feat: leftover signature database with 50 app profiles for high-accuracy remnant detection

SysAdminDoc · SysAdminDoc · commit 52da1f7a43d6 · 2026-06-16T22:16:26.000-04:00
diff --git a/src/DeepPurge.Core/Data/LeftoverSignatureDb.cs b/src/DeepPurge.Core/Data/LeftoverSignatureDb.cs
@@ -0,0 +1,83 @@
+using System.Reflection;
+using System.Text.Json;
+using DeepPurge.Core.Diagnostics;
+
+namespace DeepPurge.Core.Data;
+
+public class LeftoverSignature
+{
+    public string Name { get; set; } = "";
+    public List<string> Aliases { get; set; } = new();
+    public List<string> Files { get; set; } = new();
+    public List<string> Registry { get; set; } = new();
+}
+
+public class LeftoverMatch
+{
+    public List<string> FilePaths { get; set; } = new();
+    public List<string> RegistryPaths { get; set; } = new();
+}
+
+public static class LeftoverSignatureDb
+{
+    private static readonly Lazy<List<LeftoverSignature>> _signatures = new(Load);
+
+    public static LeftoverMatch? FindMatch(string displayName)
+    {
+        if (string.IsNullOrWhiteSpace(displayName)) return null;
+
+        var sig = _signatures.Value.FirstOrDefault(s =>
+            s.Aliases.Any(a => displayName.Contains(a, StringComparison.OrdinalIgnoreCase)));
+        if (sig == null) return null;
+
+        var match = new LeftoverMatch();
+        foreach (var pattern in sig.Files)
+        {
+            var expanded = Environment.ExpandEnvironmentVariables(pattern);
+            if (expanded.Contains('*'))
+            {
+                var dir = Path.GetDirectoryName(expanded);
+                var glob = Path.GetFileName(expanded);
+                if (dir != null && Directory.Exists(dir))
+                {
+                    try
+                    {
+                        foreach (var d in Directory.GetDirectories(dir, glob))
+                            match.FilePaths.Add(d);
+                    }
+                    catch { }
+                }
+            }
+            else if (Directory.Exists(expanded) || File.Exists(expanded))
+            {
+                match.FilePaths.Add(expanded);
+            }
+        }
+
+        foreach (var regPath in sig.Registry)
+            match.RegistryPaths.Add(regPath);
+
+        return (match.FilePaths.Count > 0 || match.RegistryPaths.Count > 0) ? match : null;
+    }
+
+    private static List<LeftoverSignature> Load()
+    {
+        try
+        {
+            var asm = Assembly.GetExecutingAssembly();
+            var resourceName = asm.GetManifestResourceNames()
+                .FirstOrDefault(n => n.EndsWith("leftover-signatures.json", StringComparison.OrdinalIgnoreCase));
+            if (resourceName == null) return new();
+
+            using var stream = asm.GetManifestResourceStream(resourceName);
+            if (stream == null) return new();
+
+            return JsonSerializer.Deserialize<List<LeftoverSignature>>(stream) ?? new();
+        }
+        catch (Exception ex)
+        {
+            Log.Warn($"Failed to load leftover signatures: {ex.Message}");
+            return new();
+        }
+    }
+}
diff --git a/src/DeepPurge.Core/Data/leftover-signatures.json b/src/DeepPurge.Core/Data/leftover-signatures.json
@@ -0,0 +1,52 @@
+[
+  {"name":"Google Chrome","aliases":["Chrome","Google Chrome"],"files":["%LocalAppData%\\Google\\Chrome","%AppData%\\Google\\Chrome","%ProgramData%\\Google\\Chrome","%ProgramFiles%\\Google\\Chrome"],"registry":["HKCU\\Software\\Google\\Chrome","HKLM\\SOFTWARE\\Google\\Chrome","HKLM\\SOFTWARE\\Policies\\Google\\Chrome","HKCU\\Software\\Google\\Update"]},
+  {"name":"Mozilla Firefox","aliases":["Firefox","Mozilla Firefox"],"files":["%AppData%\\Mozilla\\Firefox","%LocalAppData%\\Mozilla\\Firefox","%ProgramFiles%\\Mozilla Firefox"],"registry":["HKCU\\Software\\Mozilla\\Firefox","HKLM\\SOFTWARE\\Mozilla\\Firefox","HKLM\\SOFTWARE\\Mozilla\\Mozilla Firefox"]},
+  {"name":"Microsoft Edge","aliases":["Edge","Microsoft Edge"],"files":["%LocalAppData%\\Microsoft\\Edge","%ProgramFiles(x86)%\\Microsoft\\Edge"],"registry":["HKCU\\Software\\Microsoft\\Edge","HKLM\\SOFTWARE\\Microsoft\\Edge"]},
+  {"name":"Opera","aliases":["Opera","Opera Stable","Opera GX"],"files":["%AppData%\\Opera Software","%LocalAppData%\\Opera Software"],"registry":["HKCU\\Software\\Opera Software","HKLM\\SOFTWARE\\Opera Software"]},
+  {"name":"Brave","aliases":["Brave","Brave-Browser"],"files":["%LocalAppData%\\BraveSoftware","%AppData%\\BraveSoftware"],"registry":["HKCU\\Software\\BraveSoftware","HKLM\\SOFTWARE\\BraveSoftware"]},
+  {"name":"Vivaldi","aliases":["Vivaldi"],"files":["%LocalAppData%\\Vivaldi","%AppData%\\Vivaldi"],"registry":["HKCU\\Software\\Vivaldi","HKLM\\SOFTWARE\\Vivaldi"]},
+  {"name":"VLC media player","aliases":["VLC","VideoLAN"],"files":["%AppData%\\vlc","%ProgramFiles%\\VideoLAN"],"registry":["HKCU\\Software\\VideoLAN","HKLM\\SOFTWARE\\VideoLAN"]},
+  {"name":"Spotify","aliases":["Spotify"],"files":["%AppData%\\Spotify","%LocalAppData%\\Spotify"],"registry":["HKCU\\Software\\Spotify","HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Spotify"]},
+  {"name":"Discord","aliases":["Discord"],"files":["%AppData%\\discord","%LocalAppData%\\Discord"],"registry":["HKCU\\Software\\Discord"]},
+  {"name":"Slack","aliases":["Slack"],"files":["%AppData%\\Slack","%LocalAppData%\\slack"],"registry":["HKCU\\Software\\Slack"]},
+  {"name":"Zoom","aliases":["Zoom","Zoom Video Communications"],"files":["%AppData%\\Zoom","%AppData%\\Zoom Video Communications","%LocalAppData%\\Zoom"],"registry":["HKCU\\Software\\Zoom","HKCU\\Software\\ZoomVideo"]},
+  {"name":"Steam","aliases":["Steam","Valve"],"files":["%ProgramFiles(x86)%\\Steam","%LocalAppData%\\Steam"],"registry":["HKCU\\Software\\Valve\\Steam","HKLM\\SOFTWARE\\Valve\\Steam","HKLM\\SOFTWARE\\WOW6432Node\\Valve\\Steam"]},
+  {"name":"Epic Games Launcher","aliases":["EpicGamesLauncher","Epic Games"],"files":["%LocalAppData%\\EpicGamesLauncher","%ProgramData%\\Epic","%ProgramFiles%\\Epic Games"],"registry":["HKCU\\Software\\Epic Games","HKLM\\SOFTWARE\\EpicGames"]},
+  {"name":"Adobe Acrobat","aliases":["Acrobat","Adobe Acrobat"],"files":["%AppData%\\Adobe\\Acrobat","%LocalAppData%\\Adobe\\Acrobat","%ProgramData%\\Adobe\\Acrobat"],"registry":["HKCU\\Software\\Adobe\\Acrobat","HKLM\\SOFTWARE\\Adobe\\Acrobat"]},
+  {"name":"Adobe Creative Cloud","aliases":["Creative Cloud","Adobe Creative Cloud"],"files":["%AppData%\\Adobe","%LocalAppData%\\Adobe","%ProgramData%\\Adobe","%ProgramFiles%\\Adobe","%CommonProgramFiles%\\Adobe"],"registry":["HKCU\\Software\\Adobe","HKLM\\SOFTWARE\\Adobe"]},
+  {"name":"7-Zip","aliases":["7-Zip","7zip"],"files":["%ProgramFiles%\\7-Zip","%AppData%\\7-Zip"],"registry":["HKCU\\Software\\7-Zip","HKLM\\SOFTWARE\\7-Zip"]},
+  {"name":"WinRAR","aliases":["WinRAR","RARLAB"],"files":["%ProgramFiles%\\WinRAR","%AppData%\\WinRAR"],"registry":["HKCU\\Software\\WinRAR","HKLM\\SOFTWARE\\WinRAR"]},
+  {"name":"Notepad++","aliases":["Notepad++"],"files":["%AppData%\\Notepad++","%ProgramFiles%\\Notepad++"],"registry":["HKCU\\Software\\Notepad++","HKLM\\SOFTWARE\\Notepad++"]},
+  {"name":"Visual Studio Code","aliases":["VSCode","Code","Visual Studio Code"],"files":["%AppData%\\Code","%LocalAppData%\\Programs\\Microsoft VS Code","%UserProfile%\\.vscode"],"registry":["HKCU\\Software\\Microsoft\\VisualStudioCode","HKCU\\Software\\Classes\\vscode"]},
+  {"name":"Git","aliases":["Git","Git for Windows"],"files":["%ProgramFiles%\\Git","%AppData%\\Git","%LocalAppData%\\GitHubDesktop"],"registry":["HKLM\\SOFTWARE\\GitForWindows","HKCU\\Software\\GitForWindows"]},
+  {"name":"Node.js","aliases":["Node.js","nodejs"],"files":["%ProgramFiles%\\nodejs","%AppData%\\npm","%AppData%\\npm-cache","%LocalAppData%\\npm-cache"],"registry":["HKLM\\SOFTWARE\\Node.js"]},
+  {"name":"Python","aliases":["Python","Python3"],"files":["%LocalAppData%\\Programs\\Python","%LocalAppData%\\pip","%AppData%\\Python","%ProgramFiles%\\Python*"],"registry":["HKCU\\Software\\Python","HKLM\\SOFTWARE\\Python"]},
+  {"name":"Java","aliases":["Java","JDK","JRE","Oracle Java"],"files":["%ProgramFiles%\\Java","%ProgramFiles(x86)%\\Java","%ProgramData%\\Oracle\\Java","%AppData%\\.oracle_jre_usage"],"registry":["HKLM\\SOFTWARE\\JavaSoft","HKLM\\SOFTWARE\\WOW6432Node\\JavaSoft"]},
+  {"name":"Skype","aliases":["Skype"],"files":["%AppData%\\Skype","%AppData%\\Microsoft\\Skype for Desktop","%LocalAppData%\\Packages\\Microsoft.SkypeApp*"],"registry":["HKCU\\Software\\Skype","HKCU\\Software\\Microsoft\\Skype"]},
+  {"name":"TeamViewer","aliases":["TeamViewer"],"files":["%AppData%\\TeamViewer","%ProgramFiles%\\TeamViewer","%ProgramFiles(x86)%\\TeamViewer"],"registry":["HKCU\\Software\\TeamViewer","HKLM\\SOFTWARE\\TeamViewer","HKLM\\SOFTWARE\\WOW6432Node\\TeamViewer"]},
+  {"name":"Telegram","aliases":["Telegram","Telegram Desktop"],"files":["%AppData%\\Telegram Desktop","%LocalAppData%\\Telegram Desktop"],"registry":["HKCU\\Software\\Telegram Desktop"]},
+  {"name":"WhatsApp","aliases":["WhatsApp"],"files":["%LocalAppData%\\WhatsApp","%AppData%\\WhatsApp"],"registry":["HKCU\\Software\\WhatsApp"]},
+  {"name":"Dropbox","aliases":["Dropbox"],"files":["%AppData%\\Dropbox","%LocalAppData%\\Dropbox","%ProgramFiles(x86)%\\Dropbox","%ProgramData%\\Dropbox"],"registry":["HKCU\\Software\\Dropbox","HKLM\\SOFTWARE\\Dropbox"]},
+  {"name":"OneDrive","aliases":["OneDrive","Microsoft OneDrive"],"files":["%LocalAppData%\\Microsoft\\OneDrive","%ProgramData%\\Microsoft OneDrive"],"registry":["HKCU\\Software\\Microsoft\\OneDrive"]},
+  {"name":"iTunes","aliases":["iTunes","Apple iTunes"],"files":["%AppData%\\Apple Computer\\iTunes","%LocalAppData%\\Apple Computer","%ProgramFiles%\\iTunes","%CommonProgramFiles%\\Apple"],"registry":["HKCU\\Software\\Apple Computer, Inc.\\iTunes","HKLM\\SOFTWARE\\Apple Inc.\\iTunes"]},
+  {"name":"Spotify","aliases":["Spotify"],"files":["%AppData%\\Spotify","%LocalAppData%\\Spotify"],"registry":["HKCU\\Software\\Spotify"]},
+  {"name":"OBS Studio","aliases":["OBS","OBS Studio","obs-studio"],"files":["%AppData%\\obs-studio","%ProgramFiles%\\obs-studio"],"registry":["HKLM\\SOFTWARE\\OBS Studio"]},
+  {"name":"GIMP","aliases":["GIMP"],"files":["%AppData%\\GIMP","%ProgramFiles%\\GIMP*"],"registry":["HKLM\\SOFTWARE\\GIMP"]},
+  {"name":"Audacity","aliases":["Audacity"],"files":["%AppData%\\audacity","%ProgramFiles%\\Audacity"],"registry":["HKLM\\SOFTWARE\\Audacity"]},
+  {"name":"LibreOffice","aliases":["LibreOffice"],"files":["%AppData%\\LibreOffice","%ProgramFiles%\\LibreOffice"],"registry":["HKLM\\SOFTWARE\\LibreOffice"]},
+  {"name":"NVIDIA GeForce Experience","aliases":["GeForce Experience","NVIDIA"],"files":["%ProgramData%\\NVIDIA Corporation","%LocalAppData%\\NVIDIA Corporation","%LocalAppData%\\NVIDIA","%ProgramFiles%\\NVIDIA Corporation"],"registry":["HKLM\\SOFTWARE\\NVIDIA Corporation"]},
+  {"name":"AMD Software","aliases":["AMD Software","Radeon","AMD Radeon"],"files":["%LocalAppData%\\AMD","%ProgramData%\\AMD","%ProgramFiles%\\AMD"],"registry":["HKLM\\SOFTWARE\\AMD","HKCU\\Software\\AMD"]},
+  {"name":"CCleaner","aliases":["CCleaner","Piriform"],"files":["%ProgramFiles%\\CCleaner","%ProgramData%\\Piriform\\CCleaner"],"registry":["HKCU\\Software\\Piriform\\CCleaner","HKLM\\SOFTWARE\\Piriform\\CCleaner"]},
+  {"name":"WinSCP","aliases":["WinSCP"],"files":["%ProgramFiles(x86)%\\WinSCP","%AppData%\\WinSCP"],"registry":["HKCU\\Software\\Martin Prikryl\\WinSCP 2","HKLM\\SOFTWARE\\WinSCP"]},
+  {"name":"PuTTY","aliases":["PuTTY","putty"],"files":["%ProgramFiles%\\PuTTY","%ProgramFiles(x86)%\\PuTTY"],"registry":["HKCU\\Software\\SimonTatham\\PuTTY","HKLM\\SOFTWARE\\PuTTY"]},
+  {"name":"FileZilla","aliases":["FileZilla"],"files":["%AppData%\\FileZilla","%ProgramFiles%\\FileZilla FTP Client"],"registry":["HKLM\\SOFTWARE\\FileZilla"]},
+  {"name":"qBittorrent","aliases":["qBittorrent"],"files":["%LocalAppData%\\qBittorrent","%AppData%\\qBittorrent","%ProgramFiles%\\qBittorrent"],"registry":["HKCU\\Software\\qBittorrent"]},
+  {"name":"Wireshark","aliases":["Wireshark"],"files":["%AppData%\\Wireshark","%ProgramFiles%\\Wireshark"],"registry":["HKLM\\SOFTWARE\\Wireshark"]},
+  {"name":"VMware Workstation","aliases":["VMware","VMware Workstation"],"files":["%AppData%\\VMware","%ProgramData%\\VMware","%ProgramFiles(x86)%\\VMware"],"registry":["HKCU\\Software\\VMware, Inc.","HKLM\\SOFTWARE\\VMware, Inc."]},
+  {"name":"VirtualBox","aliases":["VirtualBox","Oracle VirtualBox"],"files":["%UserProfile%\\.VirtualBox","%UserProfile%\\VirtualBox VMs","%ProgramFiles%\\Oracle\\VirtualBox"],"registry":["HKLM\\SOFTWARE\\Oracle\\VirtualBox"]},
+  {"name":"PowerToys","aliases":["PowerToys","Microsoft PowerToys"],"files":["%LocalAppData%\\Microsoft\\PowerToys","%ProgramFiles%\\PowerToys"],"registry":["HKCU\\Software\\Classes\\powertoys"]},
+  {"name":"Paint.NET","aliases":["Paint.NET","paintdotnet"],"files":["%LocalAppData%\\paint.net","%ProgramFiles%\\paint.net"],"registry":["HKLM\\SOFTWARE\\paint.net"]},
+  {"name":"IrfanView","aliases":["IrfanView"],"files":["%AppData%\\IrfanView","%ProgramFiles%\\IrfanView","%ProgramFiles(x86)%\\IrfanView"],"registry":["HKCU\\Software\\IrfanView","HKLM\\SOFTWARE\\IrfanView"]},
+  {"name":"Blender","aliases":["Blender"],"files":["%AppData%\\Blender Foundation","%ProgramFiles%\\Blender Foundation"],"registry":["HKLM\\SOFTWARE\\BlenderFoundation"]},
+  {"name":"Docker Desktop","aliases":["Docker","Docker Desktop"],"files":["%AppData%\\Docker","%AppData%\\Docker Desktop","%LocalAppData%\\Docker","%ProgramData%\\Docker","%ProgramFiles%\\Docker"],"registry":["HKCU\\Software\\Docker Inc.","HKLM\\SOFTWARE\\Docker Inc."]}
+]
diff --git a/src/DeepPurge.Core/DeepPurge.Core.csproj b/src/DeepPurge.Core/DeepPurge.Core.csproj
@@ -30,6 +30,10 @@
     <Using Include="System.Runtime.InteropServices" />
   </ItemGroup>
 
+  <ItemGroup>
+    <EmbeddedResource Include="Data\leftover-signatures.json" />
+  </ItemGroup>
+
   <ItemGroup>
     <PackageReference Include="Microsoft.Toolkit.Uwp.Notifications" Version="7.1.3" />
     <PackageReference Include="System.Management" Version="8.0.0" />
diff --git a/src/DeepPurge.Core/FileSystem/FileLeftoverScanner.cs b/src/DeepPurge.Core/FileSystem/FileLeftoverScanner.cs
@@ -1,3 +1,4 @@
+using DeepPurge.Core.Data;
 using DeepPurge.Core.Models;
 
 namespace DeepPurge.Core.FileSystem;
@@ -61,6 +62,26 @@ public FileLeftoverScanner(HashSet<string>? customExclusions = null)
     public List<LeftoverItem> ScanForLeftovers(InstalledProgram program, ScanMode mode)
     {
         var leftovers = new List<LeftoverItem>();
+
+        var sigMatch = LeftoverSignatureDb.FindMatch(program.DisplayName);
+        if (sigMatch != null)
+        {
+            foreach (var path in sigMatch.FilePaths)
+            {
+                if (!Safety.SafetyGuard.IsPathSafeToDelete(path)) continue;
+                var isDir = Directory.Exists(path);
+                var size = isDir ? GetDirectorySize(path) : (File.Exists(path) ? new FileInfo(path).Length : 0);
+                if (size == 0 && !isDir) continue;
+                leftovers.Add(new LeftoverItem
+                {
+                    Path = path, DisplayPath = path,
+                    Type = isDir ? LeftoverType.Folder : LeftoverType.File,
+                    Confidence = LeftoverConfidence.Safe, SizeBytes = size,
+                    IsSelected = true, Details = "Known leftover (signature match)"
+                });
+            }
+        }
+
         BuildSearchTerms(program);
         BuildCrossReference(program);
 
diff --git a/src/DeepPurge.Core/Registry/RegistryLeftoverScanner.cs b/src/DeepPurge.Core/Registry/RegistryLeftoverScanner.cs
@@ -1,4 +1,5 @@
 using global::Microsoft.Win32;
+using DeepPurge.Core.Data;
 using DeepPurge.Core.Models;
 
 namespace DeepPurge.Core.Registry;
@@ -52,6 +53,24 @@ public RegistryLeftoverScanner(HashSet<string>? customExclusions = null)
     public List<LeftoverItem> ScanForLeftovers(InstalledProgram program, ScanMode mode)
     {
         var leftovers = new List<LeftoverItem>();
+
+        var sigMatch = LeftoverSignatureDb.FindMatch(program.DisplayName);
+        if (sigMatch != null)
+        {
+            foreach (var regPath in sigMatch.RegistryPaths)
+            {
+                if (!Safety.SafetyGuard.IsRegistryPathSafeToDelete(regPath)) continue;
+                if (!RegistryKeyExists(regPath)) continue;
+                leftovers.Add(new LeftoverItem
+                {
+                    Path = regPath, DisplayPath = regPath,
+                    Type = LeftoverType.RegistryKey,
+                    Confidence = LeftoverConfidence.Safe,
+                    IsSelected = true, Details = "Known leftover (signature match)"
+                });
+            }
+        }
+
         BuildSearchTerms(program);
 
         // 1. Remove the uninstall registry key itself
@@ -641,6 +660,28 @@ private void SearchKeyRecursive(RegistryKey hive, string path, string searchTerm
         catch { }
     }
 
+    private static bool RegistryKeyExists(string path)
+    {
+        try
+        {
+            var split = path.IndexOf('\\');
+            if (split <= 0) return false;
+            var hive = path[..split].ToUpperInvariant();
+            var sub = path[(split + 1)..];
+            RegistryKey? baseKey = hive switch
+            {
+                "HKLM" or "HKEY_LOCAL_MACHINE" => global::Microsoft.Win32.Registry.LocalMachine,
+                "HKCU" or "HKEY_CURRENT_USER" => global::Microsoft.Win32.Registry.CurrentUser,
+                "HKCR" or "HKEY_CLASSES_ROOT" => global::Microsoft.Win32.Registry.ClassesRoot,
+                _ => null,
+            };
+            if (baseKey == null) return false;
+            using var key = baseKey.OpenSubKey(sub);
+            return key != null;
+        }
+        catch { return false; }
+    }
+
     private static string ExtractExeName(string uninstallString)
     {
         if (string.IsNullOrEmpty(uninstallString)) return "";
