CN101894243A - Immunization method of malicious plugins aiming at network browser - Google Patents

Abstract

The invention discloses an immunization method of malicious plugins aiming at a network browser. The method comprises the following steps of: analyzing known malicious plugins and extracting immunization positions; carrying out access restrictions on the immunization positions to prohibit access to the immunization positions; and allowing to access non-immunization positions. The method provided by the invention can realize immunization and prevention of the known malicious plugins and can effectively prevent the malicious plugins of the browser from being installed in a system.

Description

A kind of immunization method of the malicious plugins at web browser

Technical field

The present invention relates to the network security technology field, particularly a kind of immunization method of the malicious plugins at web browser.

Background technology

At present, at the malicious plugins of web browser by releasing document, write the mode of registration table, make self to be loaded by web browser.Can pop-up advertisement after malicious plugins is loaded, steal the privacy of user data, steal user cipher.Prior art is carried out feature extraction by the analysis to known plug-in unit, realizes detection and cleaning to plug-in unit and derivant thereof, can remove browser malicious plugins and derivant thereof comparatively completely.But can't prevent malicious plugins to reinstall, particularly enter system with other Software Bundlings.So cleaning repeatedly occurs, detect the phenomenon of malicious plugins repeatedly.

Summary of the invention

At above deficiency, the technical problem to be solved in the present invention provides a kind of immunization method of the malicious plugins at web browser, and this method can effectively stop the known malicious plug-in unit to be installed.

In order to solve the problems of the technologies described above, the invention provides a kind of immunization method of the malicious plugins at web browser, comprising:

Analyze the known malicious plug-in unit, determine immune position;

Restrict access is implemented in immune position, disable access immunity position;

Allow the non-immune position of visit.

Further, among the step b, the mode of described enforcement restrict access includes but not limited to:

B1, by the registry access authority is provided with, stop visit to immune position key assignments;

B2, by the file access authority in the new technology file system is provided with, stop visit to immune position paper;

B3, by the file internal data structure in the FAT file system is made amendment, stop visit to immune position paper;

B4, stop visit to immune position by driver;

B5, by of the visit of hardware device tissue to immune position.

Method provided by the invention can realize can effectively stoping the browser malicious plugins to be installed to system to the immunity of known malicious plug-in unit and prevention.For the computing machine that has been infected by malicious plugins, carry out immunity after can using traditional mode to remove malicious plugins, reach the purpose of stopping to clear up repeatedly and detecting malicious plugins repeatedly.

Description of drawings

Fig. 1 is the concrete enforcement figure of the immunization method of the malicious plugins at web browser of the present invention.

Embodiment

Below in conjunction with drawings and Examples technical scheme of the present invention is described in detail.

The immunization method of the malicious plugins at web browser of the present invention comprises the steps: as shown in Figure 1

Analyze the known malicious plug-in unit, determine immune position;

Restrict access is implemented in immune position, disable access immunity position;

Allow the non-immune position of visit.

Among the above-mentioned steps B, the mode of described enforcement restrict access includes but not limited to:

By the registry access authority is provided with, stop visit to immune position key assignments;

By the file access authority in the new technology file system is provided with, stop visit to immune position paper;

By the file internal data structure in the FAT file system is made amendment, stop visit to immune position paper;

By the visit of driver prevention to immune position;

By of the visit of hardware device tissue to immune position.

Further be illustrated with three application examples of the present invention below.

To utilize registry access control of authority ACL (system access-control list) to implement immunity is example:

Suppose through the CLSID of manual analysis plug-in unit to be: 0958BFE2-0B32-DB04-80FC-3F165E4F5062, immune position is: HKEY_CLASSES_ROOT CLSID { 0958BFE2-0B32-DB04-80FC-3F165E4F5062}.Should be as follows with the concrete steps of embodiment:

Set up registry key HKEY_CLASSES_ROOT CLSID { 0958BFE2-0B32-DB04-80FC-3F165E4F5062};

Implement restrict access:

Use API (for example: AtlGetDacl) obtain the Access Control List (ACL) of current registration table key assignments;

(for example: the key authority of AtlSetDacl) setting up in the steps A is set to all users (comprising Admin Account, systematic account) reading and writing refusal, does not have special authority to use API.

The immunity success is then realized in disable access immunity position.

Implementing immunity with registration table surveillance style (bypass registry monitoring) is example:

Suppose through the CLSID of manual analysis plug-in unit to be: 0958BFE2-0B32-DB04-80FC-3F165E4F5062, immune position is: HKEY_CLASSES_ROOT CLSID { 0958BFE2-0B32-DB04-80FC-3F165E4F5062}.

Should be as follows with the concrete steps of embodiment:

Use API (for example: the RegNotifyChangeKeyValue function) to HKEY_CLASSES_ROOT the sub-key of CLSID create and monitor;

Whether when the sub-key of generation is created, detecting key is { 0958BFE2-0B32-DB04-80FC-3F165E4F5062};

The immunity success is then realized in disable access immunity position.

To utilize file access control of authority ACL (system access-control list) to implement immunity is example:

Suppose through the CLSID of manual analysis plug-in unit to be: 0958BFE2-0B32-DB04-80FC-3F165E4F506, immune position is:

C：\Programe?files\Coolbar\a.dll。Should be as follows with the concrete steps of embodiment:

Set up file C: Programe files Coolbar and C: Programe files Coolbar a.dll;

Implement restrict access:

(for example: AtlGetDacl) file of setting up among the obtaining step A and the Access Control List (ACL) of file use API;

(for example: file of AtlGetDacl) setting up in the steps A and file authority are set to all users (comprising Admin Account, systematic account) reading and writing refusal, do not have special authority to use API.

The immunity success is then realized in disable access immunity position.

Certainly; the present invention also can have other various embodiments; under the situation that does not deviate from spirit of the present invention and essence thereof; those of ordinary skill in the art work as can make various corresponding changes and distortion according to the present invention, but these corresponding changes and distortion all should belong to the protection domain of the appended claim of the present invention.

Claims (2)

1. the immunization method at the malicious plugins of web browser is characterized in that, comprising:

A, analysis known malicious plug-in unit are determined immune position;

B, restrict access is implemented in immune position, disable access immunity position;

C, the non-immune position of permission visit.

2. the immunization method of the malicious plugins at web browser as claimed in claim 1, it is characterized in that: among the step b, the mode of described enforcement restrict access includes but not limited to:

B1, by the registry access authority is provided with, stop visit to immune position key assignments;

B2, by the file access authority in the new technology file system is provided with, stop visit to immune position paper;

B3, by the file internal data structure in the FAT file system is made amendment, stop visit to immune position paper;

B4, stop visit to immune position by driver;

B5, by of the visit of hardware device tissue to immune position.

Images