CSGalloway

January 21, 2015



New:


[Google Chrome ART*]

LangSecRef=3022

SpecialDetect=DET_CHROME

Default=False

FileKey1=%CommonProgramFiles%\Microsoft\ART\Backup\Google Chrome\Default\Preferences.bak

FileKey2=%CommonProgramFiles%\Microsoft\ART\Backup\Google Chrome\Default|*.tmp|RECURSE


Add FileKey 7


[Microsoft Security Essentials*]

LangSecRef=3021

Detect=HKCU\Software\Microsoft\Microsoft Antimalware

Default=False

FileKey1=%CommonAppData%\Microsoft\Microsoft Antimalware\LocalCopy|*.*|RECURSE

FileKey2=%CommonAppData%\Microsoft\Microsoft Antimalware\Scans\History\Service|*.log|RECURSE

FileKey3=%CommonAppData%\Microsoft\Microsoft Security Client\Support|MSSecurityClient*.log

FileKey4=%LocalAppData%\VirtualStore\ProgramData\Microsoft\Microsoft Antimalware\LocalCopy|*.*|RECURSE

FileKey5=%LocalAppData%\VirtualStore\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Service|*.log|RECURSE

FileKey6=%LocalAppData%\VirtualStore\ProgramData\Microsoft\Microsoft Security Client\Support|MSSecurityClient*.log

FileKey7=%CommonAppData%\Microsoft\Microsoft Antimalware\Network Inspection System\Support\NisLog.txt.bak


New:


[MaceCraft PowerTools hosts backups*]

LangSecRef=3024

Default=False

DetectFile=%CommonProgramFiles%\jv16 PowerTools *\jv16PT.exe

FileKey1=%windir%\System32\drivers\etc|hosts_PTBackup*.bak


Add FileKey11


[Windows Live Messenger More*]

LangSecRef=3022

Detect=HKLM\Software\Microsoft\Windows Live\Messenger

Default=False

FileKey1=%CommonProgramFiles%\Windows Live\.cache|*.*|RECURSE

FileKey2=%LocalAppData%\Microsoft\Messenger|*.uccapilog;*.bak;*.txt|RECURSE

FileKey3=%LocalAppData%\Microsoft\Windows Live|*.log;*.jrs;*.sqm|RECURSE

FileKey4=%LocalAppData%\Microsoft\Windows Live Contacts|*.log;*.jrs|RECURSE

FileKey5=%LocalAppData%\Microsoft\Windows Live Contacts\*\*\*\Backup|*.*|RECURSE

FileKey6=%ProgramFiles%\Windows Live\Messenger|*.bak|RECURSE

FileKey7=%WinDir%\System32\config\systemprofile\Documents|wlidsvctrace*.txt

FileKey8=%WinDir%\SysWOW64\config\systemprofile\Documents|wlidsvctrace*.txt

FileKey9=%LocalAppData%\VirtualStore\Program Files*\Windows Live\Messenger|*.bak|RECURSE

FileKey10=%LocalAppData%\VirtualStore\Program Files*\Common Files\Windows Live\.cache|*.*|RECURSE

FileKey11=%CommonProgramFiles%\Windows Live\.cache|*.tmp


New


[CyberLink PowerToGo9*]

LangSecRef=3024

Detect=HKCU\Software\CyberLink\Power2Go9

Default=False

FileKey1=C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame|*.tmp


New


[Windows WebCache]

LangSecRef=3025

DetectFile=%LocalAppData%\Microsoft\Windows\WebCache\

Default=False

FileKey1=%LocalAppData%\Microsoft\Windows\WebCache|*.tmp


New


[Music Temp Files]

LangSecRef=3023

DetectFile=%UserProfile%\Music

Default=False

FileKey1=%UserProfile%\Music|*.tmp


New


[Windows Device Icon Downloads *]

LangSecRef=3025

Detect=%windir%\System32\config\systemprofile\AppData\Local\Microsoft\Device Metadata\dmrccache\downloads\

Default=False

FileKey1=%windir%\System32\config\systemprofile\AppData\Local\Microsoft\Device Metadata\dmrccache\downloads|*.tmp

January 19, 2015

For TMP files left after running CCleaner while in Safe mode....

Modify [Google Chrome ART*] to add FileKey2
FileKey2=C:\Program Files\Common Files\Microsoft\ART\Backup\Google Chrome\Default|*.tmp|RECURSE

Modify [Windows Live Messenger More*] to add FileKey11
FileKey11=C:\Program Files (x86)\Common Files\Windows Live\.cache|*.tmp

[CyberLink PowerToGo9*]
LangSecRef= ?
Detect=HKCU\Software\CyberLink\Power2Go9
Default=False
FileKey1=C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame|*.tmp

[Windows WebCache]
LangSecRef= ?
DetectFile=%LocalAppData%\Microsoft\Windows\WebCache\
Default=False
FileKey1=%LocalAppData%\Microsoft\Windows\WebCache|*.tmp

[Music Temp Files]
LangSecRef= ?
DetectFile=%UserProfile%\Music
Default=False
FileKey1=%UserProfile%\Music|*.tmp

[Windows Device Icon Downloads *]
LangSecRef= ?
Detect=%windir%\System32\%LOCALAPPDATA%\Microsoft\Device Metadata\dmrccache\downloads\
Default=False
FileKey1=%windir%\System32\%LOCALAPPDATA%\Microsoft\Device Metadata\dmrccache\downloads|*.tmp

January 19, 2015

For left over BAK files after running CCleaner in Safe mode

New:
[Google Chrome ART*]
LangSecRef= ?
SpecialDetect=DET_CHROME
Default=False
FileKey1=C:\Program Files\Common Files\Microsoft\ART\Backup\Google Chrome\Default\Preferences.bak

Modify [Microsoft Security Essentials*] to add:
FileKey7=C:\ProgramData\Microsoft\Microsoft Antimalware\Network Inspection System\Support\NisLog.txt.bak

NEW:
[MS Office 2003*]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\Office\11.0
Default=False
FileKey1=C:\ProgramData\Microsoft\OFFICE\DATA\OPA11.BAK

New:
[MaceCraft PowerTools hosts backups*]
LangSecRef= not sure here
Default=False
DetectFile=C:\Program Files (x86)\jv16 PowerTools *\jv16PT.exe
FileKey1=%windir%\System32\drivers\etc|hosts_PTBackup*.bak

January 18, 2015

I did a search of %systemdisk% for both BAK and TMP files and would like modifications to winapp2.ini to included these or why each one won't be included please.

C:\Program Files\Common Files\Microsoft\ART\Backup\Google Chrome\Default\Preferences.bak
C:\ProgramData\Microsoft\Microsoft Antimalware\Network Inspection System\Support\NisLog.txt.bak
C:\ProgramData\Microsoft\OFFICE\DATA\OPA11.BAK
C:\Windows\System32\drivers\etc\hosts_PTBackup.bak
C:\Windows\System32\drivers\etc\hosts_PTbackup2.bak
C:\Z_UserFiles\Unkn\BAK_000\settings.bak

C:\Program Files\Common Files\Microsoft\ART\Backup\Google Chrome\Default\JumpListIcons\32FA.tmp
C:\Program Files\Common Files\Microsoft\ART\Backup\Google Chrome\Default\JumpListIconsOld\D03A.tmp
C:\Program Files\Common Files\Microsoft\ART\Backup\Google Chrome\Default\JumpListIconsOld\D03B.tmp
C:\Program Files\Common Files\Microsoft\ART\Backup\Google Chrome\Default\JumpListIconsOld\D03C.tmp
C:\Program Files\Common Files\Microsoft\ART\Backup\Google Chrome\Default\JumpListIconsOld\D03D.tmp
C:\Program Files (x86)\Common Files\Windows Live\.cache\wlc3B52.tmp
C:\Program Files (x86)\Common Files\Windows Live\.cache\wlc8B43.tmp
C:\Program Files (x86)\Common Files\Windows Live\.cache\wlcA893.tmp
C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\leg272.tmp
C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\leg273.tmp
C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\leg274.tmp
C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\leg275.tmp
C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\leg276.tmp
C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\leg277.tmp
C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\legB1B.tmp
C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\legF2.tmp
C:\Users\Administrator\AppData\Local\Temp\DIOB0C9.tmp
C:\Users\Administrator\AppData\Local\Temp\MAR8E98.tmp
C:\Users\Administrator\AppData\Local\Temp\MAR9202.tmp
C:\Users\Galloway\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\7B8B.tmp
C:\Users\Galloway\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\7B8C.tmp
C:\Users\Galloway\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\7B8D.tmp
C:\Users\Galloway\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\7B8E.tmp
C:\Users\Galloway\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld\3E6A.tmp
C:\Users\Galloway\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld\3E6B.tmp
C:\Users\Galloway\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.tmp
C:\Users\Galloway\AppData\Local\Temp\DIO5FA.tmp
C:\Users\Galloway\AppData\Local\Temp\DIO7EC2.tmp
C:\Users\Galloway\AppData\Local\Temp\DIO464A.tmp
C:\Users\Galloway\AppData\Local\Temp\DIOAE4A.tmp
C:\Users\Galloway\AppData\Local\Temp\DIOD98.tmp
C:\Users\Galloway\AppData\Local\Temp\DIOD115.tmp
C:\Users\Galloway\AppData\Local\Temp\MAR65B5.tmp
C:\Users\Galloway\AppData\Local\Temp\MAR623B.tmp
C:\Users\Galloway\AppData\Local\Temp\MAR973F.tmp
C:\Users\Galloway\AppData\Local\Temp\MAR975F.tmp
C:\Users\Galloway\AppData\Local\Temp\MAR3557.tmp
C:\Users\Galloway\AppData\Local\Temp\MAR3597.tmp
C:\Users\Galloway\AppData\Local\Temp\MARB7AA.tmp
C:\Users\Galloway\AppData\Local\Temp\MARB866.tmp
C:\Users\Galloway\AppData\Local\Temp\MARE9B2.tmp
C:\Users\Galloway\AppData\Local\Temp\MARE9E2.tmp
C:\Users\Galloway\AppData\Local\Temp\MARECBE.tmp
C:\Users\Galloway\AppData\Local\Temp\MAREEA2.tmp
C:\Users\Galloway\AppData\Local\Temp\~DFD841554722215779.TMP
C:\Users\Galloway\AppData\Local\VirtualStore\Program Files (x86)\Yahoo!\Messenger\Cache\9G0IMTf7KSnOtr1pRkveNQ--.ProfileMap.dat.tmp
C:\Users\Galloway\Music\91F61065-CF82.tmp
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Device Metadata\dmrccache\downloads\BIT2DD1.tmp

Regards

December 21, 2014

I searched the %systemdrive% for both TMP and BAK files and would like suitable entries to be made - even if merged with the existing winapp2.ini ones....

2011-02-11 12:00:42.742           8,192 C:\BOOTSECT.BAK
2014-12-21 01:37:29.552             544 C:\$RECYCLE.BIN\S-1-5-21-1722484443-3582388537-2899109180-1000\$IRAYQ8C.TMP
2014-12-20 23:58:12.675          16,384 C:\$RECYCLE.BIN\S-1-5-21-1722484443-3582388537-2899109180-1000\$RDTQ5QN.TMP
2014-12-21 02:15:29.130          16,384 C:\$RECYCLE.BIN\S-1-5-21-1722484443-3582388537-2899109180-1000\$RZ472UH.TMP
2014-09-28 17:06:26.579          64,306 C:\Program Files\Adware-Removal-Tool\Quarantine\Google Chrome\Default\Preferences.bak
2014-12-11 23:29:29.989          28,134 C:\Program Files\Adware-Removal-Tool\Quarantine\Google Chrome\Default\JumpListIcons\83D6.tmp
2014-12-11 23:29:30.005               0 C:\Program Files\Adware-Removal-Tool\Quarantine\Google Chrome\Default\JumpListIcons\83E8.tmp
2014-12-11 23:29:30.006               0 C:\Program Files\Adware-Removal-Tool\Quarantine\Google Chrome\Default\JumpListIcons\83E9.tmp
2014-12-11 23:29:30.029          28,134 C:\Program Files\Adware-Removal-Tool\Quarantine\Google Chrome\Default\JumpListIcons\83EA.tmp
2014-12-11 23:29:30.046          28,134 C:\Program Files\Adware-Removal-Tool\Quarantine\Google Chrome\Default\JumpListIcons\841A.tmp
2014-12-11 23:28:38.734          28,134 C:\Program Files\Adware-Removal-Tool\Quarantine\Google Chrome\Default\JumpListIconsOld\BB90.tmp
2014-12-11 23:28:38.746               0 C:\Program Files\Adware-Removal-Tool\Quarantine\Google Chrome\Default\JumpListIconsOld\BBA2.tmp
2014-12-11 23:28:38.748               0 C:\Program Files\Adware-Removal-Tool\Quarantine\Google Chrome\Default\JumpListIconsOld\BBA3.tmp
2014-03-07 13:58:02.929          46,862 C:\Program Files\Common Files\Microsoft\ART\Backup\Google Chrome\Default\Preferences.bak
2014-04-19 14:13:25.654          28,134 C:\Program Files\Common Files\Microsoft\ART\Backup\Google Chrome\Default\JumpListIcons\32FA.tmp
2014-04-19 14:03:10.483               0 C:\Program Files\Common Files\Microsoft\ART\Backup\Google Chrome\Default\JumpListIconsOld\D03A.tmp
2014-04-19 14:03:10.485               0 C:\Program Files\Common Files\Microsoft\ART\Backup\Google Chrome\Default\JumpListIconsOld\D03B.tmp
2014-04-19 14:03:10.487               0 C:\Program Files\Common Files\Microsoft\ART\Backup\Google Chrome\Default\JumpListIconsOld\D03C.tmp
2014-04-19 14:03:10.501          28,134 C:\Program Files\Common Files\Microsoft\ART\Backup\Google Chrome\Default\JumpListIconsOld\D03D.tmp
2014-02-22 15:56:15.099         235,550 C:\Program Files (x86)\Common Files\Windows Live\.cache\wlc3B52.tmp
2014-04-24 19:32:45.519         235,566 C:\Program Files (x86)\Common Files\Windows Live\.cache\wlc8B43.tmp
2014-01-03 16:23:32.114         235,478 C:\Program Files (x86)\Common Files\Windows Live\.cache\wlcA893.tmp
2011-03-24 21:08:09.410         217,160 C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\leg272.tmp
2011-03-24 21:08:09.425         131,888 C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\leg273.tmp
2011-03-24 21:08:09.441         217,160 C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\leg274.tmp
2011-03-24 21:08:09.441         217,160 C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\leg275.tmp
2011-03-24 21:08:09.472         131,888 C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\leg276.tmp
2011-03-24 21:08:09.488         131,888 C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\leg277.tmp
2011-03-24 21:08:09.347         216,229 C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\legB1B.tmp
2011-03-24 21:08:09.394         159,852 C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\legF2.tmp
2014-12-20 07:13:46.564      33,554,583 C:\ProgramData\Microsoft\Microsoft Antimalware\Network Inspection System\Support\NisLog.txt.bak
2002-10-17 20:23:16.000           8,200 C:\ProgramData\Microsoft\OFFICE\DATA\OPA11.BAK
2014-09-28 17:06:26.579          64,306 C:\Users\Galloway\AppData\Local\Google\Chrome\User Data\Default\Preferences.bak
2014-12-20 22:11:45.504         524,288 C:\Users\Galloway\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.tmp
2014-12-20 22:12:09.787               0 C:\Users\Galloway\AppData\Local\VirtualStore\Program Files (x86)\Yahoo!\Messenger\Cache\9G0IMTf7KSnOtr1pRkveNQ--.ProfileMap.dat.tmp
2014-10-31 19:29:25.067           5,540 C:\Users\Galloway\AppData\Roaming\Mozilla\Firefox\Profiles\y73yivh7.default-1408590376909\extensions.json.bak
2014-12-09 13:36:34.300           1,232 C:\Users\Galloway\AppData\Roaming\Pointstone\Registry Cleaner\GeneralSettings.bak
2014-12-11 23:38:56.063           1,081 C:\Users\Galloway\AppData\Roaming\Pointstone\Registry Cleaner\LiveUpdate.bak
2014-12-09 13:36:34.341           1,045 C:\Users\Galloway\AppData\Roaming\Pointstone\Registry Cleaner\RegistryCleaner.bak
2014-12-11 23:38:58.064             989 C:\Users\Galloway\AppData\Roaming\Pointstone\Registry Cleaner\RescueCenter.bak
2014-12-04 23:56:57.800           2,089 C:\Users\Galloway\AppData\Roaming\Pointstone\Registry Cleaner\Statistics\REGISTRY_CLEANER.bak
2014-09-07 13:33:52.768               0 C:\Users\Galloway\Music\91F61065-CF82.tmp
2013-12-21 04:03:25.877               0 C:\Users\Public\Music\91F61065-CF82.tmp
2014-11-22 13:49:47.146               0 C:\Windows\System32\drivers\etc\hosts_PTBackup.bak
2014-11-22 13:33:54.594             837 C:\Windows\System32\drivers\etc\hosts_PTbackup2.bak
2005-07-02 17:57:28.000           4,204 C:\Z_UserFiles\Unkn\BAK_000\settings.bak

Thank you!

December 19, 2014

from winapp2.ini:

[Yahoo Messenger Logs*]
LangSecRef=3022
Detect=HKCU\Software\Yahoo\pager
Default=False
FileKey1=%LocalAppData%\VirtualStore\*\Yahoo!\Messenger\logs|*.log
FileKey2=%ProgramFiles%\Yahoo!\Messenger|*.log
FileKey3=%LocalAppData%\VirtualStore\Program Files*\Yahoo!\Messenger\Cache|*.log;*.tmp
ExcludeKey1=%ProgramFiles%\Yahoo!\Messenger\INSTALL.LOG

I forgot to include it in the change log though

Thank you for the clarification.....

December 19, 2014

Updated

What's new in winapp2.ini 5.01.141218

General:

11 New Entries

07 Modified Entries

02 Removed Entries

Note:

Changes now exclude minor pathing changes (REMOVESELF -> RECURSE, adding/removing minor wildcards, etc)

Verbose:

------------------------------------------------------------------------------

New Entries:

[.NET Framework SQM*]

LangSecRef=3025

Detect=HKLM\Software\Microsoft\.NETFramework

Default=False

RegKey1=HKCU\Software\Microsoft\.NETFramework\SQM\Apps

[Ashampoo Burning Studio 15*]

LangSecRef=3024

Detect=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15

Default=False

FileKey1=%AppData%\Ashampoo\Ashampoo Burning Studio 15|backupmetainfo.xml

FileKey2=%AppData%\Ashampoo\Ashampoo Burning Studio 15\Log|*.xml;*.txt

FileKey3=%AppData%\Ashampoo\Log|*.txt

RegKey1=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\Data Disc Project\SaveDialog_AddFilesAndDirs|InitialDirectory

RegKey2=HKCU\Software\Ashampoo\Ashampoo Burning Studio 15\tempFiles

[CyberLink AudioDirector 5*]

LangSecRef=3023

Detect=HKCU\Software\CyberLink\AudioDirector5

Default=False

FileKey1=%LocalAppData%\Cyberlink\AudioDirector\5.0|*.*|RECURSE

FileKey2=%Documents%\Cyberlink\AudioDirector\5.0\SplitterIndex|*.*|RECURSE

RegKey1=HKCU\Software\CyberLink\AudioDirector5\MediaObj\MediaCache5\Data5

RegKey2=HKCU\Software\CyberLink\AudioDirector5\MediaObj\MediaCache5\Thumbnail5

[CyberLink ColorDirector 3*]

LangSecRef=3023

Detect=HKCU\Software\CyberLink\ColorDirector3

Default=False

FileKey1=%LocalAppData%\Cyberlink\ColorDirector\3.0|*.*|RECURSE

FileKey2=%AppData%\CyberLink\MediaCache|*.*|RECURSE

RegKey1=HKCU\Software\CyberLink\ColorDirector3\MediaObj\MediaCache5\Data5

RegKey2=HKCU\Software\CyberLink\ColorDirector3\MediaObj\MediaCache5\Thumbnail5

[CyberLink PhotoDirector 6*]

LangSecRef=3023

Detect=HKLM\SOFTWARE\CyberLink\PhotoDirector6

Default=False

FileKey1=%CommonAppData%\CyberLink\Downloader|*.*

FileKey2=%Pictures%\PhotoDirector\6.0\*|*.*|RECURSE

ExcludeKey1=FILE|%Pictures%\PhotoDirector\6.0\*|*.phd

[CyberLink PowerDirector 12*]

LangSecRef=3023

Detect=HKCU\Software\CyberLink\PowerDirector12

Default=False

FileKey1=%CommonAppData%\CyberLink\Boomerang\*\|*.xml;*.dmp

FileKey2=%LocalAppData%\VirtualStore\ProgramData\CyberLink\Boomerang\*\|*.xml;*.dmp

FileKey3=%AppData%\CyberLink\MediaCache|*.*|RECURSE

FileKey4=%Documents%\CyberLink\PowerDirector\12.0|Snapshot(*).jpg

FileKey5=%Documents%\CyberLink\PowerDirector\12.0\MyTitles|*.*|RECURSE

FileKey6=%Documents%\CyberLink\PowerDirector\12.0\Preview Cache Files|*.*

FileKey7=%Documents%\CyberLink\PowerDirector\12.0\ShadowEditFiles|*.MPG

FileKey8=%Documents%\CyberLink\PowerDirector\12.0\SplitterIndex|*.maidx

RegKey1=HKCU\Software\CyberLink\PowerDirector12\MediaObj\MediaCache5\Data5

RegKey2=HKCU\Software\CyberLink\PowerDirector12\MediaObj\MediaCache5\Thumbnail5

[CyberLink PowerDirector 13*]

LangSecRef=3023

Detect=HKCU\Software\CyberLink\PowerDirector13

Default=False

FileKey1=%CommonAppData%\CyberLink\Boomerang\*\|*.xml;*.dmp

FileKey2=%LocalAppData%\VirtualStore\ProgramData\CyberLink\Boomerang\*\|*.xml;*.dmp

FileKey3=%AppData%\CyberLink\MediaCache|*.*|RECURSE

FileKey4=%Documents%\CyberLink\PowerDirector\13.0|Snapshot(*).jpg

FileKey5=%Documents%\CyberLink\PowerDirector\13.0\MyTitles|*.*|RECURSE

FileKey6=%Documents%\CyberLink\PowerDirector\13.0\Preview Cache Files|*.*

FileKey7=%Documents%\CyberLink\PowerDirector\13.0\ShadowEditFiles|*.MPG

FileKey8=%Documents%\CyberLink\PowerDirector\13.0\SplitterIndex|*.maidx

RegKey1=HKCU\Software\CyberLink\PowerDirector13\MediaObj\MediaCache5\Data5

RegKey2=HKCU\Software\CyberLink\PowerDirector13\MediaObj\MediaCache5\Thumbnail5

[iResizer*]

LangSecRef=3021

Detect=HKCU\Software\Teorex\iResizer

Default=False

RegKey1=HKCU\Software\Teorex\iResizer\RecentFileList

[Lotus Notes Cache]

LangSecRef=3021

DetectFile=%ProgramFiles%\IBM\Lotus\Notes\Data\Cache.NDK

Default=False

FileKey1=%ProgramFiles%\IBM\Lotus\Notes\Data|Cache.NDK

[OpenRA*]

Section=Games

DetectFile=%Documents%\OpenRA\Logs

Default=False

FileKey1=%Documents%\OpenRA\Logs|*.*

[Tinder++*]

LangSecRef=3021

DetectFile=%LocalAppData%\Tinder*

Default=False

FileKey1=%LocalAppData%\Tinder*|*.*|RECURSE

------------------------------------------------------------------------------

Modified Entries:

[Aimersoft Video Converter Ultimate More*]

LangSecRef=3023

Detect=HKLM\Software\Aimersoft\Aimersoft Video Converter Ultimate

Default=False

FileKey1=%ProgramFiles%\Aimersoft\Video Converter Ultimate\TempThumbDir|*.*|RECURSE

FileKey2=%CommonAppData%\Aimersoft\ProductFeatures\LocalLogs|*.*|RECURSE

FileKey3=%CommonAppData%\Aimersoft\ProductFeatures\RemoteLogs|*.*|RECURSE

FileKey4=%LocalAppData%\VirtualStore\Program Files*\Aimersoft\Video Converter Ultimate\TempThumbDir|*.*|RECURS

   - Added FileKey2 and 3

[Ashampoo Snap 7*]

LangSecRef=3024

Detect=HKCU\Software\Ashampoo\Ashampoo Snap 7

Default=False

FileKey1=%LocalAppData%\CrashRpt\UnsentCrashReports|*.*|RECURSE

FileKey2=%ProgramFiles%\Ashampoo\Ashampoo Snap 7|_NLogMsg.txt

   - Added FileKey2



[CyberLink PowerDirector 10*]

LangSecRef=3023

Detect=HKCU\Software\CyberLink\PowerDirector10

Default=False

FileKey1=%CommonAppData%\CyberLink\Boomerang\*\|*.xml;*.dmp

FileKey2=%LocalAppData%\VirtualStore\ProgramData\CyberLink\Boomerang\*\|*.xml;*.dmp

FileKey3=%AppData%\CyberLink\MediaCache|*.*|RECURSE

FileKey4=%Documents%\CyberLink\PowerDirector\10.0|Snapshot(*).jpg

FileKey5=%Documents%\CyberLink\PowerDirector\10.0\MyTitles|*.*|RECURSE

FileKey6=%Documents%\CyberLink\PowerDirector\10.0\Preview Cache Files|*.*

FileKey7=%Documents%\CyberLink\PowerDirector\10.0\ShadowEditFiles|*.MPG

FileKey8=%Documents%\CyberLink\PowerDirector\10.0\SplitterIndex|*.maidx

RegKey1=HKCU\Software\CyberLink\PowerDirector10\MediaObj\MediaCache5\Data5

RegKey2=HKCU\Software\CyberLink\PowerDirector10\MediaObj\MediaCache5\Thumbnail5

   - Added FileKeys1 through 3

   - Added RegKeys



[CyberLink PowerDirector 11*]

LangSecRef=3023

Detect=HKCU\Software\CyberLink\PowerDirector11

Default=False

FileKey1=%CommonAppData%\CyberLink\Boomerang\*\|*.xml;*.dmp

FileKey2=%LocalAppData%\VirtualStore\ProgramData\CyberLink\Boomerang\*\|*.xml;*.dmp

FileKey3=%AppData%\CyberLink\MediaCache|*.*|RECURSE

FileKey4=%Documents%\CyberLink\PowerDirector\11.0|Snapshot(*).jpg

FileKey5=%Documents%\CyberLink\PowerDirector\11.0\MyTitles|*.*|RECURSE

FileKey6=%Documents%\CyberLink\PowerDirector\11.0\Preview Cache Files|*.*

FileKey7=%Documents%\CyberLink\PowerDirector\11.0\ShadowEditFiles|*.MPG

FileKey8=%Documents%\CyberLink\PowerDirector\11.0\SplitterIndex|*.maidx

RegKey1=HKCU\Software\CyberLink\PowerDirector11\MediaObj\MediaCache5\Data5

RegKey2=HKCU\Software\CyberLink\PowerDirector11\MediaObj\MediaCache5\Thumbnail5

   - Added FileKeys1 through 3

   - Added RegKeys



[Dropbox*]

LangSecRef=3024

Detect=HKCU\Software\Dropbox

Default=False

FileKey1=%AppData%\DropBox|Filecache.db;SigStore.db

FileKey2=%AppData%\DropBox\Bin|*.log

FileKey3=%AppData%\Dropbox\logs|*.*|RECURSE

FileKey4=%AppData%\Dropbox\Cache|*.*|RECURSE

   - Added FileKey3

[sketchUp Make*]

LangSecRef=3021

Detect=HKCU\Software\SketchUp

Default=False

FileKey1=%AppData%\SketchUp\SketchUp *\SketchUp|~*.tmp

RegKey1=HKCU\Software\SketchUp\SketchUp 2013\Recent File List

RegKey2=HKCU\Software\SketchUp\SketchUp 2014\Recent File List

RegKey3=HKCU\Software\SketchUp\SketchUp 2015\Recent File List

   - Added RegKey3



[TeamViewer Logs*]

LangSecRef=3024

Detect=HKCU\Software\TeamViewer

Default=False

FileKey1=%AppData%\TeamViewer|*.log

FileKey2=%ProgramFiles%\TeamViewer|*.log|RECURSE

FileKey3=%WinDir%\System32|TeamViewer*_Hooks.log

FileKey4=%LocalAppData%\VirtualStore\Program Files*\TeamViewer|*.log|RECURSE

   - Added FileKey1



------------------------------------------------------------------------------

Removed Entries:

[NVIDIA (Play On My TV)*]

LangSecRef=3023

Detect=HKLM\Software\NVIDIA Corporation

Default=False

Warning=If you output to multiple displays such as an HDTV or another monitor don't enable this!

RegKey1=HKCR\AVIFile\shellex\ContextMenuHandlers\NvPlayOnMyTV

RegKey2=HKCR\AVIFile\shellex\ContextMenuHandlers\PlayOnMyTV

RegKey3=HKCR\mpegfile\shellex\ContextMenuHandlers\NvPlayOnMyTV

RegKey4=HKCR\mpegfile\shellex\ContextMenuHandlers\PlayOnMyTV

RegKey5=HKCR\WMVFile\shellex\ContextMenuHandlers\NvPlayOnMyTV

RegKey6=HKCR\WMVFile\shellex\ContextMenuHandlers\PlayOnMyTV

RegKey7=HKLM\Software\Classes\AVIFile\shellex\ContextMenuHandlers\NvPlayOnMyTV

RegKey8=HKLM\Software\Classes\AVIFile\shellex\ContextMenuHandlers\PlayOnMyTV

RegKey9=HKLM\Software\Classes\mpegfile\shellex\ContextMenuHandlers\NvPlayOnMyTV

RegKey10=HKLM\Software\Classes\mpegfile\shellex\ContextMenuHandlers\PlayOnMyTV

RegKey11=HKLM\Software\Classes\WMVFile\shellex\ContextMenuHandlers\NvPlayOnMyTV

RegKey12=HKLM\Software\Classes\WMVFile\shellex\ContextMenuHandlers\PlayOnMyTV

[NVIDIA (Startup)*]

LangSecRef=3023

Detect=HKLM\Software\NVIDIA Corporation

Default=False

RegKey1=HKLM\Software\Microsoft\Windows\CurrentVersion\Run|NvMediaCenter

------------------------------------------------------------------------------

forgot this post http://forum.piriform.com/index.php?showtopic=32310&page=234&do=findComment&comment=257136

December 16, 2014

Edit needed.

[Yahoo Messenger Logs*]

Needs to exclude:

%ProgramFiles%\Yahoo!\Messenger\INSTALL.LOG

as that file is used to remove Yahoo Messenger .....

December 2, 2014

or use mklink to programfiles...

http://technet.microsoft.com/de-de/library/cc753194%28v=ws.10%29.aspx

mklink /d \My Programs\JDownloader v2\ %ProgramFiles%\JDownloader v2\

Is what I would need?

November 29, 2014

[JDownloader2 Logs*]
LangSecRef=3022
Detect=HKLM\SOFTWARE\Classes\JDownloader2
DetectFile=%ProgramFiles%\JDownloader 2\
Default=False
FileKey1=%ProgramFiles%\JDownloader*2*|JDownloader.log;Updater_*-*-*.log;SessionInstallLog.json.*|RECURSE
FileKey2=%ProgramFiles%\JDownloader*2*\logs|*.*|RECURSE
FileKey3=%LocalAppData%\VirtualStore\Program Files*\JDownloader*2*|JDownloader.log;Updater_*-*-*.log;SessionInstallLog.json.*
FileKey4=%LocalAppData%\VirtualStore\Program Files*\JDownloader*2*\logs|*.*|RECURSE
FileKey5=C:\My Programs\JDownloader*2*|JDownloader.log;Updater_*-*-*.log;SessionInstallLog.json.*|RECURSE
FileKey6=C:\My Programs\JDownloader*2*\logs|*.*|RECURSE

: added FileKey5 and 6

[JDownloader2 Temps*]
LangSecRef=3022
Detect=HKLM\SOFTWARE\Classes\JDownloader2
DetectFile=%ProgramFiles%\JDownloader 2\
Default=False
FileKey1=%ProgramFiles%\JDownloader*2*\tmp|*.*|RECURSE
FileKey2=%ProgramFiles%\JDownloader*2*\captchas|*.*|RECURSE
FileKey3=%LocalAppData%\VirtualStore\Program Files*\JDownloader*2*\tmp|*.*|RECURSE
FileKey4=%LocalAppData%\VirtualStore\Program Files*\JDownloader*2*\captchas|*.*|RECURSE
FileKey5=%ProgramFiles%\JDownloader*2*\cfg|CaptchaDialogDimensions_*.json
FileKey6=%LocalAppData%\VirtualStore\Program Files*\JDownloader*2*\cfg|CaptchaDialogDimensions_*.json
FileKey7=C:\My Programs\JDownloader*2*\captchas|*.*|RECURSE
FileKey8=C:\My Programs\JDownloader*2*\cfg|CaptchaDialogDimensions_*.json
FileKey9=C:\My Programs\JDownloader*2*\tmp|*.*|RECURSE
ExcludeKey1=%ProgramFiles%\JDownloader*2*\cfg\subconf_*.ejs
ExcludeKey2=%LocalAppData%\VirtualStore\Program Files*\JDownloader*2*\cfg\subconf_*.ejs
ExcludeKey3=C:\My Programs\JDownloader*2*\cfg\subconf_*.ejs

: added FileKeys 7-9 and ExcludeKey3

November 28, 2014

I have JDownloader2 installed in C:\My Programs\JDownloader v2.0\ - I do however have the HKLM\... key. would it be possible to add the C:\My Programs\JDownloader v2.0 as additional filekeys to all the JDownloader2 entries? Or what is the best way to do it? I have it installed there instead of %ProgramFiles% sicne it does modify the contents of the folder.....

November 21, 2014

Why not suggest doing a chkdsk on C: ?

November 13, 2014

%CommonAppData% and C:\Users\All Users\ the same entries . Creat a new text.txt and you will see.

you didn't notice that one had \VirtualStore\ - but I do agree at least one path is entirely wrong....

I have found these on my PC:

C:\ProgramData\Mozilla\logs

That is the only one that has "*\Mozilla\logs"

November 11, 2014

Need to add entry for Yahoo Messenger Photo Sharing cache:

[Yahoo Messenger Photo Sharing cache]

LangSecRef=3022
Detect1=HKCU\Software\Yahoo\pager

Warning=Selecting this will remove all your Yahoo Messenger Photo Sharing photos.
Default=False
FileKey1=%CommonAppData%\Yahoo!\Messenger\PhotoSharing|*.*|RECURSE

current Winapp2.ini has:

[Yahoo Messenger Cache*]
LangSecRef=3022
DetectFile=%ProgramFiles%\Yahoo!\Messenger\YahooMessenger.exe
Detect1=HKCU\Software\Yahoo
Detect2=HKCU\Software\Yahoo\pager
Default=False
FileKey1=%AppData%\Yahoo!\Messenger|*.*|RECURSE
FileKey2=%LocalAppData%\VirtualStore\*\Yahoo!\Messenger\Cache|*.*|RECURSE

Suggest removing DetectFile and Detect1 and rename Detect2 to Detect1

October 21, 2014

Have you tried running CCleaner while in Safe mode?

October 4, 2014

When I installed JDownloader2 I accepted the defaults for the install path. The JDownloader2 entries have not been showing up. Can a Detect2 be added for:

C:\Users\[username]\AppData\Local\JDownloader v2.0\

please? Also there is NO JDownloader* sub-folder in

%LocalAppData%\VirtualStore\

September 28, 2014

My files in JD2 entry not on %localappdata% why ? I don't know...

Mine:

September 27, 2014

I suggest you look at this thread - a newer 4.18 has been released.

http://forum.piriform.com/index.php?showtopic=41860

September 26, 2014

I contacted JDownloader support and sent the rules for comment; this is what he replied:

ProgramFiles%\JDownloader\.junique <<--- do not remove as it will destroy *instance* detection. can lead to starting jdownloader twice

 Program Files*\JDownloader\captchas <<<-- should be clean, no need to remove (only in case when jd crashes, files might be left)

 log folder does clean itself (only keeps last x items) and no logs -> hard to help in case of problems

 tmp folder -> will cause longer start times as jdownloader needs to create plugin cache again and again

September 26, 2014

Be nice if http://board.jdownloader.org/showthread.php?p=308146#post308146 could be translated.... LOL.....

September 26, 2014

Interesting, but have you a Jdownloader folder in LocalAppData ???

On my Pc theres no folder ......

_______________________________________________

also an answer:

board. jdownloader.org/showthread.php?p=308146#post308146

It depends what version of JDownloader you have - if JDownloader1 there will bw no %LocalAppData%\JDownloader*2*\ folder but if you have JDownloader 2 you wil have %LocalAppData%\JDownloader*2*\ .....

I don't think OS version even matters here... just program version....

September 26, 2014

Forgot the entries at http://forum.piriform.com/index.php?showtopic=32310&page=226&do=findComment&comment=253384

Looking over the entries closer - the JDownloader2 install forces into %LocalAppData% so I have made the necessary modifications and have contacted support to verify if this is all the cleaning that can be done. so far it's just:

[JDownloader2 Logs*]
LangSecRef=3022
Detect=HKLM\SOFTWARE\Classes\JDownloader2
Default=False
FileKey1=%LocalAppData%\JDownloader*2*|JDownloader.log;Updater_*-*-*.log;SessionInstallLog.json.*|RECURSE
FileKey2=%LocalAppData%\JDownloader*2*\logs|*.*|RECURSE

[JDownloader2 Temps*]
LangSecRef=3022
Detect=HKLM\SOFTWARE\Classes\JDownloader2
Default=False
FileKey1=%LocalAppData%\JDownloader*2*\tmp|*.*|RECURSE
FileKey2=%LocalAppData%\JDownloader*2*\captchas|*.*|RECURSE
;
; Be carefull to add files from the cfg folder!!! User settings!
; Please exclude subconf_*.ejs
; files
;
FileKey3=%LocalAppData%\JDownloader*2*\cfg|CaptchaDialogDimensions_*.json

September 26, 2014

There seems to still be a lot of old files (Yahoo Messenger, for example) in %LocalAppStore%\VirtualStore\ so I have done an enhanced listing of the files - to be added to a winapp2.ini entry or modified to be included in other rules.

VirtualStore.txt

September 26, 2014

Forgot the entries at http://forum.piriform.com/index.php?showtopic=32310&page=226&do=findComment&comment=253384

September 15, 2014

Sry, I haven't one of them .....

Do you have JDownloader2 installed? Have you used Regedit to search for JDownloader2 ?

Sign In

CSGalloway

Posts

Joined

Last visited

Content Type

Forums

Events

Posts posted by CSGalloway

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Says it's deleteing Recycle Bin items, but there's nothing there but protect system files

Winapp2.ini additions

Winapp2.ini additions

CCleaner Continuously Cleans Large File in Recycle Bin

Winapp2.ini additions

Winapp2.ini additions

CCLEANER 4.18 Problem

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Winapp2.ini additions

Browse

Activity

Home

Mobile

Business

Important Information