Windows文件系统过滤驱动在防病毒方面的应用  

Application of Windows file system filter driver in anti-virus aspect

作　　者：刘伟[1] 胡平[1] 

机构地区：[1]南京工业大学信息科学与工程学院,江苏南京210009

出　　处：《计算机工程与设计》2009年第11期2652-2655,共4页Computer Engineering and Design

摘　　要：在操作系统内核层,对用户模式应用程序请求读写的磁盘数据进行病毒扫描。介绍文件系统过滤驱动的工作原理,利用文件系统过滤驱动,捕获用户应用程序发往目标文件系统驱动的磁盘操作请求,进而获得这些操作请求的处理权。论述防病毒的工作原理,利用文件扫描程序扫描文件系统过滤驱动程序截获的文件数据,并与特征码库中的病毒特征码进行匹配。若匹配成功,则通知用户模式应用程序进行处理;否则,不做处理。防止从磁盘读取病毒文件或将病毒文件写入磁盘。To scan hard-disk data requested by user mode application in operation system kernel layer. At first, the theory of file system filter driver is introduced, and using file system filter driver to obtain the hard-disk read/write request to the targetfile system driver and process it. The principle of anti-virus is discussed, using the file-scan program to scan the data captured by file system filter driver and match with signatures in the signature lib. If successfully, file system filter driver notifies the user-mode application of processing the relative file, otherwise, passer the request to the lower driver without doing anything. The virus-file from reading or writing is prevented.

关 键 词：文件系统过滤驱动 计算机病毒 防病毒 病毒特征码 信息安全 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]