基于文件过滤驱动的病毒防范方法的实现  

Implementation of Virus Prevention Method Based on File System Filter Driver

作　　者：陈建熊[1] 揭摄[1] 张鑫 

机构地区：[1]合肥电子工程学院网络系,安徽合肥230037 [2]武警合肥指挥学院院务部,安徽合肥230031

出　　处：《计算机技术与发展》2013年第3期143-146,共4页Computer Technology and Development

基　　金：国家自然科学基金资助项目(10990011);军内科研计划项目(KY08004)

摘　　要：计算机病毒给当今社会造成了较大危害,为了有效防止病毒蔓延,针对当前防病毒软件存在的不足,给出了一种基于文件过滤驱动的文件型病毒防护方法。分析了文件过滤驱动原理,通过在文件系统驱动上层附加一层过滤驱动,来截获上层应用对文件的各种操作,阻止可疑应用程序对可执行文件的写操作,达到主动防御文件型病毒的目的。文章从病毒对文件的打开、写入、关闭以及用户层和驱动通信等方面给出了该方法的实现原理。实验证明该方法能够有效对文件型病毒进行防护。Computer virus is harmful to society. In view of the defect of the virus detection method existing, a new method of virus pre vention based on file system filter driver is brought forward to prevent computer virus propagation. Analyze the theory of file system filter driver. With attaching a filter driver to the file system driver to obtain upper application operating on the file of the disk, can prevent sus picious application program to write on executable file. Thus implement the aim of active defense of the computer virus. Present the detail implementation of this method with opening, writing, closing the executable file by virus and commutation between application and driv er. The result indicates that this method can prevent the computer virus spreading efficiently.

关 键 词：文件过滤驱动 计算机病毒 主动防御 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]