基于PE文件的病毒防治技术研究

本文提出了两种防范PE文件病毒的技术:一种是分析PE文件格式和病毒对PE文件的感染方式,通过PE自身文件结构的改进来防范病毒;另一种是基于PE文件自我完整性检查的计算机病毒的免疫方法,采用单向散列函数MD5算法抽取摘要,通过比较两个摘要值来判断是否存在病毒,如果存在病毒启用恢复程序来恢复文件。相对于传统的特征码匹配方法,这些技术不依靠病毒库,可以防范未知病毒。

Research on anti-virus technology based on portable executable file

This paper proposes two kinds of technology to defend portable executable file viruses.The first technology analyses the format of portable executable file and the ways that virus infects the portable executable file,and thus defend viruses through improving the self-structure of portable executable file;The other technology is a kind of computer virus immune method which is based on self-integrality examination of portable executable file. It adopts unilateralist hashing function MD5 algorithm to acquire abstract.We judge whether it has viruses by comparing the two abstract values,and start resuming procedure to resume file if it has viruses.Compared with traditional character code matching method,these technology can prevent unknown viruses without virus library.