Jump to content

siliconman01

Experienced Members
  • Posts

    1,111
  • Joined

  • Last visited

Posts posted by siliconman01

  1. New entry: [Windows 11 Notepad *]

    [Windows 11 Notepad *]
    DetectOS=10.0|
    LangSecRef=3031
    DetectFile=%LocalAppData%\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe
    FileKey1=%LocalAppData%\Packages\Microsoft.WindowsNotepad_*\SystemAppData\Helium|User.dat

     

  2. I feel  you can include [DVDFab Update Cleanup *] in [DVDFab *]  thereby eliminating [DVDFab Update Cleanup *]

    [DVDFab *]
    LangSecRef=3023
    Detect1=HKCU\Software\DVDFab
    Detect2=HKCU\Software\DVDFab Passkey
    Detect3=HKCU\Software\FabPlayer
    FileKey1=%AppData%\DVDFab Player*\Advertis*|*.*|RECURSE
    FileKey2=%AppData%\DVDFab\DVDFab*\SceneData|*.*|RECURSE
    FileKey3=%AppData%\LiveUpdate|*.log
    FileKey4=%AppData%\Microsoft\Windows\Templates\Videos\Temp|*.*|RECURSE
    FileKey5=%Documents%\DVDFab*|*.log
    FileKey6=%Documents%\DVDFab*\Log|*.*|RECURSE
    FileKey7=%Documents%\DVDFab*\SceneData|*.*|RECURSE
    FileKey8=%Documents%\DVDFab*\Temp|*.*|RECURSE
    FileKey9=%Documents%\DVDFab\DVDFab*\Cinavia|*.*|RECURSE
    FileKey10=%Documents%\DVDFab\DVDFab*\Log|*.*|RECURSE
    FileKey11=%Documents%\DVDFab\DVDFab*\Temp|*.*|RECURSE
    FileKey12=%Documents%\DVDFab\updateLog|*.*|REMOVESELF
    FileKey13=%Documents%\LiveUpdate|*.*|REMOVESELF
    FileKey14=%Documents%\PcSetup|*.*|RECURSE
    RegKey1=HKCU\Software\FabPlayer|DefaultDir
    RegKey2=HKCU\Software\FabPlayer|DefaultFile

     

  3. Modifed entry:  [DVDFab Update Cleanup *]

    Added FileKey2, FileKey3, FileKey4

    [DVDFab Update Cleanup *]
    LangSecRef=3023
    Detect1=HKCU\Software\DVDFab
    Detect2=HKCU\Software\DVDFab Passkey
    Detect3=HKCU\Software\FabPlayer
    FileKey1=%AppData%\Microsoft\Windows\Templates\Videos\Temp|*.*|RECURSE
    FileKey2=%Documents%\DVDFab\DVDFab*\Cinavia|*.*|RECURSE
    FileKey3=%Documents%\DVDFab\updateLog|*.*|REMOVESELF
    FileKey4=%Documents%\LiveUpdate|*.*|REMOVESELF

     

  4. New entry:  [DesktopInstaller *]

    [DesktopInstaller *]
    DetectOS=10.0|
    LangSecRef=3031
    Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe
    FileKey1=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_*\AC\INet*|*.*|RECURSE
    FileKey2=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_*\AC\Temp|*.*|RECURSE
    FileKey3=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_*\LocalCache|*.*|RECURSE
    FileKey4=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_*\LocalState|*.*|RECURSE
    FileKey5=%LocalAppData%\Packages\Microsoft.DesktopAppInstaller_*\TempState|*.*|RECURSE

     

  5. Modified entry:  [Dell Logs *]

    Added |RECURSE to FileKey4

    [Dell Logs *]
    LangSecRef=3024
    Detect1=HKLM\Software\Dell\MUP
    Detect2=HKLM\Software\Dell\UpdateService
    Detect3=HKLM\Software\PC-Doctor
    DetectFile1=%AppData%\Creative\DELL Webcam Center
    DetectFile2=%CommonAppData%\Dell
    DetectFile3=%LocalAppData%\Dell
    DetectFile4=%LocalAppData%\SupportSoft\DellSupportCenter
    DetectFile5=%ProgramFiles%\Dell*
    FileKey1=%AppData%\Creative\DELL Webcam Center|MO_Log.txt
    FileKey2=%AppData%\PCDr\*\Logs|*.*
    FileKey3=%CommonAppData%\Dell\*\Log|*.*|RECURSE
    FileKey4=%CommonAppData%\Dell\*\Logs|*.*|RECURSE
    FileKey5=%CommonAppData%\Dell\BiosVerification|*.log
    FileKey6=%CommonAppData%\Dell\D3\pla\*\*|*.log;*.txt|REMOVESELF
    FileKey7=%CommonAppData%\Dell\D3\Resources\Logs\serilog|*.*
    FileKey8=%CommonAppData%\Dell\Drivers\*|*.log;*.tmp|RECURSE
    FileKey9=%CommonAppData%\Dell\TrustedDevice|*.log
    FileKey10=%CommonAppData%\Dell\Update|*.txt
    FileKey11=%CommonAppData%\Dell\UpdateService\Clients\Update|*.log
    FileKey12=%CommonAppData%\Dell\UpdateService\DataStore\*\*|*.log
    FileKey13=%CommonAppData%\Dell\UpdateService\UpdatePackage\Log|*.log;*.txt
    FileKey14=%CommonAppData%\PCDr\*\Cache|*.xml
    FileKey15=%CommonAppData%\PCDr\*\Cache\archives|*.*|RECURSE
    FileKey16=%CommonAppData%\PCDr\*\Cache\BUMA|*.*
    FileKey17=%CommonAppData%\PCDr\*\Cache\DriverScan|*.*
    FileKey18=%CommonAppData%\PCDr\*\Logs|*.*
    FileKey19=%LocalAppData%\Dell\*\Log|*.*
    FileKey20=%LocalAppData%\Dell\DellMobileConnect|*.log
    FileKey21=%LocalAppData%\SupportSoft\DellSupportCenter\*\state\logs|*.*
    FileKey22=%ProgramFiles%\Dell*|*.log|RECURSE

     

  6. In examining more thoroughly MicrosoftWindows.Client.WebExperience  [Windows Client WebExperience *] I found that there is a large cache file that keeps growing at %LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\LocalState\EBWebview\Default\Service Worker\CacheStorage\a892b700b932fb8ff36350643b5733bd1496c80b on my two Windows 11x64 Pro systems on which I use only MSEdge browser.  On one system, the cachestorage was 120 mbytes and on the other system it was 206 mbytes.  Via Google, I found discussion on this at:

    https://superuser.com/questions/1608022/how-to-clear-chrome-chromium-edge-service-worker-cache

    My interpretation is that this cache can be safely removed and will regenerate as needed by MSEdge.  Therefore, I suggest that [Windows Client WebExperience *] be modified.

    FileKey5=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\LocalState\EBWebview\*|LOG;LOG.old|RECURSE

    FileKey6=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\LocalState\EBWebview\Default\Service Worker\CacheStorage\a892b700b932fb8ff36350643b5733bd1496c80b|*.*|RECURSE

    [Windows Client WebExperience *]
    LangSecRef=3031
    Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy
    FileKey1=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\AC\INet*|*.*|RECURSE
    FileKey2=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
    FileKey3=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\AC\Temp|*.*|RECURSE
    FileKey4=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\LocalCache|*.*|RECURSE
    FileKey5=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\LocalState\EBWebview\*|LOG;LOG.old|RECURSE
    FileKey6=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\LocalState\EBWebview\Default\Service Worker\CacheStorage\a892b700b932fb8ff36350643b5733bd1496c80b|*.*|RECURSE
    FileKey7=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\TempState|*.*|RECURSE

    One thing I cannot determine is whether the folder named a892b700b932fb8ff36350643b5733bd1496c80b will vary from user system to user system.  It is the same on my two different systems under Windows 11x64 Pro.  

  7. Modified entry: [Internet Explorer *]

    FileKey2 modified; FileKey3 added

    [Internet Explorer *]
    LangSecRef=3001
    Detect=HKCU\Software\Microsoft\Internet Explorer
    FileKey1=%AppData%\Microsoft\Internet Explorer\UserData|*.*|RECURSE
    FileKey2=%LocalAppData%\Microsoft\Internet Explorer|*.log|RECURSE
    FileKey3=%LocalAppData%\Microsoft\Internet Explorer|*.txt|RECURSE
    FileKey4=%LocalAppData%\Microsoft\Internet Explorer\CacheStorage|*.*|RECURSE
    FileKey5=%LocalAppData%\Microsoft\Windows\AppCache|*.*|RECURSE
    FileKey6=%LocalAppData%\Microsoft\Windows\IECompat*Cache|*.*|RECURSE
    FileKey7=%LocalAppData%\Microsoft\Windows\INetCache|*.*|RECURSE
    FileKey8=%LocalAppData%\Microsoft\Windows\INetCookies|*.*|RECURSE
    FileKey9=%LocalAppData%\Microsoft\Windows\WebCache|*.*|RECURSE
    FileKey10=%LocalAppData%\Microsoft\Windows\WebCache.old|*.*|REMOVESELF
    FileKey11=%LocalAppData%\Packages\windows_ie_ac_*\AC\AppCache|*.*|RECURSE
    FileKey12=%LocalAppData%\Packages\windows_ie_ac_*\AC\IECompat*Cache|*.*|RECURSE
    FileKey13=%LocalAppData%\Packages\windows_ie_ac_*\AC\IEDownloadHistory|*.*|RECURSE
    FileKey14=%LocalAppData%\Packages\windows_ie_ac_*\AC\INet*|*.*|RECURSE
    FileKey15=%LocalAppData%\Packages\windows_ie_ac_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
    FileKey16=%LocalAppData%\Packages\windows_ie_ac_*\AC\Microsoft\CryptnetUrlCache\*|*.*
    FileKey17=%LocalAppData%\Packages\windows_ie_ac_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
    FileKey18=%LocalAppData%\Packages\windows_ie_ac_*\AC\Microsoft\Internet Explorer\Emie*List|*.*|RECURSE
    FileKey19=%LocalAppData%\Packages\windows_ie_ac_*\AC\PRICache|*.*|RECURSE
    FileKey20=%LocalAppData%\Packages\windows_ie_ac_*\AC\Temp|*.*|RECURSE
    FileKey21=%LocalAppData%\Packages\windows_ie_ac_*\LocalState\Cache|*.*|RECURSE
    FileKey22=%LocalAppData%\Packages\windows_ie_ac_*\LocalState\navigationHistory|*.*|RECURSE
    FileKey23=%LocalAppData%\Packages\windows_ie_ac_*\TempState|*.*|RECURSE
    FileKey24=%SystemDrive%\Documents and Settings\LocalService*\Cookies|*.*|RECURSE
    FileKey25=%SystemDrive%\Documents and Settings\LocalService*\Local Settings\History|*.*|RECURSE
    FileKey26=%SystemDrive%\Documents and Settings\LocalService*\Local Settings\Temporary Internet Files|*.*|RECURSE
    FileKey27=%SystemDrive%\Documents and Settings\NetworkService*\Cookies|*.*|RECURSE
    FileKey28=%SystemDrive%\Documents and Settings\NetworkService*\Local Settings\History|*.*|RECURSE
    FileKey29=%SystemDrive%\Documents and Settings\NetworkService*\Local Settings\Temporary Internet Files|*.*|RECURSE
    FileKey30=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History|*.*|RECURSE
    FileKey31=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\INetCache|*.*|RECURSE
    FileKey32=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\INetCookies|*.*|RECURSE
    FileKey33=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History|*.*|RECURSE
    FileKey34=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache|*.*|RECURSE
    FileKey35=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCookies|*.*|RECURSE
    FileKey36=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History|*.*|RECURSE
    FileKey37=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache|*.*|RECURSE
    FileKey38=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies|*.*|RECURSE
    FileKey39=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache|*.*|RECURSE
    FileKey40=%WinDir%\System32\config\systemprofile\Cookies|*.*|RECURSE
    FileKey41=%WinDir%\System32\config\systemprofile\History|*.*|RECURSE
    FileKey42=%WinDir%\System32\config\systemprofile\Local Settings\Temporary Internet Files|*.*|RECURSE
    FileKey43=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History|*.*|RECURSE
    FileKey44=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache|*.*|RECURSE
    FileKey45=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies|*.*|RECURSE
    FileKey46=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache|*.*|RECURSE
    RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Explorer\DOMStorage
    RegKey2=HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage
    RegKey3=HKCU\Software\Microsoft\Internet Explorer\Recovery\PendingDelete
    RegKey4=HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
    RegKey5=HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\ContainingTextMRU
    RegKey6=HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU
    RegKey7=HKU\.DEFAULT\Software\Microsoft\Internet Explorer\TypedURLs

    Modified Key:  [Windows Client WebExperience *]

    Added FileKey2

    [Windows Client WebExperience *]
    LangSecRef=3031
    Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy
    FileKey1=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\LocalState\EBWebview\*|*.old|RECURSE
    FileKey2=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\LocalState\EBWebView\Default|*.log|RECURSE

    Windows 11 Users:  See this link for [Windows Client WebExperience *] info

    https://appuals.com/msedgewebview2-exe-consuming-memory-windows-11/

     

  8. Modified entry:  [Snagit *]

    Added RegKey48-54 for new Snagit version 22

    
    [Snagit *]
    LangSecRef=3021
    Detect=HKCU\Software\TechSmith\Snagit
    FileKey1=%CommonAppData%\TechSmith\Uploader|*.log
    FileKey2=%Documents%|SnagitDebug.log
    FileKey3=%LocalAppData%\TechSmith\Logs|*.log
    FileKey4=%LocalAppData%\TechSmith\Snagit|Tray.bin
    FileKey5=%LocalAppData%\TechSmith\Snagit\*\NativeCrashReporting\Reports|*.dmp|RECURSE
    FileKey6=%LocalAppData%\TechSmith\Snagit\CrashDumps|*.*|RECURSE
    FileKey7=%LocalAppData%\TechSmith\Snagit\DataStore\AppIcons|*.ico
    FileKey8=%LocalAppData%\TechSmith\Snagit\DataStore\WebSiteIcons|*.ico
    FileKey9=%LocalAppData%\TechSmith\Snagit\Thumbnails|*.*|RECURSE
    FileKey10=%LocalAppData%\TechSmith\Snagit\TrackerbirdFiles|*.log;*.logtmp
    FileKey11=%Public%\TechSmith\Snagit\License|*.log
    RegKey1=HKCU\Software\TechSmith\Snagit\9|StampCustomFolder
    RegKey2=HKCU\Software\TechSmith\Snagit\10|StampCustomFolder
    RegKey3=HKCU\Software\TechSmith\Snagit\11|CaptureCount
    RegKey4=HKCU\Software\TechSmith\Snagit\11|CaptureOpenCount
    RegKey5=HKCU\Software\TechSmith\Snagit\11|OutputDirLastUsed
    RegKey6=HKCU\Software\TechSmith\Snagit\11|VidOutputDirLastUsed
    RegKey7=HKCU\Software\TechSmith\Snagit\11\SnagItEditor\Tray|Thumbnailsize
    RegKey8=HKCU\Software\TechSmith\Snagit\12|CaptureCount
    RegKey9=HKCU\Software\TechSmith\Snagit\12|CaptureOpenCount
    RegKey10=HKCU\Software\TechSmith\Snagit\12|OutputDirLastUsed
    RegKey11=HKCU\Software\TechSmith\Snagit\12|VidOutputDirLastUsed
    RegKey12=HKCU\Software\TechSmith\Snagit\12\SnagItEditor\Tray|Thumbnailsize
    RegKey13=HKCU\Software\TechSmith\Snagit\13|CaptureCount
    RegKey14=HKCU\Software\TechSmith\Snagit\13|CaptureOpenCount
    RegKey15=HKCU\Software\TechSmith\Snagit\13|OutputDirLastUsed
    RegKey16=HKCU\Software\TechSmith\Snagit\13|VidOutputDirLastUsed
    RegKey17=HKCU\Software\TechSmith\Snagit\13\Recent Captures
    RegKey18=HKCU\Software\TechSmith\Snagit\13\SnagitEditor\Recent File List
    RegKey19=HKCU\Software\TechSmith\Snagit\13\SnagItEditor\Tray|Thumbnailsize
    RegKey20=HKCU\Software\TechSmith\Snagit\18|CaptureCount
    RegKey21=HKCU\Software\TechSmith\Snagit\18|CaptureOpenCount
    RegKey22=HKCU\Software\TechSmith\Snagit\18|OutputDirLastUsed
    RegKey23=HKCU\Software\TechSmith\Snagit\18|VidOutputDirLastUsed
    RegKey24=HKCU\Software\TechSmith\Snagit\18\Recent Captures
    RegKey25=HKCU\Software\TechSmith\Snagit\18\SnagitEditor\Recent File List
    RegKey26=HKCU\Software\TechSmith\Snagit\18\SnagItEditor\Tray|Thumbnailsize
    RegKey27=HKCU\Software\TechSmith\Snagit\19|CaptureCount
    RegKey28=HKCU\Software\TechSmith\Snagit\19|CaptureOpenCount
    RegKey29=HKCU\Software\TechSmith\Snagit\19|OutputDirLastUsed
    RegKey30=HKCU\Software\TechSmith\Snagit\19|VidOutputDirLastUsed
    RegKey31=HKCU\Software\TechSmith\Snagit\19\Recent Captures
    RegKey32=HKCU\Software\TechSmith\Snagit\19\SnagitEditor\Recent File List
    RegKey33=HKCU\Software\TechSmith\Snagit\19\SnagItEditor\Tray|Thumbnailsize
    RegKey34=HKCU\Software\TechSmith\Snagit\20|CaptureCount
    RegKey35=HKCU\Software\TechSmith\Snagit\20|CaptureOpenCount
    RegKey36=HKCU\Software\TechSmith\Snagit\20|OutputDirLastUsed
    RegKey37=HKCU\Software\TechSmith\Snagit\20|VidOutputDirLastUsed
    RegKey38=HKCU\Software\TechSmith\Snagit\20\Recent Captures
    RegKey39=HKCU\Software\TechSmith\Snagit\20\SnagitEditor\Recent File List
    RegKey40=HKCU\Software\TechSmith\Snagit\20\SnagItEditor\Tray|Thumbnailsize
    RegKey41=HKCU\Software\TechSmith\Snagit\21|CaptureCount
    RegKey42=HKCU\Software\TechSmith\Snagit\21|CaptureOpenCount
    RegKey43=HKCU\Software\TechSmith\Snagit\21|OutputDirLastUsed
    RegKey44=HKCU\Software\TechSmith\Snagit\21|VidOutputDirLastUsed
    RegKey45=HKCU\Software\TechSmith\Snagit\21\Recent Captures
    RegKey46=HKCU\Software\TechSmith\Snagit\21\SnagitEditor\Recent File List
    RegKey47=HKCU\Software\TechSmith\Snagit\21\SnagItEditor\Tray|Thumbnailsize
    RegKey48=HKCU\Software\TechSmith\Snagit\22|CaptureCount
    RegKey49=HKCU\Software\TechSmith\Snagit\22|CaptureOpenCount
    RegKey50=HKCU\Software\TechSmith\Snagit\22|OutputDirLastUsed
    RegKey51=HKCU\Software\TechSmith\Snagit\22|VidOutputDirLastUsed
    RegKey52=HKCU\Software\TechSmith\Snagit\22\Recent Captures
    RegKey53=HKCU\Software\TechSmith\Snagit\22\SnagitEditor\Recent File List
    RegKey54=HKCU\Software\TechSmith\Snagit\22\SnagItEditor\Tray|Thumbnailsize

     

  9. New entry:  [RivetNetworks Logs *]

    [RivetNetworks Logs *]
    LangSecRef=3024
    Detect=HKLM\Software\RivetNetworks
    FileKey1=%CommonAppData%\RivetNetworks\Killer|*.log
    FileKey2=%WinDir%\System32\drivers\RivetNetworks\Killer|*.log

    Revised entry:  [MS OneDrive *]

    Added FileKey5

    [MS OneDrive *]
    LangSecRef=3021
    Detect=HKCU\Software\Microsoft\OneDrive
    FileKey1=%LocalAppData%\Microsoft\OneDrive\logs|*.*|RECURSE
    FileKey2=%LocalAppData%\Microsoft\OneDrive\setup\logs|*.*|RECURSE
    FileKey3=%LocalAppData%\Microsoft\Windows\OneDrive\logs|*.*|RECURSE
    FileKey4=%LocalAppData%\OneDrive\cache|*.*|RECURSE
    FileKey5=%ProgramFiles%\Microsoft OneDrive\Setup\Logs|*.*
    FileKey6=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\OneDrive\logs|*.*|RECURSE
    FileKey7=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\OneDrive\setup\logs|*.*|RECURSE
    FileKey8=%WinDir%\System32\LogFiles\CloudFiles|*.*|RECURSE
    FileKey9=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\OneDrive\logs|*.*|RECURSE
    FileKey10=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\OneDrive\setup\logs|*.*|RECURSE

     

  10. Revised entry:   [Samsung Magician *]

    Added FileKey1 and FileKey2

    [Samsung Magician *]
    LangSecRef=3024
    Detect=HKLM\Software\Samsung Magician
    FileKey1=%AppData%\Samsung Magician\Local Storage\leveldb|*.old
    FileKey2=%AppData%\Samsung Magician\Session Storage|*.old
    FileKey3=%CommonAppData%\Samsung\Backup|*.exe
    FileKey4=%CommonAppData%\Samsung\Samsung Magician|*.exe|RECURSE
    FileKey5=%CommonAppData%\Samsung\Samsung Magician\PB|*.txt
    FileKey6=%ProgramFiles%\Samsung Magician\Logs|*.*
    FileKey7=%ProgramFiles%\Samsung\Samsung Magician\Log*|*.*
    FileKey8=%SystemDrive%\MagicianPerf*|*.*|REMOVESELF
    RegKey1=HKCU\Software\Local AppWizard-Generated Applications\SamsungMagician

     

  11. 10 hours ago, Winapp2.ini said:

    There's been a few winapp2ool updates recently, just a reminder that until I get a new code signing certificate in my current name, builds will be unsigned and may cause false positives with your antivirus software because of this. Hopefully by mid December this should be resolved.

    Thanks for the updates to winapp2ool.exe.  Haven't encountered any problems with NIS 2021.  Is there a new winapp2.ini being issued soon??

  12. 1 hour ago, APMichael said:

    Strange, because for me |RECURSE works as expected.

    Your entry:

    Entry with |RECURSE:

    Identical result. Maybe files were still locked during your first attempts?

    [Windows Client WebExperience *]
    LangSecRef=3031
    Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy
    FileKey1=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\LocalState\EBWebview\*|*.old|RECURSE

     

    AH Ha, I stupidly left off the |RECURSE.  Thanks APM for setting me straight. 🙃 Here are the corrected entries:

    [Edge Logs *]
    LangSecRef=3006
    DetectFile=%LocalAppData%\Microsoft\Edge*
    FileKey1=%LocalAppData%\Microsoft\Edge*\Application|debug.log
    FileKey2=%LocalAppData%\Microsoft\Edge*\User Data\*|LOG;LOG.old|RECURSE
    FileKey3=%ProgramFiles%\Microsoft\Edge*\Application|debug.log
    FileKey4=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Edge\*\*|Log.Old|RECURSE
    [Windows Client WebExperience *]
    LangSecRef=3031
    Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy
    FileKey1=%LocalAppData%\Packages\MicrosoftWindows.Client.WebExperience_*\LocalState\EBWebview\*|*.old|RECURSE

     

  13. Modified entry:  [Edge Logs *]

    Added FileKey4, FileKey5, FileKey6

    [Edge Logs *]
    LangSecRef=3006
    DetectFile=%LocalAppData%\Microsoft\Edge*
    FileKey1=%LocalAppData%\Microsoft\Edge*\Application|debug.log
    FileKey2=%LocalAppData%\Microsoft\Edge*\User Data\*|LOG;LOG.old|RECURSE
    FileKey3=%ProgramFiles%\Microsoft\Edge*\Application|debug.log
    FileKey4=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Edge\*\*|Log.Old
    FileKey5=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Edge\*\*\*|Log.Old
    FileKey6=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Edge\*\*\*\*|Log.Old

     

  14. 12 hours ago, Andavari said:

    I can't test it I don't have Win11 however... ...Wouldn't just a single filekey work using |RECURSE for *.old instead of having three? Looks like it would work simplifying it.

    It doesn't work for me (I thought it should as well).  However, these *.old files are located in multiple subfolders of EBWebView.  With only one *, it finds 1 log.old; with two *, it finds 10 log.old; with three *, it finds 18 Log.old. 

×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.