CN104462974A - Program clearing method, device and system - Google Patents

Abstract

The present invention provides a program cleaning method, device, and system. Through the program cleaning method, device, and system provided by the embodiments of the present invention, firstly, the locally installed programs are scanned to obtain the scanning results, and the scanning results are uploaded to the cloud server. According to the content of the database or resource library, the cloud server finds the malware information of the malware corresponding to the program, the cloud server returns the malware information, and after receiving the malware information locally, it can further determine whether the malware has been installed locally. Malware, if it is, it is likely that the program was bundled and installed by the malware, and cleaning operations need to be performed on the program. It can be seen that through the program cleaning method, device and system, programs such as plug-ins can be effectively screened and cleaned, thereby improving user experience.

Description

A program cleaning method, device and system

technical field

The invention relates to Internet application technology, in particular to a program cleaning method, device and system.

Background technique

When the user installs the software, some plug-ins are often bundled and installed, startup items are changed, shortcuts are created, or other program changes are made.

However, the change of these programs is promoted by malicious software, which is usually not what the user needs, and causes a certain waste of resources after installation or change.

For example, when a user installs software A, plug-ins a, b, c, startup item d, etc. may be bundled and installed, but the user may not need these plug-ins or startup items at all, and the operation of these plug-ins and startup items will also occupy resources. , resulting in a waste of resources, and even some plug-ins will steal user information, which will affect the user's information security.

At present, some security software can intercept when the program is changed, but it can't do anything about the installed and unintercepted ones.

For example, when a user installs software A, the security software may intercept the bundled installation of plug-ins a and b, and the startup item d. If the security software does not recognize plug-in c at that time, the security software will no longer be able to clean up plug-in c after the installation is complete.

Contents of the invention

In view of the above problems, the present invention is proposed to provide a program cleaning method, device, and system that overcome the above problems or at least partially solve the above problems, so as to filter and clean programs such as plug-ins, thereby improving user experience.

In particular, an embodiment of the present invention provides a program cleaning method, including:

Scan locally installed programs and get the scan results;

uploading the scanning result to a cloud server, and receiving malware information of malware corresponding to the program issued by the cloud server;

Judging whether the malware corresponding to the malware information has been installed locally;

If yes, perform a cleaning operation on the program corresponding to the locally installed malware.

Further, perform cleaning operations on programs corresponding to locally installed malware, including:

Clean up or change programs corresponding to said locally installed malware; or

Prompting the user to clean up or change the program corresponding to the locally installed malicious software.

The procedures specifically include one or a combination of the following:

Plug-ins, shortcuts, startup items, service items.

Further, it is determined whether the malware corresponding to the malware information has been installed locally, specifically:

According to the program installation log file, it is determined whether the malware corresponding to the malware information has been installed locally.

Further, the performing cleaning operation on the program corresponding to the locally installed malicious software also includes:

According to the program installation log file, determine the program bound to the locally installed malicious software in the corresponding program;

Perform cleaning operations on the determined bound programs.

Furthermore, according to the program installation log file, the program bound to the locally installed malware is determined in the corresponding program, including:

According to the program installation log file, query whether the difference between the installation time of the malicious software and the installation time of the corresponding program is less than a set value;

If yes, it is determined that the scanned program is a program bound to the locally installed malware.

Further, after performing cleaning operations on the programs corresponding to the locally installed malware, it also includes:

The program information for performing cleaning operations is sent to the cloud server, and the cloud server increases the malicious level of the program in the database.

The embodiment of the present invention also provides a program cleaning device correspondingly, including:

The scanning unit is used to scan locally installed programs to obtain scanning results;

a transceiver unit, configured to upload the scan result to a cloud server, and receive malware information of malware corresponding to the program issued by the cloud server;

a judging unit, configured to judge whether the malware corresponding to the malware information has been installed locally,

The cleaning unit is configured to perform a cleaning operation on the program corresponding to the locally installed malicious software when the judging result of the judging unit is yes.

Further, the cleaning unit is specifically used for:

When the judgment result of the judging unit is yes, clean up or change the program corresponding to the locally installed malicious software; or

When the judging result of the judging unit is yes, the user is prompted to clean up or change the program corresponding to the locally installed malicious software.

The procedures specifically include one or a combination of the following:

Plug-ins, shortcuts, startup items, service items.

Further, the judging unit is specifically used for:

According to the program installation log file, it is determined whether the malware corresponding to the malware information has been installed locally.

Further, the cleaning unit is specifically used for:

When the judgment result of the judging unit is yes, according to the program installation log file, determine the program bound to the locally installed malicious software among the corresponding programs;

Perform cleaning operations on the determined bound programs.

Further, the cleaning unit determines the program bound to the locally installed malware in the corresponding program according to the program installation log file, including:

According to the program installation log file, query whether the difference between the installation time of the malicious software and the installation time of the corresponding program is less than a set value;

If yes, it is determined that the scanned program is a program bound to the locally installed malware.

Further, the cleaning unit is also used for:

After performing clean-up operations on the programs corresponding to the locally installed malicious software, the program information for performing clean-up operations is sent to the cloud server, and the cloud server increases the malicious level of the programs in the database.

The embodiment of the present invention also provides a program cleaning system correspondingly, including: a program cleaning device and a cloud server, wherein: the program cleaning device is used for:

Scan locally installed programs and get the scan results;

Uploading the scanning result to a cloud server, and receiving malware information of malware corresponding to the program issued by the cloud server;

Judging whether the malware corresponding to the malware information has been installed locally;

If yes, perform a cleaning operation on the program corresponding to the locally installed malware.

According to the program cleaning method, device and system provided by the embodiments of the present invention, the locally installed program is first scanned to obtain the scan result, and the scan result is uploaded to the cloud server, and the cloud server finds the program according to the content of the database or resource library. The malware information of the malware corresponding to the program, the cloud server returns the malware information, and after receiving the malware information locally, it can further judge whether the malware has been installed locally. If the malicious software is bundled and installed, the program needs to be cleaned up. It can be seen that through the program cleaning method, device and system, programs such as plug-ins can be effectively screened and cleaned, thereby improving user experience.

The above description is only an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and understandable , the specific embodiments of the present invention are enumerated below.

Those skilled in the art will be more aware of the above and other objects, advantages and features of the present invention according to the following detailed description of specific embodiments of the present invention in conjunction with the accompanying drawings.

Description of drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiment. The drawings are only for the purpose of illustrating a preferred embodiment and are not to be considered as limiting the invention. Also throughout the drawings, the same reference numerals are used to designate the same components. In the attached picture:

FIG. 1 is a flowchart of a program cleaning method provided by an embodiment of the present invention;

Fig. 2 is a flow chart of a preferred program cleaning method provided by an embodiment of the present invention;

Fig. 3 is a schematic structural diagram of a program cleaning device provided by an embodiment of the present invention;

FIG. 4 is a schematic structural diagram of a program cleaning system provided by an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided for more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

As shown in Figure 1, an embodiment of the present invention provides a program cleaning method, including:

Step S101, scanning locally installed programs to obtain scanning results;

Step S102, upload the scanning result to the cloud server, and receive the malware information of the malware corresponding to the program issued by the cloud server;

Step S103, judging whether the malware corresponding to the malware information has been installed locally;

Step S104 , if yes, perform a cleaning operation on the program corresponding to the locally installed malicious software.

Through the program cleaning method provided by the embodiment of the present invention, the locally installed program is first scanned to obtain the scanning result, and the scanning result is uploaded to the cloud server, and the cloud server finds the malicious program corresponding to the program according to the content of the database or resource library. The malware information of the software, the cloud server returns the malware information, and after receiving the malware information locally, it can further judge whether the malware has been installed locally, if so, it is likely that the program is bundled and installed by the malware Yes, the program needs to be cleaned up. For example, scan the locally installed programs, and the scan results are program A and program B. After uploading the information of program A and program B to the server, the server finds that program A has corresponding malware C, and program B has no corresponding malware , the server returns: "1. The malware information of the malware C corresponding to the program A; 2. There is no corresponding malware to the program B". After receiving the information locally, it is judged whether the malware C has been installed locally. If so, program A is likely to be bundled and installed by the malware C, and the program A is cleaned up. It can be seen that through the program cleaning method, programs such as plug-ins can be effectively screened and cleaned, thereby improving user experience.

Further, in step S104, perform cleaning operations on the program corresponding to the locally installed malicious software, including:

Clean up or change programs corresponding to locally installed malware; or

Prompt the user to clean up or change the program corresponding to the locally installed malware.

The programs targeted in this program cleaning method specifically include one or a combination of the following:

Plug-ins, shortcuts, startup items, service items.

Among them, the plug-in is a program written according to a certain standard application program interface. It can only run on the system platform specified by the program (may support multiple platforms at the same time), but cannot run independently from the specified platform. Because the plug-in needs to call the function library or data provided by the original pure system. Many software has plug-ins, and there are many kinds of plug-ins. For example, in a browser, after installing a related plug-in, the browser can directly call the plug-in program to process a specific type of file.

Among them, the main ones that need to be cleaned up are malicious plug-ins. Malicious plug-ins mainly include: adware (Adware) or spyware (Spyware). Creators, in order to achieve illegal purposes such as advertising, stealing game or bank account passwords, etc. Because plug-in programs are issued by different publishers, and their technical level varies, plug-in programs may conflict with other running programs, resulting in various page errors, runtime errors, etc., blocking normal browsing.

A shortcut is a quick way to launch a program, open a file or folder, and it's a quick connection to an application.

Of course, those skilled in the art may also use other content as programs that need to be scanned, screened and cleaned up, which will not be listed one by one here.

Further, in step S103, it is judged whether the malware corresponding to the malware information has been installed locally, specifically:

According to the program installation log file, determine whether the malware corresponding to the malware information has been installed locally.

Further, in step S104, performing a clean-up operation on the program corresponding to the locally installed malicious software also includes:

According to the program installation log file, determine the program bound to the locally installed malware in the corresponding program;

Perform cleanup operations on the determined bound programs.

Since the program that is bound to the locally installed malware is determined in the corresponding program according to the program installation log file, it can be further confirmed that the program is a program that is bound and installed by malware, thereby reducing the situation of mistaken cleaning Appear.

Furthermore, according to the program installation log files, the programs bound to the locally installed malware are identified in the corresponding programs, including:

According to the program installation log file, query whether the difference between the installation time of the malicious software and the installation time of the corresponding program is less than the set value;

If so, it is determined that the scanned program is a program bundled with locally installed malware.

If the difference between the installation time of the malicious software and the installation time of the corresponding program is less than the set value, it can be further confirmed that the program is installed by binding the malicious software, thereby further reducing the occurrence of misclearing.

The setting value can be set according to the actual experience value of time-consuming general software installation, and can be set to several minutes to tens of minutes.

For example, the content returned by the cloud server believes that program A corresponds to malware C, the installation time of malware C is 10:10 on October 10, 2010, and the installation time of program A is 10:00 on October 10, 2010 15 points, the difference between the two is 5 minutes, if the set value is 10 minutes, the difference is less than the set value, and it can be further confirmed that program A is a program installed by malware C, so as to further clean up program A .

Further, after performing cleaning operations on the programs corresponding to the locally installed malware, it also includes:

Send the program information that performs cleaning operations to the cloud server, and the cloud server will increase the malicious level of the program in the database.

Since the program has been cleaned up, there is a high probability that the program is a malicious program. After the cloud server increases the malicious level of the program, it can make it easier for subsequent users to filter out the program for cleaning.

As shown in Figure 2, the preferred program cleaning method in the embodiment of the present invention includes:

Step S201, scanning locally installed programs to obtain scanning results, wherein the targeted programs specifically include one or a combination of the following: plug-ins, shortcuts, startup items, and service items;

Step S202, upload the scanning result to the cloud server, and receive the malware information of the malware corresponding to the program from the cloud server;

Step S203, according to the program installation log file, determine whether the malware corresponding to the malware information has been installed locally, if so, perform step S204, otherwise end the screening of the program;

Step S204, according to the program installation log file, query whether the difference between the installation time of the malicious software and the installation time of the corresponding program is less than the set value, if so, execute step S205, otherwise end the screening of the program;

Step S205, determining that the scanned program is a program bound to locally installed malware;

Step S206, performing cleaning operations on the determined bound programs;

Step S207, sending the program information for performing cleaning operations to the cloud server, and the cloud server increases the malicious level of the program in the database.

The embodiment of the present invention also correspondingly provides a program cleaning device, as shown in FIG. 3 , including:

A scanning unit 301, configured to scan locally installed programs to obtain scanning results;

The transceiver unit 302 is configured to upload the scanning result to the cloud server, and receive the malware information of the malware corresponding to the program issued by the cloud server;

A judging unit 303, configured to judge whether the malware corresponding to the malware information has been installed locally,

The cleaning unit 304 is configured to perform a cleaning operation on the program corresponding to the locally installed malicious software when the judging result of the judging unit is yes.

Through the program cleaning device provided by the embodiment of the present invention, firstly, the scanning unit 301 scans the locally installed programs to obtain the scanning results, and the sending and receiving unit 302 uploads the scanning results to the cloud server, and the cloud server finds the program according to the content of the database or resource library. The malicious software information of the malicious software corresponding to the program, the cloud server returns the malicious software information, and after receiving the malicious software information, the transceiver unit 302 can further determine whether the malicious software has been installed locally by the judging unit 303, and if so, Then it is likely that the program is bundled and installed by the malicious software, and the cleaning unit 304 needs to perform cleaning operations on the program. For example, scan the locally installed programs, and the scan results are program A and program B. After uploading the information of program A and program B to the server, the server finds that program A has corresponding malware C, and program B has no corresponding malware , the server returns: "1. The malware information of the malware C corresponding to the program A; 2. There is no corresponding malware to the program B". After receiving the information locally, it is judged whether the malware C has been installed locally. If so, program A is likely to be bundled and installed by the malware C, and the program A is cleaned up. It can be seen that through the program cleaning device, programs such as plug-ins can be effectively screened and cleaned, thereby improving user experience.

The cleaning unit 304 is specifically used for:

When the judgment result of the judging unit 303 is yes, the program corresponding to the locally installed malicious software is cleaned up or changed; or

When the judging result of the judging unit 303 is yes, the user is prompted to clean up or change the program corresponding to the locally installed malicious software.

Wherein, the programs targeted by the program cleaning device specifically include one or a combination of the following:

Plug-ins, shortcuts, startup items, service items.

Of course, those skilled in the art may also use other content as programs that need to be scanned, screened and cleaned up, which will not be listed one by one here.

Further, the judging unit 303 is specifically used for:

According to the program installation log file, determine whether the malware corresponding to the malware information has been installed locally.

Further, the cleaning unit 304 is specifically used for:

When the judging result of the judging unit 303 is yes, according to the program installation log file, the program bound to the locally installed malicious software is determined in the corresponding program;

Perform cleanup operations on the determined bound programs.

Since the program that is bound to the locally installed malware is determined in the corresponding program according to the program installation log file, it can be further confirmed that the program is a program that is bound and installed by malware, thereby reducing the situation of mistaken cleaning Appear.

Furthermore, according to the program installation log file, the cleaning unit determines the programs bound to the locally installed malware in the corresponding programs, including:

According to the program installation log file, query whether the difference between the installation time of the malicious software and the installation time of the corresponding program is less than the set value;

If so, it is determined that the scanned program is a program bundled with locally installed malware.

If the difference between the installation time of the malicious software and the installation time of the corresponding program is less than the set value, it can be further confirmed that the program is installed by binding the malicious software, thereby further reducing the occurrence of misclearing.

The setting value can be set according to the actual experience value of time-consuming general software installation, and can be set to several minutes to tens of minutes.

For example, the content returned by the cloud server believes that program A corresponds to malware C, the installation time of malware C is 10:10 on October 10, 2010, and the installation time of program A is 10:00 on October 10, 2010 15 points, the difference between the two is 5 minutes, if the set value is 10 minutes, the difference is less than the set value, and it can be further confirmed that program A is a program installed by malware C, so as to further clean up program A .

Further, the cleaning unit 304 is also used for:

After performing cleaning operations on the programs corresponding to the locally installed malicious software, the information about the programs performing the cleaning operations is sent to the cloud server, and the cloud server increases the malicious level of the programs in the database.

Since the cleaning unit 304 has already performed cleaning operations on the program, the probability of the program being a malicious program is relatively high. After the cloud server increases the malicious level of the program, it can make it easier for subsequent users to filter out the program for cleaning.

The embodiment of the present invention also provides a program cleaning system correspondingly, as shown in FIG. 4 , including: a program cleaning device 401 and a cloud server 402, wherein: the program cleaning device 401 is used for:

Scan locally installed programs and get the scan results;

Upload the scanning result to the cloud server, and receive the malware information of the malware corresponding to the program from the cloud server;

Determine whether the malware corresponding to the malware information has been installed locally;

If yes, perform a cleaning operation on the program corresponding to the locally installed malware.

The program cleaning device 401 can also implement other functions in the program cleaning method provided by the embodiment of the present invention, or the program cleaning device 401 can directly use the program cleaning device provided by the embodiment of the present invention.

According to the program cleaning method, device and system provided by the embodiments of the present invention, the locally installed program is first scanned to obtain the scan result, and the scan result is uploaded to the cloud server, and the cloud server finds the program according to the content of the database or resource library. The malware information of the malware corresponding to the program, the cloud server returns the malware information, and after receiving the malware information locally, it can further judge whether the malware has been installed locally. If the malicious software is bundled and installed, the program needs to be cleaned up. For example, scan the locally installed programs, and the scan results are program A and program B. After uploading the information of program A and program B to the server, the server finds that program A has corresponding malware C, and program B has no corresponding malware , the server returns: "1. The malware information of the malware C corresponding to the program A; 2. There is no corresponding malware to the program B". After receiving the information locally, it is judged whether the malware C has been installed locally. If so, program A is likely to be bundled and installed by the malware C, and the program A is cleaned up. It can be seen that through the program cleaning method, device and system, programs such as plug-ins can be effectively screened and cleaned, thereby improving user experience.

Embodiments of the present invention are disclosed;

A1. A program cleaning method, comprising:

Scan locally installed programs and get the scan results;

Uploading the scanning result to a cloud server, and receiving malware information of malware corresponding to the program issued by the cloud server;

Judging whether the malware corresponding to the malware information has been installed locally;

If yes, perform a cleaning operation on the program corresponding to the locally installed malware.

A2. According to the method described in A1, performing a cleaning operation on the program corresponding to the locally installed malicious software includes:

Clean up or change programs corresponding to said locally installed malware; or

Prompting the user to clean up or change the program corresponding to the locally installed malicious software.

A3. The method as described in A1, wherein the program specifically includes one or a combination of the following:

Plug-ins, shortcuts, startup items, service items.

A4. The method described in any one of A1-A3, wherein determining whether the malware corresponding to the malware information has been installed locally is specifically:

According to the program installation log file, it is determined whether the malware corresponding to the malware information has been installed locally.

A5. The method as described in any one of A1-A4, wherein, performing a clean-up operation on the program corresponding to the locally installed malware further includes:

According to the program installation log file, determine the program bound to the locally installed malicious software in the corresponding program;

Perform cleaning operations on the determined bound programs.

A6. The method according to A5, wherein, according to the program installation log file, the program bound to the locally installed malicious software is determined in the corresponding program, including:

According to the program installation log file, query whether the difference between the installation time of the malicious software and the installation time of the corresponding program is less than a set value;

If yes, it is determined that the scanned program is a program bound to the locally installed malware.

A7. The method as described in any one of A1-A6, wherein, after performing a clean-up operation on the program corresponding to the locally installed malicious software, it also includes:

The program information for performing cleaning operations is sent to the cloud server, and the cloud server increases the malicious level of the program in the database.

B8. A program cleaning device, comprising:

The scanning unit is used to scan locally installed programs to obtain scanning results;

a transceiver unit, configured to upload the scan result to a cloud server, and receive malware information of malware corresponding to the program issued by the cloud server;

a judging unit, configured to judge whether the malware corresponding to the malware information has been installed locally,

The cleaning unit is configured to perform a cleaning operation on the program corresponding to the locally installed malicious software when the judging result of the judging unit is yes.

B9. The device as described in B8, wherein the cleaning unit is specifically used for:

When the judgment result of the judging unit is yes, clean up or change the program corresponding to the locally installed malicious software; or

When the judging result of the judging unit is yes, the user is prompted to clean up or change the program corresponding to the locally installed malicious software.

B10. The device as described in B8, wherein the program specifically includes one or a combination of the following:

Plug-ins, shortcuts, startup items, service items.

B11. The device according to any one of B8-B10, wherein the judging unit is specifically used for:

According to the program installation log file, it is determined whether the malware corresponding to the malware information has been installed locally.

B12. The device as described in any one of B8-B11, wherein the cleaning unit is specifically used for:

When the judgment result of the judging unit is yes, according to the program installation log file, determine the program bound to the locally installed malicious software among the corresponding programs;

Perform cleaning operations on the determined bound programs.

B13. The device according to B12, wherein the cleaning unit determines the program bound to the locally installed malicious software in the corresponding program according to the program installation log file, including:

According to the program installation log file, query whether the difference between the installation time of the malicious software and the installation time of the corresponding program is less than a set value;

If yes, it is determined that the scanned program is a program bound to the locally installed malware.

B14. The device according to any one of B8-B13, wherein the cleaning unit is also used for:

After performing cleaning operations on the programs corresponding to the locally installed malicious software, the program information for performing the cleaning operations is sent to the cloud server, and the cloud server increases the malicious level of the programs in the database.

C15. A program cleaning system, comprising: a program cleaning device and a cloud server, wherein: the program cleaning device is used for:

Scan locally installed programs and get the scan results;

Uploading the scanning result to a cloud server, and receiving malware information of malware corresponding to the program issued by the cloud server;

Judging whether the malware corresponding to the malware information has been installed locally;

If yes, perform a cleaning operation on the program corresponding to the locally installed malware.

In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure the understanding of this description.

Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, in order to streamline this disclosure and to facilitate an understanding of one or more of the various inventive aspects, various features of the invention are sometimes grouped together in a single embodiment, figure, or its description. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art can understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. Modules or units or components in the embodiments may be combined into one module or unit or component, and furthermore may be divided into a plurality of sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method or method so disclosed may be used in any combination, except that at least some of such features and/or processes or units are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will understand that although some embodiments described herein include some features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the invention. and form different embodiments. For example, in the claims, any one of the claimed embodiments can be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) may be used in practice to implement some or all functions of some or all components in the program cleaning device according to the embodiment of the present invention. The present invention can also be implemented as an apparatus or an apparatus program (for example, a computer program and a computer program product) for performing a part or all of the methods described herein. Such a program for realizing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet site, or provided on a carrier signal, or provided in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means can be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. does not indicate any order. These words can be interpreted as names.

So far, those skilled in the art should appreciate that, although a number of exemplary embodiments of the present invention have been shown and described in detail herein, without departing from the spirit and scope of the present invention, the disclosed embodiments of the present invention can still be used. Many other variations or modifications consistent with the principles of the invention are directly identified or derived from the content. Accordingly, the scope of the present invention should be understood and deemed to cover all such other variations or modifications.

Claims (10)

1. a program method for cleaning, comprising:

Scan local mounted program, obtain scanning result;

Described scanning result is uploaded to cloud server, and receives the malware information of the Malware corresponding with described program that described cloud server issues;

Judge the local Malware whether installed corresponding to described malware information;

If so, the program corresponding to the Malware installed this locality performs cleaning generic operation.

2. method according to claim 1, wherein, the program corresponding to the Malware installed this locality performs cleaning generic operation, comprising:

Program corresponding to the Malware installed described this locality is cleared up or is changed; Or

Program corresponding to the Malware that prompting user installed described this locality is cleared up or is changed.

3. the method for claim 1, wherein described program, specifically comprises one of following or combination:

Plug-in unit, shortcut, startup item, service entry.

4. the method as described in as arbitrary in claim 1-3, wherein, judges the local Malware whether installed corresponding to described malware information, is specially:

According to program installation log file, judge the local Malware whether installed corresponding to described malware information.

5. the method as described in as arbitrary in claim 1-4, wherein, the program corresponding to the described Malware installed this locality performs cleaning generic operation, also comprises:

According to program installation log file, in corresponding program, determine the program that the Malware installed with described this locality is bound;

Cleaning generic operation is performed to the program of the described binding determined.

6. method according to claim 5, wherein, according to program installation log file, determine in corresponding program and comprise the program that the Malware installed with described this locality is bound:

According to program installation log file, whether the difference of inquiring about the set-up time of described Malware and the set-up time of corresponding program is less than setting value;

If so, then determine that scanned program is the program that the Malware installed with described this locality is bound.

7. the method as described in as arbitrary in claim 1-6, wherein, the program corresponding to the Malware installed this locality also comprises after performing cleaning generic operation:

The program information performing cleaning generic operation is sent to described cloud server, is heightened the malice rank of this program by described cloud server in a database.

8. a program cleaning plant, comprising:

Scanning element, for scanning local mounted program, obtains scanning result;

Transmit-Receive Unit, for described scanning result is uploaded to cloud server, and receives the malware information of the Malware corresponding with described program that described cloud server issues;

Judging unit, for judging the local Malware whether installed corresponding to described malware information,

Cleaning unit, for when the judged result of described judging unit is for being, the program corresponding to the Malware installed this locality performs cleaning generic operation.

9. device as claimed in claim 8, wherein, described cleaning unit specifically for:

When the judged result of described judging unit is for being, the program corresponding to the Malware installed described this locality is cleared up or is changed; Or

When the judged result of described judging unit is for being, the program corresponding to the Malware that prompting user installed described this locality is cleared up or is changed.

10. a program cleaning system, comprising: program cleaning plant and cloud server, wherein: program cleaning plant, and for:

Scan local mounted program, obtain scanning result;

Described scanning result is uploaded to cloud server, and receives the malware information of the Malware corresponding with described program that described cloud server issues;

Judge the local Malware whether installed corresponding to described malware information;

If so, the program corresponding to the Malware installed this locality performs cleaning generic operation.