siliconman01

I'd like to rescind New entry: [Windows 11 Notepad *] ... until it comes out of beta on Windows 11.

Whereas the Windows 11 Notepad is in the beta phase and feedback has been urged, I sent a request via Notepad feedback to make the Find/Replace data as separate .dat file so that it can be cleared without affecting other User settings (Theme and Fonts). Hopefully the Notepad developer will meet the request.

This works: [Windows 11 Notepad *] DetectOS=10.0| LangSecRef=3031 DetectFile=%LocalAppData%\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe FileKey1=%LocalAppData%\Packages\Microsoft.WindowsNotepad_*\SystemAppData\Helium|User.dat

New entry: [Windows 11 Notepad *] [Windows 11 Notepad *] DetectOS=10.0| LangSecRef=3031 DetectFile=%LocalAppData%\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe FileKey1=%LocalAppData%\Packages\Microsoft.WindowsNotepad_*\SystemAppData\Helium|User.dat

I assume [MS Notepad *] clears it in Windows 10. These keys are not present in Windows 11 Notepad. [MS Notepad *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Notepad RegKey1=HKCU\Software\Microsoft\Notepad|replaceString RegKey2=HKCU\Software\Microsoft\Notepad|searchString

Open a text file in Notepad Go to Edit>Find in the top menu of Notepad. I just figured that this was Windows Explorer working with Notepad.

In Windows 11 Pro x64 V21H2 (OS Build 22000.469), CCleaner V5.89.9401 does not clear the Windows Explorer Edit>Find window.

I feel you can include [DVDFab Update Cleanup *] in [DVDFab *] thereby eliminating [DVDFab Update Cleanup *] [DVDFab *] LangSecRef=3023 Detect1=HKCU\Software\DVDFab Detect2=HKCU\Software\DVDFab Passkey Detect3=HKCU\Software\FabPlayer FileKey1=%AppData%\DVDFab Player*\Advertis*|*.*|RECURSE FileKey2=%AppData%\DVDFab\DVDFab*\SceneData|*.*|RECURSE FileKey3=%AppData%\LiveUpdate|*.log FileKey4=%AppData%\Microsoft\Windows\Templates\Videos\Temp|*.*|RECURSE FileKey5=%Documents%\DVDFab*|*.log FileKey6=%Documents%\DVDFab*\Log|*.*|RECURSE FileKey7=%Documents%\DVDFab*\SceneData|*.*|RECURSE FileKey8=%Documents%\DVDFab*\Temp|*.*|RECURSE FileKey9=%Documents%\DVDFab\DVDFab*\Cinavia|*.*|RECURSE FileKey10=%Documents%\DVDFab\DVDFab*\Log|*.*|RECURSE FileKey11=%Documents%\DVDFab\DVDFab*\Temp|*.*|RECURSE FileKey12=%Documents%\DVDFab\updateLog|*.*|REMOVESELF FileKey13=%Documents%\LiveUpdate|*.*|REMOVESELF FileKey14=%Documents%\PcSetup|*.*|RECURSE RegKey1=HKCU\Software\FabPlayer|DefaultDir RegKey2=HKCU\Software\FabPlayer|DefaultFile

Modifed entry: [DVDFab Update Cleanup *] Added FileKey2, FileKey3, FileKey4 [DVDFab Update Cleanup *] LangSecRef=3023 Detect1=HKCU\Software\DVDFab Detect2=HKCU\Software\DVDFab Passkey Detect3=HKCU\Software\FabPlayer FileKey1=%AppData%\Microsoft\Windows\Templates\Videos\Temp|*.*|RECURSE FileKey2=%Documents%\DVDFab\DVDFab*\Cinavia|*.*|RECURSE FileKey3=%Documents%\DVDFab\updateLog|*.*|REMOVESELF FileKey4=%Documents%\LiveUpdate|*.*|REMOVESELF

APMichael - Thanks very much for the update!

New entry: [DesktopInstaller *] [DesktopInstaller *] DetectOS=10.0| LangSecRef=3031 Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe FileKey1=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_*\AC\INet*|*.*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_*\AC\Temp|*.*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_*\LocalCache|*.*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_*\LocalState|*.*|RECURSE FileKey5=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_*\TempState|*.*|RECURSE

What about a "Dark Mode" for CCleaner itself (free and pro)?

New Entry: [Stardock Start11 Update Cleanup *] [Stardock Start11 Update Cleanup *] LangSecRef=3024 DetectFile=%ProgramFiles%\Stardock\Start11 FileKey1=%CommonAppData%\StarDock\Start11\Update|*.exe Reference this Stardock forum post: https://forums.stardock.com/509469/get;3836059

Modified entry: [Dell Logs *] Added |RECURSE to FileKey4 [Dell Logs *] LangSecRef=3024 Detect1=HKLM\Software\Dell\MUP Detect2=HKLM\Software\Dell\UpdateService Detect3=HKLM\Software\PC-Doctor DetectFile1=%AppData%\Creative\DELL Webcam Center DetectFile2=%CommonAppData%\Dell DetectFile3=%LocalAppData%\Dell DetectFile4=%LocalAppData%\SupportSoft\DellSupportCenter DetectFile5=%ProgramFiles%\Dell* FileKey1=%AppData%\Creative\DELL Webcam Center|MO_Log.txt FileKey2=%AppData%\PCDr\*\Logs|*.* FileKey3=%CommonAppData%\Dell\*\Log|*.*|RECURSE FileKey4=%CommonAppData%\Dell\*\Logs|*.*|RECURSE FileKey5=%CommonAppData%\Dell\BiosVerification|*.log FileKey6=%CommonAppData%\Dell\D3\pla\*\*|*.log;*.txt|REMOVESELF FileKey7=%CommonAppData%\Dell\D3\Resources\Logs\serilog|*.* FileKey8=%CommonAppData%\Dell\Drivers\*|*.log;*.tmp|RECURSE FileKey9=%CommonAppData%\Dell\TrustedDevice|*.log FileKey10=%CommonAppData%\Dell\Update|*.txt FileKey11=%CommonAppData%\Dell\UpdateService\Clients\Update|*.log FileKey12=%CommonAppData%\Dell\UpdateService\DataStore\*\*|*.log FileKey13=%CommonAppData%\Dell\UpdateService\UpdatePackage\Log|*.log;*.txt FileKey14=%CommonAppData%\PCDr\*\Cache|*.xml FileKey15=%CommonAppData%\PCDr\*\Cache\archives|*.*|RECURSE FileKey16=%CommonAppData%\PCDr\*\Cache\BUMA|*.* FileKey17=%CommonAppData%\PCDr\*\Cache\DriverScan|*.* FileKey18=%CommonAppData%\PCDr\*\Logs|*.* FileKey19=%LocalAppData%\Dell\*\Log|*.* FileKey20=%LocalAppData%\Dell\DellMobileConnect|*.log FileKey21=%LocalAppData%\SupportSoft\DellSupportCenter\*\state\logs|*.* FileKey22=%ProgramFiles%\Dell*|*.log|RECURSE

In examining more thoroughly MicrosoftWindows.Client.WebExperience [Windows Client WebExperience *] I found that there is a large cache file that keeps growing at %LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\LocalState\EBWebview\Default\Service Worker\CacheStorage\a892b700b932fb8ff36350643b5733bd1496c80b on my two Windows 11x64 Pro systems on which I use only MSEdge browser. On one system, the cachestorage was 120 mbytes and on the other system it was 206 mbytes. Via Google, I found discussion on this at: https://superuser.com/questions/1608022/how-to-clear-chrome-chromium-edge-service-worker-cache My interpretation is that this cache can be safely removed and will regenerate as needed by MSEdge. Therefore, I suggest that [Windows Client WebExperience *] be modified. FileKey5=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\LocalState\EBWebview\*|LOG;LOG.old|RECURSE FileKey6=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\LocalState\EBWebview\Default\Service Worker\CacheStorage\a892b700b932fb8ff36350643b5733bd1496c80b|*.*|RECURSE [Windows Client WebExperience *] LangSecRef=3031 Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy FileKey1=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\AC\INet*|*.*|RECURSE FileKey2=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE FileKey3=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\AC\Temp|*.*|RECURSE FileKey4=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\LocalCache|*.*|RECURSE FileKey5=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\LocalState\EBWebview\*|LOG;LOG.old|RECURSE FileKey6=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\LocalState\EBWebview\Default\Service Worker\CacheStorage\a892b700b932fb8ff36350643b5733bd1496c80b|*.*|RECURSE FileKey7=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\TempState|*.*|RECURSE One thing I cannot determine is whether the folder named a892b700b932fb8ff36350643b5733bd1496c80b will vary from user system to user system. It is the same on my two different systems under Windows 11x64 Pro.

I recommend that FileKey5 have a |RECURSE added in [Windows Client WebExperience *] FileKey5=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\LocalState\EBWebview\*|LOG;LOG.old|RECURSE

19 AV suites are flagging winapp2ool.exe as malware

Modified entry: [Internet Explorer *] FileKey2 modified; FileKey3 added [Internet Explorer *] LangSecRef=3001 Detect=HKCU\Software\Microsoft\Internet Explorer FileKey1=%AppData%\Microsoft\Internet Explorer\UserData|*.*|RECURSE FileKey2=%LocalAppData%\Microsoft\Internet Explorer|*.log|RECURSE FileKey3=%LocalAppData%\Microsoft\Internet Explorer|*.txt|RECURSE FileKey4=%LocalAppData%\Microsoft\Internet Explorer\CacheStorage|*.*|RECURSE FileKey5=%LocalAppData%\Microsoft\Windows\AppCache|*.*|RECURSE FileKey6=%LocalAppData%\Microsoft\Windows\IECompat*Cache|*.*|RECURSE FileKey7=%LocalAppData%\Microsoft\Windows\INetCache|*.*|RECURSE FileKey8=%LocalAppData%\Microsoft\Windows\INetCookies|*.*|RECURSE FileKey9=%LocalAppData%\Microsoft\Windows\WebCache|*.*|RECURSE FileKey10=%LocalAppData%\Microsoft\Windows\WebCache.old|*.*|REMOVESELF FileKey11=%LocalAppData%\Packages\windows_ie_ac_*\AC\AppCache|*.*|RECURSE FileKey12=%LocalAppData%\Packages\windows_ie_ac_*\AC\IECompat*Cache|*.*|RECURSE FileKey13=%LocalAppData%\Packages\windows_ie_ac_*\AC\IEDownloadHistory|*.*|RECURSE FileKey14=%LocalAppData%\Packages\windows_ie_ac_*\AC\INet*|*.*|RECURSE FileKey15=%LocalAppData%\Packages\windows_ie_ac_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE FileKey16=%LocalAppData%\Packages\windows_ie_ac_*\AC\Microsoft\CryptnetUrlCache\*|*.* FileKey17=%LocalAppData%\Packages\windows_ie_ac_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE FileKey18=%LocalAppData%\Packages\windows_ie_ac_*\AC\Microsoft\Internet Explorer\Emie*List|*.*|RECURSE FileKey19=%LocalAppData%\Packages\windows_ie_ac_*\AC\PRICache|*.*|RECURSE FileKey20=%LocalAppData%\Packages\windows_ie_ac_*\AC\Temp|*.*|RECURSE FileKey21=%LocalAppData%\Packages\windows_ie_ac_*\LocalState\Cache|*.*|RECURSE FileKey22=%LocalAppData%\Packages\windows_ie_ac_*\LocalState\navigationHistory|*.*|RECURSE FileKey23=%LocalAppData%\Packages\windows_ie_ac_*\TempState|*.*|RECURSE FileKey24=%SystemDrive%\Documents and Settings\LocalService*\Cookies|*.*|RECURSE FileKey25=%SystemDrive%\Documents and Settings\LocalService*\Local Settings\History|*.*|RECURSE FileKey26=%SystemDrive%\Documents and Settings\LocalService*\Local Settings\Temporary Internet Files|*.*|RECURSE FileKey27=%SystemDrive%\Documents and Settings\NetworkService*\Cookies|*.*|RECURSE FileKey28=%SystemDrive%\Documents and Settings\NetworkService*\Local Settings\History|*.*|RECURSE FileKey29=%SystemDrive%\Documents and Settings\NetworkService*\Local Settings\Temporary Internet Files|*.*|RECURSE FileKey30=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History|*.*|RECURSE FileKey31=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\INetCache|*.*|RECURSE FileKey32=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\INetCookies|*.*|RECURSE FileKey33=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History|*.*|RECURSE FileKey34=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache|*.*|RECURSE FileKey35=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCookies|*.*|RECURSE FileKey36=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History|*.*|RECURSE FileKey37=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache|*.*|RECURSE FileKey38=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies|*.*|RECURSE FileKey39=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache|*.*|RECURSE FileKey40=%WinDir%\System32\config\systemprofile\Cookies|*.*|RECURSE FileKey41=%WinDir%\System32\config\systemprofile\History|*.*|RECURSE FileKey42=%WinDir%\System32\config\systemprofile\Local Settings\Temporary Internet Files|*.*|RECURSE FileKey43=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History|*.*|RECURSE FileKey44=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache|*.*|RECURSE FileKey45=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies|*.*|RECURSE FileKey46=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache|*.*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Explorer\DOMStorage RegKey2=HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage RegKey3=HKCU\Software\Microsoft\Internet Explorer\Recovery\PendingDelete RegKey4=HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats RegKey5=HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\ContainingTextMRU RegKey6=HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU RegKey7=HKU\.DEFAULT\Software\Microsoft\Internet Explorer\TypedURLs Modified Key: [Windows Client WebExperience *] Added FileKey2 [Windows Client WebExperience *] LangSecRef=3031 Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy FileKey1=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\LocalState\EBWebview\*|*.old|RECURSE FileKey2=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\LocalState\EBWebView\Default|*.log|RECURSE Windows 11 Users: See this link for [Windows Client WebExperience *] info https://appuals.com/msedgewebview2-exe-consuming-memory-windows-11/

Modified entry: [Snagit *] Added RegKey48-54 for new Snagit version 22 [Snagit *] LangSecRef=3021 Detect=HKCU\Software\TechSmith\Snagit FileKey1=%CommonAppData%\TechSmith\Uploader|*.log FileKey2=%Documents%|SnagitDebug.log FileKey3=%LocalAppData%\TechSmith\Logs|*.log FileKey4=%LocalAppData%\TechSmith\Snagit|Tray.bin FileKey5=%LocalAppData%\TechSmith\Snagit\*\NativeCrashReporting\Reports|*.dmp|RECURSE FileKey6=%LocalAppData%\TechSmith\Snagit\CrashDumps|*.*|RECURSE FileKey7=%LocalAppData%\TechSmith\Snagit\DataStore\AppIcons|*.ico FileKey8=%LocalAppData%\TechSmith\Snagit\DataStore\WebSiteIcons|*.ico FileKey9=%LocalAppData%\TechSmith\Snagit\Thumbnails|*.*|RECURSE FileKey10=%LocalAppData%\TechSmith\Snagit\TrackerbirdFiles|*.log;*.logtmp FileKey11=%Public%\TechSmith\Snagit\License|*.log RegKey1=HKCU\Software\TechSmith\Snagit\9|StampCustomFolder RegKey2=HKCU\Software\TechSmith\Snagit\10|StampCustomFolder RegKey3=HKCU\Software\TechSmith\Snagit\11|CaptureCount RegKey4=HKCU\Software\TechSmith\Snagit\11|CaptureOpenCount RegKey5=HKCU\Software\TechSmith\Snagit\11|OutputDirLastUsed RegKey6=HKCU\Software\TechSmith\Snagit\11|VidOutputDirLastUsed RegKey7=HKCU\Software\TechSmith\Snagit\11\SnagItEditor\Tray|Thumbnailsize RegKey8=HKCU\Software\TechSmith\Snagit\12|CaptureCount RegKey9=HKCU\Software\TechSmith\Snagit\12|CaptureOpenCount RegKey10=HKCU\Software\TechSmith\Snagit\12|OutputDirLastUsed RegKey11=HKCU\Software\TechSmith\Snagit\12|VidOutputDirLastUsed RegKey12=HKCU\Software\TechSmith\Snagit\12\SnagItEditor\Tray|Thumbnailsize RegKey13=HKCU\Software\TechSmith\Snagit\13|CaptureCount RegKey14=HKCU\Software\TechSmith\Snagit\13|CaptureOpenCount RegKey15=HKCU\Software\TechSmith\Snagit\13|OutputDirLastUsed RegKey16=HKCU\Software\TechSmith\Snagit\13|VidOutputDirLastUsed RegKey17=HKCU\Software\TechSmith\Snagit\13\Recent Captures RegKey18=HKCU\Software\TechSmith\Snagit\13\SnagitEditor\Recent File List RegKey19=HKCU\Software\TechSmith\Snagit\13\SnagItEditor\Tray|Thumbnailsize RegKey20=HKCU\Software\TechSmith\Snagit\18|CaptureCount RegKey21=HKCU\Software\TechSmith\Snagit\18|CaptureOpenCount RegKey22=HKCU\Software\TechSmith\Snagit\18|OutputDirLastUsed RegKey23=HKCU\Software\TechSmith\Snagit\18|VidOutputDirLastUsed RegKey24=HKCU\Software\TechSmith\Snagit\18\Recent Captures RegKey25=HKCU\Software\TechSmith\Snagit\18\SnagitEditor\Recent File List RegKey26=HKCU\Software\TechSmith\Snagit\18\SnagItEditor\Tray|Thumbnailsize RegKey27=HKCU\Software\TechSmith\Snagit\19|CaptureCount RegKey28=HKCU\Software\TechSmith\Snagit\19|CaptureOpenCount RegKey29=HKCU\Software\TechSmith\Snagit\19|OutputDirLastUsed RegKey30=HKCU\Software\TechSmith\Snagit\19|VidOutputDirLastUsed RegKey31=HKCU\Software\TechSmith\Snagit\19\Recent Captures RegKey32=HKCU\Software\TechSmith\Snagit\19\SnagitEditor\Recent File List RegKey33=HKCU\Software\TechSmith\Snagit\19\SnagItEditor\Tray|Thumbnailsize RegKey34=HKCU\Software\TechSmith\Snagit\20|CaptureCount RegKey35=HKCU\Software\TechSmith\Snagit\20|CaptureOpenCount RegKey36=HKCU\Software\TechSmith\Snagit\20|OutputDirLastUsed RegKey37=HKCU\Software\TechSmith\Snagit\20|VidOutputDirLastUsed RegKey38=HKCU\Software\TechSmith\Snagit\20\Recent Captures RegKey39=HKCU\Software\TechSmith\Snagit\20\SnagitEditor\Recent File List RegKey40=HKCU\Software\TechSmith\Snagit\20\SnagItEditor\Tray|Thumbnailsize RegKey41=HKCU\Software\TechSmith\Snagit\21|CaptureCount RegKey42=HKCU\Software\TechSmith\Snagit\21|CaptureOpenCount RegKey43=HKCU\Software\TechSmith\Snagit\21|OutputDirLastUsed RegKey44=HKCU\Software\TechSmith\Snagit\21|VidOutputDirLastUsed RegKey45=HKCU\Software\TechSmith\Snagit\21\Recent Captures RegKey46=HKCU\Software\TechSmith\Snagit\21\SnagitEditor\Recent File List RegKey47=HKCU\Software\TechSmith\Snagit\21\SnagItEditor\Tray|Thumbnailsize RegKey48=HKCU\Software\TechSmith\Snagit\22|CaptureCount RegKey49=HKCU\Software\TechSmith\Snagit\22|CaptureOpenCount RegKey50=HKCU\Software\TechSmith\Snagit\22|OutputDirLastUsed RegKey51=HKCU\Software\TechSmith\Snagit\22|VidOutputDirLastUsed RegKey52=HKCU\Software\TechSmith\Snagit\22\Recent Captures RegKey53=HKCU\Software\TechSmith\Snagit\22\SnagitEditor\Recent File List RegKey54=HKCU\Software\TechSmith\Snagit\22\SnagItEditor\Tray|Thumbnailsize

New entry: [RivetNetworks Logs *] [RivetNetworks Logs *] LangSecRef=3024 Detect=HKLM\Software\RivetNetworks FileKey1=%CommonAppData%\RivetNetworks\Killer|*.log FileKey2=%WinDir%\System32\drivers\RivetNetworks\Killer|*.log Revised entry: [MS OneDrive *] Added FileKey5 [MS OneDrive *] LangSecRef=3021 Detect=HKCU\Software\Microsoft\OneDrive FileKey1=%LocalAppData%\Microsoft\OneDrive\logs|*.*|RECURSE FileKey2=%LocalAppData%\Microsoft\OneDrive\setup\logs|*.*|RECURSE FileKey3=%LocalAppData%\Microsoft\Windows\OneDrive\logs|*.*|RECURSE FileKey4=%LocalAppData%\OneDrive\cache|*.*|RECURSE FileKey5=%ProgramFiles%\Microsoft OneDrive\Setup\Logs|*.* FileKey6=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\OneDrive\logs|*.*|RECURSE FileKey7=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\OneDrive\setup\logs|*.*|RECURSE FileKey8=%WinDir%\System32\LogFiles\CloudFiles|*.*|RECURSE FileKey9=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\OneDrive\logs|*.*|RECURSE FileKey10=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\OneDrive\setup\logs|*.*|RECURSE

Revised entry: [Samsung Magician *] Added FileKey1 and FileKey2 [Samsung Magician *] LangSecRef=3024 Detect=HKLM\Software\Samsung Magician FileKey1=%AppData%\Samsung Magician\Local Storage\leveldb|*.old FileKey2=%AppData%\Samsung Magician\Session Storage|*.old FileKey3=%CommonAppData%\Samsung\Backup|*.exe FileKey4=%CommonAppData%\Samsung\Samsung Magician|*.exe|RECURSE FileKey5=%CommonAppData%\Samsung\Samsung Magician\PB|*.txt FileKey6=%ProgramFiles%\Samsung Magician\Logs|*.* FileKey7=%ProgramFiles%\Samsung\Samsung Magician\Log*|*.* FileKey8=%SystemDrive%\MagicianPerf*|*.*|REMOVESELF RegKey1=HKCU\Software\Local AppWizard-Generated Applications\SamsungMagician

Thanks for the updates to winapp2ool.exe. Haven't encountered any problems with NIS 2021. Is there a new winapp2.ini being issued soon??

AH Ha, I stupidly left off the |RECURSE. Thanks APM for setting me straight. Here are the corrected entries: [Edge Logs *] LangSecRef=3006 DetectFile=%LocalAppData%\Microsoft\Edge* FileKey1=%LocalAppData%\Microsoft\Edge*\Application|debug.log FileKey2=%LocalAppData%\Microsoft\Edge*\User Data\*|LOG;LOG.old|RECURSE FileKey3=%ProgramFiles%\Microsoft\Edge*\Application|debug.log FileKey4=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Edge\*\*|Log.Old|RECURSE [Windows Client WebExperience *] LangSecRef=3031 Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy FileKey1=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\LocalState\EBWebview\*|*.old|RECURSE

Modified entry: [Edge Logs *] Added FileKey4, FileKey5, FileKey6 [Edge Logs *] LangSecRef=3006 DetectFile=%LocalAppData%\Microsoft\Edge* FileKey1=%LocalAppData%\Microsoft\Edge*\Application|debug.log FileKey2=%LocalAppData%\Microsoft\Edge*\User Data\*|LOG;LOG.old|RECURSE FileKey3=%ProgramFiles%\Microsoft\Edge*\Application|debug.log FileKey4=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Edge\*\*|Log.Old FileKey5=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Edge\*\*\*|Log.Old FileKey6=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Edge\*\*\*\*|Log.Old

It doesn't work for me (I thought it should as well). However, these *.old files are located in multiple subfolders of EBWebView. With only one *, it finds 1 log.old; with two *, it finds 10 log.old; with three *, it finds 18 Log.old.