JPH03233629A - System for checking destruction of execution format file - Google Patents

Abstract

PURPOSE:To easily specify a suspected file and to prevent a computer system from being infected by computer virus by totally comprehensively executing a check while paying attention onto the character of infection caused by the computer virus. CONSTITUTION:A file existence checking mechanism 6 investigates whether the file name of an execution format file taken out from a file system 1 by an execution format file take-out mechanism 5 exists in data read out from a file checking data base 2 or not. A file length checking mechanism 7 investigates whether the real file length of the execution format file is coincident with the file length of the same file registered to the file checking data base 2 or not, and a file checksome checking mechanism 8 investigates whether the checksome of a byte string is coincident or not. Then, alarming messages are respectively outputted to a picture display device 9. Thus, the suspected file is specified by easily checking the infection of the computer virus and the computer system is prevented form being infected.

Description

[Detailed Description of the Invention] [Industrial Application Field] The present invention relates to a method for checking whether an executable file in a computer system is destroyed. This relates to a method for inspecting for intrusion and destruction of executable files.

[Conventional technology]

A computer virus is a program that has the ability to self-replicate and damage the system.

Here, the self-copying function refers to a function that copies or inserts its own program (computer virus program) into another appropriate executable file (program). An executable file that has a computer virus program copied or inserted into it is said to be infected with a computer virus, and when this executable file is executed next, another suitable executable file is selected and the computer virus program is copied or inserted. do.

These operations are then repeated at various locations within the computer system. This is called the proliferation of computer viruses, and when a computer virus program invades a computer system, it is said that the computer system is infected with a computer virus.

On the other hand, a system damage function is a function that performs processing that causes irreparable damage to a computer system, such as the formant of a magnetic disk drive. Occurs due to factors such as When this happens, it is said that the computer system has developed an illness.

Conventionally, the following measures have been taken against the computer viruses mentioned above.

■In order to prevent infection from the network, users logging in from external computer systems should be treated as general users, distinguished from privileged users, and prevented from rewriting or installing programs.

■To prevent infection from external storage devices such as floppy disks, clarify the publisher and avoid installing anything suspicious.

■Privileged users should be careful to execute only executable files that have sufficient credibility to minimize the chance of computer virus infection, and also to minimize the chance of computer virus infection, and to ) will try to prevent this from happening.

■For executable files that are suspected to have been infected with a computer virus due to signs such as execution time being slower than usual, we compare them with executable files that have already been verified to be correct and ensure that they have not been rewritten. In other words, make sure that your computer is not infected with a virus.

[Problem to be solved by the invention]

As mentioned above, in the past, the main focus was on preventing computer virus infection itself, and the method for determining whether or not a computer virus has already been infected was based on an executable file that is suspected of being infected. The only way to do this is to check the validity of each computer virus individually, and it is not possible to discover latent computer viruses without any noticeable symptoms at an early stage. The drawback was that it was not possible.

The present invention has been proposed in view of the above points, and its purpose is to easily check all executable files existing in a file system for computer virus infection and identify suspect files. An object of the present invention is to provide a method for checking whether an executable file is destroyed and can effectively prevent the onset of computer system problems.

[Means for solving the problem] In the second method of checking for destruction of executable files of the present invention,
Based on the results of analyzing the types of computer virus infections to computer systems and the types of computer virus infections to executable files,
This makes it possible to uniformly detect executable files (suspect files) infected with computer viruses.

That is, there are two types of computer virus infections to computer systems:

The first is the infection of executable files that originally reside in the file system of a computer system.

The second problem is the new installation of an executable file that has already been infected with a computer virus.

This involves installing such an executable file in an appropriate location on the file system and waiting for a user in privileged mode to execute it. When the user who executes this happens to be in a privileged mode, it causes the proliferation or onset of a computer virus.

On the other hand, there are two types of computer virus infections to executable files:

The first is that the computer virus program executable file has been overwritten. When infected in this way, the original functions of the executable file are lost, and even if the executable file is executed, it does not perform the expected operation, but instead causes the virus to become infected.

The second type is one in which a computer virus program is added to an executable file without damaging its original functionality. When you run this executable file,
Although the computer virus causes the virus to propagate, the original function also works properly, so users can be assured that they are not infected, as it can only be determined by the secondary symptoms associated with the execution of the computer virus program, such as execution speed being slower than usual. It's hard to notice that it's there. Then, the onset of the disease occurs when the number of proliferation reaches a certain value.

Therefore, in the executable file destruction check method of the present invention, of the two types of computer virus infection of a computer system, the second type of new installation of an executable file that has already been infected with a computer virus is For all executable files existing in the file system, suspect files are detected by determining from the file name whether or not the executable file is approved to exist in the file system. . In other words, the infection can be detected by the fact that a new executable file has been installed. In addition, the first
Infection of executable files that originally exist in the file system of a computer system cannot be detected by this method because the file names are legitimate, and the determination will be left to the next section.

Next, of the two types of computer virus infection of executable files, for the second one, in which a computer virus program is added to an executable file, the file length should be compared with the previous value. The system detects suspicious files. In other words, this type of infection can be detected by the fact that the file size is larger than the original one.

Regarding the first type of computer virus programs, infection cannot be detected by changes in file length, but suspect files can be detected by comparing the file checksum, which reflects the difference in file content, with the previous value. I'm trying to detect it. In other words, this type of infection can only be known by checking the file contents.

These techniques allow detection of all types of infections.

In order to realize the above-mentioned method, the present invention includes a file check database consisting of a correspondence table between the file name and file length of each executable file and the checksum of the hide column of the file, and data from the file check database. A file check database reading mechanism for reading, an executable file extracting mechanism for sequentially extracting all executable files from the file system, and checking whether or not the extracted executable file exists in the file check database, and if it does not exist, it is checked. A file existence check mechanism outputs a warning message to the effect that the executable file is not executed, and it checks once whether the actual file length of the retrieved executable file matches the file length of the same file registered in the file check database. A file length 1 hook mechanism that outputs a warning message indicating that they do not match if -it is not present, and a checksum of the actual byte sequence of the extracted executable file is the byte of the same file registered in the file check database. A file checksum check mechanism that checks whether the column checksum matches the column checksum, and outputs a warning message to the effect that they do not match if they do not match, and the file existence check mechanism, file length checker, and The present invention includes a check method selection mechanism that allows execution of the file checksum check mechanism to be arbitrarily selected.

[Effect]

In the executable file destruction check method of the present invention, a file check database is constructed in advance, which is composed of a correspondence table of the file name and file length of each executable file and the checksum of the byte string of the file. In response to the check execution instruction, the file check database reading mechanism reads data from the file check database, and the executable file extraction mechanism sequentially extracts all executable files from the file system, and extracts the extracted executable files. The file existence check mechanism checks whether the file exists in the file check database, and if it does not exist, outputs a warning message to the effect that it does not exist, and the actual file length of the retrieved executable file is checked in the file check database. The file length 1 hook mechanism checks whether the file length matches the file length of the same file registered in The file checksum checking mechanism checks whether the checksum of the byte string matches the checksum of the hide string of the same file registered in the file chain and the data file, and if they do not match, a check is made to indicate that they do not match. A warning message is output.Furthermore, the check method selection mechanism can arbitrarily select execution of the file existence check mechanism, file length check mechanism, and file check sum checking mechanism.

〔Example〕

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is a block diagram showing an embodiment of a method for checking whether an executable file is destroyed according to the present invention. In FIG. 1, this embodiment includes a file system 1, a file check database 2, a check method selection mechanism 3, a file check database reading mechanism 4, an executable file retrieval mechanism 5, and a file existence check 7ri 4a! 416, a file length check mechanism 7, a file checksum check mechanism 8, and a screen display device 9. Note that thick lines with arrows indicate the flow of control, thin lines indicate the flow of data, and broken lines indicate selection.

The functions of each part are as follows.

File system 1: A file system of a computer system, in which executable files are stored.

File check database 2; file system l
This is a data hese in which one entry is the file name of an executable file that is legitimately stored in , the file length, and the checksum of the hide string of the file. Create this when you first install your computer system. The administrator of the computer system may register using an editor, or a separate tool may be created and registered.

Check method selection mechanism 3; determines the mechanism to be checked and executed. Check methods include file existence check, file length check, and file checksum check. Note that which check to perform is given as an argument at startup.

File check database reading mechanism 4; reads data from the file check data base 2.

Executable file extraction mechanism 5; file system l
This is to sequentially extract all executable files from .

File existence checking mechanism 6: Checks whether the file name of the executable file extracted from the file system 1 by the executable file extraction mechanism 5 exists in the data read from the file check database 2, and if it does not exist, it does not exist. A warning message to this effect is output to the screen display device 9. Note that it operates only when the check method selection mechanism 3 selects that mechanism.

File length check mechanism 7; checks whether the actual file length of the executable file retrieved from the file system 1 by the executable file retrieval mechanism 5 matches the file length of the same file registered in the file check database 2. , if they do not match, a warning message to the effect that they do not match is output to the screen display device 9.

Note that it operates only when the check method selection mechanism 3 selects that mechanism.

File checksum check mechanism 8: The checksum of the actual byte sequence of the executable file extracted from the file system 1 by the executable file extraction mechanism 5 is the same as the checksum of the byte sequence of the same file registered in the file check database 2. It is checked whether they match, and if -it is not found, a warning message to the effect that they do not match is output to the screen display device 9. Note that it operates only when the check method selection mechanism 3 selects that mechanism.

Screen display device 9: Displays a warning message to the administrator of the computer system.

FIG. 2 is a flowchart showing the processing of the above embodiment, and the operation of the embodiment will be explained below with reference to FIG. 1 and the second part.

First, when the operation starts (step SL), the check method selection lm443 specifies the check method based on instructions from an operator or the like (step S2). Accordingly, bits of a file check flag having bits corresponding to each of the three methods (file existence check, file length check, file checksum check) are set. The value of the bit indicates whether the method is adopted or not.

Next, the file check database reading mechanism 4
As a result, data is read from the file check database 2 onto a memory (not shown) (step S3).
.

Next, the executable file extraction mechanism 5 sequentially extracts executable files from the file system 1 (step S4), and it is determined whether or not the executable file exists (step S5). If YES in step S5), it is assumed that processing has been completed for all executable files and the process ends (step S6). If there are any executable files, the process moves to the next process.

Next, the file existence check mechanism 6 checks the value corresponding to the file existence check among the file check flags previously set by the check method selection mechanism 3 (step S7), and if it is "ON" (ON in step S7 ) is checked to see if a file name with the same name as the retrieved executable file exists in the data of the file check database 2 read into the memory (step S8), and if it does not exist (No in step S8). teeth,
A warning message to the effect that it does not exist is output to the screen display device 9 (step S9). After that, the process returns to step S4.

If the value corresponding to the file existence check among the file check flags is rOFF (0FF in step S7
) and the same file name exists in the file check database 2 (YES in step S8), the process moves to the next step.

Next, the file length check mechanism 7 checks the value corresponding to the file check flag among the file check flags (step 310), and if it is "ON" (ON in step 510), the value is registered in the file check database 2. It is checked whether the file length of the same file matches the actual file length of the extracted executable file (step 5ll), and if they do not match (
If NO in step Sll), a warning message to the effect that they do not match is output to the screen display device 9 (step 51).
2). After that, the process returns to step S4.

If the value corresponding to the file length check among the file check flags is rOFFJ (0FF in step S10)
) and the file length is -t with the same file in the file manager and database 2 (YES in step Sll).
), move on to the next process.

Next, the file checksum check mechanism 8 checks the value corresponding to the file checksum check among the file check flags (step 513), and rO
In the case of NJ (ON in step S13), it is checked whether the file checksum of the same file registered in the file check database 2 matches the checksum of the actual byte string of the extracted executable file. (Step 514) If they do not match (No in step S14), a warning message to the effect that they do not match is output to the screen display device 9 (step 515). After that, the process returns to step S4.

Also, if the value corresponding to the file check sum check among the file check flags is rOFFJ (0FF in step S13), and if the file check sum matches the same file in the file check database 2 (YES in step S14), Similarly, step S4
Return to

These processes are performed for all executable files.

The executable file identified by the warning message has a high possibility of being infected with a computer virus, so please do not
Appropriate action will be taken after checking each case individually.

〔Effect of the invention〕

As explained above, in the destruction checksum of an executable file according to the present invention, a unified and comprehensive check is performed focusing on the nature of computer virus infection. It is possible to determine whether or not the file is false and to identify the suspect file without delay, which has the effect of effectively preventing computer systems from becoming ill due to computer viruses.

[Brief explanation of drawings]

FIG. 1 is a configuration diagram showing an embodiment of the executable file destruction check method of the present invention, and FIG. 2 is a flowchart of the processing of the embodiment of FIG. In the figure, l...File system 2...File check database 3...
... Check method selection mechanism 4 ... File check database reading mechanism 5 ... Executable file extraction mechanism 6 ...
... File existence check mechanism 7 ... File length check mechanism 8 ... File checksum check mechanism 9 ... Screen display device

Claims (2)

[Claims] (1) A file check database consisting of a correspondence table between the file name and file length of each executable file and the checksum of the byte string of the file; a file check database reading mechanism that reads data from the file check database; and a file check database. An executable file extraction mechanism that sequentially extracts all executable files from the system, and a file that checks whether the extracted executable file exists in the file check database and outputs a warning message that it does not exist if it does not exist. The existence check mechanism checks whether the actual file length of the retrieved executable file matches the file length of the same file registered in the file check database, and if it does not match, a check is made to indicate that they do not match. A file length check mechanism that outputs a warning message and checks whether the checksum of the actual byte string of the retrieved executable file matches the checksum of the byte string of the same file registered in the file check database. , a file checksum check mechanism that outputs a warning message to the effect that they do not match if they do not match, and a check that allows execution of the file existence check mechanism, file length check mechanism, and file checksum check mechanism to be arbitrarily selected. A method for checking destruction of an executable file, characterized by comprising a method selection mechanism. (2) The executable file destruction check method according to claim 1, wherein each warning message is output to a screen display device.