Changed file identification, software conflict resolution and unwanted file removal

• US 20050155031A1
• Filed: 04/22/2004
• Published: 07/14/2005
• Est. Priority Date: 01/10/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Wang, Yi-Min, Verbowski, Chad E., Johnson, Aaron R., Roussev, Roussi A., Ladd, David C.
• Granted Patent: US 7,765,592 B2
• Time in Patent Office: Days
• US Class Current: 717/170
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/44505 Configuring for program initiating, e.g. using registry, configuration files

Abstract

As computer programs grow more complex, extensible, and connected, it becomes increasingly difficult for users to understand what has changed on their machines and what impact those changes have. An embodiment of the invention is described via a software tool, called AskStrider, that answers those questions by correlating volatile process information with persistent-state context information and change history. AskStrider scans a system for active components, matches them against a change log to identify recently updated and hence more interesting state, and searches for context information to help users understand the changes. Several real-world cases are provided to demonstrate the effectiveness of using AskStrider to quickly identify the presence of unwanted software, to determine if a software patch is potentially breaking an application, and to detect lingering components left over from an unclean uninstallation.

Claims

1. A method of automatically identifying changes to a computer system, comprising:

scanning the computer system for active software components;

investigating file change histories for the active software components to find recently updated files; and

searching a local file system for context information for the recently updated files.

2. The method of claim 1 wherein the investigating further comprises ranking the active software components by how recently the active software components were updated on the computer system.

3. The method of claim 1 wherein the investigating further comprises querying a file change log of a system restore service.

4. The method of claim 1 wherein the searching for context information further comprises grouping software components based on proximity in a file change log.

5. The method of claim 1 further comprising deleting files associated with at least one of the active software components.

6. The method of claim 5 further comprising deleting all files associated with at least one of the active software components.

7. The method of claim 1 further comprising identifying a software patch conflicting with a software application.

8. A computer readable medium having computer-executable instructions to perform acts for automatically identifying changes to files on a computer system, the acts comprising:

scanning the computer system for active software components;

investigating file change histories for the active software components to find recently updated files; and

searching a local file system for context information for the recently updated files.

9. For use in a computer system executing a system restore operation that logs changes to files at restore points, a method of approximating the age of a file on the computer system, wherein a change to the file is logged by the system restore operation with respect to a first restore point, the method comprising:

setting a lower-bound for the age of the file as the time the first restore point was created;

setting an upper-bound for the age of the file as the time a second restore point was created; and

approximating the age of the file to be within the range of the upper-bound and lower-bound;

wherein the second restore point immediately follows the first restore point sequentially.

10. The method of claim 9 further comprising adjusting the range based on at least one timestamp for at least one log file associated with the first restore point.

11. The method of claim 9 further comprising adjusting the range based on time periods when the computer system was not operational.

12. The method of claim 9 further approximating the age of the file based on the number of times the file has been accessed since the creation of the first or second restore points.

13. A user interface for assisting a computer user with troubleshooting software conflicts on a local computer, the user interface comprising:

a list of user selectable items including processes currently executing on the computer;

wherein the list of user selectable items is sortable based on the time the items were last updated on the local computer.

14. The user interface of claim 13 wherein selecting an item from the list causes context information about the item to be displayed.

15. The user interface of claim 14 wherein the context information comprises items that are logged in close proximity to the selected item in a file change log.

16. The user interface of claim 13 further comprising a second list of user selectable items including dynamic library modules currently loaded on the computer.

17. The user interface of claim 13 wherein those user selectable items updated within a designated time period are highlighted on the user interface.

18. The user interface of claim 13 further comprising a user selectable option to delete files associated with at least one of the user selectable items.

19. For use in a computer system including a system restore operation that periodically logs changes to files at restore points, a method of communicating between a computer troubleshooting module and a computer process comprising:

receiving, from the computer process, a call having a plurality of parameters comprising a first time parameter; and

issuing, by the troubleshooting module, a list of processes and modules active on the computer system;

wherein the list of processes and modules is sorted by time last updated on the computer system relative to the first time parameter, and time last updated is determined by a method comprising investigating logs at system restore points.

20. The method of claim 19 wherein the plurality of parameters further comprises a second time parameter, and wherein the list of processes and modules is further sorted relative to the second time parameter.