SMalik

Entries name change [Chrome Application Cache *] to [Application Cache *] [Chrome Crash Reports *] to [Crash Reports *] [Chrome Updates *] to [Updates *]

Revised Entry Changed the entry name [PnaclTranslation Cache *] to [PNaCl Translation Cache *] Replaced |*.* with |*.*|RECURSE [PNaCl Translation Cache *] LangSecRef=3029 Detect1=HKCU\Software\7Star\7Star Detect2=HKCU\Software\360Browser\Browser Detect3=HKCU\Software\Amigo Detect4=HKCU\Software\BraveSoftware\Brave-Browser Detect5=HKCU\Software\CentBrowser Detect6=HKCU\Software\ChromePlus Detect7=HKCU\Software\Chromium\PreferenceMACs Detect8=HKCU\Software\CocCoc\Browser Detect9=HKCU\Software\Comodo\Dragon Detect10=HKCU\Software\Coowon\Coowon Detect11=HKCU\Software\Epic Privacy Browser Detect12=HKCU\Software\Flock Detect13=HKCU\Software\Opera Software Detect14=HKCU\Software\RockMelt Detect15=HKCU\Software\Slimjet Detect16=HKCU\Software\Torch Detect17=HKCU\Software\Vivaldi Detect18=HKCU\Software\Yandex\YandexBrowser DetectFile1=%AppData%\brave DetectFile2=%LocalAppData%\Google\Chrome* Default=False FileKey1=%AppData%\brave\PnaclTranslationCache|*.*|RECURSE FileKey2=%AppData%\Opera Software\Opera*\PnaclTranslationCache|*.*|RECURSE FileKey3=%LocalAppData%\7Star\7Star\User Data\PnaclTranslationCache|*.*|RECURSE FileKey4=%LocalAppData%\360Browser\Browser\User Data\PnaclTranslationCache|*.*|RECURSE FileKey5=%LocalAppData%\Amigo\User Data\PnaclTranslationCache|*.*|RECURSE FileKey6=%LocalAppData%\BraveSoftware\Brave-Browser\User Data\PnaclTranslationCache|*.*|RECURSE FileKey7=%LocalAppData%\CentBrowser\User Data\PnaclTranslationCache|*.*|RECURSE FileKey8=%LocalAppData%\Chromium\User Data\PnaclTranslationCache|*.*|RECURSE FileKey9=%LocalAppData%\CocCoc\Browser\User Data\PnaclTranslationCache|*.*|RECURSE FileKey10=%LocalAppData%\Comodo\Dragon\User Data\PnaclTranslationCache|*.*|RECURSE FileKey11=%LocalAppData%\Coowon\Coowon\User Data\PnaclTranslationCache|*.*|RECURSE FileKey12=%LocalAppData%\Epic Privacy Browser\User Data\PnaclTranslationCache|*.*|RECURSE FileKey13=%LocalAppData%\Flock\User Data\PnaclTranslationCache|*.*|RECURSE FileKey14=%LocalAppData%\Google\Chrome*\User Data\PnaclTranslationCache|*.*|RECURSE FileKey15=%LocalAppData%\MapleStudio\ChromePlus\User Data\PnaclTranslationCache|*.*|RECURSE FileKey16=%LocalAppData%\RockMelt\User Data\PnaclTranslationCache|*.*|RECURSE FileKey17=%LocalAppData%\Slimjet\User Data\PnaclTranslationCache|*.*|RECURSE FileKey18=%LocalAppData%\Torch\User Data\PnaclTranslationCache|*.*|RECURSE FileKey19=%LocalAppData%\Vivaldi\User Data\PnaclTranslationCache|*.*|RECURSE FileKey20=%LocalAppData%\Yandex\YandexBrowser\User Data\PnaclTranslationCache|*.*|RECURSE

Revised Entry Changed the entry name from [Omnibox Shortcut *] to [Omnibox Shortcuts *] [Omnibox Shortcuts *] LangSecRef=3029 Detect1=HKCU\Software\7Star\7Star Detect2=HKCU\Software\360Browser\Browser Detect3=HKCU\Software\Amigo Detect4=HKCU\Software\BraveSoftware\Brave-Browser Detect5=HKCU\Software\CentBrowser Detect6=HKCU\Software\ChromePlus Detect7=HKCU\Software\Chromium\PreferenceMACs Detect8=HKCU\Software\CocCoc\Browser Detect9=HKCU\Software\Comodo\Dragon Detect10=HKCU\Software\Coowon\Coowon Detect11=HKCU\Software\Epic Privacy Browser Detect12=HKCU\Software\Flock Detect13=HKCU\Software\Opera Software Detect14=HKCU\Software\RockMelt Detect15=HKCU\Software\Slimjet Detect16=HKCU\Software\Torch Detect17=HKCU\Software\Vivaldi Detect18=HKCU\Software\Yandex\YandexBrowser DetectFile1=%AppData%\brave DetectFile2=%LocalAppData%\Google\Chrome* Default=False FileKey1=%AppData%\brave|Shortcuts FileKey2=%AppData%\Opera Software\Opera*|Shortcuts FileKey3=%LocalAppData%\7Star\7Star\User Data\*|Shortcuts FileKey4=%LocalAppData%\360Browser\Browser\User Data\*|Shortcuts FileKey5=%LocalAppData%\Amigo\User Data\*|Shortcuts FileKey6=%LocalAppData%\BraveSoftware\Brave-Browser\User Data\*|Shortcuts FileKey7=%LocalAppData%\CentBrowser\User Data\*|Shortcuts FileKey8=%LocalAppData%\Chromium\User Data\*|Shortcuts FileKey9=%LocalAppData%\CocCoc\Browser\User Data\*|Shortcuts FileKey10=%LocalAppData%\Comodo\Dragon\User Data\*|Shortcuts FileKey11=%LocalAppData%\Coowon\Coowon\User Data\*|Shortcuts FileKey12=%LocalAppData%\Epic Privacy Browser\User Data\*|Shortcuts FileKey13=%LocalAppData%\Flock\User Data\*|Shortcuts FileKey14=%LocalAppData%\Google\Chrome*\User Data\*|Shortcuts FileKey15=%LocalAppData%\MapleStudio\ChromePlus\User Data\*|Shortcuts FileKey16=%LocalAppData%\RockMelt\User Data\*|Shortcuts FileKey17=%LocalAppData%\Slimjet\User Data\*|Shortcuts FileKey18=%LocalAppData%\Torch\User Data\*|Shortcuts FileKey19=%LocalAppData%\Vivaldi\User Data\*|Shortcuts FileKey20=%LocalAppData%\Yandex\YandexBrowser\User Data\*|Shortcuts

Revised Entry Changed the entry name from [History *] to [Internet History *] Also, separated JumpListIcons FileKey's into a new entry [Internet History *] LangSecRef=3029 Detect1=HKCU\Software\7Star\7Star Detect2=HKCU\Software\360Browser\Browser Detect3=HKCU\Software\Amigo Detect4=HKCU\Software\BraveSoftware\Brave-Browser Detect5=HKCU\Software\CentBrowser Detect6=HKCU\Software\ChromePlus Detect7=HKCU\Software\Chromium\PreferenceMACs Detect8=HKCU\Software\CocCoc\Browser Detect9=HKCU\Software\Comodo\Dragon Detect10=HKCU\Software\Coowon\Coowon Detect11=HKCU\Software\Epic Privacy Browser Detect12=HKCU\Software\Flock Detect13=HKCU\Software\Opera Software Detect14=HKCU\Software\RockMelt Detect15=HKCU\Software\Slimjet Detect16=HKCU\Software\Torch Detect17=HKCU\Software\Vivaldi Detect18=HKCU\Software\Yandex\YandexBrowser DetectFile1=%AppData%\brave DetectFile2=%LocalAppData%\Google\Chrome* Default=False FileKey1=%AppData%\brave|History FileKey2=%AppData%\Opera Software\Opera*|History FileKey3=%LocalAppData%\7Star\7Star\User Data\*|History FileKey4=%LocalAppData%\360Browser\Browser\User Data\*|History FileKey5=%LocalAppData%\Amigo\User Data\*|History FileKey6=%LocalAppData%\BraveSoftware\Brave-Browser\User Data\*|History FileKey7=%LocalAppData%\CentBrowser\User Data\*|History FileKey8=%LocalAppData%\Chromium\User Data\*|History FileKey9=%LocalAppData%\CocCoc\Browser\User Data\*|History FileKey10=%LocalAppData%\Comodo\Dragon\User Data\*|History FileKey11=%LocalAppData%\Coowon\Coowon\User Data\*|History FileKey12=%LocalAppData%\Epic Privacy Browser\User Data\*|History FileKey13=%LocalAppData%\Flock\User Data\*|History FileKey14=%LocalAppData%\Google\Chrome*\User Data\*|History FileKey15=%LocalAppData%\MapleStudio\ChromePlus\User Data\*|History FileKey16=%LocalAppData%\RockMelt\User Data\*|History FileKey17=%LocalAppData%\Slimjet\User Data\*|History FileKey18=%LocalAppData%\Torch\User Data\*|History FileKey19=%LocalAppData%\Vivaldi\User Data\*|History FileKey20=%LocalAppData%\Yandex\YandexBrowser\User Data\*|History [Jump List Icons *] LangSecRef=3029 Detect1=HKCU\Software\7Star\7Star Detect2=HKCU\Software\360Browser\Browser Detect3=HKCU\Software\Amigo Detect4=HKCU\Software\BraveSoftware\Brave-Browser Detect5=HKCU\Software\CentBrowser Detect6=HKCU\Software\ChromePlus Detect7=HKCU\Software\Chromium\PreferenceMACs Detect8=HKCU\Software\CocCoc\Browser Detect9=HKCU\Software\Comodo\Dragon Detect10=HKCU\Software\Coowon\Coowon Detect11=HKCU\Software\Epic Privacy Browser Detect12=HKCU\Software\Flock Detect13=HKCU\Software\Opera Software Detect14=HKCU\Software\RockMelt Detect15=HKCU\Software\Slimjet Detect16=HKCU\Software\Torch Detect17=HKCU\Software\Vivaldi Detect18=HKCU\Software\Yandex\YandexBrowser DetectFile1=%AppData%\brave DetectFile2=%LocalAppData%\Google\Chrome* Default=False FileKey1=%AppData%\brave\JumpListIcons*|*.*|RECURSE FileKey2=%AppData%\Opera Software\Opera*\JumpListIcons*|*.*|RECURSE FileKey3=%LocalAppData%\7Star\7Star\User Data\*\JumpListIcons*|*.*|RECURSE FileKey4=%LocalAppData%\360Browser\Browser\User Data\*\JumpListIcons*|*.*|RECURSE FileKey5=%LocalAppData%\Amigo\User Data\*\JumpListIcons*|*.*|RECURSE FileKey6=%LocalAppData%\BraveSoftware\Brave-Browser\User Data\*\JumpListIcons*|*.*|RECURSE FileKey7=%LocalAppData%\CentBrowser\User Data\*\JumpListIcons*|*.*|RECURSE FileKey8=%LocalAppData%\Chromium\User Data\*\JumpListIcons*|*.*|RECURSE FileKey9=%LocalAppData%\CocCoc\Browser\User Data\*\JumpListIcons*|*.*|RECURSE FileKey10=%LocalAppData%\Comodo\Dragon\User Data\*\JumpListIcons*|*.*|RECURSE FileKey11=%LocalAppData%\Coowon\Coowon\User Data\*\JumpListIcons*|*.*|RECURSE FileKey12=%LocalAppData%\Epic Privacy Browser\User Data\*\JumpListIcons*|*.*|RECURSE FileKey13=%LocalAppData%\Flock\User Data\*\JumpListIcons*|*.*|RECURSE FileKey14=%LocalAppData%\Google\Chrome*\User Data\*\JumpListIcons*|*.*|RECURSE FileKey15=%LocalAppData%\MapleStudio\ChromePlus\User Data\*\JumpListIcons*|*.*|RECURSE FileKey16=%LocalAppData%\RockMelt\User Data\*\JumpListIcons*|*.*|RECURSE FileKey17=%LocalAppData%\Slimjet\User Data\*\JumpListIcons*|*.*|RECURSE FileKey18=%LocalAppData%\Torch\User Data\*\JumpListIcons*|*.*|RECURSE FileKey19=%LocalAppData%\Vivaldi\User Data\*\JumpListIcons*|*.*|RECURSE FileKey20=%LocalAppData%\Yandex\YandexBrowser\User Data\*\JumpListIcons*|*.*|RECURSE

New Entries [Blob Storage *] LangSecRef=3029 DetectFile=%LocalAppData%\Google\Chrome* Default=False FileKey1=%LocalAppData%\Google\Chrome\User Data\Default\blob_storage|*.*|RECURSE [BrowserMetrics *] LangSecRef=3029 DetectFile=%LocalAppData%\Google\Chrome* Default=False FileKey1=%LocalAppData%\Google\Chrome\User Data|BrowserMetrics-spare.pma FileKey2=%LocalAppData%\Google\Chrome\User Data\BrowserMetrics|*.*|RECURSE [Chrome Bookmarks Icons *] LangSecRef=3029 DetectFile=%LocalAppData%\Google\Chrome* Default=False Warning=This will delete all the icons of your bookmarks. The icons will be rebuilt as websites are manually re-visited. FileKey1=%LocalAppData%\Google\Chrome\User Data\Default|Favicons [Internet Cache *] LangSecRef=3029 DetectFile=%LocalAppData%\Google\Chrome* Default=False FileKey1=%LocalAppData%\Google\Chrome\User Data\Default|MANIFEST-*;Network Persistent State;Origin Bound Certs [LevelDB Storage *] LangSecRef=3029 DetectFile=%LocalAppData%\Google\Chrome* Default=False FileKey1=%LocalAppData%\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb|*.*|RECURSE

[SetupMetrics *] is not a part of Google Chrome anymore. I think it should be removed. WebRTC is a Google Chrome addon. I don't have this but, the entry, WebRTCIdentityStore still shows up.

Revised Entry Changed the entry name from [Lock Files *] to [Parental Controls *] Also, fixed the FileKey's [Parental Controls *] LangSecRef=3026 Detect1=HKLM\Software\Mozilla\Pale Moon Detect2=HKLM\Software\Mozilla\SeaMonkey Detect3=HKLM\Software\Mozilla\Waterfox DetectFile=%AppData%\Mozilla\Firefox Default=False FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|parent.lock FileKey2=%AppData%\Mozilla\Firefox\Profiles\*|parent.lock FileKey3=%AppData%\Mozilla\SeaMonkey\Profiles\*|parent.lock FileKey4=%AppData%\Waterfox\Profiles\*|parent.lock

New Entry [Firefox Bookmarks Icons *] LangSecRef=3026 DetectFile=%AppData%\Mozilla\Firefox Default=False Warning=This will delete all the icons of your bookmarks. The icons will be rebuilt as websites are manually re-visited. FileKey1=%AppData%\Mozilla\Firefox\Profiles\*|favicons.sqlite

New Entry [iMyFone Umate *] LangSecRef=3024 Detect=HKLM\Software\iMyFone\Umate Default=False FileKey1=%ProgramFiles%\iMyFone\iMyFone Umate|mate.log FileKey2=%ProgramFiles%\iMyFone\iMyFone Umate\cache|*.*|RECURSE FileKey3=%ProgramFiles%\iMyFone\iMyFone Umate\Log|*.*|RECURSE FileKey4=%ProgramFiles%\iMyFone\iMyFone Umate\temp|*.*|RECURSE

As for the Microsoft Edge Favorites icons, I believe it is a sensitive area because deleted Favorites’ icons remain in that location and don’t get removed. Favorites icons get repopulated after opening Microsoft Edge. I don’t think it is a wise idea to remove that FileKey from that entry. I believe the Firefox and Chrome entries also remove bookmarks’ icons.

I have two physical drives in the system. My computer Sleep time is set to 20 minutes. I started to defrag the non system drive. The de-fragmentation was at 40% and the computer went into Sleep mode. Defraggler didn't stop the computer from going into Sleep mode. I think this behavior should be changed.

Revised Entry Changed the DetectFile from %CommonAppData%\Norton\LocalDumps to %CommonAppData%\Norton [Norton *] LangSecRef=3024 DetectFile=%CommonAppData%\Norton Default=False FileKey1=%CommonAppData%\Norton|*.log;*.txt FileKey2=%CommonAppData%\Norton\LocalDumps|*.dmp FileKey3=%CommonAppData%\NortonInstaller\Logs|*.*|RECURSE FileKey4=%LocalAppData%\VirtualStore\ProgramData\Norton\LocalDumps|*.dmp FileKey5=%LocalAppData%\VirtualStore\ProgramData\NortonInstaller\Logs|*.*|RECURSE

Revised Entry Changed the entry name from [webappsstore.sqlite *] to [DOM Storage *] webappsstore.sqlite stores all the DOM storage data, mostly data for websites http://kb.mozillazine.org/Webappsstore.sqlite [DOM Storage *] LangSecRef=3026 Detect1=HKLM\Software\Mozilla\Pale Moon Detect2=HKLM\Software\Mozilla\SeaMonkey Detect3=HKLM\Software\Mozilla\Waterfox DetectFile=%AppData%\Mozilla\Firefox Default=False FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|webappsstore.sqlite FileKey2=%AppData%\Mozilla\Firefox\Profiles\*|webappsstore.sqlite FileKey3=%AppData%\Mozilla\SeaMonkey\Profiles\*|webappsstore.sqlite FileKey4=%AppData%\Waterfox\Profiles\*|webappsstore.sqlite

Revised Entry Changed the entry name from [urlclassifier3.sqlite *] to [Anti-Phishing data *] Changed the Warning from "This will delete urlclassifier3.sqlite. If you just want to reduce its size, select Compact Databases instead." to "This will delete anti-phishing data." urlclassifier2.sqlite stores anti-phishing data http://kb.mozillazine.org/Urlclassifier2.sqlite [Anti-Phishing data *] LangSecRef=3026 Detect1=HKLM\Software\Mozilla\Pale Moon Detect2=HKLM\Software\Mozilla\SeaMonkey Detect3=HKLM\Software\Mozilla\Waterfox DetectFile=%AppData%\Mozilla\Firefox Default=False Warning=This will delete anti-phishing data. FileKey1=%LocalAppData%\Moonchild Productions\Pale Moon\Profiles\*|urlclassifier3.sqlite FileKey2=%LocalAppData%\Mozilla\Firefox\Profiles\*|urlclassifier3.sqlite FileKey3=%LocalAppData%\Mozilla\SeaMonkey\Profiles\*|urlclassifier3.sqlite FileKey4=%LocalAppData%\Waterfox\Profiles\*|urlclassifier3.sqlite

Lots of sensitive stuff here. It stores favorite icons, input history, keywords, and browsing history (a record of visited pages). Deleting this file will also delete the bookmarks. %AppData%\Mozilla\Firefox\Profiles\*|places.sqlite http://kb.mozillazine.org/Places.sqlite

New Entry http://forums.mozillazine.org/viewtopic.php?f=23&t=2919581 [HSTS supercookies*] LangSecRef=3026 SpecialDetect=DET_MOZILLA Default=False FileKey1=%AppData%\Mozilla\Firefox\Profiles\*|SiteSecurityServiceState.txt

Revised Entry Added FileKey1 [Windows Communications Apps *] LangSecRef=3031 Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.windowscommunicationsapps_8wekyb3d8bbwe DetectFile=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe Default=False FileKey1=%LocalAppData%\Comms\Unistore\data|AggregateCache.uca FileKey2=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\AppCache|*.*|RECURSE FileKey3=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\INet*|*.*|RECURSE FileKey4=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE FileKey5=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE FileKey6=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE FileKey7=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\PRICache|*.*|RECURSE FileKey8=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\Temp|*.*|RECURSE FileKey9=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\LocalState\LiveComm\*\*\DBStore\LogFiles|edbtmp.log FileKey10=%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\TempState|*.*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\SearchHistory ExcludeKey1=FILE|%LocalAppData%\Packages\microsoft.windowscommunicationsapps_*\AC\INetCache\|container.dat

Revised Entry Added FileKey5 [Adobe Acrobat DC *] LangSecRef=3021 Detect=HKLM\Software\Adobe\Adobe Acrobat\DC Default=False FileKey1=%LocalAppData%\Adobe\Acrobat\DC|*.lst;UserCache.bin FileKey2=%LocalAppData%\Adobe\Acrobat\DC\Cache|*.lst FileKey3=%LocalAppData%\Adobe\Acrobat\DC\ToolsSearchCacheAcro|*.*|RECURSE FileKey4=%LocalLowAppData%\Adobe\Acrobat\DC\Search|*.*|RECURSE FileKey5=%LocalLowAppData%\Adobe\AcroCef\DC\Acrobat\Cache|*.*|RECURSE RegKey1=HKCU\Software\Adobe\Adobe Acrobat\DC\AVConversionFromPDF\cSettings RegKey2=HKCU\Software\Adobe\Adobe Acrobat\DC\AVConversionToPDF\cSettings RegKey3=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cDockables RegKey4=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles RegKey5=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFolders RegKey6=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentToolsList RegKey7=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cToolbars RegKey8=HKCU\Software\Adobe\Adobe Acrobat\DC\RememberedViews\cNoCategoryFiles RegKey9=HKCU\Software\Adobe\Adobe Acrobat\DC\ShareIdentity RegKey10=HKCU\Software\Adobe\Adobe Synchronizer\DC

Revised Entry Added FileKey12 [MS Office *] LangSecRef=3021 Detect1=HKCU\Software\Microsoft\Office\12.0\Common Detect2=HKCU\Software\Microsoft\Office\14.0\Common Detect3=HKCU\Software\Microsoft\Office\15.0\Common Detect4=HKCU\Software\Microsoft\Office\16.0\Common Default=False FileKey1=%AppData%\Microsoft\Document Building Blocks|*.*|RECURSE FileKey2=%AppData%\Microsoft\Office|*.tmp|RECURSE FileKey3=%AppData%\Microsoft\OIS|Toolbars.dat FileKey4=%AppData%\Microsoft\UProof|*.bin;*.XML FileKey5=%CommonAppData%\Microsoft\ClickToRun\ProductReleases|*.*|RECURSE FileKey6=%Documents%|~*.ppt;~*.pptx;~*.doc;~*.docx|RECURSE FileKey7=%LocalAppData%\Microsoft Help|*.* FileKey8=%LocalAppData%\Microsoft\Office\*|OneNoteOfflineCache.onecache FileKey9=%LocalAppData%\Microsoft\Office\*\OfficeFileCache|*.*|RECURSE FileKey10=%LocalAppData%\Microsoft\OneNote\*|OneNoteOfflineCache.onecache FileKey11=%LocalAppData%\Microsoft\OneNote\*\OneNoteOfflineCache_Files|*.*|RECURSE FileKey12=%LocalAppData%\Microsoft\OneNote\*\cache|*.*|RECURSE FileKey13=%SystemDrive%|propfix.log RegKey1=HKCU\Software\Microsoft\Office\11.0\MSE|LastLoadedSolution RegKey2=HKCU\Software\Microsoft\Office\11.0\MSE\FileMRUList RegKey3=HKCU\Software\Microsoft\Office\11.0\MSE\ProjectMRUList RegKey4=HKCU\Software\Microsoft\Office\11.0\MSE\SolutionMRUList RegKey5=HKCU\Software\Microsoft\Office\12.0\Common\Internet|UseRWHlinkNavigation RegKey6=HKCU\Software\Microsoft\Office\12.0\Word\Reading Locations RegKey7=HKCU\Software\Microsoft\Office\14.0\Common\Internet|UseRWHlinkNavigation RegKey8=HKCU\Software\Microsoft\Office\14.0\Word\Reading Locations RegKey9=HKCU\Software\Microsoft\Office\15.0\Common\Internet|UseRWHlinkNavigation RegKey10=HKCU\Software\Microsoft\Office\15.0\Word\Reading Locations RegKey11=HKCU\Software\Microsoft\Office\16.0\Common\Internet|UseRWHlinkNavigation RegKey12=HKCU\Software\Microsoft\Office\16.0\Word\Reading Locations RegKey13=HKCU\Software\Microsoft\Office\Common|FontBmpCache RegKey14=HKCU\Software\Microsoft\OfficeCustomizeWizard\12.0\RecentFileList RegKey15=HKCU\Software\Microsoft\OfficeCustomizeWizard\14.0\RecentFileList RegKey16=HKCU\Software\Microsoft\OfficeCustomizeWizard\15.0\RecentFileList RegKey17=HKCU\Software\Microsoft\OfficeCustomizeWizard\16.0\RecentFileList

I have been watching that path in the registry. Portable apps leave traces there, but no settings. In the screenshot above, I used a portable app, Windows ISO Downloader, and I deleted it from the drive. I tried some other portable apps and they also left traces at the same path, even though the program was removed from the drive. The link posted above with the screenshot has good information about these traces.

Revised Entry Added FileKey7 [Xbox *] DetectOS=10.0| LangSecRef=3031 Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.XboxApp_8wekyb3d8bbwe Default=False FileKey1=%LocalAppData%\Packages\Microsoft.XboxApp_*\AC\INet*|*.*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.XboxApp_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.XboxApp_*\AC\Temp|*.*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.XboxApp_*\LocalCache|*.*|RECURSE FileKey5=%LocalAppData%\Packages\Microsoft.XboxApp_*\LocalState|*.log*|RECURSE FileKey6=%LocalAppData%\Packages\Microsoft.XboxApp_*\LocalState\*Cache|*.*|RECURSE FileKey7=%LocalAppData%\Packages\Microsoft.XboxApp_*\LocalState\DiagOutputDir|*.txt FileKey8=%LocalAppData%\Packages\Microsoft.XboxApp_*\LocalState\SmartGlass|*.log FileKey9=%LocalAppData%\Packages\Microsoft.XboxApp_*\TempState|*.*|RECURSE ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.XboxApp_*\AC\INetCache\|container.dat

Revised Entry Added FileKey5 [Feedback Hub *] DetectOS=10.0| LangSecRef=3031 Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe Default=False FileKey1=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\AC\INet*|*.*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\AC\Temp|*.*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\LocalCache|*.*|RECURSE FileKey5=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\LocalState\DiagOutputDir|*.txt FileKey6=%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\TempState|*.*|RECURSE ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.WindowsFeedbackHub_*\AC\INetCache\|container.dat

New Entries [OneConnect *] DetectOS=10.0 LangSecRef=3031 Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.OneConnect_8wekyb3d8bbwe Default=False FileKey1=%LocalAppData%\Packages\Microsoft.OneConnect_*\AC\INet*|*.*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.OneConnect_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.OneConnect_*\AC\Temp|*.*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.OneConnect_*\LocalCache\Cache|*.*|RECURSE FileKey5=%LocalAppData%\Packages\Microsoft.OneConnect_*\LocalState\Cache|*.*|RECURSE FileKey6=%LocalAppData%\Packages\Microsoft.OneConnect_*\LocalState\DiagOutputDir|*.txt FileKey7=%LocalAppData%\Packages\Microsoft.OneConnect_*\TempState|*.*|RECURSE [XboxGameOverlay *] DetectOS=10.0 LangSecRef=3031 Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.XboxGameOverlay_8wekyb3d8bbwe Default=False FileKey1=%LocalAppData%\Packages\Microsoft.XboxGameOverlay_*\AC\INet*|*.*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.XboxGameOverlay_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.XboxGameOverlay_*\AC\Temp|*.*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.XboxGameOverlay_*\LocalCache\Cache|*.*|RECURSE FileKey5=%LocalAppData%\Packages\Microsoft.XboxGameOverlay_*\LocalState\Cache|*.*|RECURSE FileKey6=%LocalAppData%\Packages\Microsoft.XboxGameOverlay_*\LocalState\DiagOutputDir|*.txt FileKey7=%LocalAppData%\Packages\Microsoft.XboxGameOverlay_*\TempState|*.*|RECURSE

Revised Entry Added FileKey10, FileKey11 & FileKey12 Removed FileKey9 [Movies & TV *] LangSecRef=3031 Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneVideo_8wekyb3d8bbwe DetectFile=%LocalAppData%\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe* Default=False FileKey1=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\AppCache|*.*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\INet*|*.*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE FileKey5=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE FileKey6=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\PRICache|*.*|RECURSE FileKey7=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\Temp|*.*|RECURSE FileKey8=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalCache\PlayReady\Cache|*.*|RECURSE FileKey9=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\Database\anonymous|*.log FileKey10=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\ImageCache|*.*|RECURSE FileKey11=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\ImageRetrievalFailure|*.*|RECURSE FileKey12=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\ImageStore|*.*|RECURSE FileKey13=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\navigationHistory|*.*|RECURSE FileKey14=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\PlayReady|*.*|RECURSE FileKey15=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\TempState|*.*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneVideo_8wekyb3d8bbwe\SearchHistory\SearchHistory ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\INetCache\|container.dat

Revised Entry Added FileKey10, FileKey11 & FileKey12 Removed FileKey9 [Groove Music *] LangSecRef=3031 Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneMusic_8wekyb3d8bbwe DetectFile=%LocalAppData%\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe Default=False FileKey1=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\AppCache|*.*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\INet*|*.*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE FileKey5=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE FileKey6=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\PRICache|*.*|RECURSE FileKey7=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\Temp|*.*|RECURSE FileKey8=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalCache\PlayReady\Cache|*.*|RECURSE FileKey9=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\Database\*|*.log FileKey10=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\ImageCache|*.*|RECURSE FileKey11=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\ImageRetrievalFailure|*.*|RECURSE FileKey12=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\ImageStore|*.*|RECURSE FileKey13=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\navigationHistory|*.*|RECURSE FileKey14=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\PlayReady|*.*|RECURSE FileKey15=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\TempState|*.*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneMusic_8wekyb3d8bbwe\SearchHistory ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\INetCache\|container.dat