Method and device for processing computer viruses

Abstract

Disclosed is a method for multiple antivirus engines to clear viruses in parallel. The multiple antivirus engines include at least one first antivirus engine and at least one second antivirus engine. The method for multiple antivirus engines to clear viruses in parallel includes: invoking a first antivirus engine, and scanning a first classified file in a file to be checked for and rid of viruses to obtain a first scanning result which includes a target file in the first classified file ( 101 ); invoking a second antivirus engine, and scanning other file except the target file in the first classified file in the file to be checked for and rid of viruses to obtain a second scanning result ( 102 ); and outputting the first scanning result and the second scanning result ( 103 ). Also disclosed are a device for multiple antivirus engines to clear viruses in parallel, a method for processing a computer virus, and a device for processing a computer virus. The present solution can effectively utilize system resources to enable a plurality of antivirus engines not to scan the same file repeatedly by way of parallel virus-clearing and by clearing a virus for a first classified file using a first antivirus engine according to the antivirus feature of different antivirus engines and clearing a virus by a second antivirus engine for the file for which the first antivirus engine cannot clear a virus.

1 . A method for multiple antivirus engines to clear viruses in parallel, the multiple antivirus engines including at least one first anti-virus engine and at least one second anti-virus engine, the method comprising:
 invoking the first anti-virus engine and scanning a first classified file in a file to be checked for and rid of viruses to obtain a first scanning result, wherein the first scanning result includes a target file in the first classified file;   invoking the second antivirus engine and scanning other file in the file to be checked for and rid of viruses, except the target file in the first classified file, to obtain a second scanning result; and   outputting the first scanning result and the second scanning result.   
     
     
         2 . The method according to  claim 1 , wherein before scanning the first classified file in the file to be checked for and rid of viruses, the method further comprises:
 identifying the first classified file in the file to be checked for and rid of viruses according to a classification feature of the first classified file.   
     
     
         3 . The method according to  claim 1 , wherein the step of scanning the first classified file in the file to be checked for and rid of viruses, comprises:
 sequentially obtaining a preset amount of files in the file to be checked for and rid of viruses;   scanning the first classified file in the preset amount of files by the first anti-virus engine to obtain a first scanning result which includes the target file in the preset amount of files;   inputting other file in the preset amount of files except the target file to the second anti-virus engine; and   without having scanned all the file to be checked for and rid of viruses, go to perform the step of sequentially obtaining a preset amount of files in the file to be checked for and rid of viruses, until the first anti-virus engine has scanned all the file to be checked for and rid of viruses.   
     
     
         4 . The method according to  claim 1 , wherein the target file in the first classified file comprises: a file identified as a malicious file and/or a file identified as a non-malicious file in the first classified file. 
     
     
         5 . The method according to  claim 4 , wherein
 when the first anti-virus engine is a cloud antivirus engine, the step of invoking the first anti-virus engine, and scanning a first classified file in the file to be checked for and rid of viruses, comprises:
 invoking the cloud antivirus engine, scanning a PE type file in the file to be checked for and rid of viruses by a blacklist and a whitelist stored in the cloud antivirus engine, to filter a malicious file matched with the blacklist and a non-malicious file matched with the whitelist; inputting other file in the file to be checked for and rid of viruses except the malicious file and the non-malicious file filtered by the cloud antivirus engine filter to the second anti-virus engine; 
   when the first anti-virus engine is a QVM engine, the step of invoking the first anti-virus engine, and scanning a first classified file in the file to be checked for and rid of viruses, comprising:
 invoking the QVM engine, scanning a PE type file in the file to be checked for and rid of viruses through a blacklist saved in the QVM engine to filter a malicious file matched with the blacklist; and inputting other file in the file to be checked for and rid of viruses except the malicious file filtered by the QVM engine to the second anti-virus engine. 
   
     
     
         6 . The method according to  claim 4 , wherein when the first anti-virus engine is a cloud antivirus engine and a QVM engine, the step of invoking the first anti-virus engine, and scanning the first classified file in the file to be checked for and rid of viruses, comprises:
 invoking the cloud antivirus engine, scanning a PE type file in the file to be checked for and rid of viruses by a blacklist and a whitelist stored in the cloud antivirus engine, to filter a malicious file matched with the blacklist and a non-malicious file matched with a whitelist;   inputting other file in the file to be checked for and rid of viruses except the malicious file and non-malicious file filtered by the cloud antivirus engine filter to the QVM engine;   invoking the QVM engine, scanning a PE type file in other file through a blacklist saved in the QVM engine to filter a malicious file matched with the blacklist; and   inputting a file in the other file except the malicious file filtered by the QVM engine to the second anti-virus engine.   
     
     
         7 . A device for multiple antivirus engines to clear viruses in parallel, the multiple antivirus engines including at least one first anti-virus engine and at least one second anti-virus engine, and the device comprising:
 a first invoking unit, configured to invoke the first anti-virus engine;   a first scanning unit, configured to scan a first classified file in a file to be checked for and rid of viruses by the first anti-virus engine to obtain a first scanning result, wherein the first scanning result includes a target file in the first classified file;   a second invoking unit, configured to invoke the second anti-virus engine;   a second scanning unit, configured to scan, by the second anti-virus engine, other file in the file to be checked for and rid of viruses, except the target file in the first classified file, to obtain a second scanning result; and   an output unit, configured to output the first scanning result and the second scanning result.   
     
     
         8 . The device according to  claim 7 , wherein the device further comprises:
 an identification unit, configured to identify the first classified file in the file to be checked for and rid of viruses according to a classification feature of the first classified file.   
     
     
         9 . The device according to  claim 7 , wherein the first scanning unit further comprises:
 a file obtaining sub-unit, configured to sequentially obtain a preset amount of file in the file to be checked for and rid of viruses;   a file scanning sub-unit, configured to scan the first classified file in the preset amount of files by the first anti-virus engine to obtain a first scanning result including the target file in the preset amount of files;   a file inputting sub-unit, configured to input other file in the preset amount of files except the target file to the second anti-virus engine; and   a determining-triggering sub-unit, configured to, without having scanned all the file to be checked for and rid of viruses, go to perform to a function of triggering and executing the file obtaining sub-unit, until the first anti-virus engine has scanned all the file to be checked for and rid of viruses.   
     
     
         10 . The device according to  claim 8 , wherein
 the first invoking unit is specifically configured to, when the first anti-virus engine is a cloud antivirus engine, invoke the cloud antivirus engine; and   the first scanning unit is specifically configured to scan a PE type file in the file to be checked for and rid of viruses by a blacklist and a whitelist stored in the cloud antivirus engine, to filter a malicious file matched with the blacklist and a non-malicious file matched with the whitelist; and input other file in the file to be checked for and rid of viruses except the malicious file and the non-malicious file filtered by the cloud antivirus engine filter to the second anti-virus engine.   
     
     
         11 . The device according to  claim 10 , wherein
 the first invoking unit is specifically configured to, when the first anti-virus engine is a QVM engine, invoke the QVM engine; and   the first scanning unit is specifically configured to scan a PE type file in the file to be checked for and rid of viruses through a blacklist saved in the QVM engine to filter a malicious file matched with the blacklist; and input other file in the file to be checked for and rid of viruses except the malicious file filtered by the QVM engine to the second anti-virus engine.   
     
     
         12 . A method for processing a computer virus, wherein several virus scanning modes which occupy different system resources during file scanning is pre-set, and the method comprises:
 obtaining a file to be scanned; and   invoking a corresponding virus scanning mode to scan the file to be scanned from a virus scanning mode which occupies lest system resources to a virus scanning mode which occupies most system resources in the several virus scanning modes.   
     
     
         13 . The method according to  claim 12 , wherein the several virus scanning modes at least includes a first virus scanning mode and a second virus scanning mode, the first virus scanning mode occupies less system resources than the second virus scanning mode; and
 the step of invoking a corresponding virus scanning mode to scan a file to be scanned, comprises:
 invoking the first virus scanning mode to scan the file to be scanned to obtain a determine file in the file to be scanned; and 
 invoking the second virus scanning mode to only scan other file in the file to be scanned except the target file. 
   
     
     
         14 . The method according to  claim 12 , wherein the several virus scanning modes are arranged from a virus scanning mode which occupies lest system resources to a virus scanning mode which occupies most system resources in the several virus scanning modes, and include at least two of the following modes:
 a memory scanning mode of scanning a virus according to a scanning result of the scanned file saved in a cache, wherein the scanning result includes file attribute information of a file identified as a malicious file or a non-malicious file, and the file attribute information includes file size, file modification time and a file path;   a list scanning mode of scanning a virus through pre-saved at least one of a blacklist and a whitelist; and   an engine scanning mode of scanning a virus by the antivirus engine.   
     
     
         15 . The method according to  claim 14 , wherein the step of, invoking a corresponding virus scanning mode to scan the file to be scanned from a virus scanning mode which occupies lest system resources to a virus scanning mode which occupies most system resources in the several virus scanning modes, comprises:
 invoking the memory scanning mode to scan the file to be scanned, to obtain a first scanning result including a first target file;   invoking the list scanning mode to only scan other file in the file to be scanned except the first target file, to obtain a second scanning result including a second target file; and   invoking the engine scanning mode to only scan a remaining file in the other file except the second target file to obtain a third scanning result including a third target file.   
     
     
         16 . The method according to  claim 15 , wherein the step of employing the memory scanning mode to scan the file to be scanned, comprises:
 obtaining file attribute information of the file to be scanned;   matching the file attribute information with file attribute information saved in the cache; and   when the file attribute of the file to be scanned is matched with the file attribute saved in the cache, identifying the file to be scanned as a malicious file or a non-malicious file, and when the file attribute of the file to be scanned is not matched with the file attribute saved in the cache, identifying the file to be scanned as other file to be scanned by the list scanning mode.   
     
     
         17 . The method according to  claim 15 , wherein
 the step of scanning, by the pre-saved blacklist, other file scanned by the memory scanning mode except the first target file, comprises:
 comparing a filename of each file in the other file with a filename pre-saved in the blacklist, and when a filename of a certain file is matched with a pre-saved filename, determining that the certain file belongs to a malicious file of the second target file; 
 the step of scanning, by the pre-saved whitelist, other file scanned by the memory scanning mode except the first target file, comprises: 
 comparing a filename of each file in the other file with a filename pre-saved in the whitelist, and when a filename of a certain file is matched with a pre-saved filename, determining that the certain file belongs to a non-malicious file of the second target file. 
   
     
     
         18 - 23 . (canceled)