Software unloading method and device of Windows operating system, storage medium and terminal

Abstract

The invention discloses a software uninstalling method and device of a Windows operating system, a storage medium and a terminal, relates to the technical field of software engineering, and mainly aims to solve the problem of low software uninstalling efficiency under the existing Windows operating system. The method mainly comprises the following steps: monitoring a system event in real time to capture process event information of a software installation process; in response to a process ending event of the software installation process, performing multi-dimensional feature matching on the process event information and software matching information of blacklist software, so as to take the installed software as target software under the condition of the installed software corresponding to the process event information; and performing reverse cleaning operation on the target software according to the software matching information and the process event information of the target software so as to unload the target software. The method is mainly used for automatically uninstalling software.

Description

Technical Field

[0001] This invention relates to the field of software engineering technology, and in particular to a software uninstallation method and apparatus, storage medium, and terminal for a Windows operating system. Background Technology

[0002] With the widespread adoption of computer technology, the number of software programs installed on user devices has surged, including a large number of unnecessary, redundant, and even malicious programs. These programs not only consume valuable system resources (such as disk space, memory, and CPU), but can also remain resident in the system through registry entries, system services, and background processes, leading to decreased device performance and system lag. Especially for enterprise devices or public terminals, unauthorized software can introduce security vulnerabilities, privacy leaks, and even become a springboard for the spread of malicious code, seriously threatening network and data security. Therefore, effectively and thoroughly uninstalling non-compliant or blacklisted software is a rigid requirement for ensuring clean device performance, maintaining system security and stability, and implementing management strategies; it is also a key component of the endpoint security management system.

[0003] Currently, in the Windows operating system environment, the core dilemma facing software uninstallation lies in its passivity and superficiality. Existing uninstallation mechanisms heavily rely on the uninstallation programs provided by the software itself or standard system interfaces, essentially a "request-response" model. This model has fundamental flaws: First, it cannot guarantee a thorough uninstallation; a large number of residual files, registry entries, background services, and other "digital relics" remain in the system for a long time, not only consuming resources but also creating security risks. Second, traditional methods are almost completely ineffective against malicious software and rogue plugins that deliberately evade or resist uninstallation, failing to penetrate their self-protection mechanisms. More importantly, the entire process lacks proactive detection and precise removal capabilities, unable to identify and intervene when software installation occurs, and can only implement delayed and inefficient cleanup after problems have accumulated. Summary of the Invention

[0004] In view of this, the present invention provides a software uninstallation method, apparatus, storage medium, and terminal for a Windows operating system, the main purpose of which is to solve the problem of low software uninstallation efficiency under the existing Windows operating system.

[0005] According to one aspect of the present invention, a software uninstallation method for a Windows operating system is provided, comprising: Monitor system events in real time to capture process event information of the software installation process; In response to the process termination event of the software installation process, the process event information is matched with the software matching information of the blacklist software using multi-dimensional features, so that in the case of software being installed corresponding to the process event information, the software being installed is selected as the target software. Based on the target software's software matching information and process event information, a reverse cleanup operation is performed on the target software to uninstall it.

[0006] Furthermore, before performing multi-dimensional feature matching between the process event information and the software matching information of the blacklisted software, the method further includes: In response to software blacklist updates, retrieve newly added blacklisted software; Scan the uninstall entries in the Windows registry of the running device to obtain a list of installed software, and retrieve the software installation directory of the newly added blacklisted software from the list of installed software; The files in the software installation directory are parsed to identify executable files; The service manager enumerates services and drivers to associate the identified executable files with the newly added blacklist software based on the executable file path of the service or driver, thus providing software matching information for the newly added blacklist software.

[0007] Furthermore, the real-time monitoring system events for capturing process event information of the software installation process include: Start and process a kernel event tracing session to capture the event stream of the software installation process; The event stream is parsed to extract process identifiers, process lifecycle events, registry operation events, and file operation events to obtain process event information; After obtaining the process event information, the method further includes: storing the process event information in a cache space.

[0008] Furthermore, the software installation process includes a main installation process and a sub-installation process, and the method further includes: In response to a process creation event, the parent process is searched by traversing the process identifier of the process that created the process. If a parent process is found, the process identifier of the process being created is associated with the process identifier of the parent process to update the process tree in which the parent process resides. If no parent process is found, a new process tree is built using the process being created as the parent process.

[0009] Furthermore, multi-dimensional feature matching is performed between the process event information and the software matching information of the blacklisted software, so that in the case of software being installed corresponding to the process event information, the installed software is selected as the target software, including: Extract the root path and subpath of the registry that was operated on from the process event information, and extract the full file path of the file that was operated on from the process event information; Extract executable file features based on the executable file pointed to by the full file path, and extract path behavior features based on the root path, the subpath, and the full file path; If the executable file characteristics and the path behavior characteristics match the software matching information of any blacklisted software, then the installed software will be the target software. If the target software is not identified from the blacklist software through multi-dimensional feature matching, the process event information is cleared from the cache space.

[0010] Furthermore, the executable file features include digital signature features, company name features, file name features, and version number features, wherein each feature has a corresponding basic weight; If the executable file characteristics and the path behavior characteristics match the software matching information of any blacklisted software, then the installed software will be used as the target software, including: Based on the process event information, a structured context information set containing process topology, operation sequence, path type, and signature status is constructed; If the structured context information set indicates that the created target file is placed in a temporary directory or system directory, and the company name of the target file does not match the directory context, then the dynamic weight of the path behavior feature is positively adjusted, the dynamic weight of the company name feature is negatively adjusted, and the digital signature feature is subjected to anti-counterfeiting verification, so as to adjust the basic weight of the digital signature feature based on the verification result. If the structured context information set represents a valid digital signature and the digital signature features include anomalous features, then the dynamic weights of the digital signature features are negatively adjusted, at least one additional verification feature is introduced, and a temporary weight is assigned to the additional verification feature. If the structured context information set indicates that there is a conflict between process nodes in the target process tree to which the creation process belongs, then the overall behavioral anomaly degree and digital signature consistency of the target process tree are calculated, and the dynamic weight of the conflict feature item is negatively adjusted according to the level of the conflict between process nodes. Based on the basic weights and adjusted dynamic weights of each feature, the matching degree between the installed software and different blacklisted software is calculated, and when the matching degree is greater than a preset threshold, the installed software is identified as the target software.

[0011] Furthermore, the reverse cleanup operation on the target software based on the target software's software matching information and process event information includes: Based on the historical operation data of the target software stored in the software matching information, extract the list of service and driver names, the set of software-related registry entries, and the software installation directory path; Call the handle that matches the list of service and driver names, delete the services and drivers registered by the target software, recursively delete all registry entries and sub-entries in the software-related registry entry set, and delete all files and subdirectories under the software installation directory path; A rollback list for the creation process is generated based on the process event information, and a point-to-point deletion operation is performed based on the rollback list to delete the files and lists created in the creation process.

[0012] According to another aspect of the present invention, a software uninstallation device for a Windows operating system is provided, comprising: The real-time monitoring module is used to monitor system events in real time to capture process event information of the software installation process; The feature matching module is used to respond to the process termination event of the software installation process, and perform multi-dimensional feature matching between the process event information and the software matching information of the blacklist software, so as to select the software being installed as the target software in the case of software being installed corresponding to the process event information. The uninstallation module is used to perform a reverse cleanup operation on the target software based on the target software's software matching information and process event information, so as to uninstall the target software.

[0013] According to another aspect of the present invention, a storage medium is provided, wherein at least one executable instruction is stored therein, the executable instruction causing a processor to perform an operation corresponding to the software uninstallation method of the Windows operating system described above.

[0014] According to another aspect of the present invention, a terminal is provided, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other through the communication bus; The memory is used to store at least one executable instruction, which causes the processor to perform the operation corresponding to the software uninstallation method of the Windows operating system described above.

[0015] By employing the above-described technical solutions, the technical solutions provided by the embodiments of the present invention have at least the following advantages: This invention provides a software uninstallation method, apparatus, storage medium, and terminal for a Windows operating system. Embodiments of this invention capture the dynamic behavior of the software installation process by real-time monitoring of system events and accurately identify the target software based on multi-dimensional feature matching after the process ends. This significantly reduces the false negatives and missed positives caused by traditional static feature library scanning, and lowers the risks of incomplete cleanup and failure to resist malware due to reliance on the software's built-in uninstaller. Simultaneously, reverse cleanup based on precisely matched software information and process event information ensures the targeting and completeness of the uninstallation operation, avoiding accidental deletion of critical system components. This greatly improves the accuracy, thoroughness, and automation of software uninstallation in complex Windows environments, especially when combating malware installation, thereby increasing software uninstallation efficiency.

[0016] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the specification. Furthermore, in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0017] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 A flowchart of a software uninstallation method for a Windows operating system provided by an embodiment of the present invention is shown; Figure 2 A flowchart of another software uninstallation method for a Windows operating system provided by an embodiment of the present invention is shown; Figure 3 This diagram illustrates a software uninstallation device for a Windows operating system according to an embodiment of the present invention. Figure 4 This invention provides a block diagram of another software uninstallation device for a Windows operating system according to an embodiment of the present invention. Figure 5 A schematic diagram of the structure of a terminal provided in an embodiment of the present invention is shown. Detailed Implementation

[0018] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0019] To address the problem of low software uninstallation efficiency in existing Windows operating systems, this invention provides a software uninstallation method for Windows operating systems, such as... Figure 1 As shown, the method includes: 101. Monitor system events in real time to capture process event information of the software installation process.

[0020] In enterprise network environments or personal device management scenarios, real-time monitoring of device systems is necessary to prevent the installation of malicious, unauthorized, or non-compliant software. For example, enterprises want to ensure that all software installed on employees' devices has undergone security audits to avoid data leaks or system attacks caused by the installation of insecure software; individual users also want to prevent bundled malicious software from quietly entering their devices.

[0021] In this embodiment of the invention, a monitoring tool or script is deployed in the operating system to continuously monitor system events using the system's provided API interfaces. When a software installation process is created, the monitoring tool captures relevant event information of that process, i.e., process event information. This information includes, but is not limited to, the process name, startup time, process identifier, installation path, file operations involved in the installation process (such as creating, modifying, and deleting a list of files), and registry operations (such as adding and modifying registry entries). Software installation processes include the installation process of brand-new software and the software update installation process of already installed software.

[0022] 102. In response to the process termination event of the software installation process, perform multi-dimensional feature matching between the process event information and the software matching information of the blacklisted software, so as to select the software being installed as the target software in the case of software being installed corresponding to the process event information.

[0023] In this embodiment of the invention, after monitoring the software installation process and obtaining relevant information, it is necessary to quickly determine whether the installed software belongs to the blacklist. The blacklist can be configured by the user through an interactive interface, or it can be a pre-prepared software blacklist, such as a blacklist maintained by an enterprise security department that includes known malicious software and illegal software.

[0024] When the monitoring tool detects a software installation process termination event, it triggers a matching mechanism. The captured process event information, such as the software name, file characteristics (e.g., hash values ​​of specific files), and registry characteristics, is compared in multiple dimensions with software matching information pre-stored in a blacklist database. This matching goes beyond simple software name matching; it delves into the software's internal characteristics, such as digital signature information in executable files, company names, and version formats, to improve accuracy. If a record in the blacklist highly matches the characteristics of the software being installed, that software is identified as the target software. Through multi-dimensional feature matching, blacklisted software can be identified more accurately, avoiding misjudgments caused by similar software names or simple similar characteristics. This effectively improves the identification rate of malicious or illegal software, ensuring that only software that complies with security regulations can run on devices.

[0025] 103. Perform a reverse cleanup operation on the target software based on the software matching information and process event information of the target software to uninstall the target software.

[0026] In this embodiment of the invention, once it is determined that the installed software is a target software on a blacklist, immediate measures must be taken to remove it from the device to prevent damage to the device and data. For example, in a corporate environment, if malicious software is found installed on an employee's device, it should be uninstalled quickly to prevent the spread of malicious software within the corporate network and protect corporate data and system security. Based on the target software's software matching information (such as detailed records of the software in the blacklist, including related files and registry entries) and process event information (such as installation path, created files, and registry entries), the system-provided uninstallation interface or a specific uninstallation tool is invoked to perform a reverse cleanup operation on the target software according to the correct uninstallation process. This includes deleting all files and folders created during the software installation process, cleaning up all entries added or modified by the software in the registry, and ensuring that all traces of the software are completely removed.

[0027] It's important to note that reverse cleanup can quickly and thoroughly uninstall target software from running devices, eliminating potential threats to devices and data, restoring devices to normal operation, and ensuring the security and stability of devices and data. Furthermore, the cleanup operation occurs after the software installation process has ended, avoiding potential problems such as installer remnants, corrupted system files, or incomplete registry information that might occur during the installation process. This is because the software installation is complete at this point, the system is relatively stable, and the cleanup operation can be performed more thoroughly and safely.

[0028] In one embodiment of the present invention, for further illustration and limitation, such as Figure 2As shown, before performing multi-dimensional feature matching between the process event information and the software matching information of the blacklisted software, the method further includes: 201. In response to software blacklist updates, retrieve newly added blacklisted software.

[0029] 202. Scan the uninstallation entries in the Windows registry of the running device to obtain a list of installed software, and retrieve the software installation directory of the newly added blacklist software from the list of installed software.

[0030] 203. Perform file format parsing on the files in the software installation directory to identify executable files.

[0031] 204. Enumerate services and drivers through the service manager, and associate the identified executable files with the newly added blacklist software based on the executable file path of the service or driver, as the software matching information of the newly added blacklist software.

[0032] In this embodiment of the invention, to ensure the accuracy and timeliness of multi-dimensional feature matching, a dynamically updated blacklist software feature library is pre-built and maintained before real-time monitoring and matching operations. Specifically, when a user or security policy updates the software blacklist, the system responds to this update event and obtains the identifier of the newly added blacklist software. Subsequently, the system scans the uninstallation entries (HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER under SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall) in the Windows registry of the running device to obtain a list of installed software. It then locates the installation directory of the newly added blacklist software. The system traverses this directory, using executable file format parsing technology to identify all executable files (PE files) in the directory. Simultaneously, it enumerates all current system services and drivers through the System Services Manager (SCM), and based on their executable file paths, associates the services and drivers matching the aforementioned installation directory with the newly added blacklist software. Finally, the identified executable file information (which serves as the carrier for subsequent filenames, digital signatures, and other features) and their associated system resource (services, drivers) information are integrated into the software matching information of the newly added blacklisted software and stored in the feature library for accurate comparison during subsequent real-time monitoring.

[0033] In one embodiment of the present invention, for further explanation and limitation, the step of real-time monitoring of system events to capture process event information of the software installation process includes: Start and process a kernel event tracing session to capture the event stream of the software installation process; The event stream is parsed to extract process identifiers, process lifecycle events, registry operation events, and file operation events to obtain process event information; After obtaining the process event information, the method further includes: storing the process event information in a cache space.

[0034] In this embodiment of the invention, real-time monitoring of system events is used to capture process event information of the software installation process, specifically by calling the Windows Event Tracing (ETW) interface. First, the system calls the StartTrace function to start a kernel event tracing session and configures its monitoring flags to capture event streams strongly related to software installation behavior, such as process, registry, and file I / O events. Then, the tracing session is opened via OpenTrace, and a dedicated thread is started to call the ProcessTrace function to process the incoming event stream in real time. The system parses the raw event stream, extracting key event information, including: process identifier (PID), process lifecycle events representing process creation and termination, registry operation events indicating registry key creation or value setting (including root path, subpath, and value name), and file operation events indicating file creation or renaming (including the full file path). The information obtained from the above parsing constitutes the "process event information." To improve processing efficiency and provide a fast data source for subsequent feature matching, after obtaining process event information, it is dynamically stored in the cache space in memory based on the process PID as an index, ensuring the real-time nature of event information and the efficiency of related queries.

[0035] In one embodiment of the present invention, for further explanation and limitation, the method further includes: In response to a process creation event, the parent process is searched by traversing the process identifier of the process that created the process. If a parent process is found, the process identifier of the process being created is associated with the process identifier of the parent process to update the process tree in which the parent process resides. If no parent process is found, a new process tree is built using the process being created as the parent process.

[0036] In this embodiment of the invention, installation behavior is associated and tracked based on a process tree. The software installation process includes a main installation process and child installation processes. That is, the currently monitored software installation process can be either a main software installation process or a sub-installation program under the main software installation process. The sub-installation process is a child process of the main installation process, and the main installation process is the parent process. In response to a captured process creation event, the system searches backwards for the PID of its parent process based on the process identifier (PID) of the newly created process. If the parent process is found in the recorded process information, it indicates that the new process is part of a monitored installation activity (e.g., a child installation process started by the main installation process or a temporary tool). At this time, the system associates the PID of the new process with the PID of its parent process and includes it in the process tree structure of its parent process, thereby updating and expanding the process tree. If no parent process record is found, the newly created process is treated as a completely new main software installation process, and a new process tree is initialized and constructed with it as the root node. In this way, the present invention logically aggregates multiple processes (main installation process and child installation process) that may be generated during the software installation process and have a parent-child relationship, providing accurate contextual basis for subsequent feature matching and collaborative cleanup based on the complete installation sequence.

[0037] In one embodiment of the present invention, for further explanation and limitation, multi-dimensional feature matching is performed between the process event information and the software matching information of the blacklist software, so that when the process event information corresponds to installed software, the installed software is selected as the target software, including: Extract the root path and subpath of the registry that was operated on from the process event information, and extract the full file path of the file that was operated on from the process event information; Extract executable file features based on the executable file pointed to by the full file path, and extract path behavior features based on the root path, the subpath, and the full file path; If the executable file characteristics and the path behavior characteristics match the software matching information of any blacklisted software, then the installed software will be the target software. If the target software is not identified from the blacklist software through multi-dimensional feature matching, the process event information is cleared from the cache space.

[0038] In this embodiment of the invention, the root path (e.g., HKEY_LOCAL_MACHINE) and sub-paths (e.g., \Software\Vendor\Product) of the registry operated by the process (or process tree), as well as the full path of the operated file (e.g., C:\Program Files\Vendor\Product\bin.exe), are extracted from the cached process event information. Then, the corresponding executable file (e.g., .exe, .dll, etc.) is located based on the full file path, and key executable file characteristics are parsed from it, such as digital signatures, embedded company names, product version information, and file names. Simultaneously, the system performs pattern analysis on the extracted registry paths and file paths to extract path behavior characteristics, such as whether the path contains specific vendor identifiers, product names, version number patterns, or whether files are released to abnormal locations such as temporary directories or system directories. Then, the extracted executable file characteristics and path behavior characteristics are comprehensively compared with corresponding characteristics in a pre-stored blacklist software matching information database. If these characteristics successfully match the preset characteristics of a blacklisted software, the software being installed corresponding to the current process is identified as the target software, which will then be executed by the automatic uninstallation module. Conversely, if none of the characteristics match any blacklisted software, the system determines that the process behavior is legitimate or irrelevant and clears all related process event information from the cache to free up system resources.

[0039] In one embodiment of the present invention, for further explanation and limitation, if the executable file characteristics and the path behavior characteristics match the software matching information of any blacklisted software, then the installed software will be used as the target software, including: Based on the process event information, a structured context information set containing process topology, operation sequence, path type, and signature status is constructed; If the structured context information set represents that the created target file is placed in a temporary directory or system directory, and the company name of the target file does not match the directory context, the dynamic weight of the path behavior feature is adjusted positively, the dynamic weight of the company name feature is adjusted negatively, and the digital signature feature is verified for anti-counterfeiting, so as to adjust the basic weight of the digital signature feature based on the verification result. If the structured context information set represents a valid digital signature and the digital signature features include anomalous features, then the dynamic weights of the digital signature features are negatively adjusted, at least one additional verification feature is introduced, and a temporary weight is assigned to the additional verification feature. If the structured context information set indicates that there is a conflict between process nodes in the target process tree to which the creation process belongs, then the overall behavioral anomaly degree and digital signature consistency of the target process tree are calculated, and the dynamic weight of the conflict feature item is negatively adjusted according to the level of the conflict between process nodes. Based on the basic weights and adjusted dynamic weights of each feature, the matching degree between the installed software and different blacklisted software is calculated, and when the matching degree is greater than a preset threshold, the installed software is identified as the target software.

[0040] In this embodiment of the invention, a dynamic weight adaptive matching strategy is adopted. Based on the process event information, a structured context information set containing multi-dimensional information such as process topology relationships, operation timing sequences, file path semantic types, and digital signature verification status is constructed. This set serves as the decision basis for dynamic weight adjustment. The construction of the structured context information set includes: constructing a process tree topology context: whenever a Process / Start event is captured, the system records {PID, PPID} pairs. Through continuous association, a process tree is constructed for each monitored installation master process, including the root node (installation master process identifier and image path), the PIDs and image paths of all descendant process nodes, and a parent-child relationship graph between processes. Constructing a timing and behavior sequence context: arranging all file and registry operation events generated by a process (or process tree) in chronological order. Constructing a file system path context: extracting the full path of the target file from the FileIO event, and parsing and classifying it. Constructing a digital signature verification context: for executable files (.exe, .dll, .sys) captured in the FileIO / Create event, the system asynchronously or after the process ends, initiates the signature verification process. Construct a context for system status and related information: combine real-time information with a pre-stored system knowledge base to extract path history, service / driver associations, and network behavior, etc.

[0041] During the matching process, different weight adjustment strategies are triggered based on context information: Path anomaly analysis rule: If the context information indicates that the target file is released to an unconventional location such as a temporary directory or system directory, and the embedded company name declaration does not match the software identity implied by the directory (e.g., system directories usually correspond to Microsoft files), then it is determined to be a path anomaly. At this time, the system performs weight adjustment: positively increasing the weight coefficient of the path behavior feature to enhance its influence; negatively decreasing the weight coefficient of the company name feature to reduce its credibility; simultaneously, initiating anti-counterfeiting or deep verification processes for the digital signature feature, and adjusting its basic weight accordingly based on the verification results (e.g., whether the certificate chain is complete, whether the timestamp is reasonable).

[0042] Signature cross-validation rule: If the context information indicates that the digital signature of the file is valid, but the signature itself contains abnormal characteristics (such as unknown certificate issuer reputation, short certificate chain and self-signed, or issuance time extremely close to file creation time), then the signature is deemed suspicious. In this case, the system performs weight adjustment: negatively reducing the dynamic weight of the digital signature feature itself; and introducing at least one additional verification feature (e.g., calculating the file hash value and comparing it with the cloud threat intelligence database), assigning a temporary weight to this additional feature, and incorporating it into the comprehensive matching calculation.

[0043] Process Tree Consistency Rule: If the context information indicates that the current installation process involves a target process tree, and there are conflicts in the characteristics of different process nodes within that process tree (e.g., the parent process has a valid signature while the child process has no signature or the signer is abnormal), then a conflict between process nodes is determined to exist. In this case, the system calculates two derived indicators: one is the overall behavioral anomaly characteristic, which characterizes the degree of suspicion of the entire installation behavior; the other is the digital signature consistency characteristic, which characterizes the consistency of signatures within the process tree. Simultaneously, based on the severity of the conflict, the dynamic weights of conflicting feature items (such as conflicting company names or version numbers) are negatively adjusted proportionally.

[0044] Finally, based on the basic weights of each feature and the dynamically adjusted weights according to the above rules, a weighted calculation is performed to determine the overall match degree between the currently installed software and each blacklisted software in the blacklist database. The software with the highest match degree, if its score exceeds a preset threshold, is identified as the target software that needs to be blocked and cleaned up. Through context-aware dynamic weight adjustment, the accuracy and robustness of identifying advanced evasion techniques and complex installation behaviors are significantly improved.

[0045] In one embodiment of the present invention, for further explanation and limitation, a reverse cleanup operation is performed on the target software based on the target software's software matching information and process event information, including: Based on the historical operation data of the target software stored in the software matching information, extract the list of service and driver names, the set of software-related registry entries, and the software installation directory path; Call the handle that matches the list of service and driver names, and delete the services and drivers registered by the target software; Recursively delete all registry entries and sub-entries in the software-related registry entry set; Delete all files and subdirectories under the software installation directory path; A rollback list for the created process is generated based on the process event information; Based on the rollback list, perform a point-to-point deletion operation to delete the files and lists created during the creation process.

[0046] In this embodiment of the invention, cleanup is performed at two levels: static archives and dynamic records. First, based on software matching information (i.e., the software static feature archive constructed through pre-scanning), the system extracts a list of recorded service and driver names related to the target software, a set of software-related registry entries, and the software installation directory path. This information represents all historical residual components that the software may have in the system. During cleanup, the system, based on the list of service and driver names, calls system APIs (such as OpenService) to open the corresponding handles and performs deletion operations (such as DeleteService) to remove the services and drivers registered by the software. For the registry, based on the set of software-related registry entries and the specific operation items recorded in this event, the system recursively deletes all related registry entries and their sub-entries. For files, based on the software installation directory path and verifying the list of files created in this event, the system deletes all files and subdirectories under that directory.

[0047] Simultaneously, combining process event information (i.e., the dynamic operation records captured by this real-time monitoring), a precise rollback list is generated for the processes (and their process trees) identified as installation activities. This list only includes specific files and registry entries directly created or modified by the process (tree) during this execution, not all possible components of the entire software. Based on this rollback list, the system performs point-to-point deletion operations, precisely deleting each file and registry entry listed, thereby reversing the immediate impact of the process's installation operation. This dual cleanup mechanism ensures both the thorough removal of known software remnants and the precise, real-time rollback of monitored malicious installation activities, avoiding unnecessary impacts on the system from excessive cleanup. By combining the integrity of static archives with the accuracy of dynamic records, this method achieves thorough and complete cleanup of the target software and its installation remnants.

[0048] This invention provides a software uninstallation method for the Windows operating system. The embodiments of this invention capture the dynamic behavior of the software installation process by real-time monitoring of system events, and accurately identify the target software based on multi-dimensional feature matching after the process ends. This significantly reduces the false negatives and missed positives caused by traditional static feature library scanning; it also reduces the risks of incomplete cleanup and failure to resist malware due to reliance on the software's built-in uninstaller; simultaneously, reverse cleanup based on accurately matched software information and process event information ensures the targeting and completeness of the uninstallation operation, avoiding accidental deletion of critical system components. Therefore, it greatly improves the accuracy, thoroughness, and automation of software uninstallation in complex Windows environments, especially when combating malware installation, thereby increasing software uninstallation efficiency.

[0049] Furthermore, as a response to the above Figure 1The implementation of the method shown in this invention provides a software uninstallation device for a Windows operating system, such as... Figure 3 As shown, the device includes: The real-time monitoring module 31 is used to monitor system events in real time to capture process event information of the software installation process; The feature matching module 32 is used to respond to the process termination event of the software installation process, and perform multi-dimensional feature matching between the process event information and the software matching information of the blacklist software, so as to select the software being installed as the target software in the case of the software being installed corresponding to the process event information. The uninstallation module 33 is used to perform a reverse cleanup operation on the target software based on the software matching information and process event information of the target software, so as to uninstall the target software.

[0050] Furthermore, such as Figure 4 As shown, the device further includes a scanning module 34, which includes: The acquisition unit is used to acquire newly added software to the blacklist in response to updates to the software blacklist. The scanning unit is used to scan the uninstallation entries in the Windows registry of the running device, obtain a list of installed software, and retrieve the software installation directory of the newly added blacklist software from the list of installed software. The parsing unit is used to parse the file formats of the files in the software installation directory in order to identify executable files; The association unit is used to enumerate services and drivers through the service manager, and associate the identified executable files with the newly added blacklist software based on the executable file path of the service or driver, as software matching information of the newly added blacklist software.

[0051] Furthermore, the real-time monitoring module 31 includes: The capture unit is used to initiate and process kernel event tracing sessions to capture the event stream of the software installation process; The extraction unit is used to parse the event stream to extract process identifiers, process lifecycle events, registry operation events, and file operation events to obtain process event information; A caching unit is used to store the process event information in a cache space.

[0052] Furthermore, the software installation process includes a main installation process and a sub-installation process, and the real-time monitoring module 31 further includes: The lookup unit is used to traverse and search for the parent process based on the process identifier of the process that created the process in response to a process creation event. The process tree update unit is used to, if a parent process is found, associate the process identifier of the process being created with the process identifier of the parent process to update the process tree in which the parent process resides. The process tree construction unit is used to construct a new process tree by taking the currently created process as the parent process if no parent process is found.

[0053] Furthermore, the feature matching module 32 includes: The first path extraction unit is used to extract the root path and subpath of the registry to be operated from the process event information, and to extract the full file path of the file to be operated from the process event information. The feature extraction unit is used to extract executable file features based on the executable file pointed to by the full file path, and to extract path behavior features based on the root path, the sub-path and the full file path; The feature matching unit is configured to target the installed software if the executable file features and the path behavior features match the software matching information of any blacklisted software. The cache cleanup unit is used to clear the process event information from the cache space if the target software is not identified from the blacklist software through multi-dimensional feature matching.

[0054] Furthermore, the executable file features include digital signature features, company name features, file name features, and version number features, wherein each feature has a corresponding basic weight; In specific application scenarios, the feature matching unit is specifically used to construct a set of structured context information containing process topology, operation sequence, path type and signature status based on the process event information; If the structured context information set indicates that the created target file is placed in a temporary directory or system directory, and the company name of the target file does not match the directory context, then the dynamic weight of the path behavior feature is positively adjusted, the dynamic weight of the company name feature is negatively adjusted, and the digital signature feature is subjected to anti-counterfeiting verification, so as to adjust the basic weight of the digital signature feature based on the verification result. If the structured context information set represents a valid digital signature and the digital signature features include anomalous features, then the dynamic weights of the digital signature features are negatively adjusted, at least one additional verification feature is introduced, and a temporary weight is assigned to the additional verification feature. If the structured context information set indicates that there is a conflict between process nodes in the target process tree to which the creation process belongs, then the overall behavioral anomaly degree and digital signature consistency of the target process tree are calculated, and the dynamic weight of the conflict feature item is negatively adjusted according to the level of the conflict between process nodes. Based on the basic weights and adjusted dynamic weights of each feature, the matching degree between the installed software and different blacklisted software is calculated, and when the matching degree is greater than a preset threshold, the installed software is identified as the target software.

[0055] Furthermore, the unloading module 33 includes: The second path extraction unit is used to extract a list of service and driver names, a set of software-related registry entries, and the software installation directory path based on the historical operation data of the target software stored in the software matching information. The first deletion unit is used to call the handle that matches the list of service and driver names, delete the services and drivers registered by the target software, recursively delete all registry entries and sub-entries in the software-related registry entry set, and delete all files and subdirectories under the software installation directory path. The second deletion unit is used to generate a rollback list in the creation process based on the process event information, and to perform point-to-point deletion operations based on the rollback list to delete the files and lists created in the creation process.

[0056] This invention provides a software uninstallation device for the Windows operating system. Embodiments of this invention capture the dynamic behavior of the software installation process by real-time monitoring of system events and accurately identify the target software based on multi-dimensional feature matching after the process ends. This significantly reduces the false negatives and missed positives caused by traditional static feature library scanning; it also reduces the risks of incomplete cleanup and failure to resist malware due to reliance on the software's built-in uninstaller; simultaneously, reverse cleanup based on precisely matched software information and process event information ensures the targeting and completeness of the uninstallation operation, avoiding accidental deletion of critical system components. Therefore, it greatly improves the accuracy, thoroughness, and automation of software uninstallation in complex Windows environments, especially when combating malware installation, thereby increasing software uninstallation efficiency.

[0057] According to one embodiment of the present invention, a storage medium is provided, the storage medium storing at least one executable instruction, the computer executable instruction being able to execute the software uninstallation method of the Windows operating system in any of the above method embodiments.

[0058] Figure 5 The diagram shows a structural schematic of a terminal according to an embodiment of the present invention. The specific implementation of the present invention is not limited to the specific implementation of the terminal.

[0059] like Figure 5 As shown, the terminal may include: a processor 402, a communication interface 404, a memory 406, and a communication bus 408.

[0060] The processor 402, communication interface 404, and memory 406 communicate with each other via communication bus 408.

[0061] Communication interface 404 is used for network communication with other devices such as clients or other servers.

[0062] The processor 402 is used to execute program 410, specifically to perform the relevant steps in the above-described embodiment of the software uninstallation method for the Windows operating system.

[0063] Specifically, program 410 may include program code that includes computer operation instructions.

[0064] Processor 402 may be a central processing unit (CPU), a specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The terminal may include one or more processors of the same type, such as one or more CPUs; or it may include processors of different types, such as one or more CPUs and one or more ASICs.

[0065] Memory 406 is used to store program 410. Memory 406 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0066] Specifically, program 410 can be used to cause processor 402 to perform the following operations: Monitor system events in real time to capture process event information of the software installation process; In response to the process termination event of the software installation process, the process event information is matched with the software matching information of the blacklist software using multi-dimensional features, so that in the case of software being installed corresponding to the process event information, the software being installed is selected as the target software. Based on the target software's software matching information and process event information, a reverse cleanup operation is performed on the target software to uninstall it.

[0067] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0068] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for uninstalling software on a Windows operating system, characterized in that, include: Monitor system events in real time to capture process event information of the software installation process; In response to the process termination event of the software installation process, the process event information is matched with the software matching information of the blacklist software using multi-dimensional features, so that in the case of software being installed corresponding to the process event information, the software being installed is selected as the target software. Based on the target software's software matching information and process event information, a reverse cleanup operation is performed on the target software to uninstall it.

2. The method according to claim 1, characterized in that, Before performing multi-dimensional feature matching between the process event information and the software matching information of the blacklisted software, the method further includes: In response to software blacklist updates, retrieve newly added blacklisted software; Scan the uninstall entries in the Windows registry of the running device to obtain a list of installed software, and retrieve the software installation directory of the newly added blacklisted software from the list of installed software; The files in the software installation directory are parsed to identify executable files; The service manager enumerates services and drivers to associate the identified executable files with the newly added blacklist software based on the executable file path of the service or driver, thus providing software matching information for the newly added blacklist software.

3. The method according to claim 1, characterized in that, The real-time monitoring system events capture process event information of the software installation process, including: Start and process a kernel event tracing session to capture the event stream of the software installation process; The event stream is parsed to extract process identifiers, process lifecycle events, registry operation events, and file operation events to obtain process event information; After obtaining the process event information, the method further includes: storing the process event information in a cache space.

4. The method according to claim 3, characterized in that, The software installation process includes a main installation process and a sub-installation process, and the method further includes: In response to a process creation event, the parent process is searched by traversing the process identifier of the process that created the process. If a parent process is found, the process identifier of the process being created is associated with the process identifier of the parent process to update the process tree in which the parent process resides. If no parent process is found, a new process tree is built using the process being created as the parent process.

5. The method according to claim 3, characterized in that, Perform multi-dimensional feature matching between the process event information and the software matching information of the blacklisted software, so as to select the installed software as the target software when the process event information corresponds to the installed software, including: Extract the root path and subpath of the registry that was operated on from the process event information, and extract the full file path of the file that was operated on from the process event information; Extract executable file features based on the executable file pointed to by the full file path, and extract path behavior features based on the root path, the subpath, and the full file path; If the executable file characteristics and the path behavior characteristics match the software matching information of any blacklisted software, then the installed software will be the target software. If the target software is not identified from the blacklist software through multi-dimensional feature matching, the process event information is cleared from the cache space.

6. The method according to claim 5, characterized in that, The executable file features include digital signature features, company name features, file name features, and version number features, where each feature has a corresponding basic weight; If the executable file characteristics and the path behavior characteristics match the software matching information of any blacklisted software, then the installed software will be used as the target software, including: Based on the process event information, a structured context information set containing process topology, operation sequence, path type, and signature status is constructed; If the structured context information set indicates that the created target file is placed in a temporary directory or system directory, and the company name of the target file does not match the directory context, then the dynamic weight of the path behavior feature is positively adjusted, the dynamic weight of the company name feature is negatively adjusted, and the digital signature feature is subjected to anti-counterfeiting verification, so as to adjust the basic weight of the digital signature feature based on the verification result. If the structured context information set represents a valid digital signature and the digital signature features include anomalous features, then the dynamic weights of the digital signature features are negatively adjusted, at least one additional verification feature is introduced, and a temporary weight is assigned to the additional verification feature. If the structured context information set indicates that there is a conflict between process nodes in the target process tree to which the creation process belongs, then the overall behavioral anomaly degree and digital signature consistency of the target process tree are calculated, and the dynamic weight of the conflict feature item is negatively adjusted according to the level of the conflict between process nodes. Based on the basic weights and adjusted dynamic weights of each feature, the matching degree between the installed software and different blacklisted software is calculated, and when the matching degree is greater than a preset threshold, the installed software is identified as the target software.

7. The method according to claim 1, characterized in that, The reverse cleanup operation on the target software based on the target software's software matching information and process event information includes: Based on the historical operation data of the target software stored in the software matching information, extract the list of service and driver names, the set of software-related registry entries, and the software installation directory path; Call the handle that matches the list of service and driver names, delete the services and drivers registered by the target software, recursively delete all registry entries and sub-entries in the software-related registry entry set, and delete all files and subdirectories under the software installation directory path; A rollback list for the creation process is generated based on the process event information, and a point-to-point deletion operation is performed based on the rollback list to delete the files and lists created in the creation process.

8. A software uninstallation device for a Windows operating system, characterized in that, include: The real-time monitoring module is used to monitor system events in real time to capture process event information of the software installation process; The feature matching module is used to respond to the process termination event of the software installation process, and perform multi-dimensional feature matching between the process event information and the software matching information of the blacklist software, so as to select the software being installed as the target software in the case of software being installed corresponding to the process event information. The uninstallation module is used to perform a reverse cleanup operation on the target software based on the target software's software matching information and process event information, so as to uninstall the target software.

9. A storage medium, characterized in that, The storage medium stores at least one executable instruction that causes the processor to perform the operation corresponding to the software uninstallation method of the Windows operating system as described in any one of claims 1-7.

10. A terminal, characterized in that, include: The processor, memory, communication interface, and communication bus are provided, wherein the processor, memory, and communication interface communicate with each other via the communication bus. The memory is used to store at least one executable instruction that causes the processor to perform the operation corresponding to the software uninstallation method of the Windows operating system as described in any one of claims 1-7.

Images