JP2003216445A - Checking method of computer virus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a virus checking method not giving large load to a hardware on which the virus check is performed, by using the database of computer virus. <P>SOLUTION: A check flag is attached to the data of a file on which the virus check has been performed in the first time, by using a data list stored in a FAT, and the virus check is performed only on the data of the file free from the check flag in the second time. When the virus checked-data is rewritten, the flag is eliminated to perform the virus check. Further the virus check may be performed by storing the data from the data of new time stamp indicating the file updating date. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a computer virus check method, and more particularly, to a computer virus check method that enables a computer virus check by reducing the load on hardware.

[0002]

2. Description of the Related Art In recent years, new computer viruses have been discovered every day. Virus vaccine software is usually used for such computer virus inspection. As a main virus inspection method using virus vaccine software, a unique code is taken out from a computer virus to make it a database, a pattern matching method that compares the data to be inspected with the data to be inspected, and it seems to be illegal when the program is executed Two types of methods are known, a rule-based method for determining whether or not processing is being performed.

The above-described pattern matching method uses a unique code of a computer virus as a database, so that the database becomes larger as the number of new computer viruses increases, and the comparison time increases accordingly.

Further, the rule-based method may be a legitimate process even if it seems to be fraudulent, and even if it can be detected, the type of virus cannot be specified. Therefore, the computer virus can be eliminated. It cannot be done.

As a conventional technique relating to the virus check as described above, for example, Japanese Unexamined Patent Publication Nos. 8-44556, 9-319574, and 10-11.
The technology described in Japanese Patent No. 283 is known. The technique disclosed in Japanese Patent Laid-Open No. 8-44556 does not consider the efficiency of virus checking. Further, those disclosed in Japanese Patent Laid-Open Nos. 9-319574 and 10-112183 are those in which a virus vaccine program is incorporated in hardware.

[0006]

DISCLOSURE OF THE INVENTION Problems to be Solved by the Invention
In order to detect the invasion of computer viruses, a pattern matching method is used, and reading and writing of memory and storage devices and execution of programs are compared with computer virus databases.

Therefore, the above-mentioned conventional technique requires a huge computer virus database in order to cope with computer viruses that are discovered every day, and the processing load on the hardware becomes large. There is a problem that it ends up.

An object of the present invention is to solve the above-mentioned problems of the prior art and to provide a virus checking method which does not impose a heavy load on hardware for checking a virus using a computer virus database. is there.

[0009]

According to the present invention, the above-mentioned object is a computer virus check method for confirming whether or not the data inside the computer is infected with a computer virus. Performs on internal data, confirms that the data inside the computer is not infected by a computer virus, and then checks whether the data read from outside the computer is infected by a computer virus. It is achieved by

Further, the purpose is to check the infection of the virus inside the computer for each file data, and for the uninfected file data, perform the next virus check when the data of the file is changed. This is also achieved by checking the virus infection from the new file data of the time stamp.

[0011]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the virus checking method according to the present invention will be described below in detail with reference to the drawings.

FIG. 1 is a diagram for explaining a monitoring place where a virus vaccine program installed in a computer is monitoring, FIG. 2 is a flow chart for explaining a monitoring processing operation by the virus vaccine program, and FIG. FIG. 4 is a diagram for explaining the order of virus check, FIG. 4 is a diagram for explaining the order of file virus check according to the embodiment of the present invention, and FIG. 5 is a file virus check according to the embodiment of the present invention. It is a figure explaining another example of the order in a case. In FIG. 1, 10 is a computer, 11 is a main storage device, 12 is a central processing unit, 13
Is an auxiliary storage device (fixed disk), and 14 is an external input device. First, a basic concept of a virus checking method according to an embodiment of the present invention will be described with reference to FIGS.

In general, the computer 10 is, as shown in FIG. 1, a main storage device 11, a central processing unit 12, an auxiliary storage device such as a fixed disk (hereinafter referred to as a fixed disk) 1
3, an external input device 14 such as an auxiliary storage device using a removable medium such as an FD or a CD, an input device, and a communication unit for the Internet is connected to the computer 10. The virus vaccine program is usually stored in the fixed disk 13, and the main storage device 1 is used when virus check processing is performed.
1 and is used by the central processing unit 12. Further, the virus vaccine program may be transferred from the external input / output device 14 to the main storage device 11.

In the above description, the central processing unit 12 is fixed to a computer such as a personal computer and reads out data from the fixed disk 13 which is not directly written from other storage devices in the computer other than the main storage device 11 shown in the figure. A virus check is performed when writing and processing are performed, and the main storage device 11 and the inside of the computer are monitored. Further, the central processing unit 12 is an FD or a CD that allows data to be rewritten between a plurality of computers.
A secondary storage device (removable), etc., an input device, an external input / output device 14 such as the Internet, performs a virus check when reading, writing, and executing processing of data in the main storage device 11, and monitors the outside of the computer. .

Next, the operation of the virus monitoring process will be described with reference to the flow shown in FIG.

First, the data read in step S201 is checked for viruses in step S202. If there is no computer virus intrusion, the data is processed in step S203. Also, step S20
When the invasion of the computer virus is detected by the virus check of 2, the computer virus is dealt with in step S204, that is, the process of exterminating the virus, deleting the data, and recovering the normal data is performed.

As described above, the process of step S202 is added to the computer 10 in which the virus vaccine program is installed. Since this processing is always performed regardless of the infection of the data by the computer virus, the hardware such as the central processing unit 12 is loaded.

In the above description, the fixed disk 1 shown in FIG.
If it can be confirmed that the data existing inside 3 is not infected by the computer virus, then it is not necessary to monitor the fixed disk 13 until new data is written from the outside, and the hardware The load can be reduced. Moreover, in order to confirm that the computer virus is not infected, the central processing unit 1
By performing the virus check by using the idle time of the second CPU, it is possible to prevent the load from being applied to the hardware. The embodiment of the present invention is designed to reduce the hardware load for virus checking based on the concept described above.

On the other hand, the virus check is usually FAT.
Each file is checked for viruses in the order registered in the (File Allocation Table). With such a checking method, as shown in FIG. 3, each file is subjected to the virus check in the same order between the first virus check and the second virus check, and the checking efficiency is low.

Therefore, in the embodiment of the present invention, as shown in FIG. 4, the data list of the FAT is used, and the data of the file that has been virus-checked for the first time is attached with a flag of checked and the data for the second time is added. Attempts to perform a virus check efficiently by avoiding duplication of virus check processing by performing a virus check only on the data of a file that does not have the above-mentioned flag. Also, when the data that has been virus-checked is rewritten, the flag is removed and virus-checking is performed. In the case of the example shown in FIG.
File A to File C in the first virus check
Up to the second virus check,
It is shown that the file A and the files D and E that have been updated in the meantime have been checked.

Further, in the embodiment of the present invention, as shown in FIG. 5, the virus check is performed by sorting from the new data of the time stamp indicating the file update date and time. In general, data with a new timestamp is likely to be infected by a computer virus, so
By performing the checks in the order as described above, the virus can be checked more efficiently and in a short time. In the example shown in FIG. 5, the order of checking the FAT is specified so that each file is sorted by the time stamp and a data virus check with a new time stamp is performed. As a result, the virus check is performed from the most recently rewritten data.

FIG. 6 is a flow chart for explaining the processing operation for installing the virus vaccine program, and FIG.
6 is a diagram showing an example of a data list in the fixed disk 13 created in the process of step S602 of FIG. 6, and FIG.
FIG. 18 is a diagram showing an example of a data list sorted by the processing of step S603, FIG. 18 is a diagram showing an example of the data list in which the maximum value of the counter is set by the processing of step S604 of FIG. 6, and FIG. 20 is a diagram showing an example of a data list in which the flag is reset in the process of step S605, FIG.
FIG. 7 is a diagram showing an example of a data list whose counters are initialized by the processing of step S606 in FIG. Hereinafter, FIG.
The processing operation for installing the virus vaccine program will be described with reference to the flow chart shown in FIG. 6 while referring to the example of the data list shown in FIG.

(1) First, the virus vaccine program is written in the fixed disk 13 and installed. Next, a data list in the fixed disk 13 is created. The data list created here is, as shown in FIG.
File name, time stamp by its update date, flag indicating whether virus check was performed, multiple records with search order, maximum counter value indicating the number of records, and counter value counting the number of check processing files (Steps S601 and S60
2).

(2) Next, the data list created in step S602 is sorted in ascending order of time stamps. As a result, in the data list shown in FIG. 16, as shown in FIG. 17, the records are rearranged in the order of newest time stamps, and the search order is determined accordingly (step S603).

(3) Next, the total number of files whose file names are stored in the data list is set to the maximum counter value. As a result, the data list shown in FIG.
As shown in FIG. 8, the total number of files, “5” in the illustrated example, is stored in the counter maximum value column in the data list (step S604).

(4) Next, the virus check flag (hereinafter referred to as a flag) in the data list is reset.
As a result, in the data list shown in FIG. 18, as shown in FIG. 19, nothing is stored in the flag column in the record of each file in the data list (step S60).
5).

(5) Next, "1" is set to the value of the counter in the data list. As a result, the data list shown in FIG. 19 is in a state in which the value of the counter in the data list is set to “1” as shown in FIG. 20 (step S606).

(6) Next, when the OS of the computer is started, the settings of the OS are changed so that the virus vaccine program can be automatically started, and when data is read, written, or deleted, and when the CPU is run. The virus vaccine program is made resident so that the virus check can be performed by interrupting the free time (steps S607 and 608).

FIG. 7 is a flow chart for explaining a virus check processing operation by interruption of a virus vaccine program when data is read.
This will be described next.

(1) When the data reading process is started, first, it is judged whether or not the data reading is from the fixed disk. If the data reading is from the fixed disk, all the data in the fixed disk are read. Whether or not the virus check is completed is determined by whether or not the value of the counter in the data list is the maximum value (step S
701, 702).

(2) If it is determined in step S702 that the counter value has not reached the maximum value and all virus checks in the fixed disk have not been completed, a flag is set in the data file to be read. Then, it is determined whether the virus check on the data is completed (step S703).

(3) If it is determined in step S703 that the virus check for the data to be read has not been completed, a flag is set for that data file in the data list and a virus check is performed by the virus vaccine program to interrupt. The process ends (steps S704 and 705).

(4) If it is determined in step S702 that all viruses in the fixed disk have been checked,
Alternatively, if it is determined in step S703 that the flag is set in the data file to be read and the virus check for that data has been completed, the interrupt process here is terminated without doing anything.

(5) If it is determined in step S701 that the data read is not from the fixed disk, that is, if the data is read from the external input / output device 14, the data is checked for viruses. Since it has not been performed, the data from the external input / output device 14 is checked, and the interrupt processing here is ended (step S705).

FIG. 8 is a flow chart for explaining the virus check processing operation by interruption of the virus vaccine program when data is written.
This will be described next.

(1) When the data writing process is started, first, it is judged whether or not the data writing is writing to the fixed disk, and if it is writing to the fixed disk, the flow shown in FIG. 9 is used. Registration processing to the data list described in detail is performed (steps S801 and S802).

(2) Next, the virus check flag is set in the record of the data registered in the data list, the virus check is performed on the written data by the virus vaccine program, and the interrupt processing is terminated (step S803). , S804).

(3) If it is determined in step S801 that the data writing is not writing to the fixed disk, that is, if the data writing (transmitting) to the external input / output device 14, the external input / output device Data is checked to 14 and the interrupt processing here is ended (step S804).

FIG. 9 is a flow chart for explaining the data list registration processing operation of step S802 in the flow shown in FIG. 8, which will be described next.

(1) First, the data list search index i is initialized to "1", and the information of the data to be written and the information of the data list are compared. If they do not match, the data list search index i and the data are compared. The maximum counter value in the list is compared (steps S901 to S90).
3).

(2) In the comparison in step S903, if the data list search index i and the data list counter maximum value do not match, step S90 is performed for i obtained by adding 1 to the data list search index i.
The processing from 2 is repeated (step S904).

(3) If the data list search index i matches the maximum value of the counter in the data list in the comparison in step S903, the data to be written is new data and the information is not yet registered in the data list. Since it does not exist, the information of the data to be newly written is added to the information of the data list by the data list addition processing described in detail in the flow shown in FIG. 10 and the processing here ends (step S905).

(4) In the comparison in step S902, when the information of the data to be written and the information of the data list match, the written data is the update of the data in the fixed disk and the overwriting data. The record corresponding to the data in the data list described in detail by the flow shown in FIG. 10 is deleted, and the process shown in FIG. 10 for adding a new record to the data list is performed, and the process here ends (step S906, S907).

FIG. 10 is a flow chart for explaining the processing operation of adding data to the data list in steps S905 and S907 in the flow shown in FIG. 9, and this will be described next.

First, data information is inserted at the beginning of the data list, the maximum value of the counter is incremented (steps S1001 and S1002), the counter is further incremented, and the data flag is reset (steps S1003 and S1004). Then, the processing here is finished.

FIG. 11 is a flow chart for explaining the operation of the data deletion process, which will be described next.

When the data deletion processing is started, it is judged whether or not the data deletion is the data deletion of the fixed disk (step SS1101). If the data deletion of the fixed disk is shown in FIG. The data list deletion process described in detail in the flow is executed (step SS110).
2) Then, the processing here is finished. If the data deletion is not the fixed disk deletion, the process ends without doing anything.

FIG. 12 shows step S906 in the flow shown in FIG. 9 and step S1 in the flow shown in FIG.
10 is a flowchart illustrating a process of deleting data information of the data list 102, which will be described next.

First, data information is deleted from the data list (step S1201), and the data after the deleted data is shifted by one (step S1202). Then, the maximum value of the counter is decremented (step S
1203) and the process ends.

FIG. 13 shows the CP when the idle time of the CPU is monitored.
It is a flowchart explaining the process which performs a virus check of a fixed disk in U free time, and this is demonstrated next.

(1) First, it is determined whether or not the virus check has been completed for all the data files in the fixed disk, based on whether or not the counter in the data list has the maximum value (step S1301). .

(2) If it is determined in step S1301 that the virus check has not been completed for all the data files in the fixed disk, it is determined whether or not the CPU is idle, and the CPU is idle. In this case, the fixed disk is checked for viruses, which will be described in detail with reference to the flow shown in FIG.

(3) If it is determined in step S1301 that the virus check has been completed for all the data files in the fixed disk, then step S130
In the case of No. 2, if the CPU is not idle, the process is terminated without doing anything.

FIG. 14 is a flow chart for explaining the execution of the virus check on the data file in the fixed disk. Next, this will be explained.

(1) It is checked whether or not a flag is set in the record indicated by the counter in the data list, and whether or not the data has been virus checked. If the flag is set, it means that the virus has been checked, so without checking the virus,
The process ends (step S1401).

(2) If it is determined in step S1401 that the flag is not set, the virus check is not performed. Therefore, the data of the data list indicated by the counter is read and the read data is checked for virus (step S1401). S1402, S1403).

(3) After the virus check is completed, the virus-checked flag is set in the record of the data list corresponding to the data, and the counter is incremented for the virus check on the next data in the data list. The process ends (step S140).
2, S1403).

FIG. 15 is a flow chart for explaining the process of updating the virus vaccine program to the latest database and virus search engine. Next, this will be described. This process is arbitrarily executed according to the scheduler and the instruction of the user.

(1) First, a database is acquired using the Internet or a medium, and a virus search engine is acquired using the Internet or a medium (steps S1501 and S1502).

(2) The acquired database is compared with the current database, it is determined whether the acquired database is newer than the current database, and if new, the database is updated to the acquired database (steps S1503, S1504). .

(3) After the processing of step S1504 or in the determination of step S1503, if the acquired database is older than or the same as the current database, the acquired virus search engine and the current virus search engine are compared. If the acquired virus search engine is newer than the current virus search engine, the virus search engine is updated to the acquired virus search engine (steps S1505 and S1506).

(4) After the processing of step S1506, or in the determination of step S1505, if the acquired virus search engine is older than or the same as the current virus engine, is the database or virus search engine updated? It is determined whether or not the update has not been performed, and the processing here is ended (step 150).
7).

(5) If it is determined in step S1507 that the database and the virus search engine have been updated, the counter value is set to "1" so that the virus check is performed by the updated virus program.
The flags of all the data in the data list are reset, and the process ends (steps S1508 and S1509).

Although the above-described embodiment of the present invention has been described as performing a virus check at the time of accessing a file, other accesses can be dealt with by a conventional technique.

Further, each processing according to the above-described embodiment of the present invention can be configured as a processing program, and this processing program is HD, DAT, FD, MO, DV.
It can be provided by being stored in a recording medium such as a D-ROM or a CD-ROM.

[0066]

As described above, according to the present invention, it is possible to reduce the load on the hardware for virus checking by the virus vaccine program, and
Since the virus check is performed from the data that may be infected by the computer virus, the computer virus can be efficiently detected.

[Brief description of drawings]

FIG. 1 is a diagram illustrating a monitoring place where a virus vaccine program installed in a computer monitors.

FIG. 2 is a flowchart illustrating a monitoring processing operation by a virus vaccine program.

FIG. 3 is a diagram illustrating an order in which a virus check of a file is performed according to a conventional technique.

FIG. 4 is a diagram illustrating an order in which a file virus check is performed according to an embodiment of the present invention.

FIG. 5 is a diagram illustrating another example of the order in the case of performing a virus check on a file according to the embodiment of the present invention.

FIG. 6 is a flowchart illustrating a processing operation of installing a virus vaccine program.

FIG. 7 is a flowchart illustrating a virus check processing operation by interruption of a virus vaccine program when data is read.

FIG. 8 is a flowchart illustrating a virus check processing operation by interruption of a virus vaccine program when data is written.

FIG. 9 is a flowchart illustrating a data list registration processing operation in the flow shown in FIG. 8;

10 is a flowchart illustrating a processing operation of adding data to a data list in the flow illustrated in FIG.

FIG. 11 is a flowchart illustrating an operation of data deletion processing.

FIG. 12 is a flowchart illustrating a process of deleting data information of a data list in the flows shown in FIGS. 9 and 11.

FIG. 13 is a flowchart illustrating a process of monitoring a free time of a CPU and executing a virus check of a fixed disk in the free time of the CPU.

FIG. 14 is a flowchart illustrating execution of a virus check on a data file in a fixed disk.

FIG. 15 is a flowchart illustrating a process of updating a virus vaccine program to the latest database and virus search engine.

16 is a diagram showing an example of a data list in a fixed disk created in the process of step SS602 of FIG.

17 is a diagram showing an example of a data list sorted by the process of step SS603 of FIG.

FIG. 18 is a diagram showing an example of a data list in which the maximum value of the counter is set in the process of step SS604 of FIG.

FIG. 19 is a diagram showing an example of a data list in which a flag is reset in the process of step S605 of FIG.

20 is a diagram showing an example of a data list in which a counter is initialized by the process of step SS606 of FIG.

[Explanation of symbols]

10 computers 11 main memory 12 Central processing unit 13 Auxiliary storage device (fixed disk) 14 External input / output device

Claims (3)

[Claims] 1. A computer virus check method for confirming whether or not data inside a computer is infected with a computer virus, wherein the data inside the computer is checked for virus infection. The method for checking computer viruses is characterized by confirming that the computer virus has not been infected, and then checking whether the data read from outside the computer is infected with computer virus. 2. A computer virus check method for confirming whether or not the data inside the computer is infected with a computer virus, wherein the virus infection inside the computer is checked for each file data, and the file is not infected. Regarding the data, when the data of the file is changed, the next virus check is performed, and the computer virus check method. 3. The computer virus check method according to claim 1, wherein the virus infection check for each file data is performed from the file data with a new time stamp.