JP4622523B2 - File search program and file search method - Google Patents

Description

  The present invention relates to a file search program and a file search method for efficiently executing a search for an actual file stored in a storage device when a virus scan is performed in a computer device such as a personal computer.

  In a computer device such as a personal computer, a virus search in the system is performed at regular intervals assuming the occurrence of a new virus, etc., but the number of files to be stored stored in the storage device is enormous. Due to time constraints, it is often necessary to interrupt the search before finishing the search of all files. In general, the search order of a file by virus scanning software is executed according to a fixed order in ascending or descending order of initial characters of the file name (for example, Patent Document 1).

However, if the search according to the regularity such as the conventional name order is assumed to be interrupted for a certain period of time, after that, when restarting the interrupted search, the search is repeated for all files from the beginning, In addition, since a certain search order is taken, the same file is always preferentially searched, which is a very inefficient way.
JP 2003-216445 A

  Therefore, in the present invention, in order to solve the above-described problem, the search order of the files stored in the storage device is randomly created, the search state is recorded when the virus scan is temporarily suspended, and again when the scan is resumed. It is an object of the present invention to provide a file search program and a file search method in which a search is performed within a certain distributed range even when interruption is repeated by re-setting the search order.

  A first invention is a file search program for scanning a plurality of files stored in a storage device with a virus. The computer searches the computer for initials from a character string representing a file name of the plurality of files to be scanned by the virus scan. A search order creation step for creating a search order table by arranging the search order at random, and a search execution step for executing a search for a plurality of files according to the search order of the search order table created in the search order creation step, When the virus scan being executed in the search execution step is temporarily suspended, a state recording step for recording the search state as a work in the search order table, and then when the virus scan is resumed, the search order The search order for files in process in the table is first. And re-setting step for subsequently has become not completed the search order of the file to find initial sort randomly again, about the file search program for execution.

  That is, according to the first invention, the search order creation means extracts the initial (first character) from the file name subject to virus scanning, and creates a search order table in which the search order is randomly ranked for the initials. Then, the search execution means scans the ordered initial files in the search order table in order, and when the status recording means suspends the virus scan temporarily, the file that was in the process of processing is used as a device. When the search status is recorded in the search order table and then the interrupted virus scan is resumed, the resetting means refers to the search status of the search order table and preferentially selects the file in progress as 1 Secondly, the initials that are not yet searched are randomly sorted and reset. Airu search program is configured.

  As a result, for users who have a large number of files in the storage device of their own computer device, files that were in the middle of processing are first searched for virus scans that had to be interrupted because it took too much time, Since the search files that follow are provided in a random order, the inefficiency caused by the files being always searched in a certain order can be avoided, and the benefits of using virus scanning at any time can be achieved. Come.

  The second invention relates to the file search program according to the first invention, wherein the search order in the search order creation step is determined by a code of the first two bytes for the initial of the file name.

  That is, according to the second invention, the file name initial is a byte code, and the search order of the file is determined by the code of the first 2 bytes, so that the search efficiency can be improved. It will provide an environment for high-speed search without being affected by languages such as Japanese.

  The following effects can be expected from the present invention described above.

  First, for users who have a large number of files in the storage device of their computer device, files that were in the middle of processing are first searched for virus scans that have been too long and have to be interrupted. Since the search files that follow are provided in a random order, it is possible to avoid the inefficiency that the files are always searched in a fixed order, and the benefits of using virus scanning at any time come out. .

  Secondly, by using a mechanism that determines the file search order based on the code of the first two bytes of the file name, the search efficiency can be improved, and high-speed search can be performed without being affected by languages such as alphabet and Japanese. Environment.

  As described above, according to the present invention, since the virus search can be interrupted and resumed continuously, the search can be efficiently performed in a limited time, and the same file is not redundantly searched. The time required and the time for which the machine is restrained by the search are shortened.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a diagram showing a basic configuration of a file search system according to an embodiment of the present invention.

  A device that executes virus scanning is a computer device 1 that includes a CPU 2, a memory 3, and an auxiliary storage device 4. The auxiliary storage device 4 stores a file search program 10, a search order table 15, a virus scan program 20, and a virus definition file 21. When the virus scan is executed, the file search program 10 and the virus scan program 20 are loaded from the auxiliary storage device 4 into the memory 3, and these programs are executed by the CPU 2.

  The file search program 10 corresponds to a routine program for processing a file search in the virus scan program 20. Each of the search order creation means 11, search execution means 12, status recording means 13, and resetting means 14. And stored in advance in the auxiliary storage device 4 of the computer device 1, loaded into the memory 3 and executed by the CPU 2 at the time of virus scanning.

  A plurality of real files (hereinafter simply referred to as files) to be subjected to virus scanning are stored in an auxiliary storage device 4 represented by a hard disk (not shown).

  Note that these programs may be recorded in a computer-readable recording medium such as a flexible disk, a compact disk, and a ROM, and set in a built-in or externally connected medium reader and installed to be executable. .

  The virus scan program 20 is an application program supplied from a software manufacturer, and a virus definition file 21 that defines rules for scanning is received from a supplier via a network (not shown). It is always updated to the latest definition.

  FIG. 2 shows a data configuration example (when the first search is interrupted) of the search order table according to the embodiment of the present invention. The search order table 15 of this embodiment is composed of a plurality of records including items of a search target first character code 101, a search order 102, a last search date and time 103, a search state 104, and a previous last search file name 105.

  The search target first character code 101 represents the initial character (first character) extracted from the character string of the file name with a code of the first two bytes, thereby enabling a high-speed search of the initial part and an alphabetic character. , Japanese, etc., and language-independent searches are possible.

  In the search order 102, a numerical value obtained by randomly ranking the search order by applying a general prescription such as a random number table or a random number function in each search file is entered.

  Further, in each initial, the search completion date and time is added as information to the last search date and time 103, and the date and time of the last search is stamped.

  Further, in the search state 104, when the virus scan is interrupted, if the virus scan has already been completed, the search state is recorded as “complete”, and if it is in the process, it is recorded as “in process”.

  In the previous last search file name 105, the search file name that was “completed” or “in-process” at the time of the previous interruption is recorded.

  For example, in the first record, the search target first character code 101 is “3030”, the search rank 102 is “1”, the last search date 103 is “November 11, 2004 0:00, search state 104 Is “completed”, and “00ABCDE” is entered in the last final search file name 105.

  Note that the search completion date and time in the last search date and time 103 is based on the premise that every time a virus scan is performed, the file that has been cleared and stamped and the previous search is recorded is recorded. If this time is too long, “elapsed time from the interrupted search completion date and time” may be designated to cancel “completed” and set it as the target of the next virus scan as incomplete.

  FIG. 3 shows a data configuration example of the search order table according to the embodiment of the present invention (when the second search is resumed). The data structure of the search order table 15 is the same as the structure of FIG. 2, and the search order of the file in the search order 102 item is the search file in the “in-process” with the highest priority, and other virus scans are still in progress. For initial files that have not been completed, the search order is randomly sorted.

  That is, the file search order is the initial character order of random file names, the end state of the file search is stored for each initial character, and the search is performed from the initial file that has not been searched at the next restart. The incomplete characters of the search order file for specifying the order in which the file search is performed can be given more irregularity by randomly specifying the order every time.

  In addition, the search completion date and time is added as information corresponding to the first character code of each search target file, and next time the search is started from the initials after the date and time.

  FIG. 4 shows a flowchart at the start of file search according to the embodiment of the present invention. First, in step S11, initials are extracted from the character string of the file name of the virus scan target file stored in the storage device, and the initial search order table 15 is created.

  Next, in step S12, the search is executed in the order of the files corresponding to the initials based on the search order table created in the previous step. When the search is started, a mark indicating that the search is in progress is recorded in the search state of the target initial in the search order table in step S13.

  In step S14, it is determined whether or not all the files of the corresponding initial have been searched, and the process is repeated until all the files are completed. In step S15, a completion mark is recorded in the item indicating the search status of the search order designation file for the completion initial.

  In step S16, it is determined whether or not all initials in the search order table have been searched. If not, the process returns to step S13, and the subsequent processing steps are repeated until the search is completed.

  FIG. 5 shows a flowchart at the time of resuming the file search according to the embodiment of the present invention. First, in step S21, the search order table 15 of the auxiliary storage device 4 is referred to, and in step S22, a file that has been suspended in the previous search is detected.

  Next, in step S23, the initial file in process status in the search order table 15 is set to the first search order. In step S24, the search order in the search order table is processed, and reset processing is performed for files that have not been searched for other than completed.

  In step S25, the search is executed in the order of files corresponding to the initials in the search order table, and in step S26, a “work in progress” mark indicating that the search is in progress is recorded in the search status of the target initial in the search order table.

  In step S27, the process is repeated until all the initial files are searched. In step S28, a “complete” mark is recorded in the item indicating the search status of the search order designation file for the completion initial.

  In step S29, it is determined whether or not all initials have been searched. If the search has not been completed, the process returns to step S26, and the subsequent processing steps are repeated.

The embodiment of the present invention described above is shown in the following supplementary notes.
(Appendix 1)
A file search program for scanning a plurality of files stored in a storage device for viruses,
On the computer,
A search order creation step of extracting initials from the character strings representing the file names of the plurality of files to be searched for virus scanning, creating a search order table by randomly arranging the search order; and
A search execution step for executing a search for a plurality of files according to a search order of a search order table created in the search order creation step;
A state recording step of recording a search state as a device in the search order table when the virus scan being executed in the search execution step is temporarily suspended;
After that, when resuming virus scanning, the search order of the file in process in the search order table is ranked first, and the search order of the file to be subsequently searched is rearranged at random for the initials that have not been completed. A reconfiguration step;
File search program that executes
(Appendix 2)
The file search program according to appendix 1, wherein the search order in the search order creation step is determined by a code of the first two bytes for the initial of the file name.
(Appendix 3)
The search order table created in the search order creation step stores the search completion date and the search state as the previous record corresponding to the initial of the file name at the end of the search. File search program.
(Appendix 4)
A file search method for virus scanning of a plurality of files stored in a storage device,
A search order creation step of extracting initials from character strings representing the file names of the plurality of files to be searched for virus scanning, creating a search order table by randomly arranging the search order; and
A search execution step for executing a search for a plurality of files according to a search order of a search order table created in the search order creation step;
A state recording step of recording a search state as a device in the search order table when the virus scan being executed in the search execution step is temporarily suspended;
After that, when resuming virus scanning, the search order of the file in process in the search order table is ranked first, and the search order of the file to be subsequently searched is rearranged at random for the initials that have not been completed. A reconfiguration step;
A file search method characterized by comprising:
(Appendix 5)
A file search device for virus scanning of multiple files stored in a storage device,
A search order creation means for extracting initials from character strings representing the file names of the plurality of files to be searched for virus scanning, and creating a search order table by arranging the search order randomly;
Search execution means for searching for a plurality of files in accordance with the search order of the search order table created by the search order creation means;
A state recording unit for recording a search state as a work in progress in the search order table when the virus scan being executed by the search execution unit is temporarily suspended;
After that, when resuming virus scanning, the search order of the file in process in the search order table is ranked first, and the search order of the file to be subsequently searched is rearranged at random for the initials that have not been completed. A resetting means;
A file search apparatus characterized by comprising:

It is a figure which shows the basic composition of the file search system which becomes embodiment of this invention. It is a figure which shows the data structural example (at the time of the 1st search interruption) of the search order table which becomes embodiment of this invention. It is a figure which shows the data structural example (at the time of the 2nd search resumption) of the search order table which becomes embodiment of this invention. It is a figure which shows the flowchart at the time of the file search start which becomes embodiment of this invention. It is a figure which shows the flowchart at the time of the file search resumption which becomes embodiment of this invention.

Explanation of symbols

1 Computer device 2 CPU
DESCRIPTION OF SYMBOLS 3 Memory 4 Auxiliary storage device 10 File search program 11 Search order creation means 12 Search execution means 13 Status recording means 14 Reset means 15 Search order table 20 Virus scan program 21 Virus definition file

Claims (3)

A file search program for scanning a plurality of files stored in a storage device for viruses,
On the computer,
A search order creation step of extracting initials from the character strings representing the file names of the plurality of files to be searched for virus scanning, creating a search order table by randomly arranging the search order; and
A search execution step for executing a search for a plurality of files according to a search order of a search order table created in the search order creation step;
A state recording step of recording a search state as a device in the search order table when the virus scan being executed in the search execution step is temporarily suspended;
After that, when resuming virus scanning, the search order of the file in process in the search order table is ranked first, and the search order of the file to be subsequently searched is rearranged at random for the initials that have not been completed. A reconfiguration step;
File search program that executes   2. The file search program according to claim 1, wherein the search order in the search order creation step is determined by a code of the first two bytes for the initial of the file name. A file search method for virus scanning of a plurality of files stored in a storage device,
A search order creation step of extracting initials from the character strings representing the file names of the plurality of files to be searched for virus scanning, creating a search order table by randomly arranging the search order; and
A search execution step for executing a search for a plurality of files according to a search order of a search order table created in the search order creation step;
A state recording step of recording a search state as a device in the search order table when the virus scan being executed in the search execution step is temporarily suspended;
After that, when resuming virus scanning, the search order of the file in process in the search order table is ranked first, and the search order of the file to be subsequently searched is rearranged at random for the initials that have not been completed. A reconfiguration step;
A file search method characterized by comprising:

Images