WO2015081791A1 - 内核级恶意软件查杀的方法和装置 - Google Patents

内核级恶意软件查杀的方法和装置 Download PDF

Info

Publication number
WO2015081791A1
WO2015081791A1 PCT/CN2014/092133 CN2014092133W WO2015081791A1 WO 2015081791 A1 WO2015081791 A1 WO 2015081791A1 CN 2014092133 W CN2014092133 W CN 2014092133W WO 2015081791 A1 WO2015081791 A1 WO 2015081791A1
Authority
WO
WIPO (PCT)
Prior art keywords
data structure
virus software
operating system
linked list
pointer
Prior art date
Application number
PCT/CN2014/092133
Other languages
English (en)
French (fr)
Inventor
邵坚磊
Original Assignee
北京奇虎科技有限公司
奇智软件（北京）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京奇虎科技有限公司, 奇智软件（北京）有限公司 filed Critical 北京奇虎科技有限公司
Publication of WO2015081791A1 publication Critical patent/WO2015081791A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/568—Computer malware detection or handling, e.g. anti-virus arrangements eliminating virus, restoring damaged files

Definitions

  • the present invention relates to the field of computer technology, and in particular, to a kernel level malware killing method and apparatus.
  • the confrontation between virus Trojans and killing soft has changed from passive behaviors such as past, avoidance and evasion, to active actions such as active confrontation and ending the soft killing process.
  • the malicious program scans the process of the anti-virus software running in the operating system according to the name of the anti-virus software, and ends the process of the anti-virus software, so that the anti-virus software cannot perform the anti-virus operation.
  • the top and second viruses in China's top ten computer viruses, the ghost series and the AV (Anti-Virus) terminator series will end the process of anti-virus software, making it extremely difficult to check after poisoning. kill.
  • These viruses will load the driver to enumerate all the processes after infecting the system, and will find that the process of killing the software will terminate the process. Due to the processing at the kernel level, it is difficult to confront.
  • the present invention has been made in order to provide a method and corresponding apparatus suitable for kernel level malware killing that overcomes the above problems or at least partially solves the above problems.
  • a method for kernel level malware killing including:
  • the operating system is checked and killed by the hidden anti-virus software.
  • a kernel level malware killing apparatus comprising:
  • the data structure obtaining module is configured to acquire a data structure in the operating system that records the current inter-process pointing relationship
  • the process positioning module is configured to locate a front process and a back process of the loaded antivirus software process in the data structure, where the front process is a process pointed to by the antivirus software process, and the backward process is a process directed to the antivirus software process;
  • Pointing to the relationship modification module configured to modify the pointing relationship between the front process and the rear process to the rear process directly pointing to the front process
  • the killing module is configured to perform malware killing on the operating system through the hidden anti-virus software.
  • a computer program comprising computer readable code, when the computer readable code is run on a computing device, causing the computing device to perform according to any of the above Kernel-level malware killing methods.
  • a computer readable medium wherein the computer program described above is stored.
  • the present invention provides a kernel level malware killing method and apparatus.
  • the present invention locates a loaded antivirus software process in the data structure by acquiring a data structure in an operating system that records a currently running inter-process pointing relationship.
  • the front process and the rear process and modify the pointing relationship between the front process and the rear process to the rear process directly pointing to the front process, which can be used in the operating system to record the process of the anti-virus software in the data structure of the inter-process pointing relationship, so that the malicious
  • the program can not get the process information of the anti-virus software by editing the data structure, and thus cannot close the process of the anti-virus software, ensuring that the anti-virus software can normally kill and kill the malicious program, and maliciously kill the operating system through the hidden anti-virus software.
  • the killing of software improves security.
  • FIG. 1 is a flow chart of a method for kernel-level malware killing according to an embodiment of the present invention
  • FIG. 2 is a flow chart of a specific method for kernel-level malware killing according to an embodiment of the present invention
  • FIG. 3 is a schematic structural view of a doubly linked list according to an embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of a doubly linked list after modifying a pointing relationship according to an embodiment of the present invention
  • FIG. 5 is a structural block diagram of an apparatus for kernel-level malware killing according to an embodiment of the present invention.
  • Figure 6 is a schematic block diagram of a computing device for performing a method of kernel level malware killing in accordance with the present invention
  • Figure 7 schematically illustrates a storage unit of program code for maintaining or carrying a method of implementing kernel level malware killing in accordance with the present invention.
  • Embodiments of the invention may be applied to computer systems/servers that operate with numerous other general purpose or special purpose computing system environments or configurations.
  • Examples of well-known computing systems, environments, and/or configurations suitable for use with computer systems/servers include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, based on Microprocessor systems, set-top boxes, programmable consumer electronics, networked personal computers, small computer systems, mainframe computer systems, and distributed cloud computing technology environments including any of the above, and the like.
  • the computer system/server can be described in the general context of computer system executable instructions (such as program modules) being executed by a computer system.
  • program modules may include routines, programs, target programs, components, logic, data structures, and the like that perform particular tasks or implement particular abstract data types.
  • the computer system/server can be implemented in a distributed cloud computing environment where tasks are performed by remote processing devices that are linked through a communication network.
  • program modules may be located on a local or remote computing system storage medium including storage devices.
  • the embodiment of the invention provides a kernel level malware killing method.
  • This method improves the device for killing kernel-level malware.
  • the device for killing the kernel-level malware in this embodiment may be a tool installed on the client, wherein the client may be a user terminal such as a PC (Personal Computer), a mobile phone, a handheld computer, and the client.
  • the end can run a cloud-based virus detection and killing system, combined with a cloud security server, and a virus scanning engine that processes various types of files, a proactive defense module, etc., to detect and kill malware.
  • FIG. 1 is a flow chart of a method for kernel-level malware killing according to an embodiment of the present invention, The method includes steps S102 to S108.
  • the front process is the process pointed to by the anti-virus software process
  • the rear process is the process pointing to the anti-virus software process.
  • S108 Performing malware killing of the operating system through the hidden anti-virus software.
  • An embodiment of the present invention provides a kernel-level malware killing method.
  • the method locates a loaded anti-virus software process in the data structure by acquiring a data structure of an operating system that records a currently-oriented inter-process pointing relationship.
  • the front process and the rear process and modify the pointing relationship between the front process and the rear process to the rear process directly pointing to the front process, which can be used in the operating system to record the process of the anti-virus software in the data structure of the inter-process pointing relationship, so that the malicious
  • the program can not get the process information of the anti-virus software by editing the data structure, and thus cannot close the process of the anti-virus software, ensuring that the anti-virus software can normally kill and kill the malicious program, and maliciously kill the operating system through the hidden anti-virus software.
  • the killing of software improves security.
  • This embodiment is a specific application scenario of the foregoing first embodiment. Through the embodiment, the method provided by the present invention can be more clearly and specifically illustrated.
  • FIG. 2 is a flow chart of a specific method for kernel-level malware killing according to an embodiment of the present invention, the method including steps S201 to S208.
  • the method can be implemented in the anti-virus software by the driver, so that the anti-virus software can automatically hide its own process when it is started, so that the malicious program can not find the process of the anti-virus software, and then the malicious program is scanned and cleared. .
  • step S201 is executed to receive a killing request of the user for kernel-level malware, start a preset protection tool, and run a driver for hiding the anti-virus software.
  • the process of the anti-virus software is hidden by the driver.
  • the driver is immediately run to hide the process of the anti-virus software.
  • the above-mentioned driver can be implemented in the anti-virus software or in the protection tool of the anti-virus software, and the protection tool can be a safe or the like.
  • the driver utilizes the DKOM (Direct Kernel Object Manipulation) technology provided in the operating system.
  • DKOM Direct Kernel Object Manipulation
  • All operating systems store specific information in memory. It is usually in the form of a structure or object and is managed by the object manager. These objects are reported to the user when the user space process requests operating system information such as a list of processes, threads, or device drivers. These objects or structures are in memory so they can be modified directly.
  • DKOM Direct Kernel Object Manipulation
  • the hidden key data structure of the hidden process is: the EPROCESS structure of the process and the ETHREAD structure of the thread, and the linked list (such as the process, the thread linked list, and the CPU (Central Processing Unit). Scheduling linked list) and so on.
  • the present invention operates on these data structures through DKOM to achieve the purpose of hiding processes.
  • step S202 is executed, that is, a doubly linked list for recording process information of a process currently running in the operating system is read in the memory.
  • the bidirectional list is: a PsAcvtiveProcessList linked list.
  • the malicious program is also the process information of the process of obtaining the anti-virus software by scanning the linked list.
  • step S203 is performed to read a data structure for recording the inter-process pointing relationship in the above-described doubly linked list.
  • the above data structure is the EPROCESS structure.
  • each EPROCESS structure is used to store process information of a process.
  • FIG. 3 shows a schematic structural diagram of a doubly linked list (PsAcvtiveProcessList).
  • each EPROCESS structure there is a LIST_ENTRY structure with pointer members FLINK and BLINK;
  • FLINK is used to record a pointer to the front process of the current process
  • BLINK is used to record a pointer to a subsequent process of the current process.
  • step S204 After reading the data structure for recording the inter-process pointing relationship, step S204 is continued.
  • step S204 an EPROCESS structure corresponding to the loaded anti-virus software process is looked up in the data structure.
  • each process corresponds to an EPROCESS structure
  • the EPROCESS structure of all processes is stored in a doubly linked list manner. By traversing the PsAcvtiveProcessList linked list and sequentially reading the process information, the loaded information can be obtained.
  • the EPROCESS structure corresponding to the anti-virus software.
  • step S204 After the step S204 is performed, the pointers recorded by the FLINK and the BLINK in the EPROCESS structure corresponding to the anti-virus software are continuously read through step S205.
  • FLINK and BLINK in the EPROCESS structure are used to save the pointers of the front process and the rear process of the current process respectively.
  • the front process and the rear process of the current antivirus software process can be known.
  • step S206 is continued, that is, the front process and the back process of the antivirus software are obtained by the pointers recorded by the FLINK and BLINK obtained by the above acquisition.
  • step S207 is executed to extract the self-information of the anti-virus software process in the above-mentioned doubly linked list.
  • the self-information of the anti-virus software process in the above-mentioned doubly linked list also changes the pointing relationship between the preceding process and the rear process to the backward process directly pointing to the front process.
  • step S207 can be specifically implemented as follows:
  • FIG. 4 shows a schematic structural diagram of a modified doubly linked list (PsAcvtiveProcessList).
  • the EPROCESS structure of the process of the anti-virus software can be hidden in the PsAcvtiveProcessList linked list, so that the malicious program can not read the process information of the process of the anti-virus software, and even if the system service ZwQuerySystemInformation is called, the process of the anti-virus software cannot be found. Moreover, it does not affect the operation of the anti-virus software process.
  • step S208 is performed to perform malware killing on the operating system by the hidden anti-virus software.
  • the anti-virus software provided by the present invention can be applied to detect stubborn viruses, and can be applied to perform Trojan scanning, cleaning functions, MBR (Master Boot Record) repair functions, and the like.
  • the anti-virus software provided by the invention comprises a stubborn virus and a Trojan scanning and cleaning function. To help users Clean up the stubborn virus and Trojan in the computer system. When the software scans the computer virus, it will automatically delete the virus file or lock the virus file to prevent it from running.
  • the anti-virus software provided by the invention will scan key items of the system and automatically handle system abnormalities. The killing results will be presented in the list. Users can recover some file operations in the file quarantine.
  • the anti-virus software provided by the invention protects the normal operation of the system by killing Trojans running under the system such as a Trojan.
  • Trojans running under the system
  • malicious services and drivers existing in the system will be checked and killed. Since the killing may cause the system to fail to start normally under certain circumstances, the software will add a startup item to the system. If the user fails to start after the repair, the startup item can be attempted to be repaired.
  • the anti-virus software provided by the invention has a system file repair function.
  • This function scans the system's own key DLL (Dynamic Link Library) files in the system.
  • DLL Dynamic Link Library
  • the software will query the missing DLL file from the cloud query server, and then select a DLL file suitable for the user's current system to download to the user machine.
  • This feature can solve the problem that the computer dll file is missing due to malicious damage caused by Trojan horse or other reasons. Users can also manually enter the name of the missing DLL file to find and repair.
  • the anti-virus software provided by the invention has an MBR repair function. Some Trojans infect computer MBRs to hide themselves and repeatedly infect computer systems. This feature helps users clear malicious code in the MBR.
  • the anti-virus software provided by the present invention can be combined with the cloud security technology.
  • the principle is to collect the fingerprint of the file on the user's computer and send it to the cloud server for analysis, thereby identifying the security level of the file.
  • File fingerprint is the unique identification information of the file calculated according to the international common standard algorithm. It is usually a combination of numbers and letters of several tens of bytes.
  • the frequently used algorithms such as MD5 (Message Digest Algorithm 5, Message Digest Algorithm Fifth Edition), SHA1 (Secure Hash Algorithm 1, the first version of the secure hash algorithm) and so on.
  • the protection tool provided by the invention can upload the discovered suspicious executable program samples to the cloud server for analysis by the engineer.
  • the uploaded samples are limited to PE (Portable Execute) files for virus analysis.
  • PE Portable Execute
  • An embodiment of the present invention provides a kernel-level malware killing method.
  • the method locates a loaded anti-virus software process in the data structure by acquiring a data structure of an operating system that records a currently-oriented inter-process pointing relationship.
  • the front process and the rear process and modify the pointing relationship between the front process and the rear process to the rear process directly pointing to the front process, which can be used in the operating system to record the process of the anti-virus software in the data structure of the inter-process pointing relationship, so that the malicious
  • the program can't get the process information of the anti-virus software by editing the data structure, so the process of the anti-virus software cannot be closed, and the anti-virus software can be normal to malicious.
  • the program is checked and killed, and the operating system is checked and killed by the hidden anti-virus software to improve security.
  • FIG. 5 is a structural block diagram of a device for killing kernel-level malware according to an embodiment of the present invention.
  • the device 500 includes:
  • the data structure obtaining module 510 is configured to acquire a data structure of an inter-process pointing relationship that is currently running in the operating system;
  • the process locating module 520 is configured to locate a front process and a back process of the loaded anti-virus software process in the data structure, where the front process is a process pointed to by the anti-virus software process, and the rear process is a process directed to the anti-virus software process;
  • the point-to-relationship modification module 530 is configured to modify the pointing relationship between the front process and the back process to directly mark the forward process to the front process;
  • the killing module 540 is configured to perform malware killing on the operating system by using hidden anti-virus software.
  • the data structure obtaining module configuration 510 is configured to obtain, in the following manner, a data structure in the operating system that records the currently running inter-process pointing relationship:
  • the operation of acquiring a data structure in the operating system that records the currently running inter-process pointing relationship is performed by a pre-launched protection tool.
  • the data structure obtaining module 510 includes:
  • the linked list obtaining unit 511 is configured to read, in the memory, a doubly linked list for recording process information of a process currently running by the operating system;
  • the data structure reading unit 512 is configured to read a data structure for recording an inter-process pointing relationship in the doubly linked list.
  • the doubly linked list obtained by the linked list obtaining unit 511 is a PsAcvtiveProcessList linked list.
  • the data structure is an EPROCESS structure
  • the EPROCESS structure includes the LIST_ENTRY structure
  • the LIST_ENTRY structure includes the pointer members FLINK and BLINK
  • the pointer recorded in the FLINK is used to point to the front process of the current EPROCESS structure belongs to the process
  • the pointer recorded in the BLINK is used to point to the process of the current EPROCESS structure. Rear process.
  • the process positioning module 520 includes:
  • the data structure searching unit 521 is configured to search for EPROCESS corresponding to the loaded antivirus software process. structure
  • the pointer reading unit 522 is configured to read the pointers recorded by the pointer members FLINK and BLINK in the EPROCESS structure;
  • the process locating unit 523 is configured to locate the front process and the back process of the antivirus software by using the pointers recorded by the pointer members FLINK and BLINK.
  • the pointing relationship modification module configuration 530 is to extract the self-information of the anti-virus software process in the above-mentioned doubly linked list.
  • the pointing relationship modification module 530 is configured to extract the self-information of the anti-virus software process in the above-mentioned doubly linked list as follows:
  • An embodiment of the present invention provides a device for killing and killing kernel-level malware.
  • the device locates a loaded anti-virus software process in the data structure by acquiring a data structure of an operating system that records a current inter-process pointing relationship.
  • the front process and the rear process and modify the pointing relationship between the front process and the rear process to the rear process directly pointing to the front process, which can be used in the operating system to record the process of the anti-virus software in the data structure of the inter-process pointing relationship, so that the malicious
  • the program can not get the process information of the anti-virus software by editing the data structure, and thus cannot close the process of the anti-virus software, ensuring that the anti-virus software can normally kill and kill the malicious program, and maliciously kill the operating system through the hidden anti-virus software.
  • the killing of software improves security.
  • modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment.
  • the modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components.
  • any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined.
  • Each feature disclosed in this specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.
  • the various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof.
  • Those skilled in the art will appreciate that some or all of some or all of the components of the kernel-level malware killing device in accordance with embodiments of the present invention may be implemented in practice using a microprocessor or digital signal processor (DSP).
  • DSP digital signal processor
  • the invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein.
  • Such a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.
  • Figure 6 illustrates a computing device that can implement a method of kernel level malware killing in accordance with the present invention.
  • the computing device conventionally includes a processor 610 and a computer program product or computer readable medium in the form of a memory 620.
  • the memory 620 may be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM.
  • Memory 620 has a memory space 630 for program code 631 for performing any of the method steps described above.
  • storage space 630 for program code may include various program code 631 for implementing various steps in the above methods, respectively.
  • the program code can be read from or written to one or more computer program products.
  • Such computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks.
  • Such a computer program product is typically a portable or fixed storage unit as described with reference to FIG.
  • the storage unit may have storage segments, storage spaces, and the like that are similarly arranged to memory 620 in the computing device of FIG.
  • the program code can be compressed, for example, in an appropriate form.
  • the storage unit includes computer readable code 631', code that can be read by a processor, such as 610, which, when executed by a computing device, causes the computing device to perform the above Each step in the described method.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Virology (AREA)
  • General Health & Medical Sciences (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Stored Programmes (AREA)

Abstract

一种内核级恶意软件查杀的方法和装置，涉及计算机技术领域。该方法包括：获取操作系统中记录的正在运行的进程间指向关系的数据结构（S102）；定位已加载的杀毒软件进程的前方进程和后方进程，其中，前方进程为杀毒软件进程所指向的进程，后方进程为指向杀毒软件进程的进程（S104）；将前方进程和后方进程的指向关系修改为后方进程直接指向前方进程（S106）。该方法和装置可以在操作系统中用于记录进程间指向关系的数据结构中隐藏杀毒软件的进程，使得恶意程序无法通过编辑该数据结构得到杀毒软件的进程信息，进而无法关闭杀毒软件的进程，保证了杀毒软件能够对恶意程序进行查杀，并通过已隐藏的杀毒软件对操作系统进行恶意软件的查杀，提高了安全性。

Description

内核级恶意软件查杀的方法和装置 技术领域
本发明涉及计算机技术领域，特别是涉及一种内核级恶意软件查杀的方法和装置。
背景技术
目前随着杀毒软件(以下简称杀软)的日益完善，病毒木马与杀软的对抗已经由过去的，免杀逃避等被动行为，转变为主动对抗结束杀软进程等主动行为。恶意程序会根据杀毒软件的名称扫描在操作系统中运行的杀毒软件的进程，并结束杀毒软件的进程，使得杀毒软件不能执行杀毒操作。
比如2012年肆虐我国的十大计算机病毒中的排名第一和第二的病毒，鬼影系列和AV(Anti-Virus，反病毒)终结者系列都会结束杀毒软件的进程，导致中毒后极难查杀。这些病毒会在感染系统后，加载驱动枚举所有的进程，发现是杀软的进程就一律终止进程。由于在内核级进行的处理，导致对抗很困难。
现有的一些技术方案是通过一些专杀，更改名字来进行处理，但由于只要供用户下载的软件，都可以被恶意程序作者获得，所以还是可以被木马加入终止列表中。
一般情况下，只能让用户手动修改随机杀毒软件的名字，来进行启动，但是这种方式导致了很大的麻烦，同时很多杀软自保是根据名字来进行保护的，修改名字也会导致自保失效。
发明内容
鉴于上述问题，提出了本发明以便提供一种克服上述问题或者至少部分地解决上述问题的适于内核级恶意软件查杀的方法和相应的装置。
依据本发明的一个方面，提供一种内核级恶意软件查杀的方法，包括：
获取操作系统中记录当前正在运行的进程间指向关系的数据结构；
在数据结构中定位已加载的杀毒软件进程的前方进程和后方进程，其中，前方进程为杀毒软件进程所指向的进程，后方进程为指向杀毒软件进程的进程；
将前方进程和后方进程的指向关系修改为后方进程直接指向前方进程；
通过已隐藏的杀毒软件对所述操作系统进行恶意软件的查杀。
依据本发明的另一个方面，还提供了一种内核级恶意软件查杀的装置，包括：
数据结构获取模块，配置为获取操作系统中记录当前正在运行的进程间指向关系的数据结构；
进程定位模块，配置为在数据结构中定位已加载的杀毒软件进程的前方进程和后方进程，其中，前方进程为杀毒软件进程所指向的进程，后方进程为指向杀毒软件进程的进程；
指向关系修改模块，配置为将前方进程和后方进程的指向关系修改为后方进程直接指向前方进程；
查杀模块，配置为通过已隐藏的杀毒软件对所述操作系统进行恶意软件的查杀。
根据本发明的又一个方面，提供了一种计算机程序，其包括计算机可读代码，当所述计算机可读代码在计算设备上运行时，导致所述计算设备执行根据上文任一个所述的内核级恶意软件查杀的方法。
根据本发明的再一个方面，提供了一种计算机可读介质，其中存储了上述的计算机程序。
本发明的有益效果为：
本发明提供了一种内核级恶意软件查杀的方法和装置，本发明通过获取操作系统中记录当前正在运行的进程间指向关系的数据结构，在所述数据结构中定位已加载的杀毒软件进程的前方进程和后方进程，并将前方进程和后方进程的指向关系修改为后方进程直接指向前方进程，可以在操作系统中用于记录进程间指向关系的数据结构中隐藏杀毒软件的进程，使得恶意程序无法通过编辑该数据结构得到杀毒软件的进程信息，进而无法关闭杀毒软件的进程，保证了杀毒软件能够正常的对恶意程序进行查杀，并通过已隐藏的杀毒软件对所述操作系统进行恶意软件的查杀，提高了安全性。
上述说明仅是本发明技术方案的概述，为了能够更清楚了解本发明的技术手段，而可依照说明书的内容予以实施，并且为了让本发明的上述和其它目的、特征和优点能够更明显易懂，以下特举本发明的具体实施方式。
附图说明
通过阅读下文优选实施方式的详细描述，各种其他的优点和益处对于本领域普通技术人员将变得清楚明了。附图仅用于示出优选实施方式的目的，而并不认为是对本发明的限制。而且在整个附图中，用相同的参考符号表示相同的部件。在附图中：
图1是根据本发明一个实施例的一种内核级恶意软件查杀的方法流程图；
图2是根据本发明一个实施例的一种内核级恶意软件查杀的具体方法流程图；
图3是根据本发明一个实施例的双向链表的结构示意图；
图4是根据本发明一个实施例的修改指向关系后的双向链表的结构示意图；
图5是根据本发明一个实施例的一种内核级恶意软件查杀的装置结构框图；
图6示意性地示出了用于执行根据本发明的内核级恶意软件查杀的方法的计算设备的框图；以及
图7示意性地示出了用于保持或者携带实现根据本发明的内核级恶意软件查杀的方法的程序代码的存储单元。
具体实施方式
下面结合附图和具体的实施方式对本发明作进一步的描述。
本发明实施例可以应用于计算机系统/服务器，其可与众多其它通用或专用计算系统环境或配置一起操作。适于与计算机系统/服务器一起使用的众所周知的计算系统、环境和/或配置的例子包括但不限于：个人计算机系统、服务器计算机系统、瘦客户机、厚客户机、手持或膝上设备、基于微处理器的系统、机顶盒、可编程消费电子产品、网络个人电脑、小型计算机系统﹑大型计算机系统和包括上述任何系统的分布式云计算技术环境，等等。
计算机系统/服务器可以在由计算机系统执行的计算机系统可执行指令(诸如程序模块)的一般语境下描述。通常，程序模块可以包括例程、程序、目标程序、组件、逻辑、数据结构等等，它们执行特定的任务或者实现特定的抽象数据类型。计算机系统/服务器可以在分布式云计算环境中实施，分布式云计算环境中，任务是由通过通信网络链接的远程处理设备执行的。在分布式云计算环境中，程序模块可以位于包括存储设备的本地或远程计算系统存储介质上。
实施例一
本发明实施例提供了一种内核级恶意软件查杀的方法。该方法对内核级恶意软件查杀的装置进行了改进。例如，本实施例中内核级恶意软件查杀的装置可以为安装在客户端上的工具，其中，客户端可以为PC(Personal Computer，个人计算机)，手机，手持电脑等用户终端，并且该客户端可以运行基于云安全的病毒查杀系统，结合云安全服务器等，以及处理各种不同类型文件的病毒扫描引擎，主动防御模块等，对恶意软件查杀处理。
图1是根据本发明一个实施例的一种内核级恶意软件查杀的方法流程图，该方 法包括步骤S102至S108。
S102，获取操作系统中记录当前正在运行的进程间指向关系的数据结构。
S104，在数据结构中定位已加载的杀毒软件进程的前方进程和后方进程。
其中，前方进程为杀毒软件进程所指向的进程，后方进程为指向杀毒软件进程的进程。
S106，将前方进程和后方进程的指向关系修改为后方进程直接指向前方进程。
S108，通过已隐藏的杀毒软件对操作系统进行恶意软件的查杀。
本发明实施例提供了一种内核级恶意软件查杀的方法，该方法通过获取操作系统中记录当前正在运行的进程间指向关系的数据结构，在所述数据结构中定位已加载的杀毒软件进程的前方进程和后方进程，并将前方进程和后方进程的指向关系修改为后方进程直接指向前方进程，可以在操作系统中用于记录进程间指向关系的数据结构中隐藏杀毒软件的进程，使得恶意程序无法通过编辑该数据结构得到杀毒软件的进程信息，进而无法关闭杀毒软件的进程，保证了杀毒软件能够正常的对恶意程序进行查杀，并通过已隐藏的杀毒软件对所述操作系统进行恶意软件的查杀，提高了安全性。
实施例二
本实施例为上述实施例一的一种具体应用场景，通过本实施例，能够更加清楚、具体地阐述本发明所提供的方法。
图2是根据本发明一个实施例的一种内核级恶意软件查杀的具体方法流程图，该方法包括步骤S201至S208。
需要说明的是，该方法可以通过驱动实现在杀毒软件中，使得杀毒软件在启动时，即可自动隐藏自身进程，使得恶意程序不能发现杀毒软件的进程存在，进而进行恶意程序的扫描和清除操作。
首先，执行步骤S201，接收用户对内核级的恶意软件的查杀请求，启动预设的保护工具，运行用于隐藏杀毒软件的驱动。
本实施例通过驱动实现对杀毒软件的进程的隐藏，当检测到杀毒软件启动时，即立刻运行驱动将杀毒软件的进程隐藏。
上述驱动既可以实现在杀毒软件中，也可以实现在杀毒软件的保护工具中，该保护工具可以是保险箱等。
其中，该驱动利用了操作系统中提供的DKOM(Direct Kernel Object Manipulation，直接内核对象操作)技术。所有的操作系统都在内存中存储特定信息， 通常采用结构或对象的形式，由对象管理器管理。当用户空间进程请求操作系统信息例如进程、线程或设备驱动程序列表时，这些对象被报告给用户。这些对象或结构位于内存中，因此可以直接对其进行修改。
例如，在Windows(窗口)操作系统中，隐藏进程主要关注的Windows关键数据结构是：进程的EPROCESS结构与线程的ETHREAD结构、链表(如进程、线程链表与CPU(Central Processing Unit，中央处理器)的调度链表)等等。本发明通过DKOM对这些数据结构进行操作来达到隐藏进程的目的。
接着，执行步骤S202，即在内存中读取用于记录操作系统中当前正在运行的进程的进程信息的双向链表。
本实施例以Windows操作系统为例，该双向列表为：PsAcvtiveProcessList链表。
需要说明的是，在Windows操作系统中，当系统启动以后，会建立名称为PsAcvtiveProcessList的链表，通过该链表保存当前操作系统中正在运行的进程的进程信息。
其中，恶意程序也是通过扫描该链表得到杀毒软件的进程的进程信息。
在读取到双向链表之后，执行步骤S203，在上述双向链表中读取用于记录进程间指向关系的数据结构。
其中，在Windows操作系统中，上述数据结构即为EPROCESS结构。
在PsAcvtiveProcessList链表中，具有所有进程的EPROCESS结构，每个EPROCESS结构用于保存一个进程的进程信息。
本实施例还提供了图3，展示了双向链表(PsAcvtiveProcessList)的结构示意图。
需要说明的是，在每一个EPROCESS结构中，都具有一个具有指针成员FLINK和BLINK的LIST_ENTRY结构；
其中，FLINK用于记录指向当前进程的前方进程的指针；
BLINK用于记录指向当前进程的后方进程的指针。
在读取到用于记录进程间指向关系的数据结构之后，继续执行步骤S204。在步骤S204中，在数据结构中查找与已加载的杀毒软件进程对应的EPROCESS结构。
需要说明的是，在PsAcvtiveProcessList链表中，每个进程对应于一个EPROCESS结构，且所有进程的EPROCESS结构采用双向链表的方式保存，通过遍历该PsAcvtiveProcessList链表，依次读取进程信息，即可获取已加载的杀毒软件对应的EPROCESS结构。
在执行完步骤S204之后，继续通过步骤S205来读取与杀毒软件对应的EPROCESS结构中的FLINK和BLINK所记录的指针。
其中，EPROCESS结构中的FLINK和BLINK分别用于保存当前进程的前方进程和后方进程的指针，通过获取FLINK和BLINK成员，即可知道当前杀毒软件进程的前方进程和后方进程。
接下来，继续执行步骤S206，即通过上述获取得到的FLINK和BLINK所记录的指针定位得到杀毒软件的前方进程和后方进程。
需要说明的是，通过该步骤，即可得到杀毒软件的进程的前方进程和后方进程对应的EPROCESS结构。
接着，执行步骤S207，在上述双向链表中摘除杀毒软件进程的自身信息。
其中，在上述双向链表中摘除杀毒软件进程的自身信息也即将上述前方进程和后方进程的指向关系修改为后方进程直接指向前方进程。
由于在操作系统中，通过PsAcvtiveProcessList链表中的EPROCESS结构记录进程间的指向关系，因此，在本实施例中，步骤S207具体可通过如下方式实现：
将前方进程对应的EPROCESS结构中的BLINK中记录的指针修改为指向后方进程；
将后方进程对应的EPROCESS结构中的FLINK中记录的指针修改为指向前方进程。
本实施例还提供了图4，展示了修改指向关系后的双向链表(PsAcvtiveProcessList)的结构示意图。
通过上述方式，可以在PsAcvtiveProcessList链表中隐藏杀毒软件的进程的EPROCESS结构，使得恶意程序不能读取到杀毒软件的进程的进程信息，即使调用系统服务ZwQuerySystemInformation也无法找到杀毒软件的进程。而且，并不会影响杀毒软件的进程的运行。
最后，执行步骤S208，通过已隐藏的杀毒软件对所述操作系统进行恶意软件的查杀。
需要说明的是，由于经过步骤S201-S207，杀毒软件已经被隐藏，恶意软件无法关闭杀毒软件，因此可开始进行恶意软件的查杀操作。
其中，本发明提供的杀毒软件，可以适用于检测顽固病毒，并可以适用于进行木马扫描、清理功能、MBR(Master Boot Record，硬盘的主引导记录)修复功能等功能。
本发明所提供的杀毒软件包含顽固病毒和木马扫描、清理功能。为了帮助用户 清理电脑系统中的顽固病毒、木马，本软件在扫描到计算机病毒时，会自动删除病毒文件或者锁定病毒文件禁止其运行。本发明所提供的杀毒软件将对系统的关键项进行扫描并自动处理系统异常情况。查杀结果将在列表中呈现。用户可以在文件隔离区中对部分文件操作进行恢复。
本发明所提供的杀毒软件通过查杀驱动木马等系统底层运行的木马来保护系统的正常运行。扫描过程中会对系统中存在的恶意服务、驱动进行查杀。由于查杀在某些情况下可能造成系统无法正常启动，本软件会在系统中增加一个启动项，用户在修复后如无法启动，可以通过该启动项尝试进行修复。
本发明所提供的杀毒软件具有系统文件修复功能。该功能会对系统中的操作系统自有的关键DLL(Dynamic Link Library，动态链接库)文件进行扫描。当发现缺失的DLL文件时，本软件会从云查询服务器上对丢失的DLL文件进行查询，再选择一个适合用户当前系统的DLL文件下载到用户机器上。此功能可以解决因为木马恶意破坏或其它原因导致系统DLL文件缺失，而致使电脑无法正常工作的问题。用户也可以手动输入缺失的DLL文件的名称进行查找、修复。
本发明所提供的杀毒软件具有MBR修复功能。有些木马会感染计算机的MBR来达到隐藏自身并反复感染计算机系统的目的。该功能可以帮助用户清除MBR中的恶意代码。
并且本发明所提供的杀毒软件可以结合云安全技术，其原理是采集用户电脑上文件的指纹，发送到云服务器上进行分析，从而鉴定文件的安全级别。文件指纹是根据国际通用标准算法计算出的文件唯一标识信息，通常为数十个字节的数字、字母组合，经常使用的算法如MD5(Message Digest Algorithm 5，消息摘要算法第五版)、SHA1(Secure Hash Algorithm 1，安全哈希算法第一版)等。
本发明所提供的保护工具，能够将发现的可疑的可执行程序样本上传至云服务器，由工程师进行分析。并且上传的样本仅限于用于病毒分析的PE(Portable Execute，可移植的执行体)文件，云安全中心服务器已有的样本不会再上传。
本发明实施例提供了一种内核级恶意软件查杀的方法，该方法通过获取操作系统中记录当前正在运行的进程间指向关系的数据结构，在所述数据结构中定位已加载的杀毒软件进程的前方进程和后方进程，并将前方进程和后方进程的指向关系修改为后方进程直接指向前方进程，可以在操作系统中用于记录进程间指向关系的数据结构中隐藏杀毒软件的进程，使得恶意程序无法通过编辑该数据结构得到杀毒软件的进程信息，进而无法关闭杀毒软件的进程，保证了杀毒软件能够正常的对恶意 程序进行查杀，并通过已隐藏的杀毒软件对所述操作系统进行恶意软件的查杀，提高了安全性。
实施例三
图5是本发明一个实施例提供的一种内核级恶意软件查杀的装置结构框图，该装置500包括：
数据结构获取模块510，配置为获取操作系统中记录当前正在运行的进程间指向关系的数据结构；
进程定位模块520，配置为在数据结构中定位已加载的杀毒软件进程的前方进程和后方进程，其中，前方进程为杀毒软件进程所指向的进程，后方进程为指向杀毒软件进程的进程；
指向关系修改模块530，配置为将前方进程和后方进程的指向关系修改为后方进程直接指向前方进程；
查杀模块540，配置为通过已隐藏的杀毒软件对所述操作系统进行恶意软件的查杀。
可选地，所述数据结构获取模块配置510为按照如下方式获取操作系统中记录当前正在运行的进程间指向关系的数据结构：
接收用户对内核级的恶意软件的查杀请求；
通过预先启动的保护工具执行获取操作系统中记录当前正在运行的进程间指向关系的数据结构的操作。
可选地，数据结构获取模块510包括：
链表获取单元511，配置为在内存中读取用于记录操作系统当前正在运行的进程的进程信息的双向链表；
数据结构读取单元512，配置为在双向链表中读取用于记录进程间指向关系的数据结构。
可选地，链表获取单元511获取的双向链表为PsAcvtiveProcessList链表。
可选地，数据结构为EPROCESS结构；
其中，EPROCESS结构中包括LIST_ENTRY结构，LIST_ENTRY结构中包括指针成员FLINK和BLINK，FLINK中记录的指针用于指向当前EPROCESS结构所属进程的前方进程，BLINK中记录的指针用于指向当前EPROCESS结构所属进程的后方进程。
可选地，进程定位模块520包括：
数据结构查找单元521，配置为查找与已加载的杀毒软件进程对应的EPROCESS 结构；
指针读取单元522，配置为读取EPROCESS结构中的指针成员FLINK和BLINK所记录的指针；
进程定位单元523，配置为通过指针成员FLINK和BLINK所记录的指针定位杀毒软件的前方进程和后方进程。
可选地，所述指向关系修改模块配置530为在上述双向链表中摘除杀毒软件进程的自身信息。
可选地，指向关系修改模块530配置为按照如下方式在上述双向链表中摘除杀毒软件进程的自身信息：
将前方进程对应的EPROCESS结构中的BLINK中记录的指针修改为指向后方进程；
将后方进程对应的EPROCESS结构中的FLINK中记录的指针修改为指向前方进程。
本发明实施例提供了一种内核级恶意软件查杀的装置，该装置通过获取操作系统中记录当前正在运行的进程间指向关系的数据结构，在所述数据结构中定位已加载的杀毒软件进程的前方进程和后方进程，并将前方进程和后方进程的指向关系修改为后方进程直接指向前方进程，可以在操作系统中用于记录进程间指向关系的数据结构中隐藏杀毒软件的进程，使得恶意程序无法通过编辑该数据结构得到杀毒软件的进程信息，进而无法关闭杀毒软件的进程，保证了杀毒软件能够正常的对恶意程序进行查杀，并通过已隐藏的杀毒软件对所述操作系统进行恶意软件的查杀，提高了安全性。
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本发明的实施例可以在没有这些具体细节的情况下实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
类似地，应当理解，为了精简本公开并帮助理解各个发明方面中的一个或多个，在上面对本发明的示例性实施例的描述中，本发明的各个特征有时被一起分组到单个实施例、图、或者对其的描述中。然而，并不应将该公开的方法解释成反映如下意图：即所要求保护的本发明要求比在每个权利要求中所明确记载的特征更多的特征。更确切地说，如下面的权利要求书所反映的那样，发明方面在于少于前面公开的单个实施例的所有特征。因此，遵循具体实施方式的权利要求书由此明确地并入该具体实施方式，其中每个权利要求本身都作为本发明的单独实施例。
本领域那些技术人员可以理解，可以对实施例中的设备中的模块进行自适应性地改变并且把它们设置在与该实施例不同的一个或多个设备中。可以把实施例中的模块或单元或组件组合成一个模块或单元或组件，以及此外可以把它们分成多个子模块或子单元或子组件。除了这样的特征和/或过程或者单元中的至少一些是相互排斥之外，可以采用任何组合对本说明书(包括伴随的权利要求、摘要和附图)中公开的所有特征以及如此公开的任何方法或者设备的所有过程或单元进行组合。除非另外明确陈述，本说明书(包括伴随的权利要求、摘要和附图)中公开的每个特征可以由提供相同、等同或相似目的的替代特征来代替。
此外，本领域的技术人员能够理解，尽管在此所述的一些实施例包括其它实施例中所包括的某些特征而不是其它特征，但是不同实施例的特征的组合意味着处于本发明的范围之内并且形成不同的实施例。例如，在下面的权利要求书中，所要求保护的实施例的任意之一都可以以任意的组合方式来使用。
本发明的各个部件实施例可以以硬件实现，或者以在一个或者多个处理器上运行的软件模块实现，或者以它们的组合实现。本领域的技术人员应当理解，可以在实践中使用微处理器或者数字信号处理器(DSP)来实现根据本发明实施例的内核级恶意软件查杀的装置中的一些或者全部部件的一些或者全部功能。本发明还可以实现为用于执行这里所描述的方法的一部分或者全部的设备或者装置程序(例如，计算机程序和计算机程序产品)。这样的实现本发明的程序可以存储在计算机可读介质上，或者可以具有一个或者多个信号的形式。这样的信号可以从因特网网站上下载得到，或者在载体信号上提供，或者以任何其他形式提供。
例如，图6示出了可以实现根据本发明的内核级恶意软件查杀的方法的计算设备。该计算设备传统上包括处理器610和以存储器620形式的计算机程序产品或者计算机可读介质。存储器620可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM、硬盘或者ROM之类的电子存储器。存储器620具有用于执行上述方法中的任何方法步骤的程序代码631的存储空间630。例如，用于程序代码的存储空间630可以包括分别用于实现上面的方法中的各种步骤的各个程序代码631。这些程序代码可以从一个或者多个计算机程序产品中读出或者写入到这一个或者多个计算机程序产品中。这些计算机程序产品包括诸如硬盘，紧致盘(CD)、存储卡或者软盘之类的程序代码载体。这样的计算机程序产品通常为如参考图7所述的便携式或者固定存储单元。该存储单元可以具有与图6的计算设备中的存储器620类似布置的存储段、存储空间等。程序代码可以例如以适当形式进行压缩。通常，存储单元包括计算机可读代码631’，即可以由例如诸如610之类的处理器读取的代码，这些代码当由计算设备运行时，导致该计算设备执行上面所 描述的方法中的各个步骤。
本文中所称的“一个实施例”、“实施例”或者“一个或者多个实施例”意味着，结合实施例描述的特定特征、结构或者特性包括在本发明的至少一个实施例中。此外，请注意，这里“在一个实施例中”的词语例子不一定全指同一个实施例。
应该注意的是上述实施例对本发明进行说明而不是对本发明进行限制，并且本领域技术人员在不脱离所附权利要求的范围的情况下可设计出替换实施例。在权利要求中，不应将位于括号之间的任何参考符号构造成对权利要求的限制。单词“包含”不排除存在未列在权利要求中的元件或步骤。位于元件之前的单词“一”或“一个”不排除存在多个这样的元件。本发明可以借助于包括有若干不同元件的硬件以及借助于适当编程的计算机来实现。在列举了若干装置的单元权利要求中，这些装置中的若干个可以是通过同一个硬件项来具体体现。单词第一、第二、以及第三等的使用不表示任何顺序。可将这些单词解释为名称。
此外，还应当注意，本说明书中使用的语言主要是为了可读性和教导的目的而选择的，而不是为了解释或者限定本发明的主题而选择的。因此，在不偏离所附权利要求书的范围和精神的情况下，对于本技术领域的普通技术人员来说许多修改和变更都是显而易见的。对于本发明的范围，对本发明所做的公开是说明性的，而非限制性的，本发明的范围由所附权利要求书限定。

Claims (18)

  1. 一种内核级恶意软件查杀的方法，包括：
    获取操作系统中记录当前正在运行的进程间指向关系的数据结构；
    在所述数据结构中定位已加载的杀毒软件进程的前方进程和后方进程，其中，所述前方进程为所述杀毒软件进程所指向的进程，所述后方进程为指向所述杀毒软件进程的进程；
    将所述前方进程和所述后方进程的指向关系修改为所述后方进程直接指向所述前方进程；
    通过已隐藏的杀毒软件对所述操作系统进行恶意软件的查杀。
  2. 根据权利要求1所述的方法，其中，所述获取操作系统中记录当前正在运行的进程间指向关系的数据结构，包括：
    接收用户对内核级的恶意软件的查杀请求；
    通过预先启动的保护工具执行获取操作系统中记录当前正在运行的进程间指向关系的数据结构的操作。
  3. 根据权利要求1所述的方法，其中，所述获取操作系统中记录当前正在运行的进程间指向关系的数据结构，包括：
    在内存中读取用于记录所述操作系统当前正在运行的进程的进程信息的双向链表；
    在所述双向链表中读取用于记录进程间指向关系的数据结构。
  4. 根据权利要求3所述的方法，其中，所述双向链表为PsAcvtiveProcessList链表。
  5. 根据权利要求1至4任一项所述的方法，其中，所述数据结构为EPROCESS结构；
    其中，所述EPROCESS结构中包括LIST_ENTRY结构，所述LIST_ENTRY结构中包括指针成员FLINK和BLINK，所述FLINK中记录的指针用于指向当前EPROCESS结构所属进程的前方进程，所述BLINK中记录的指针用于指向当前EPROCESS结构所属进程的后方进程。
  6. 根据权利要求5所述的方法，其中，在所述数据结构中定位已加载的杀毒软件进程的前方进程和后方进程，包括：
    查找与已加载的杀毒软件进程对应的EPROCESS结构；
    读取所述EPROCESS结构中的指针成员FLINK和BLINK所记录的指针；
    通过所述指针成员FLINK和BLINK所记录的指针定位所述杀毒软件的前方进程和后方进程。
  7. 根据权利要求3至6任一项所述的方法，其中，在所述数据结构中定位已加载的杀毒软件进程的前方进程和后方进程，包括：
    在所述双向链表中摘除所述杀毒软件进程的自身信息。
  8. 根据权利要求7所述的方法，其中，所述在所述双向链表中摘除所述杀毒软件进程的自身信息，包括：
    将所述前方进程对应的EPROCESS结构中的BLINK中记录的指针修改为指向所述后方进程；
    将所述后方进程对应的EPROCESS结构中的FLINK中记录的指针修改为指向所述前方进程。
  9. 一种内核级恶意软件查杀的装置，包括：
    数据结构获取模块，配置为获取操作系统中记录当前正在运行的进程间指向关系的数据结构；
    进程定位模块，配置为在所述数据结构中定位已加载的杀毒软件进程的前方进程和后方进程，其中，所述前方进程为所述杀毒软件进程所指向的进程，所述后方进程为指向所述杀毒软件进程的进程；
    指向关系修改模块，配置为将所述前方进程和所述后方进程的指向关系修改为所述后方进程直接指向所述前方进程；
    查杀模块，配置为通过已隐藏的杀毒软件对所述操作系统进行恶意软件的查杀。
  10. 根据权利要求9所述的装置，其中，所述数据结构获取模块配置为按照如下方式获取操作系统中记录当前正在运行的进程间指向关系的数据结构：
    接收用户对内核级的恶意软件的查杀请求；
    通过预先启动的保护工具执行获取操作系统中记录当前正在运行的进程间指向关系的数据结构的操作。
  11. 根据权利要求9所述的装置，其中，所述数据结构获取模块包括：
    链表获取单元，配置为在内存中读取用于记录所述操作系统当前正在运行的进程的进程信息的双向链表；
    数据结构读取单元，配置为在所述双向链表中读取用于记录进程间指向关系的数据结构。
  12. 根据权利要求11所述的装置，其中，所述链表获取单元获取的双向链表为PsAcvtiveProcessList链表。
  13. 根据权利要求9至12任一项所述的装置，其中，所述数据结构为EPROCESS结构；
    其中，所述EPROCESS结构中包括LIST_ENTRY结构，所述LIST_ENTRY结构中包括指针成员FLINK和BLINK，所述FLINK中记录的指针用于指向当前EPROCESS结构所属进程的前方进程，所述BLINK中记录的指针用于指向当前EPROCESS结构所属进程的后方进程。
  14. 根据权利要求13所述的装置，其中，所述进程定位模块包括：
    数据结构查找单元，配置为查找与已加载的杀毒软件进程对应的EPROCESS结构；
    指针读取单元，配置为读取所述EPROCESS结构中的指针成员FLINK和BLINK所记录的指针；
    进程定位单元，配置为通过所述指针成员FLINK和BLINK所记录的指针定位所述杀毒软件的前方进程和后方进程。
  15. 根据权利要求11至14任一项所述的装置，其中，所述指向关系修改模块配置为在所述双向链表中摘除所述杀毒软件进程的自身信息。
  16. 根据权利要求15所述的装置，其中，所述指向关系修改模块配置为按照如下方式在所述双向链表中摘除所述杀毒软件进程的自身信息：
    将所述前方进程对应的EPROCESS结构中的BLINK中记录的指针修改为指向所述后方进程；
    将所述后方进程对应的EPROCESS结构中的FLINK中记录的指针修改为指向所述前方进程。
  17. 一种计算机程序，包括计算机可读代码，当所述计算机可读代码在计算设备上运行时，导致所述计算设备执行根据权利要求1-8中的任一个所述的内核级恶意软件查杀的方法。
  18. 一种计算机可读介质，其中存储了如权利要求17所述的计算机程序。
PCT/CN2014/092133 2013-12-05 2014-11-25 内核级恶意软件查杀的方法和装置 WO2015081791A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310652289.0 2013-12-05
CN201310652289.0A CN103679027A (zh) 2013-12-05 2013-12-05 内核级恶意软件查杀的方法和装置

Publications (1)

Publication Number Publication Date
WO2015081791A1 true WO2015081791A1 (zh) 2015-06-11

Family

ID=50316537

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/092133 WO2015081791A1 (zh) 2013-12-05 2014-11-25 内核级恶意软件查杀的方法和装置

Country Status (2)

Country Link
CN (1) CN103679027A (zh)
WO (1) WO2015081791A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112580030A (zh) * 2019-09-27 2021-03-30 奇安信科技集团股份有限公司 网络系统及半隔离网终端病毒查杀方法和装置
CN113918933A (zh) * 2021-09-26 2022-01-11 北京鲸鲮信息系统技术有限公司 前端进程查杀方法、装置、设备和存储介质
US20230048653A1 (en) * 2021-07-29 2023-02-16 Kyndryl, Inc. Software application deployment

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103679027A (zh) * 2013-12-05 2014-03-26 北京奇虎科技有限公司 内核级恶意软件查杀的方法和装置
CN104156653B (zh) * 2014-08-07 2018-08-03 深圳鼎瑄通讯科技有限公司 一种移动终端的应用保护方法及装置
CN106815523B (zh) * 2015-11-27 2019-10-15 珠海豹趣科技有限公司 一种恶意软件防御方法及装置
CN109829270B (zh) * 2018-12-27 2022-04-15 奇安信科技集团股份有限公司 应用程序防护方法及装置
CN109784059B (zh) * 2019-01-11 2020-11-17 北京中睿天下信息技术有限公司 一种木马文件溯源方法、系统及设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101183418A (zh) * 2007-12-25 2008-05-21 北京大学 一种Windows隐蔽性恶意软件检测方法
CN101206692A (zh) * 2006-12-20 2008-06-25 联想(北京)有限公司 检测进程的方法及设备
CN101477600A (zh) * 2009-01-20 2009-07-08 中国人民解放军保密委员会技术安全研究所 一种基于固件的软件自动防护系统及安全卡
US20130247180A1 (en) * 2007-08-15 2013-09-19 Tracy E. Camp System, method, and computer program product for comparing an object with object enumeration results to identify an anomaly that at least potentially indicates unwanted activity
CN103679027A (zh) * 2013-12-05 2014-03-26 北京奇虎科技有限公司 内核级恶意软件查杀的方法和装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101206692A (zh) * 2006-12-20 2008-06-25 联想(北京)有限公司 检测进程的方法及设备
US20130247180A1 (en) * 2007-08-15 2013-09-19 Tracy E. Camp System, method, and computer program product for comparing an object with object enumeration results to identify an anomaly that at least potentially indicates unwanted activity
CN101183418A (zh) * 2007-12-25 2008-05-21 北京大学 一种Windows隐蔽性恶意软件检测方法
CN101477600A (zh) * 2009-01-20 2009-07-08 中国人民解放军保密委员会技术安全研究所 一种基于固件的软件自动防护系统及安全卡
CN103679027A (zh) * 2013-12-05 2014-03-26 北京奇虎科技有限公司 内核级恶意软件查杀的方法和装置

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112580030A (zh) * 2019-09-27 2021-03-30 奇安信科技集团股份有限公司 网络系统及半隔离网终端病毒查杀方法和装置
CN112580030B (zh) * 2019-09-27 2023-08-01 奇安信科技集团股份有限公司 网络系统及半隔离网终端病毒查杀方法和装置
US20230048653A1 (en) * 2021-07-29 2023-02-16 Kyndryl, Inc. Software application deployment
US12020009B2 (en) * 2021-07-29 2024-06-25 Kyndryl, Inc. Software application deployment
CN113918933A (zh) * 2021-09-26 2022-01-11 北京鲸鲮信息系统技术有限公司 前端进程查杀方法、装置、设备和存储介质

Also Published As

Publication number Publication date
CN103679027A (zh) 2014-03-26

Similar Documents

Publication Publication Date Title
WO2015081791A1 (zh) 内核级恶意软件查杀的方法和装置
Scaife et al. Cryptolock (and drop it): stopping ransomware attacks on user data
US11188650B2 (en) Detection of malware using feature hashing
US9953162B2 (en) Rapid malware inspection of mobile applications
US8844039B2 (en) Malware image recognition
US10133866B1 (en) System and method for triggering analysis of an object for malware in response to modification of that object
US9135443B2 (en) Identifying malicious threads
US8806625B1 (en) Systems and methods for performing security scans
US8176556B1 (en) Methods and systems for tracing web-based attacks
US10216934B2 (en) Inferential exploit attempt detection
US20130247190A1 (en) System, method, and computer program product for utilizing a data structure including event relationships to detect unwanted activity
WO2017053745A1 (en) Malware detection via data transformation monitoring
US20050262567A1 (en) Systems and methods for computer security
US9239922B1 (en) Document exploit detection using baseline comparison
US9202050B1 (en) Systems and methods for detecting malicious files
US20170171240A1 (en) Method and system for identifying uncorrelated suspicious events during an attack
US10097569B2 (en) System and method for tracking malware route and behavior for defending against cyberattacks
WO2018099206A1 (zh) 一种apt检测方法、系统及装置
JP2019079492A (ja) コンボリューションのポピュラリティに基づいて異常なイベントを検出するシステムおよび方法
US8448243B1 (en) Systems and methods for detecting unknown malware in an executable file
WO2014082599A1 (zh) 用于恶意程序查杀的扫描设备、云端管理设备及方法和系统
WO2020014663A1 (en) Systems and methods for detecting obfuscated malware in obfuscated just-in-time (jit) compiled code
US11533323B2 (en) Computer security system for ingesting and analyzing network traffic
US20220201016A1 (en) Detecting malicious threats via autostart execution point analysis
US9239907B1 (en) Techniques for identifying misleading applications

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14868215

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14868215

Country of ref document: EP

Kind code of ref document: A1