Jump to content

siliconman01

Experienced Members
  • Posts

    1,117
  • Joined

  • Last visited

Posts posted by siliconman01

  1. Modified Entry: [CNN*] Added FileKey8

     

    [CNN*]
    LangSecRef=3031
    Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\588E6FFA.CNNAppforWindows_cs8eyncph15zy
    DetectFile=%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_cs8eyncph15zy
    Default=False
    FileKey1=%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_*\AC\INetCache|*.*|RECURSE
    FileKey2=%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_*\AC\INetCookies|*.*|RECURSE
    FileKey3=%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_*\AC\INetHistory|*.*|RECURSE
    FileKey4=%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_*\AC\Microsoft\CLR_v4.0*\UsageLogs|*.*|RECURSE
    FileKey5=%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_*\AC\PRICache|*.*
    FileKey6=%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_*\AC\Temp|*.*
    FileKey7=%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_*\TempState|*.*|RECURSE
    FileKey8=%LocalAppData%\Packages\588E6FFA.CNNAppforWindows_*\AC\Microsoft\CLR_v4.0\|*.log
    

     

    Modified Entry [uSA Today*] Added FileKey9

     

    [uSA Today*]
    LangSecRef=3031
    Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\USATODAY.USATODAY_wy7mw3214mat8
    DetectFile=%LocalAppData%\Packages\USATODAY.USATODAY_wy7mw3214mat8
    Default=False
    FileKey1=%LocalAppData%\Packages\USATODAY.USATODAY_*\AC\INetCache|*.*|RECURSE
    FileKey2=%LocalAppData%\Packages\USATODAY.USATODAY_*\AC\INetCookies|*.*|RECURSE
    FileKey3=%LocalAppData%\Packages\USATODAY.USATODAY_*\AC\INetHistory|*.*|RECURSE
    FileKey4=%LocalAppData%\Packages\USATODAY.USATODAY_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
    FileKey5=%LocalAppData%\Packages\USATODAY.USATODAY_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
    FileKey6=%LocalAppData%\Packages\USATODAY.USATODAY_*\AC\PRICache|*.*
    FileKey7=%LocalAppData%\Packages\USATODAY.USATODAY_*\AC\Temp|*.*
    FileKey8=%LocalAppData%\Packages\USATODAY.USATODAY_*\TempState|*.*|RECURSE
    FileKey9=%LocalAppData%\Packages\USATODAY.USATODAY_*\AC\Microsoft\CLR_v4.0\|*.log
    

     

    Modified Entry: [NBC News*] Added FileKey8

     

    [NBC News*]
    LangSecRef=3031
    Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\msnbc.comDigitalNetwork.msnbc.com_amdjbdaxqsje6
    DetectFile=%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_amdjbdaxqsje6
    Default=False
    FileKey1=%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_*\AC\INetCache|*.*|RECURSE
    FileKey2=%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_*\AC\INetCookies|*.*|RECURSE
    FileKey3=%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_*\AC\INetHistory|*.*|RECURSE
    FileKey4=%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
    FileKey5=%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_*\AC\PRICache|*.*
    FileKey6=%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_*\AC\Temp|*.*
    FileKey7=%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_*\TempState|*.*|RECURSE
    FileKey8=%LocalAppData%\Packages\msnbc.comDigitalNetwork.msnbc.com_*\AC\Microsoft\CLR_v4.0\|*.log
    

  2. Modified Entry: [Windows Communications Apps*] Added FileKey12

     

    [Windows Communications Apps*]
    LangSecRef=3031
    Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.windowscommunicationsapps_8wekyb3d8bbwe
    DetectFile=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe
    Default=False
    FileKey1=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\AppCache|*.*|RECURSE
    FileKey2=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\INetCache|*.*|RECURSE
    FileKey3=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\INetCookies|*.*|RECURSE
    FileKey4=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\INetHistory|*.*|RECURSE
    FileKey5=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
    FileKey6=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\Microsoft\CryptnetUrlCache\Content|*.*
    FileKey7=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\Microsoft\CryptnetUrlCache\MetaData|*.*
    FileKey8=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
    FileKey9=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\PRICache|*.*
    FileKey10=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\Temp|*.*
    FileKey11=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\TempState|*.*|RECURSE
    FileKey12=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\LocalState\LiveComm\nouser0000000000000001\120712-0049\DBStore\LogFiles\|*.Log
    RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\SearchHistory
    

  3. Modified Entry: [Zune Video*] Added FileKey16

     

    [Zune Video*]
    LangSecRef=3031
    Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneVideo_8wekyb3d8bbwe
    DetectFile=%LocalAppData%\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe
    Default=False
    FileKey1=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\AppCache|*.*|RECURSE
    FileKey2=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\INetCache|*.*|RECURSE
    FileKey3=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\INetCookies|*.*|RECURSE
    FileKey4=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\INetHistory|*.*|RECURSE
    FileKey5=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
    FileKey6=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\Microsoft\CryptnetUrlCache\Content|*.*
    FileKey7=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\Microsoft\CryptnetUrlCache\MetaData|*.*
    FileKey8=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
    FileKey9=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\PRICache|*.*
    FileKey10=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\Temp|*.*
    FileKey11=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\Cache|*.*|RECURSE
    FileKey12=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\ImageCache|*.*|RECURSE
    FileKey13=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\navigationHistory|*.*|RECURSE
    FileKey14=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\PlayReady|*.*|RECURSE
    FileKey15=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\TempState|*.*|RECURSE
    FileKey16=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\Database\anonymous|*.log
    RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneVideo_8wekyb3d8bbwe\SearchHistory
    

  4. New Language file entry.

     

    [sUPERAntiSpyware (Lng)*]
    Section=Language Files
    Detect=HKLM\SOFTWARE\SUPERAntiSpyware.com\SUPERAntiSpyware
    Default=False
    Warning=This will delete all language files excluding English.
    FileKey1=%ProgramFiles%\SUPERAntiSpyware\Language|*.lng
    ExcludeKey1=FILE|%ProgramFiles%\SUPERAntiSpyware\Language\English (US).lng
    

     

    Question Winapp2:

    Can you perhaps make one file of all the Lanuage Files entries obtained ?

     

    I am sure there are a couple of people that will contribute as well to that file.

     

    Unless SAS changed something in the latest release, removing the unneeded languages causes SAS to think it has a new program update available because it cannot find the missing languages. So when you update, the languages are put right back in. That's kind of a pain in the butt if you are running real-time protection or automatic check for updates with SAS Pro.

  5. The code below needs a stronger detect string for ResumeMaker. The code shows up on systems that do not have ResumeMaker installed

     

    [ResumeMaker Logs*]
    LangSecRef=3021
    Detect=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
    Default=False
    FileKey1=%CommonAppData%\Individual Software\ResumeMaker\R12|*.log
    

  6. Modified: [MS Word 2007 Document Building Blocks*] to [MS Word 2007/10/13 Document Building Blocks*] This code also applies to MS Office 2010 and 2013.

     

    [MS Word 2007/10/13 Document Building Blocks*]
    LangSecRef=3021
    DetectFile=%AppData%\Microsoft\Document Building Blocks
    Default=False
    FileKey1=%AppData%\Microsoft\Document Building Blocks|*.*|RECURSE
    

  7. Corrected/Modified Entry [Belarc*]: Discovered that removing file Install.log damages the program uninstaller and it will not uninstall. Removed FileKey1 and FileKey5 from the post above.

     

    [belarc*]

    LangSecRef=3024

    Detect=HKCU\Software\Belarc

    Default=False

    FileKey1=%ProgramFiles%\Belarc\Advisor\System|Progress.Log

    FileKey2=%ProgramFiles%\Belarc\Advisor\System\Security\BelNotify|BelNotify.log;History.log;HistoryHF.log

    FileKey3=%ProgramFiles%\Belarc\Advisor\System\Tmp|*.*

    FileKey4=%ProgramFiles%\Belarc\BelArcAdvisor\System|Progress.Log

    FileKey5=%ProgramFiles%\Belarc\BelArcAdvisor\System\Security\BelNotify|BelNotify.log;History.log;HistoryHF.log

    FileKey6=%ProgramFiles%\Belarc\BelArcAdvisor\System\Tmp|*.*

  8. Modified Entry BelArc*: Belarc developers changed the name on one of its folders on the newest version of Belarc. Added FileKey5/6/7/8

     

    [belarc*]

    LangSecRef=3024

    Detect=HKCU\Software\Belarc

    Default=False

    FileKey1=%ProgramFiles%\Belarc\Advisor|INSTALL.Log

    FileKey2=%ProgramFiles%\Belarc\Advisor\System|Progress.Log

    FileKey3=%ProgramFiles%\Belarc\Advisor\System\Security\BelNotify|BelNotify.log;History.log;HistoryHF.log

    FileKey4=%ProgramFiles%\Belarc\Advisor\System\Tmp|*.*

    FileKey5=%ProgramFiles%\Belarc\BelArcAdvisor|INSTALL.Log

    FileKey6=%ProgramFiles%\Belarc\BelArcAdvisor\System|Progress.Log

    FileKey7=%ProgramFiles%\Belarc\BelArcAdvisor\System\Security\BelNotify|BelNotify.log;History.log;HistoryHF.log

    FileKey8=%ProgramFiles%\Belarc\BelArcAdvisor\System\Tmp|*.*

  9. If time permits, how about an interium release of Winapp2.ini to include missed code of the last release and new code? :wub:

     

    Might help solidify the release of Winapp2.ini when the next version of CCleaner is issued.

  10. And try: Control Panel>Internet Options>General Tab>Browsing history>Delete hot button.

     

    On the Delete Browsing History page, check mark or uncheck what you want the delete action to do or not do and then click on Delete. As suggestion:

     

    Uncheck "Preserve Favorites website data"

    Check "Temporary Internet files and website files"

    Check "Cookies and website data"

    Check "History"

    The last three items are at your choice.

     

    Repeat/Do this for every user account on the laptop. In other words sign on under each user account and perform the above.

  11. Modified Entry: [Quicken Logs*] Added FileKey4

     

    [Quicken Logs*]

    LangSecRef=3021

    Detect=HKLM\SOFTWARE\Intuit\Quicken

    Default=False

    FileKey1=%AppData%\Intuit\Quicken\Log|*.txt;*.log

    FileKey2=%CommonAppData%\Intuit\Quicken\Log|*.log

    FileKey3=%CommonAppData%\Intuit\Quicken\Log\installer|*.*|REMOVESELF

    FileKey4=%ProgramData%\Intuit\SendError\|*.log|

  12. DEFINITELY do not include FileKey1=%ProgramFiles%\Intel|*.*|REMOVESELF. Removing this will damage a lot of systems with various Intel components used. There is already an Intel entry to take care of the FileKey1=%SystemDrive%\Intel*|*.*|REMOVESELF

     

    [intel Installation Logs*]

    LangSecRef=3024

    Detect1=HKCU\Software\Intel

    Detect2=HKLM\Software\Intel

    Default=False

    FileKey1=%SystemDrive%\Intel*|*.*|REMOVESELF

    FileKey2=%UserProfile%\Intel\Logs|*log

     

    Also there is a NetGenie entry that can be modified to take care of the NetGenie entry above.

     

    Suggested Modification

    [NETGEAR Genie (logs)*]

    LangSecRef=3024

    Detect1=HKLM\Software\NETGEAR Genie

    Default=False

    FileKey1=%LocalAppData%\NETGEARGenie\log|*.log

     

    to

     

    [NETGEAR Genie*]

    LangSecRef=3024

    Detect=HKLM\Software\NETGEAR Genie

    Default=False

    FileKey1=%LocalAppData%\NETGEARGenie|*.txt

    FileKey2=%LocalAppData%\NETGEARGenie\log|*.log

    FileKey3=%LocalAppData%\NETGEARGenie\update_temp|*.*

  13. For me the Windows Event Viewer log cleaning works on XP, Windows 764bit and Windows 8 64bit.

     

    UAC on.

     

    (Just tested it on my Win 8 machine)

     

    I turned on UAC and tried....no luck. Tried CCleaner "Run as Administrator", etc....no luck.

     

    Are you running with "elevated administrator" or with the unelevated administrator account? I'm running the unelevated.

  14. Have you given the 'event logs' clean a run, rebooted, and then looked?

     

    Or are you saying no matter what you do this doesn't work?

     

    What security set up do you run?

     

    No matter what I do on the Windows 7 and/or Windows 8 computers, it does not clean out the Event logs. I am running under Administrator privileges on my User account on all systems.

    I even tried CCleaner with my Windows 7 system booted into Safe Mode....still no cleaning of the Event Viewer logs. And I'm showing event log entries as far back as 09-Jan-2013.

  15. Errrrr I would rather not promote this entry (opinion only) as it could be used unwisely and file key 2 just looks scary, what happens when symantec decides to store all logs there

     

    Honestly things like that should only be removed at the request of the technician who ran/suggested-running-of the error repairer

     

    JFI, the Symantec program SYMNRA.exe does not actually do any repair of Norton products. When a Norton user has a problem and reports it to Symantec, the techs often ask the user to download/install and then run SYMNRA.exe. The user is then supposed to regenerate the "problem". SymNRA.exe collects, builds and stores log files to help the techs identify what is going on. That is ALL SymNRA.exe does...is build and store log files. The user then stops SymNRA and uploads the log files to TinyURL into a Norton upload storage area for the techs to recover.

     

    So the user is left hanging with log files that can be quite large. The Symantec techs do not give a hoot whether the log files build up or are cleaned off. That's strictly up to the Norton user.

  16. This new entry was missed ??

     

    New Entry: [Amazon.com Software Downloads (Logs)*]

    The logs are created when you purchase and download software from Amazon.com.

     

    [Amazon.com Software Downloads (Logs)*]
    LangSecRef=3024
    DetectFile=%Documents%\Amazon Downloader Logs
    Default=False
    FileKey1=%Documents%\Amazon Downloader Logs\|*.*|REMOVESELF
    

×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.