Scanning device, cloud management device, method and system for checking and killing malicious programs

A cloud management device for checking and killing a malicious program comprising:

• a second transmission interface configured to transmit information to a client device and receive information transmitted by the client device;
• a first indicator configured to generate a first scanning content indication according to characteristics of a newborn malicious program and system environment information transmitted by the client device, the first scanning content indication at least comprising scanning content at a specified position and notifying scanned feature data of an unknown program file, and transmit the first scanning content indication to the client device via the second transmission interface;
• a first matcher configured to obtain via the second transmission interface feature data of the unknown program file transmitted by the client device, and hereby perform matching in known records of feature data of malicious programs;
• and
• a second indicator configured to generate a second scanning content indication when the first matcher fails to match to a known record, the second scanning content indication comprising scanning a specified attribute of the unknown program file and/or a specified attribute of the contextual environment of the unknown program file, and transmit the second scanning content indication to the client device via the second transmission interface.

A scanning method for checking and killing a malicious program comprising:

• reading current system environment information of a client device, and transmitting it to a server-side device;
• obtaining a first scanning content indication judged by the server-side device based on the system environment information, scanning a specified position in the first scanning content indication, and transmitting at least feature data of an unknown program file obtained by scanning to the server-side device;
• and
• obtaining a second scanning content indication transmitted by the server-side device, the second scanning content indication comprising scanning a specified attribute of the unknown program file and/or a specified attribute of the contextual environment of the unknown program file, and scanning according to the second scanning content indication.