基于文件过滤驱动的病毒防范方法的实现

摘要

计算机病毒给当今社会造成了较大危害，为了有效防止病毒蔓延，针对当前防病毒软件存在的不足，给出了一种基于文件过滤驱动的文件型病毒防护方法。分析了文件过滤驱动原理，通过在文件系统驱动上层附加一层过滤驱动，来截获上层应用对文件的各种操作，阻止可疑应用程序对可执行文件的写操作，达到主动防御文件型病毒的目的。文章从病毒对文件的打开、写入、关闭以及用户层和驱动通信等方面给出了该方法的实现原理。实验证明该方法能够有效对文件型病毒进行防护。%Computer virus is harmful to society. In view of the defect of the virus detection method existing,a new method of virus pre-vention based on file system filter driver is brought forward to prevent computer virus propagation. Analyze the theory of file system filter driver. With attaching a filter driver to the file system driver to obtain upper application operating on the file of the disk,can prevent sus-picious application program to write on executable file. Thus implement the aim of active defense of the computer virus. Present the detail implementation of this method with opening,writing,closing the executable file by virus and commutation between application and driv-er. The result indicates that this method can prevent the computer virus spreading efficiently.