Patent ID: 8490192

Claim:
A malicious software (malware) cleaning method, comprising: establishing a relation graph, wherein the relation graph comprises a plurality of nodes, the nodes are respectively corresponding to a plurality of processes in an operating system (OS) and elements related to the processes, and relations between the nodes are established according to relations among the processes and the elements; performing a node marking action on the relation graph when a predetermined condition is satisfied, wherein the node marking action comprises marking each of the nodes along both or one of an outgoing relation and an incoming relation of the node, and the node marking action further comprises: marking the node corresponding to a malicious process and the related nodes with a first label; marking the nodes without the first label and corresponding to other normal processes and the related nodes with a second label; and screening the nodes marked with both the first label and the second label so that each of the nodes is marked with only one of the first label and the second label; and removing the processes and the elements corresponding to the nodes marked with the first label.