing of above-mentioned steps by running executable program code
The step performed further, may refer to the description of Fig. 1 of the present invention or embodiment illustrated in fig. 2, does not repeats them here.
This electronic equipment exists in a variety of forms, includes but not limited to:
(1) mobile communication equipment: the feature of this kind equipment is to possess mobile communication function, and to provide speech, data
Communication is main target.This Terminal Type includes: smart mobile phone (such as iPhone), multimedia handset, functional mobile phone, and low
End mobile phone etc..
(2) super mobile personal computer equipment: this kind equipment belongs to the category of personal computer, has calculating and processes merit
Can, the most also possess mobile Internet access characteristic.This Terminal Type includes: PDA, MID and UMPC equipment etc., such as iPad.
(3) portable entertainment device: this kind equipment can show and play content of multimedia.This kind equipment includes: audio frequency,
Video player (such as iPod), handheld device, e-book, and intelligent toy and portable car-mounted navigator.
(4) server: providing the equipment of the service of calculating, the composition of server includes that processor, hard disk, internal memory, system are total
Lines etc., server is similar with general computer architecture, but owing to needing to provide highly reliable service, is therefore processing energy
The aspects such as power, stability, reliability, safety, extensibility, manageability require higher.
(5) other have the electronic equipment of data interaction function.
Those skilled in the art are appreciated that and realize all or part of step that above-described embodiment method is carried
Suddenly the program that can be by completes to instruct relevant hardware, and described program can be stored in a kind of computer-readable storage medium
In matter, this program upon execution, including one or a combination set of the step of embodiment of the method.
For convenience of description, describing apparatus above is to be divided into various units/modules to be respectively described with function.Certainly, exist
Implement the function of each unit/module to be realized in same or multiple softwares and/or hardware during the present invention.
As seen through the above description of the embodiments, those skilled in the art it can be understood that to the present invention can
The mode adding required general hardware platform by software realizes.Based on such understanding, technical scheme essence
On the part that in other words prior art contributed can embody with the form of software product, this computer software product
Can be stored in storage medium, such as ROM/RAM, magnetic disc, CD etc., including some instructions with so that a computer equipment
(can be personal computer, server, or the network equipment etc.) performs some of each embodiment of the present invention or embodiment
Method described in part.
Claims (9)
1. the processing method revising double mouse click interval time, it is characterised in that including:
Inspection software process calls the behavior forbidding shut-off function function；
When detecting that software process calls the behavior forbidding shut-off function function, obtain described software process call forbid close
Feature index No. the first incoming during machine power function；
Judge the second function rope of described feature index No. first and the amendment double mouse click corresponding kernel of power function interval time
Quotation marks are the most identical；
If differing, then call and forbid that shut-off function function performs the operation corresponding with described feature index No. first, otherwise
Judge whether described software process is malicious software process；
If described software process is malicious software process, then refuses double mouse click operation interval time of modifying, otherwise call
Forbid that shut-off function function performs amendment double mouse click operation interval time.
The processing method of amendment the most according to claim 1 double mouse click interval time, it is characterised in that described amendment Mus
Feature index No. the second that mark double-clicks power function correspondence kernel interval time is different under different systems.
The processing method of amendment the most according to claim 1 double mouse click interval time, it is characterised in that described judgement institute
State whether software process is that malicious software process includes:
Obtain the characteristic information of described software process；
The characteristic information of described software process is inquired about in storage has the feature database of malicious software process characteristic information；
If the characteristic information of described software process can be inquired, then judge that described software process, as malicious software process, is otherwise sentenced
Fixed described software process is not malicious software process.
The processing method of amendment the most according to claim 3 double mouse click interval time, it is characterised in that in described detection
Before software process calls the behavior forbidding shut-off function function, described method also includes:
Set up feature database, the characteristic information of the malicious software process got is stored in described feature database.
5. the processing means revising double mouse click interval time, it is characterised in that including:
Detector unit, calls the behavior forbidding shut-off function function for inspection software process；
Acquiring unit, is used for when described detector unit detects that software process calls the behavior forbidding shut-off function function,
Obtain described software process and call feature index No. the first incoming when forbidding shut-off function function；
First judging unit, is used for judging that described feature index No. first is corresponding with amendment double mouse click power function interval time
Feature index No. second of kernel is the most identical；
First processing unit, for when the judged result of described first judging unit is for differing, calls and forbids shut-off function
Function performs the operation corresponding with described feature index No. first；
Second judging unit, for when the judged result of described first judging unit is identical, it is judged that described software process is
No for malicious software process；
Second processing unit, for when described second judging unit judges described software process as malicious software process, refuses
Double mouse click of modifying operates interval time；
3rd processing unit, for when described second judging unit judges that described software process is not malicious software process, adjusting
With forbidding that shut-off function function performs amendment double mouse click operation interval time.
The processing means of amendment the most according to claim 5 double mouse click interval time, it is characterised in that described amendment Mus
Feature index No. the second that mark double-clicks power function correspondence kernel interval time is different under different systems.
The processing means of amendment the most according to claim 5 double mouse click interval time, it is characterised in that described second sentences
Disconnected unit includes:
Obtain subelement, for obtaining the characteristic information of described software process；
Inquiry subelement, for there being the spy inquiring about described software process in the feature database of malicious software process characteristic information in storage
Reference ceases；
Judgment sub-unit, for when described inquiry subelement can inquire the characteristic information of described software process, it is determined that described
Software process is malicious software process, otherwise judges that described software process is not malicious software process.
The processing means of amendment the most according to claim 7 double mouse click interval time, it is characterised in that described device is also
Including:
Set up unit, before call the behavior forbidding shut-off function function in described detector unit inspection software process, build
Vertical feature database, is stored in the characteristic information of the malicious software process got in described feature database.
9. an electronic equipment, it is characterised in that described electronic equipment includes: housing, processor, memorizer, circuit board and electricity
Source circuit, wherein, circuit board is placed in the interior volume that housing surrounds, processor and memorizer and arranges on circuit boards；Power supply
Circuit, powers for each circuit or the device for above-mentioned electronic equipment；Memorizer is used for storing executable program code；Process
Device runs the program corresponding with executable program code by reading the executable program code of storage in memorizer, is used for holding
The processing method revising double mouse click interval time described in the aforementioned any claim 1-4 of row.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610552278.9A CN106201032B (en) | 2016-07-13 | 2016-07-13 | Modify processing method, device and the electronic equipment of double click interval time |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610552278.9A CN106201032B (en) | 2016-07-13 | 2016-07-13 | Modify processing method, device and the electronic equipment of double click interval time |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106201032A true CN106201032A (en) | 2016-12-07 |
| CN106201032B CN106201032B (en) | 2019-04-30 |
Family
ID=57476742
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610552278.9A Active CN106201032B (en) | 2016-07-13 | 2016-07-13 | Modify processing method, device and the electronic equipment of double click interval time |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106201032B (en) |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101414341A (en) * | 2007-10-15 | 2009-04-22 | 北京瑞星国际软件有限公司 | Software self-protection method |
| CN102457474A (en) * | 2010-10-21 | 2012-05-16 | 镇江金软计算机科技有限责任公司 | Method for managing logs of lessee of software-as-a-service (SaaS) application software |
-
2016
- 2016-07-13 CN CN201610552278.9A patent/CN106201032B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101414341A (en) * | 2007-10-15 | 2009-04-22 | 北京瑞星国际软件有限公司 | Software self-protection method |
| CN102457474A (en) * | 2010-10-21 | 2012-05-16 | 镇江金软计算机科技有限责任公司 | Method for managing logs of lessee of software-as-a-service (SaaS) application software |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106201032B (en) | 2019-04-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104680084A (en) | Method and system for protecting user privacy in computer | |
| CN106201468A (en) | Screen capture processing method and device and electronic equipment | |
| CN106127031A (en) | Method and device for protecting process and electronic equipment | |
| CN105871795A (en) | Internet surfing control method and related device | |
| CN104008337A (en) | Active defense method and device based on Linux system | |
| CN106169047A (en) | Method and device for opening monitoring camera and electronic equipment | |
| CN106203092A (en) | Method and device for intercepting shutdown of malicious program and electronic equipment | |
| CN114065204A (en) | File-free Trojan horse searching and killing method and device | |
| CN106203119A (en) | Processing method and device for hiding cursor and electronic equipment | |
| CN106022117A (en) | Method and device for preventing system environment variable from being modified and electronic equipment | |
| CN106126282A (en) | Injection method and device for dynamic link library file and terminal equipment | |
| CN106126291A (en) | Method and device for deleting malicious file and electronic equipment | |
| Williams et al. | Beyond Huawei and TikTok: Untangling US concerns over Chinese tech companies and digital security | |
| CN105868625B (en) | Method and device for intercepting restart deletion of file | |
| CN106203114A (en) | Application program protection method and device and electronic equipment | |
| CN109784051A (en) | Protecting information safety method, device and equipment | |
| CN106203115A (en) | Application program protection method and device and electronic equipment | |
| CN103455767A (en) | System and method for multi-network safety isolation | |
| CN106022109A (en) | Method and device for preventing thread from being suspended and electronic equipment | |
| CN106201032A (en) | Processing method and device for modifying double-click interval time of mouse and electronic equipment | |
| CN105956475A (en) | DLL file interception processing method and device and electronic equipment | |
| CN106022111B (en) | Processing method and device for hiding pop-up window and electronic equipment | |
| CN101706852A (en) | Online game password protecting device and method thereof | |
| CN106203118A (en) | Processing method and device for modifying flicker time of insertion mark and electronic equipment | |
| CN106127051A (en) | Method and device for preventing mouse from being maliciously captured and electronic equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20190124 Address after: 519031 Room 105-53811, No. 6 Baohua Road, Hengqin New District, Zhuhai City, Guangdong Province Applicant after: Zhuhai Leopard Technology Co.,Ltd. Address before: 100085 East District, No. 33 Xiaoying West Road, Haidian District, Beijing Applicant before: BEIJING KINGSOFT INTERNET SECURITY SOFTWARE Co.,Ltd. |
|
| GR01 | Patent grant | ||
| GR01 | Patent grant |