siliconman01
-
Posts
1,117 -
Joined
-
Last visited
Posts posted by siliconman01
-
-
On my Windows 8.1 x64 Professional system, the two suggested new entries shown below:
[LocalService Cached Certification Files*]
LangSecRef=3025
Detect=HKLM\SOFTWARE\Microsoft\Windows
Default=False
FileKey1=%WinDir%\LocalService\AppData\LocalLow\Microsoft\CryptnetUrlCacheContent|*.*|RECURSE
FileKey2=%WinDir%\LocalService\AppData\LocalLow\Microsoft\CryptnetUrlCacheMetaData|*.*|RECURSE
[NetworkService Cached Certification Files*]
LangSecRef=3025
Detect=HKLM\SOFTWARE\Microsoft\Windows
Default=False
FileKey1=%WinDir%\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content|*.*|RECURSE
FileKey2=%WinDir%\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData|*.*|RECURSEshould actually be:
[LocalService Cached Certification Files*]
LangSecRef=3025
Detect=HKLM\SOFTWARE\Microsoft\Windows
Default=False
FileKey1=%WinDir%\ServiceProfiles\LocalService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content|*.*|RECURSE
FileKey2=%WinDir%\ServiceProfiles\LocalService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData|*.*|RECURSE[NetworkService Cached Certification Files*]
LangSecRef=3025
Detect=HKLM\SOFTWARE\Microsoft\Windows
Default=False
FileKey1=%WinDir%\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content|*.*|RECURSE
FileKey2=%WinDir%\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData|*.*|RECURSE -
+3
+4
-
For the soon to be released Malwarebytes Anti-Malware 2.0. I recommend that this code be "in addition" to the current Malwarebytes Anti-Malware code in Winapp2.ini because many people may elect not to upgrade to this new version.
[Malwarebytes Anti-Malware 2.0*] LangSecRef=3024 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\mbam.exe Default=False FileKey1=%CommonAppData%\Malwarebytes\Malwarebytes Anti-Malware\Logs|*.*
-
adwcleaner doesn't have that functionality,and as far as i know doesn't allow you to restore from the quarantine
I do not use adwcleaner 3.0 so I cannot confirm this; however, post #2 on this forum thread indicates that quarantine restore is available.
http://www.bleepingcomputer.com/forums/t/506366/does-adwcleaner-automatically-quarantine/
-
On Windows 8.1, the FileKey1 entry for [Windows Burn Cache*] is different. Here is the change. I suspect the original post is in error.
[Windows Burn Cache*]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning
Default=False
Warning=This option will wipe all files that are waiting to be burned to a CD/DVD/BRD
FileKey1=%LocalAppData%\Microsoft\Windows\Burn\Temporary Burn Folder|*.* -
That was how I originally had it then someone for whatever reason changed it to DetectFile.
This is how I have mine now, no need for a DetectFile at all:
[Config.msi Folder*] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Installer Detect2=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer Default=False FileKey1=%SystemDrive%\Config.msi|*.*|REMOVESELF
That works for me as well.
-
Modified: Added DetectFile=. The current "Detect" key is not present in Windows 8 x64 Professional
[Config.msi Folder*]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Installer
DetectFile=%SystemDrive%\Config.msi
Default=False
FileKey1=%SystemDrive%\Config.msi|*.*|REMOVESELF -
New Entry: [Western Digital MyCloud Drive (Logs)*]
[Western Digital MyCloud Drive (Logs)*] LangSecRef=3024 Detect=HKLM\Software\Western Digital\WD My Cloud Default=False FileKey1=%ProgramData%\Western Digital\Logs\WD QuickView\*\|*.log FileKey2=%LocalAppData%\Western Digital\WDNasSetup\|*.*|RECURSE
-
Please remove the entry listed below. There is no .log file there to be removed ever. I have been watching this entry since PerfectDisk 12.5 & until the current build, 13.0. There is a file in that location called 'PDBootLog' and that is not a .log file. It is an essential file for the program. A snapshot of the location is attached with this post.
[PerfectDisk More*]
LangSecRef=3024
Detect=HKCU\Software\Raxco\PerfectDisk
Default=False
FileKey1=%CommonAppData%\Raxco\PerfectDisk\*|*.log
I have PerfectDisk Pro V13 (Build 770) which is the latest version of PD. There is a log created named PDBootlog.log. It is generated when you do a Boot Time defrag. This is on Windows 7 x86 Professional.
-
windows 8 here, might be related to a pre 8.1 patch or something
Yeah, if my memory serves me correctly, the large Reserve.tmp file did go away after I upgraded to 8.1.
-
Does anyone know what's up with Reserve.tmp in my winsxs folder? Everything I've read says it should delete itself after a few days but it's been there for 11 days now and 2% of my drive space is occupied by that file alone.
Hmmm...Reverse.tmp does not exist on my Windows 8.1 x64 Professional nor Windows 7 x86 Professional systems.
-
If the [Office 2010 More*] code above is okay, then it also applies to Office 2013 as shown below.
[Office 2013 More*]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\Office\15.0\Common
Default=False
FileKey1=%LocalAppData%\Microsoft\Office\15.0\OfficeFileCache|*.*|RECURSE
FileKey2=%LocalAppData%\Microsoft\Office\15.0|OneNoteOfflineCache.onecache
FileKey3=%LocalAppData%\Microsoft\OneNote\15.0\OneNoteOfflineCache_Files|*.*|RECURSE
FileKey4=%AppData%\Microsoft\OneNote\15.0|Preferences.dat -
I think that should be RECURSE as it cleans it's own detect, But I think this one has been discussed before that it could be harmful for uninstalling some updates
Post 4 on the Wilders Security forum gives some pretty compelling arguments as to why NOT to delete $patchcache$.
http://www.wilderssecurity.com/showthread.php?t=341036
And this statement from the link below:
Package cache copyWhether or not a user interface is displayed, the primary portion of the installation - the only portion that should attempt to modify machine state - runs as a service. At this point, the package - either a .msi file stripped of any embedded cabinets, or an entire .msp file - is copied to the Windows Installer cache under %WINDIR%\Installer. If the installation is successful, this file will remain in that location for all future maintenance installations including uninstalling the product. Patch packages are cached in whole to make available any updated files for future maintenance installations like repairs or installing additional patches.
This location is under %WINDIR%\Installer.
These files cannot be deleted or future maintenance installations on products - including even uninstalling a product - will fail.
-
Got it now....thanks much.
-
Update does not appear to be posted. Download is previous release "Link to download Winapp2.ini Version: v4.09.131219"
-
How's this for wmdb?
[Windows Media Player (Databases)*]
LangSecRef=3023
Detect1=HKCR\Windows.Movie.Maker
Detect2=HKCU\Software\Microsoft\MediaPlayer
Default=False
Warning=This will remove ratings, play counts, last played, etc.
FileKey1=%SystemDrive%\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Media Player|*.*|REMOVESELF
FileKey2=%SystemDrive%\Documents and Settings\NetworkService\Local Settings\Microsoft\Media Player|*.*|REMOVESELF
FileKey3=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Media Player|*.*|RECURSE
FileKey4=%LocalAppData%\Microsoft\Media Player|*.wmdb;wmdbexport.xml
FileKey5=%WinDir%\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Media Player|*.wmdb
FileKey6=%SystemDrive%\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player|*.wmdb
FileKey7=%SystemDrive%\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Media Player|*.wmdb
ExcludeKey1=%LocalAppData%\Microsoft\Media Player|CurrentDatabase*.wmdb
ExcludeKey2=%SystemDrive%\Documents and Settings\*\Local Settings\Microsoft\Media Player|CurrentDatabase*.wmdb
I'm not experiencing any problems with the code above and Windows Media Player 12 on Windows 8.1 x64 Professional.
-
New Entry: Bitdefender Total Security 2014 (Logs)
[bitDefender Total Security 2014 (Logs)*]
LangSecRef=3024
Detect=HKLM\Software\BitDefender\Bitdefender Total Security
Warning=This removes only logs created while scanning external drives and other special unneeded scan logs generated by Bitdefender scanner.
Default=False
FileKey1=%Appdata%\Bitdefender\Desktop\profiles\Logs\*\|*.xml -
Updated. Changes on the way. changes.txt updated for now
Hope you aced the final. Thanks for the update of winapp2.ini.
-
Modified [internet Explorer 10/11 More*]- Removed FileKey7, FileKey12, ExcludeKey1
These are not needed because the cookie handler built into CCleaner properly handles these cookies.
[Internet Explorer 10/11*] LangSecRef=3022 DetectFile=%LocalAppData%\Microsoft\Windows\WebCache Default=False FileKey1=%LocalAppData%\Microsoft\SmartScreen|*.tmp FileKey2=%LocalAppData%\Microsoft\Vault\*|*.vcrd FileKey3=%LocalAppData%\Microsoft\Windows\AppCache|*.*|RECURSE FileKey4=%LocalAppData%\Microsoft\Windows\IECompatCache|*.*|RECURSE FileKey5=%LocalAppData%\Microsoft\Windows\IECompatUACache|*.*|RECURSE FileKey6=%LocalAppData%\Microsoft\Windows\INetCache|*.*|RECURSE FileKey7=%LocalAppData%\Microsoft\Windows\WebCache|*.*|RECURSE FileKey8=%LocalAppData%\Microsoft\Windows\WebCache.old|*.*|REMOVESELF FileKey9=%LocalLowAppData%\Microsoft\Windows\AppCache|*.*|RECURSE FileKey10=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache|*.*|RECURSE RegKey1=HKCU\Software\Microsoft\Internet Explorer\TypedURLSTime
-
Modified Entry: [internet Explorer 10/11*]- Added ExcludeKey1
In the code below, FileKey7 removes cookies without regard to the built-in intelligent cookie logic or manual entry that specifies which cookies should not be removed. In my personal case, this removes a banking cookie that my bank uses to force a member to have to enter a code via mobile text or telephone each time the member signs on to the e-banking website. I do not want this cookie removed. ExcludeKey1 prevents this code block from removing the cookie. (To comply with CCleaner's cookie management features, FileKey7 and FileKey12 probably should be removed completely from this code. That would negate the need for ExcludeKey1.)
[Internet Explorer 10/11*] LangSecRef=3022 DetectFile=%LocalAppData%\Microsoft\Windows\WebCache Default=False FileKey1=%LocalAppData%\Microsoft\SmartScreen|*.tmp FileKey2=%LocalAppData%\Microsoft\Vault\*|*.vcrd FileKey3=%LocalAppData%\Microsoft\Windows\AppCache|*.*|RECURSE FileKey4=%LocalAppData%\Microsoft\Windows\IECompatCache|*.*|RECURSE FileKey5=%LocalAppData%\Microsoft\Windows\IECompatUACache|*.*|RECURSE FileKey6=%LocalAppData%\Microsoft\Windows\INetCache|*.*|RECURSE FileKey7=%LocalAppData%\Microsoft\Windows\INetCookies|*.*|RECURSE FileKey8=%LocalAppData%\Microsoft\Windows\WebCache|*.*|RECURSE FileKey9=%LocalAppData%\Microsoft\Windows\WebCache.old|*.*|REMOVESELF FileKey10=%LocalLowAppData%\Microsoft\Windows\AppCache|*.*|RECURSE FileKey11=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache|*.*|RECURSE FileKey12=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies|*.*|RECURSE RegKey1=HKCU\Software\Microsoft\Internet Explorer\TypedURLSTime ExcludeKey1=FILE|%LocalAppData%\Microsoft\Windows\INetCookies\Low\|*.*
-
Also a duplicated entry:
[Windows Log Files More*] LangSecRef=3025 DetectFile=%windir%\Panther Default=False FileKey1=%windir%\PANTHER| [Windows Log Files More*] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows Default=False FileKey1=%WinDir%\inf|setupapi.offline.log FileKey2=%WinDir%\Panther|cbs.log;DDACLSys.log;miglog.xml;Migrep.html FileKey3=%WinDir%\winsxs|poqexec.log FileKey4=%WinDir%\debug\WIA|*.log FileKey5=%WinDir%|SIGVERIF.TXT FileKey6=%WinDir%\System32\sysprep\Panther\IE|diagerr.xml;diagwrn.xml FileKey7=%WinDir%\Panther|PostGatherPnPList.log;PreGatherPnPList.log FileKey8=%WinDir%\Panther\UnattendGC|diagerr.xml;diagwrn.xml
This name duplication is preventing either one from showing up in the Applications tab. Looks to me that the first/top one needs to be totally removed.
-
And another error, filekey duplicated in this entry:
[NVIDIA Updates*] LangSecRef=3023 Detect=HKLM\Software\NVIDIA Corporation Default=False FileKey1=%CommonAppData%\Nvidia\Updates|*.bak FileKey2=%CommonAppData%\Nvidia\Updatus|*.bak
Can you tell I'm looking through the whole file for the first time in ages
These are not duplicated FileKeyx. One is for Nvidia folder Updates and the other is for Nvidia folder Updatus. Note the spelling difference.
-
unneeded post
-
I like [someprogram Temporary Files] best.
Winapp2.ini additions
in CCleaner
Posted
On Windows 8.1 x64, the entry finds a lot of files that are .bak, .log, .logx, and others that I believe would be pretty risky to remove. I do not recommend such a "global" code for Winapp2.ini.