200841201 九、發明說明： 【發明所屬之技術領域】 本發明涉及一種病毒防禦系統及方法，尤其涉及一種 圖檔病毒防禦系統及方法。 【先前技術】 SUs病毒的産生對於模具設計者來說，設計的圖檔可200841201 IX. Description of the Invention: [Technical Field] The present invention relates to a virus defense system and method, and more particularly to a virus defense system and method. [Prior Art] The generation of SUs virus for the mold designer, the design of the image can be
能由於無法保存而丟失，或者由於命令失效而導致模具圖 檔無法進入加工製造。 股玟訂者清除Can be lost due to failure to save, or the mold image cannot enter the manufacturing process due to the failure of the command. Shareholders clear
“ 揭毋的方法係· h叩TF呆尔现W 查找文件或文件夾冑話方塊；在“文件或文件爽，，資 =框中輸入病毒槽案名稱；在“包含文字，，資料框中輸入 ^效的命令，例如：Aut〇CAD中的叫1〇和命令；在 二枓:：：擇所有硬碟驅動器；將搜索到的病毒文件刪 二亥方法時必須將圖檔設計系統關閉，且發現病毒 的恰候彺往係在模具設計的中期， 使設計者的®❹法佯存m / ⑦相統可能 【發明内容】 ―⑴田貝、枓 鑒於以上内容，有必要提供一 能在圖檔系統運行時 ：：’讀禦系統’ 除系統，的病毒文件。'中文件的情況’自動刪 此外，還有必要提供一種圖 处 檔系統運行時監控圖㈣統中文件 ^能在圖 中的病毒文件。 S ’兄，自動刪除系統 -種圖檔病毒防禦系統，包 仏主機，該電腦主機 6 200841201 包括：獲取模組，用於從該電腦主機中獲取圖檔系統所有 支援文件的路徑；查找模組，用於查找所獲取的支援文件 ’ 路徑下指定尾碼名的文件；判斷模組，用於判斷所述指定 尾碼名的文件中是否存在病毒文件；刪除模組，用於當指 定尾碼名的文件中存在病毒文件時，刪除所述病毒文件； 監控模組，用於啓動一監控程式，監控所述支援文件的路 徑下是否增加新的文件；所述判斷模組還用於當所述支援 文件路徑下增加新的文件時，判斷所增加的文件是否爲所 * 述指定尾碼名的文件，當所述增加的文件爲指定尾碼名的 文件時，判斷增加的文件中是否存在病毒文件；所述刪除 模組還用於當增加的文件中存在病毒文件時，刪除所述病 毒文件。 一種圖檔病毒防禦方法，該方法包括如下步驟：從電 腦主機中獲取圖檔系統的所有支援文件的路徑；查找所獲 取的支援文件路徑下指定尾碼名的文件；判斷所述指定尾 φ 碼名的文件中是否存在病毒文件；當指定尾碼名的文件中 存在病毒文件時，刪除所述病毒文件；啓動一監控程式； 監控所述支援文件路徑下是否增加新的文件；當所述支援 文件路徑下增加新的文件時，判斷所述增加的文件是否爲 指定尾碼名的文件；當所述增加的文件爲指定尾碼名的文 件時，判斷所述增加的文件是否存在病毒文件；當所述增 加的文件存在病毒文件時，刪除所述病毒文件。 相較於習知技術，所述圖檔病毒防禦系統及方法，能 在圖檔系統運行時監控圖檔系統中文件的情況，自動刪除 7 200841201 系統中的病毒文件。 % 【實施方式】 如圖1所示係本發明圖構病毒防禦系統較佳實施例的 更體=構圖°遠系統包括電腦主機1、顯示螢幕2、鍵盤3 及’月乳4°其中’電腦主機1用於圖檔病毒防禦的相關操作， ’、可以係IBM的電腦、Apple公司的遍。pc、個人電腦、網 路：務器，還可以係任意其他適用的電腦。顯 馨任意顯示裝置，其爲操作人員提供圖形化用戶介面，用戶 透過鍵盤3或滑鼠4輪入要執行的操作命令。 如圖2所示，係圖}中電腦主機丄的功能模組圖。所述電 月自主機1包括獲取模組10、查找模組12、判斷模組14、刪除 模組16及監控模組18。在本較佳實施例中，圖檔系統以 AutoCAD爲例進行說明。 所述獲取模組10用於從電腦主機1中獲取Aut〇CAD的 所有支援文件的路徑。所述AutoCAD的支援文件包括：功 • 能表文件、Excel文件、幫助文件、色彩文件、模版文件、 功能文件及驅動文件。 所述查找模組12用於查找所獲取的支援文件路徑下尾 碼名爲.lsp的文件。在AutoCAD中，所有圖檔的病毒都係 基於AutoLisp語言的程式，該病毒産生後存在於尾碼名 爲.lsp的文件中。 所述判斷模組14用於判斷所查找到的尾碼名爲】 ”的 文件中是否存在病毒文件。該病毒文件包括acad,lsp及 acadapp.lsp文件。在AutoCAD打開一個圖檔或新建—個圖 8 200841201 檔時，將在該圖檔所在路徑下生成 acad.lsp病毒文件及在 AutoCAD的支援文件路徑下生成acadaPP」sp病毒文件。所 述病毒文件的主要特徵爲圖檔無法保存，圖檔中explode命 令無效。若尾碼名爲·1δΡ的文件中存在acad.lsp文件或 acadapp.lsp文件，則判斷.lsP文件中存在病毒文件；若尾碼 名爲.lsp文件中不存在acad」sP文件，也不存在acadapp.lsp 文件，則判斷.lsp文件中不存在病毒文件。 所述刪除模組16用於當尾碼名爲」sp文件中存在病毒 文件時，刪除所述病毒文件。 所述監控模組18用於啓動一監控程式，監控所述支援 文件路徑下是否增加新的文件。該監控程式係基於C++語 言的程式。 所述判斷模組14還用於當所述支援文件路徑下增加新 的文件時’判斷所述增加的文件的尾碼名是否爲.lsp。 所述判斷模組14還用於當所述增加的文件的尾碼名 爲.lsp時，判斷所增加的文件中是否存在病毒文件。若增加 的文件中存在acad.lsp文件或acadapp.lsp文件，則判斷所增 加的文件中存在病毒文件；若增加的文件中不存在acad.lsp 文件，也不存在acadapp.lsp文件，則判斷所增加的文件中 不存在病毒文件。 所述刪除模組16還用於當增加的文件中存在病毒文件 時，刪除所述病毒文件。 如圖3所示，係本發明圖檔病毒防禦方法較佳實施例的 作業流程圖。在本較佳實施例中，圖檔系統以AutoCAD爲 200841201 例進行說明。 步驟S10 ’獲取模組10從電腦主機i中獲取Aut〇CAD的 ' 所有支援文件的路經。 步驟S12,查找模㈣查找所獲取的支援文件路徑下 尾碼名爲.lsp的文件。 步驟S14，判斷模虹14判斷所查找到的尾碼名爲.㈣文 件中是否存在病毒文件。該病毒文件包括acad.lsp及 acadapp.lsp 文件。 步驟S16 $尾碼名爲柳的文件中存在病毒文件，則 刪除模組16刪除所述病毒文件。 yl^S18監控模組18啓動一監控程式。該監控程式 係基於C++語言的程式。 乂驟320風控模組18監控所述支援文件路徑下是否 增加新的文件。 ' ^所述支援文件路徑下增加新的文件時， 馨判斷板組14判斯所述增加的文件的尾碼名是否爲柳。 步驟 S24，备％、+、，， t 田所述~加的文件的尾碼名爲.lsp時，判斷 模組==所％^.lsp文件中是砰在病毒文件。 乂驟6田％加的JSp文件中存在病毒文件時，刪除 模組16刪除所述病毒文件。 步驟S28 ’判斷模組14判斷AutoCAD是否關閉。當 AutoCAD系統不關閉時，返回步驟S2〇繼續監控所述支援 文件路徑下是否增加㈣U ;當AutoCAD系統關閉時， 結束流程。 200841201 在步驟S14中’當尾碼名爲.lsp的文件中不存在病毒文 ^ 件時，至步驟S18啓動一監控程式。 B 在步驟S20中，當所述支援文件路徑下沒有增加新的 文件時，返回本步驟S20繼續監控所述支援文件路徑下是 否增加新的文件。 在步驟S22中，當所述增加的文件不係指定尾碼名的 文件時，返回步驟S20繼續監控所述支援文件路徑下是否 增加新的文件。 ® 在步驟S24中，當所述增加的文件不存在病毒文件 時，返回步驟S20繼續監控所述支援文件路徑下是否增加 新的文件。 【圖式簡單說明】 圖1係本發明圖檔病毒防禦系統較佳實施例的硬體架 構圖。 圖2係圖1中電腦主機的功能模組圖。 φ 圖3係本發明圖檔病毒防禦方法較佳實施例的作業流 程圖。 【主要元件符號說明】 電腦主機 1 獲取模組 10 查找模組 12 判斷模組 14 刪除模組 16 監控模組 18 11 200841201 從電腦主機中獲取AutoCAD的所有支援文件的 路徑 S10 查找所獲取的支援文件路徑下尾碼名為.lsp 的文件 S12 判斷.lsp文件中是否存在病毒文件 S14 刪除所述病毒文件 S16 啓動一監控程式 S18 監控所述支援文件路徑下是否增加新的文 件 S20 所述增加的新的文件的尾碼名是否為.lsp S22 所述增加的.lsp文件中是否有病毒文件 S24 刪除所增加的.lsp文件中的病毒文件 S26" The method of revealing the system · h叩TF Dil is now W to find the file or folder call box; in the "File or file cool,, the = box = enter the virus slot name; in the "including text," data box Enter the ^ effect command, for example: A〇〇CAD in the 1〇 and command; in the second::: select all hard disk drives; the search for the virus file to delete the second method must be closed the file design system, And found that the virus is in the middle of the mold design, so that the designer's ® method can save m / 7 phase system may be [invention content] - (1) Tian Bei, 枓 In view of the above, it is necessary to provide a map When the file system is running:: 'Reading the system' except the system, the virus file. 'The situation of the file' is automatically deleted. In addition, it is necessary to provide a picture file system runtime monitoring chart (4) The file in the system can be in the figure Virus file. S 'Brother, automatic deletion system - a kind of file virus defense system, package host, the computer host 6 200841201 includes: acquisition module for obtaining the path of all supporting files of the image system from the host computer a search module for finding a file of a specified end code name in the path of the obtained support file, and a judging module for judging whether a virus file exists in the file of the specified end code name; When the virus file exists in the file of the specified tail code name, the virus file is deleted; the monitoring module is configured to start a monitoring program, and monitor whether the new file is added in the path of the supporting file; For adding a new file under the support file path, determining whether the added file is a file of the specified last code name, and when the added file is a file specifying the last code name, determining to increase Whether the virus file exists in the file; the deleting module is further configured to delete the virus file when a virus file exists in the added file. A method for preventing a virus file, the method comprising the following steps: obtaining a picture from a computer host The path of all the support files of the file system; find the file of the specified tail code name under the obtained support file path; judge the file of the specified tail φ code name Whether there is a virus file; when a virus file exists in the file specifying the last code name, deleting the virus file; starting a monitoring program; monitoring whether a new file is added under the support file path; adding when the support file path is added a new file, determining whether the added file is a file specifying a last code name; when the added file is a file specifying a last code name, determining whether the added file has a virus file; When the file exists, the virus file is deleted. Compared with the prior art, the file virus defense system and method can monitor the file in the file system when the file system is running, and automatically delete 7 200841201 The virus file in the system. [Embodiment] As shown in FIG. 1 , the preferred embodiment of the preferred embodiment of the virus defense system of the present invention is as follows: computer host 1, display screen 2, keyboard 3 and 'month Milk 4 ° where 'computer host 1 is used for the related operations of the image virus defense, ', can be IBM's computer, Apple's all over. Pc, PC, network: can also be any other suitable computer. Any display device is displayed, which provides a graphical user interface for the operator, and the user enters an operation command to be executed through the keyboard 3 or the mouse 4. As shown in Figure 2, the function module diagram of the computer host in Figure}. The power module 1 includes an acquisition module 10, a search module 12, a determination module 14, a deletion module 16, and a monitoring module 18. In the preferred embodiment, the image file system is described by taking AutoCAD as an example. The obtaining module 10 is configured to obtain a path of all supporting files of the Aut〇CAD from the host computer 1. The AutoCAD support files include: function table files, Excel files, help files, color files, template files, function files, and driver files. The search module 12 is configured to search for a file with a .lsp tail code under the obtained support file path. In AutoCAD, the viruses of all images are based on the AutoLisp language program. The virus is generated in a file with a .lsp trailing code. The judging module 14 is configured to determine whether a virus file exists in the file whose tail code name is named “]. The virus file includes acad, lsp and acadapp.lsp files. Open an image file in AutoCAD or create a new one. Figure 8 In the 200841201 file, the acad.lsp virus file will be generated in the path of the image file and the acadaPP”sp virus file will be generated under the AutoCAD support file path. The main feature of the virus file is that the image file cannot be saved, and the explode command in the image file is invalid. If the acad.lsp file or the acadapp.lsp file exists in the file whose tail code name is ·1δΡ, it is judged that there is a virus file in the .lsP file; if the acad file name does not exist in the .lsp file, there is no acadapp. The lsp file determines that no virus files exist in the .lsp file. The deleting module 16 is configured to delete the virus file when a virus file exists in the tail file named "sp". The monitoring module 18 is configured to start a monitoring program to monitor whether a new file is added under the support file path. This monitoring program is based on the C++ language. The determining module 14 is further configured to: determine whether the end code name of the added file is .lsp when a new file is added under the support file path. The judging module 14 is further configured to: when the end code name of the added file is .lsp, determine whether a virus file exists in the added file. If the acad.lsp file or the acadapp.lsp file exists in the added file, it is judged that there is a virus file in the added file; if the acad.lsp file does not exist in the added file, and the acadapp.lsp file does not exist, the judgment is made. There are no virus files in the added file. The deleting module 16 is further configured to delete the virus file when a virus file exists in the added file. As shown in Fig. 3, it is a flowchart of the operation of the preferred embodiment of the virus defense method of the present invention. In the preferred embodiment, the image file system is described by AutoCAD as 200841201. Step S10' acquires a path for the module 10 to obtain all of the support files of the Aut〇CAD from the host computer i. In step S12, the search module (4) searches for the file with the end code name .lsp under the obtained support file path. In step S14, it is judged that the template 14 determines whether the found end code name is . (4) Whether a virus file exists in the file. The virus files include acad.lsp and acadapp.lsp files. In step S16, if there is a virus file in the file with the last code name, the deletion module 16 deletes the virus file. The yl^S18 monitoring module 18 starts a monitoring program. This monitoring program is based on the C++ language program. Step 320: The wind control module 18 monitors whether a new file is added under the support file path. When the new file is added to the support file path, it is determined whether the end code name of the added file is Liu. Step S24, when the end code of the file added to the %, +, and t fields is named .lsp, the judgment module == the %^.lsp file is a virus file. When a virus file exists in the JSp file added to the field, the deletion module 16 deletes the virus file. Step S28' determines that the module 14 determines whether AutoCAD is closed. When the AutoCAD system is not closed, the process returns to step S2 and continues to monitor whether the support file path is incremented by (4) U; when the AutoCAD system is closed, the process ends. 200841201 In step S14, when there is no virus document in the file whose end code name is .lsp, a monitoring program is started in step S18. B In step S20, when a new file is not added in the support file path, the process returns to step S20 to continue monitoring whether the new file is added under the support file path. In step S22, when the added file is not a file specifying the last code name, the process returns to step S20 to continue monitoring whether a new file is added under the support file path. In step S24, when there is no virus file in the added file, the process returns to step S20 to continue monitoring whether a new file is added under the support file path. BRIEF DESCRIPTION OF THE DRAWINGS Fig. 1 is a block diagram showing the hardware architecture of a preferred embodiment of the virus defense system of the present invention. FIG. 2 is a functional module diagram of the computer host in FIG. 1. φ Figure 3 is a workflow diagram of a preferred embodiment of the image virus defense method of the present invention. [Description of main component symbols] Computer host 1 acquisition module 10 search module 12 judgment module 14 deletion module 16 monitoring module 18 11 200841201 Get the path of all support files of AutoCAD from the host computer S10 Find the obtained support files The file S12 with the end code name .lsp in the path determines whether there is a virus file in the .lsp file. S14 deletes the virus file S16. Starts a monitoring program S18. Monitors whether the new file S20 is added under the support file path. Whether the end code name of the file is .lsp S22 is added in the .lsp file. Is there a virus file S24 deleted? The virus file S26 in the .lsp file is added.
AutoCAD是否關閉 S28Is AutoCAD closed? S28
1212