CN103093145B - A kind of methods, devices and systems scanning movable storage device - Google Patents

Abstract

The invention discloses a method, device and system for scanning mobile storage devices, and relates to the technical field of information security. The method includes: enumerating the root directory files of the mobile storage device, adding the root directory files matching the blacklist, special rule list or cloud query type list to the scan list, scanning the non-root directory files of the mobile storage device, and The items matching the non-root directory path in the blacklist are added to the scan list, the cloud query type in the scan list is sent to the server, the security information fed back by the server is saved in the scan list, and the items in the scan list are compared with the The whitelist is matched, the security information of the matched item is modified to be trusted, and the information in the scan list is displayed. The technical scheme of the present invention can scan the mobile storage device when it is connected to the terminal, and effectively find out risky files, thereby solving the problem that the risky files on the mobile storage device endanger the security of the terminal.

Description

A method, device and system for scanning mobile storage devices

technical field

The invention relates to the technical field of information security, in particular to a method, device and system for scanning mobile storage devices.

Background technique

A mobile storage device refers to a storage device that can be moved between different terminals, including a USB flash drive, a mobile hard disk, and a flash memory card. People often use mobile storage devices to back up, carry and transfer files. Some mobile storage devices have a USB (UniversalSerialBUS, Universal Serial Bus) interface. When you need to read and write data on this mobile storage device, you need to connect it to the computer through the Universal Serial Bus interface, and after use After that, it needs to be uninstalled from the computer according to the prescribed procedure before it can be pulled out from the universal serial bus interface. For example, the user usually needs to click the button displayed as "Safely Remove Hardware" in the lower right corner of the taskbar. When the "Safely Remove USBMassStorageDevice-driver" prompt pops up, click the prompt, wait until the "Safely Remove Hardware" button disappears, and then remove the Unplug the removable storage device from the Universal Serial Bus interface.

With the development of network technology, many viruses and Trojan horses targeting mobile storage devices have also appeared, seriously endangering computer security. And due to the mobility of mobile storage devices, viruses can spread to many computers after infection.

Therefore, it is necessary to scan the mobile storage device to seize risky files when it is connected to the computer.

Contents of the invention

In view of the above problems, the present invention is proposed to provide a method, device and system for scanning mobile storage devices that overcome the above problems or at least partially solve the above problems.

According to one aspect of the present invention, a method for scanning a mobile storage device is provided, wherein the method includes:

Enumerate the root directory files of the mobile storage device, and for at least one root directory file enumerated, determine whether the root directory file matches any item in the pre-saved blacklist, special rule list or cloud query type list, If yes, add the root directory file to the scan list;

Scan the non-root directory files of the mobile storage device, if there is a non-root directory file matching the non-root directory path in the blacklist, then add the matching non-root directory file to the scan list;

Send the cloud query type in the scan list to the server for security query, and save the security information fed back by the server to the scan list;

Match each item in the scan list with the pre-saved white list, and modify the security information of the matched item to be trusted;

Display the information in the scan list.

Optionally, enumerating the root directory files of the mobile storage device includes: enumerating all root directory files of the mobile storage device if the number of root directory files of the mobile storage device is less than or equal to a preset number ; If the number of root directory files of the mobile storage device is more than a preset number, enumerate the preset number of root directory files of the mobile storage device.

Optionally, the displaying the information in the scanning list includes: if the scanning list contains hidden files, prompting the user whether to display the hidden files, and displaying the hidden files when the user chooses to confirm.

Optionally, after displaying the information in the scan list, the method further includes: according to the user instruction, correspondingly process the items whose security information in the scan list indicates risk; on display.

Optionally, before enumerating the root directory files of the mobile storage device, the method further includes: checking the autorun.inf file in the mobile storage device, and judging whether the executable file pointed to by the autorun.inf file is If there is a risk, add the executable file to the scan list and prevent the system from starting the file pointed to by the autorun.inf file.

Optionally, before displaying the information in the scan list, the method further includes: matching items in the scan list with a trustworthy list, and modifying the security information of the matched items to trustworthy.

Optionally, for the enumerated at least one root directory file, it is judged whether the root directory file matches any item in the pre-saved blacklist, special rule list or cloud query type list, and if so, the root directory file Files added to the scan list include:

Step A, judging whether the root directory file matches any item in the blacklist, if yes, add the root directory file to the scan list, otherwise perform step B;

Step B, judging whether the root directory file matches any item in the special rule list, if yes, add the root directory file to the scan list, otherwise perform step C;

Step C, judging whether the root directory file matches any item in the cloud query type list, and if so, adding the root directory file to the scan list.

Optionally, the pre-saved blacklist, special rule list, cloud query type list and whitelist are saved locally or saved on the server side.

Optionally, the method further includes before enumerating the root directory files of the mobile storage device:

Load the scan logic implementation file;

The scanning logic realizes the file loading and saves the scanning rule file of blacklist, special rule list, cloud query type list and white list.

According to another aspect of the present invention, a device for scanning mobile storage devices is provided, wherein the device includes: a storage unit, a scanning unit, a security query unit, a security information correction unit, and a display unit;

The storage unit is suitable for storing blacklists, special rule lists, cloud query type lists and white lists;

The scanning unit is adapted to enumerate the root directory files of the mobile storage device, and for at least one root directory file enumerated, judge whether the root directory file matches the blacklist or special file in the storage unit or on the server side. Any item in the rule list or cloud query type list, add the root directory file to the scan list, and then scan the non-root directory file of the mobile storage device, if there is a non-root directory path in the blacklist matching non-root directory file, then add the matching non-root directory file to the scan list;

The security query unit is suitable for sending the cloud query type in the scan list to the server for security query, and correspondingly saving the security information fed back by the server into the scan list;

The security information correction unit is adapted to match the items in the scan list with the white list in the storage unit or on the server side, and modify the security information of the matching items to be trustworthy;

The display unit is suitable for displaying information in the scan list.

Optionally, the scanning unit is adapted to enumerate all root directory files of the mobile storage device when the number of root directory files of the mobile storage device is less than or equal to a preset number, and is adapted to When the number of root directory files of the mobile storage device is more than a preset number, enumerate the preset number of root directory files of the mobile storage device.

Optionally, the display unit is further adapted to prompt the user whether to display the hidden file when the hidden file is included in the scanning list, and display the hidden file when the user chooses to confirm.

Optionally, the device further includes:

The processing display unit is adapted to process the items in the scan list that are risky according to the user's instruction, and display the processing results on the user interface of the computer after the processing is completed.

Optionally, the scanning unit, before enumerating the root directory files of the mobile storage device, is further adapted to check the autorun.inf file in the mobile storage device, and determine the executable file pointed to by the autorun.inf file If there is a risk, add the executable file to the scan list and prevent the system from starting the file pointed to by the autorun.inf file.

Optionally, the security information modifying unit is further adapted to match the items in the scan list with the trustworthy list, and modify the security information of the matched items to be trustworthy.

Optionally, the scanning unit is adapted to judge whether the enumerated at least one root directory file matches any of the blacklist, special rule list or cloud query type list according to the following order:

Step A, judging whether the root directory file matches any item in the blacklist, if yes, add the root directory file to the scan list, otherwise perform step B;

Step B, judging whether the root directory file matches any item in the special rule list, if yes, add the root directory file to the scan list, otherwise perform step C;

Step C, judging whether the root directory file matches any item in the cloud query type list, and if so, adding the root directory file to the scan list.

According to another aspect of the present invention, a system for scanning mobile storage devices is provided, wherein the system includes: a server and one or more devices as described in any one of the above;

The server is adapted to save a blacklist, a special rule list, a cloud query type list and a white list for the device to query, and is adapted to provide the device with a cloud query type of security query.

According to the present invention, the root directory file of the mobile storage device is first enumerated, and any root directory file matching the local or server-side blacklist, special rule list or cloud query type list is added to the scan list, Then scan the non-root directory files of the mobile storage device, add the non-root directory files matching the non-root directory path in the blacklist to the scan list, send the cloud query type in the scan list to the server for security query, and The security information fed back by the server is correspondingly stored in the scan list, the items in the scan list are matched with the pre-saved white list, the security information of the matching items is modified to be trusted, and the technical solution for displaying the information in the scan list can be When the mobile storage device is connected to the terminal, the mobile storage device is scanned, and risky files are effectively seized, thereby solving the problem that the risky files on the mobile storage device endanger the security of the terminal.

The above description is only an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and understandable , the specific embodiments of the present invention are enumerated below.

Description of drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiment. The drawings are only for the purpose of illustrating a preferred embodiment and are not to be considered as limiting the invention. Also throughout the drawings, the same reference numerals are used to designate the same components. In the attached picture:

Fig. 1 shows a flow chart of a method for scanning a mobile storage device according to an embodiment of the present invention;

Fig. 2 shows a flowchart of a method for scanning a mobile storage device according to an embodiment of the present invention;

FIG. 3 shows a structural diagram of an apparatus for scanning mobile storage devices according to an embodiment of the present invention;

FIG. 4 shows a structural diagram of an apparatus for scanning mobile storage devices according to an embodiment of the present invention;

Fig. 5 shows a schematic composition diagram of a system for scanning mobile storage devices according to an embodiment of the present invention.

detailed description

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided for more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

Fig. 1 shows a flowchart of a method for scanning a mobile storage device according to an embodiment of the present invention. As shown in Figure 1, the method includes:

S110, enumerate the root directory files of the mobile storage device, and for at least one root directory file enumerated, determine whether the root directory file matches any of the pre-saved blacklist, special rule list or cloud query type list item, if yes, add the root directory file to the scan list.

In one embodiment of the present invention, if the number of root directory files of the mobile storage device is less than or equal to the preset number, all root directory files of the mobile storage device are enumerated; If the number is more than the preset number, enumerate the preset number of root directory files of the mobile storage device. This solution is mainly aimed at controlling the scanning time of the U disk. If the number of files in the root directory of the U disk is very large, it will take a long time to scan all of them, and the user experience is not good. Set the number of root directory files. For example, the preset number is 100. When the root directory files of the U disk are less than or equal to 100, all root directory files are scanned; when the root directory files of the U disk are more than 100, only 100 root directory files are scanned.

S120. Scan the non-root directory files of the mobile storage device, and if there is a non-root directory file matching the non-root directory path in the blacklist, add the matched non-root directory file to the scanning list.

In one embodiment of the present invention, when scanning non-root directory files, there is no restriction on the number of files, that is, all non-root directory files are scanned regardless of the number of non-root directory files.

S130. Send the cloud query type in the scan list to the server for security query, and correspondingly save the security information fed back by the server into the scan list.

S140. Match each item in the scan list with a pre-saved white list, and modify the security information of the matched item to be trustworthy.

S150, displaying information in the scan list.

Wherein, the pre-saved blacklist, special rule list, cloud query type list and whitelist are stored locally or stored on the server side.

In one embodiment of the present invention, the scanning shown in FIG. 1 is performed according to the locally saved blacklist, special rule list, cloud query type list and whitelist. At this time, since the matching information is all locally, the scanning speed is fast. In another embodiment of the present invention, the scanning shown in Figure 1 is carried out according to the blacklist, special rule list, cloud query type list and white list of the server side, that is, it is necessary to query the server for relevant information, which can be done in the server The terminal maintains the latest blacklist, special rule list, cloud query type list and whitelist, so the accuracy of the scanning results is very high.

The technical solution shown in Figure 1 can scan the mobile storage device when the mobile storage device is connected to the terminal, and effectively seize the risky files, thereby solving the problem that the risky files on the mobile storage device endanger the security of the terminal .

In the embodiment of the present invention, the blacklist refers to a collection of files (such as virus files, Trojan programs, etc.) that have been confirmed as risky. These risky files can be indicated by their filenames. In some cases, the specified file in the specified directory is a risky file, so the file name and path will also be given in the blacklist. For example, the blacklist in one embodiment of the present invention can include the following content:

oso.exe

rising.exe

Here is just an example of the content contained in the blacklist, and it cannot be used as a restriction on the blacklist. In actual situations, all files that have been confirmed as risky can be added to the blacklist based on experience.

In the embodiment of the present invention, the special rule list is a set of risky files conforming to special rules. For example, the list of special rules in one embodiment of the present invention may include the following rules:

(1). Whether there is usp10.dll/ws2help.dll/msimg32.dll/lpk.dll, if it exists, it is a PE file, without signature, it will report poison.

(2).Whether desktop.ini exists, and the file size is between 20 bytes and 1024 bytes, scan the file for the following string (case insensitive) iconfile=recycle.exe, if there is, report poison .

Here is just an example of the special rules, and it cannot be used as a limitation on the list of special rules. In actual situations, special rules that match risk files can be added to the list of special rules based on experience.

In the embodiment of the present invention, the cloud query type list is a collection of files that need to be cloud queryed. The files that need to be queried by the cloud are files whose security information is not clear and need to be queried on the server side.

In the embodiment of the present invention, the white list refers to a collection of safe files that have been confirmed as risk-free.

When actually implementing the method shown in FIG. 1 , specifically, the scanning logic can be written into the scanning logic implementation file, and the blacklist, special rule list, cloud query type list and whitelist can be written into the scanning rule file. Then when scanning a mobile storage device (such as a U disk), first load the scan logic implementation file, and the scan logic implementation file loads the scan rule file containing the blacklist, special rule list, cloud query type list and white list, and then the scan The logic implementation file completes the scanning of the mobile storage device according to the content in the scanning rule file according to the method shown in FIG. 1 .

Fig. 2 shows a flowchart of a method for scanning a mobile storage device according to an embodiment of the present invention. As shown in Figure 2, the method includes:

Step S202, check the autorun.inf file in the mobile storage device.

autorun.inf is one of the more common files in computer use. Its function is to allow a specified file to be automatically run when the disk is double-clicked. However, in recent years, there have been cases of using autorun.inf files to spread Trojan horses or viruses. It makes the target program execute through the user's misoperation, and achieves the purpose of invading the computer, which has brought great negative effects.

Therefore, in this step, check the autorun.inf file in the mobile storage device to determine whether the executable file pointed to by the autorun.inf file is at risk, and if so, add the executable file to the scan list and prevent the system from starting The file pointed to by the autorun.inf file.

Step S204, enumerating root directory files in the mobile storage device.

In this step, the root directory files in the mobile storage device are listed one by one, and the processes from step S206 to step S214 are executed for the listed root directory files.

Step S206, judging whether the currently enumerated root directory file matches an item in the blacklist, if yes, execute step S212, otherwise execute step S208.

Step S208, judging whether the currently enumerated root directory file matches an item in the special rule list, if yes, execute step S212, otherwise execute step S210.

Step S210, judging whether the currently enumerated root directory file matches an item in the cloud query type list, if yes, execute step S212, otherwise execute step S214.

Step S212, adding matching root directory files to the scan list.

Step S214, judging whether the enumeration of root directory files is completed, if yes, execute step S216, otherwise return to step S204.

Step S216, scanning the non-root directory files of the mobile storage device, if there is a non-root directory file matching the non-root directory path in the blacklist, adding the matching non-root directory file to the scan list.

For example, the file recycier\system.exe is included in the mobile storage device. Since this item is also included in the blacklist, the match is successful and it will be added to the scan list.

Step S218, sending the cloud query type in the scan list to the server for security query, and correspondingly saving the security information fed back by the server into the scan list.

In this step, items matching the cloud query type list are sent to the server for security information query.

Step S220, matching the items in the scan list with the white list and the trusted list, and modifying the security information of the matched items to be trusted.

In this step, the content in the scan list is matched with the white list and trusted list. Wherein, the white list can be stored locally or on the server side, and if it is on the server side, it is necessary to query the server for the white list. The trustworthy list may be created by the user, and the user may add some confirmed trustworthy files to the list, and the trustworthy list may be updated subsequently.

In the embodiment of the present invention, the order in which items in the scan list are matched with the white list and the trusted list is not limited. That is, the items in the scan list can be matched with the white list first, and then matched with the trusted list, or the items in the scan list can be matched with the trusted list first, and then matched with the white list.

Step S222, displaying information in the scan list.

In this step, the information in the scan list is displayed to the user. Information in the scan list includes file names and corresponding security information. In an embodiment of the present invention, the security information can be represented by a security level. A higher security level indicates a lower risk and is more secure, whereas a lower security level indicates a higher risk and is less secure. Set the security level of each item in the blacklist, special rule list or cloud query type list. When adding items matching the blacklist, special rule list or cloud query type list to the scan list, the corresponding security level will also be Also added to the scan list. For example, if the security level is set higher, it means that the risk is smaller and more secure, and the security level 10 is the level of a trusted file, then in step S220, the security level of the item matched with the white list and the user-defined trusted list will be determined. The level is corrected to 10.

In this step, the hidden files can also be processed, specifically: if the hidden files are included in the scanning list, the user is prompted whether to display the hidden files, and when the user chooses to confirm, the hidden files are displayed.

So far, the flow of the method shown in FIG. 2 is completed, and the security scanning of the mobile storage device is realized, and risky files are effectively seized, thus solving the problem that the risky files on the mobile storage device endanger the security of the terminal.

In one embodiment of the present invention, the method shown in FIG. 2 may further include after step S222: according to the user instruction, correspondingly process items in the scan list whose security information indicates risk; displayed on the user interface of the computer. Specifically, when the information in the scan list is displayed on the user interface, the user is prompted to delete or quarantine risky files. The content is deleted or quarantined, and the processing results are displayed to the user after the processing is completed, such as successful quarantine.

Fig. 3 shows a structural diagram of an apparatus for scanning a mobile storage device according to an embodiment of the present invention. As shown in FIG. 3 , the device 300 includes: a storage unit 310 , a scanning unit 320 , a security query unit 330 , a security information correction unit 340 and a display unit 350 .

The storage unit 310 is adapted to store a blacklist, a special rule list, a cloud query type list and a whitelist.

The scanning unit 320 is adapted to enumerate the root directory files of the mobile storage device, and for at least one root directory file enumerated, judge whether the root directory file matches the blacklist, special rule list or cloud list in the storage unit 310 or on the server side. Query any item in the type list, add the root directory file to the scan list, and then scan the non-root directory file of the mobile storage device, if there is a non-root directory file matching the non-root directory path in the blacklist , the matching non-root directory file is added to the scan list.

The security query unit 330 is adapted to send the cloud query type in the scan list to the server for security query, and correspondingly save the security information fed back by the server into the scan list.

The security information modification unit 340 is adapted to match the items in the scan list with the white list in the storage unit 310 or on the server side, and modify the security information of the matched items to be trusted.

The display unit 350 is adapted to display information in the scan list.

The device shown in Figure 3 can scan the mobile storage device when the mobile storage device is connected to the terminal, and effectively seize risky files, thus solving the problem that the risky files on the mobile storage device endanger the security of the terminal.

Fig. 4 shows a structural diagram of an apparatus for scanning a mobile storage device according to an embodiment of the present invention. As shown in FIG. 4 , the device 400 includes: a storage unit 410 , a scanning unit 420 , a security query unit 430 , a security information modification unit 440 , a display unit 450 and a processing display unit 460 .

The storage unit 410 is adapted to store a blacklist, a special rule list, a cloud query type list and a whitelist.

The scanning unit 420 is adapted to enumerate the root directory files of the mobile storage device, and for each root directory file enumerated, it is judged whether the root directory file matches the blacklist, special rule list or cloud list in the storage unit 410 or on the server side. Query any item in the type list, add the root directory file to the scan list, and then scan the non-root directory file of the mobile storage device, if there is a non-root directory file matching the non-root directory path in the blacklist , the matching non-root directory file is added to the scan list.

In one embodiment of the present invention, the scanning unit 420 is adapted to, for each root directory file enumerated, judge whether to match any item in the blacklist, special rule list or cloud query type list according to the following sequence: Step A , to judge whether the root directory file matches any item in the blacklist, if yes, add the root directory file to the scan list, otherwise perform step B; step B, judge whether the root directory file matches any item in the special rule list One item, if yes, add the root directory file to the scan list, otherwise perform step C; step C, judge whether the root directory file matches any item in the cloud query type list, if so, add the root directory file to scan list.

In one embodiment of the present invention, the scanning unit 420 is adapted to enumerate all root directory files of the mobile storage device when the number of root directory files of the mobile storage device is less than or equal to a preset number, and is adapted to When the number of root directory files of the mobile storage device is more than the preset number, enumerate the preset number of root directory files of the mobile storage device. For example, the preset number may be 100.

In one embodiment of the present invention, the scanning unit 420 may be further adapted to check the autorun.inf file in the mobile storage device before enumerating the root directory files of the mobile storage device, and determine the autorun.inf file pointed to by the autorun.inf file. If there is a risk in executing the file, add the executable file to the scan list and prevent the system from starting the file pointed to by the autorun.inf file.

The security query unit 430 is adapted to send the cloud query types in the scan list to the server for security query, and store the security information fed back by the server into the scan list.

The security information modification unit 440 is adapted to match the items in the scan list with the white list in the storage unit 410 or on the server side, and modify the security information of the matched items to be trusted.

In an embodiment of the present invention, the security information modifying unit 440 may be further adapted to match the items in the scan list with the trusted list, and modify the security information of the matched items to be trusted.

The display unit 450 is adapted to display information in the scan list. In an embodiment of the present invention, the display unit 450 may be further adapted to prompt the user whether to display the hidden file when the hidden file is included in the scanning list, and display the hidden file when the user chooses to confirm.

The processing and displaying unit 460 is adapted to process correspondingly risky items in the scan list according to user instructions, and display the processing results on the user interface of the computer after the processing is completed.

Fig. 5 shows a schematic composition diagram of a system for scanning mobile storage devices according to an embodiment of the present invention. As shown in FIG. 5 , the system includes: a server 501 and one or more devices 502 for scanning mobile storage devices.

Wherein, the device 502 for scanning a mobile storage device is the device 300 for scanning a mobile storage device as shown in FIG. 3 , or it may be the device 400 for scanning a mobile storage device as shown in FIG. 4 . The server 501 is adapted to save the blacklist, special rule list, cloud query type list and white list for query by the device 502 for scanning mobile storage devices, and is suitable for providing cloud query type security queries for the device 502 for scanning mobile storage devices.

In summary, according to the present invention, the root directory file of the mobile storage device is first enumerated, and the root directory file matching any one of the local or server-side blacklist, special rule list or cloud query type list is added Go to the scan list, then scan the non-root directory files of the mobile storage device, add the non-root directory files matching the non-root directory path in the blacklist to the scan list, and send the cloud query type in the scan list to the server Perform a security query, save the security information fed back from the server to the scan list, match the items in the scan list with the pre-saved white list, modify the security information of the matching item to trustworthy, and display the information in the scan list The technical solution can scan the mobile storage device when the mobile storage device is connected to the terminal, and effectively seize the risky files, thereby solving the problem that the risky files on the mobile storage device endanger the security of the terminal.

It should be noted:

The algorithms and displays presented herein are not inherently related to any particular computer, virtual system, or other device. Various generic systems can also be used with the teachings based on this. The structure required to construct such a system is apparent from the above description. Furthermore, the present invention is not specific to any particular programming language. It should be understood that various programming languages can be used to implement the content of the present invention described herein, and the above description of specific languages is for disclosing the best mode of the present invention.

In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure the understanding of this description.

Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, in order to streamline this disclosure and to facilitate an understanding of one or more of the various inventive aspects, various features of the invention are sometimes grouped together in a single embodiment, figure, or its description. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art can understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. Modules or units or components in the embodiments may be combined into one module or unit or component, and furthermore may be divided into a plurality of sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings), as well as any method or method so disclosed, may be used in any combination, except that at least some of such features and/or processes or units are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will understand that although some embodiments described herein include some features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the invention. and form different embodiments. For example, in the following claims, any one of the claimed embodiments may be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) can be used in practice to implement some or all of some or all of the components in the device and system for scanning mobile storage devices according to the embodiments of the present invention Features. The present invention can also be implemented as an apparatus or an apparatus program (for example, a computer program and a computer program product) for performing a part or all of the methods described herein. Such a program for realizing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet site, or provided on a carrier signal, or provided in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means can be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. does not indicate any order. These words can be interpreted as names.

Claims (17)

1. scan a method for movable storage device, wherein, the method comprises:

Enumerate the root directory file of described movable storage device, for at least one the root directory file enumerated, judge whether this root directory file mates blacklist, any one in special rules list or the list of cloud query type of preserving in advance, is add in scan list by this root directory file; Wherein, blacklist refers to the set confirming as risky file, and special rules list is that some meet the set of the risky file of special rules, and the list of cloud query type is the set needing the file carrying out cloud inquiry;

Scan the non-root catalogue file of described movable storage device, if there is the non-root catalogue file mated with the non-root directory path in blacklist, then the non-root catalogue file of this coupling is added in described scan list;

Cloud query type in scan list is sent to server end and carries out Safety query, the security information correspondence that server end feeds back is saved in scan list;

In scan list every is mated with the white list preserved in advance, the security information of occurrence is revised as trusted;

Information in display scan list, wherein, the information in described scan list comprises the security information of filename and correspondence.

2. the root directory file the method for claim 1, wherein enumerating described movable storage device comprises:

If the quantity of the root directory file of described movable storage device is less than or equals predetermined number, then enumerate whole root directory files of described movable storage device;

If the quantity of the root directory file of described movable storage device is more than predetermined number, then enumerate the root directory file of the described predetermined number of described movable storage device.

3. the information the method for claim 1, wherein in described display scan list comprises:

If comprise hidden file in scan list, then point out user whether to show hidden file, when user selects to confirm, show hidden file.

4., after the information the method for claim 1, wherein in described display scan list, the method comprises further:

According to user instruction, respective handling is carried out to the item that the safety information table in scan list is shown with risk;

After having processed, result is shown in the user interface of computing machine.

5. the method for claim 1, wherein described enumerate the root directory file of described movable storage device before, the method comprises further:

Check the autorun.inf file in described movable storage device, judge whether the executable file that this autorun.inf file points to exists risk, be that this executable file is added in scan list, and stop the file that system self-starting autorun.inf file points to.

6., before the information the method for claim 1, wherein in described display scan list, the method comprises further:

The every of scan list is mated with trusted list, the security information of occurrence is revised as trusted.

7. the method for claim 1, wherein, described at least one root directory file for enumerating, judge whether this root directory file mates blacklist, any one in special rules list or the list of cloud query type of preserving in advance, is add this root directory file to scan list and comprise:

Steps A, judges whether this root directory file mates any one in blacklist, is, is added in scan list by this root directory file, otherwise performs step B;

Step B, judges whether this root directory file mates any one in special rules list, is, is added in scan list by this root directory file, otherwise performs step C;

Step C, judges whether this root directory file mates any one in the list of cloud query type, is, is added in scan list by this root directory file.

8. the method according to any one of claim 1 to 7, wherein, described blacklist, special rules list, the list of cloud query type and the white list preserved in advance is local preservation, or for server end preservation.

9. the method according to any one of claim 1 to 7, wherein, the taking a step forward of root directory file that the method is enumerating described movable storage device comprises:

Load scanning logic and realize file;

The scanning rule file that files loading preserves blacklist, special rules list, the list of cloud query type and white list is realized by described scanning logic.

10. scan a device for movable storage device, wherein, this device comprises: storage unit, scanning element, Safety query unit, security information amending unit and display unit;

Described storage unit, is suitable for storing blacklist, special rules list, the list of cloud query type and white list;

Described scanning element, be suitable for the root directory file enumerating described movable storage device, for at least one the root directory file enumerated, judge whether this root directory file mates blacklist that is in described storage unit or server end, any one in special rules list or the list of cloud query type, that this root directory file is added in scan list, then the non-root catalogue file of described movable storage device is scanned, if there is the non-root catalogue file mated with the non-root directory path in blacklist, then the non-root catalogue file of this coupling is added in described scan list, wherein, blacklist refers to the set confirming as risky file, and special rules list is that some meet the set of the risky file of special rules, and the list of cloud query type is the set needing the file carrying out cloud inquiry,

Described Safety query unit, is suitable for that the cloud query type in scan list is sent to server end and carries out Safety query, is saved in scan list by the security information correspondence that server end feeds back;

Described security information amending unit, be suitable for by the every of scan list and described storage unit or the white list of server end mate, the security information of occurrence is revised as trusted;

Display unit, is suitable for the information in display scan list, and wherein, the information in described scan list comprises the security information of filename and correspondence.

11. devices as claimed in claim 10, wherein,

Described scanning element, be suitable for when the quantity of the root directory file of described movable storage device is less than or equals predetermined number, enumerate whole root directory files of described movable storage device, and be suitable for, when the quantity of the root directory file of described movable storage device is more than predetermined number, enumerating the root directory file of the described predetermined number of described movable storage device.

12. devices as claimed in claim 10, wherein,

Described display unit, is further adapted for when comprising hidden file in described scan list, and whether prompting user shows hidden file, when user selects to confirm, shows hidden file.

13. devices as claimed in claim 10, wherein, this device comprises further:

Processes and displays unit, is suitable for carrying out respective handling according to user instruction to the item that the safety information table in scan list is shown with risk, and result is shown in the user interface of computing machine after processing is completed.

14. devices as claimed in claim 10, wherein,

Described scanning element, before enumerating the root directory file of described movable storage device, be further adapted for the autorun.inf file checked in described movable storage device, judge whether the executable file that this autorun.inf file points to exists risk, be that this executable file is added in scan list, and stop the file that system self-starting autorun.inf file points to.

15. devices as claimed in claim 10, wherein,

Described security information amending unit, is further adapted for and the every of scan list is mated with trusted list, and the security information of occurrence is revised as trusted.

16. devices as claimed in claim 10, wherein, described scanning element is suitable at least one the root directory file for enumerating, and judges whether to mate any one in blacklist, special rules list or the list of cloud query type according to following order:

Steps A, judges whether this root directory file mates any one in blacklist, is, is added in scan list by this root directory file, otherwise performs step B;

Step B, judges whether this root directory file mates any one in special rules list, is, is added in scan list by this root directory file, otherwise performs step C;

Step C, judges whether this root directory file mates any one in the list of cloud query type, is, is added in scan list by this root directory file.

17. 1 kinds of systems scanning movable storage device, wherein, this system comprises: server and one or more device according to any one of claim 10 to 16;

Described server, is suitable for preserving blacklist, special rules list, the list of cloud query type and white list, for described device inquiry, and is suitable for the Safety query that described device provides cloud query type.