in a method for determining and scoring a signature for a software package . a processor determines a signature of a first software package , wherein the signature comprises an indication of a first set of files on a computer system after installation of the first software package that were not present on the computer system before the installation , and an indication of a second set of files not remaining on the computer system after an uninstall of the first software package . a processor compares the first and the second set of files indicated in the signature of the first software package to files indicated in one or more other signatures of other software packages . a processor determines a score for the signature of the first software package based on the comparison .