SMalik

I agree with you, obsolete program entries should be removed.

On 64-bit systems, CCleaner checks both locations.

Check under HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node, if you have a 64-bit system.

You're right, it looks very unprofessional. Also, we should find a replacement for "More".

Please change [NetworkService Temps*] to [NetworkService Temp Files*] [LocalService Temporary Files*] to [LocalService Temp Files*] [LocalSystem Temp Internet Files*] t [LocalSystem Temporary Internet Files*]

Revised Entry Removed RegKey8=HKU\S-1-5-18\Software\Microsoft\Windows\Windows Error Reporting\Debug|StoreLocation. FileKey7 cleans this location also. [Windows Error Reporting More*] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows\Windows Error Reporting Default=False FileKey1=%WinDir%\System32\config\systemprofile\AppData\Local\CrashDumps|*.dmp FileKey2=%WinDir%\System32\config\systemprofile\Local Settings\Application Data\CrashDumps|*.dmp FileKey3=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\CrashDumps|*.dmp FileKey4=%WinDir%\SysWOW64\config\systemprofile\Local Settings\Application Data\CrashDumps|*.dmp RegKey1=HKCU\Software\Microsoft\Windows\Windows Error Reporting\Debug|StoreLocation RegKey2=HKLM\Software\Microsoft\Windows\Windows Error Reporting\Debug|StoreLocation RegKey3=HKLM\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps RegKey4=HKLM\Software\Microsoft\Windows\Windows Error Reporting\FullLiveKernelReports|LastFullLiveReport RegKey5=HKLM\Software\Microsoft\Windows\Windows Error Reporting\FullLiveKernelReports\win32k.sys RegKey6=HKLM\Software\Microsoft\Windows\Windows Error Reporting\LiveKernelReports\win32k.sys RegKey7=HKU\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting\Debug|StoreLocation

I tried adding the exclude rules, but they are not working. ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\AC\INetCache|container.dat ExcludeKey2=FILE|%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\AC\INetHistory\BackgroundTransferApi|container.dat [Content Delivery Manager*] DetectOS=10.0| Section=3031 Default=False Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy FileKey1=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\AC\INetCache|*.*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\AC\INetCookies|*.*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\AC\INetHistory|*.*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\AC\Microsoft\CryptnetUrlCache\Content|*.*|RECURSE FileKey5=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\AC\Microsoft\CryptnetUrlCache\MetaData|*.*|RECURSE FileKey6=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\AC\Temp|*.*|RECURSE FileKey7=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\AC\TokenBroker\Cache|*.*|RECURSE FileKey8=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\LocalCache|*.*|RECURSE FileKey9=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\LocalState\Cache|*.*|RECURSE FileKey10=%LocalAppData%\Packages\Microsoft.Windows.ContentDeliveryManager_*\TempState|*.*|RECURSE

Revised Entry Fixed FileKey1 [WDI Logs*] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows Default=False FileKey1=%WinDir%\System32\WDI\*|snapshot.etl|REMOVESELF FileKey2=%WinDir%\System32\WDI\LogFiles\StartupInfo|*.*|RECURSE

Please change the names of [LocalService Temporary Files*] and [LocalSystem Temporary Files*] to [LocalService Temp Files*] and [LocalSystem Temp Files*], as you suggested.

Proper names for these entries are [LocalSystem Cookies*], [LocalSystem History*], [LocalSystem Temp Files*] and [LocalSystem Temporary Internet Files*].

I think we should change Detect to DetectFile=CommonAppData%\Microsoft\Windows\RetailDemo and DetectOS=10.0| can be removed. [Windows Retail Demo*] DetectOS=10.0| Section=3025 Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft Default=False FileKey1=%CommonAppData%\Microsoft\Windows\RetailDemo|*.*|REMOVESELF

Do we really need the entries listed below. I cannot find those locations on Window 7, 8, 8.1 and 10. I checked a few other known privacy eraser programs and they don't have cleaning rules for the locations listed below. [LocalService Cookies*] LangSecRef=3022 Detect=HKCU\Software\Microsoft\Windows Default=False FileKey1=%SystemDrive%\Documents and Settings\LocalService\Cookies|*.*|RECURSE FileKey2=%SystemDrive%\Documents and Settings\LocalService.NT*\Cookies|*.*|RECURSE FileKey3=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies|*.*|REMOVESELF FileKey4=%WinDir%\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies|*.*|REMOVESELF [LocalService History*] LangSecRef=3022 Detect=HKCU\Software\Microsoft\Windows Default=False FileKey1=%SystemDrive%\Documents and Settings\LocalService\Local Settings\History|*.*|RECURSE FileKey2=%SystemDrive%\Documents and Settings\LocalService.NT*\Local Settings\History|*.*|RECURSE FileKey3=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History|*.*|RECURSE [LocalService Temporary Internet Files*] LangSecRef=3022 Detect=HKCU\Software\Microsoft\Windows Default=False FileKey1=%SystemDrive%\Documents and Settings\LocalService\Local Settings\Temporary Internet Files|*.*|RECURSE FileKey2=%SystemDrive%\Documents and Settings\LocalService.NT*\Local Settings\Temporary Internet Files|*.*|RECURSE FileKey3=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files|*.*|RECURSE [NetworkService Cookies*] LangSecRef=3022 Detect=HKCU\Software\Microsoft\Windows Default=False FileKey1=%SystemDrive%\Documents and Settings\NetworkService\Cookies|*.*|RECURSE FileKey2=%SystemDrive%\Documents and Settings\NetworkService.NT*\Cookies|*.*|RECURSE FileKey3=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Temp\Cookies|*.*|RECURSE FileKey4=%WinDir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies|*.*|RECURSE [NetworkService History*] LangSecRef=3022 Detect=HKCU\Software\Microsoft\Windows Default=False FileKey1=%SystemDrive%\Documents and Settings\NetworkService\Local Settings\History|*.*|RECURSE FileKey2=%SystemDrive%\Documents and Settings\NetworkService.NT*\Local Settings\History|*.*|RECURSE FileKey3=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History|*.*|RECURSE [NetworkService Temporary Internet Files*] LangSecRef=3022 Detect=HKCU\Software\Microsoft\Windows Default=False FileKey1=%SystemDrive%\Documents and Settings\NetworkService\Local Settings\Content.IE5|*.*|RECURSE FileKey2=%SystemDrive%\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files|*.*|RECURSE FileKey3=%SystemDrive%\Documents and Settings\NetworkService.NT*\Local Settings\Content.IE5|*.*|RECURSE FileKey4=%SystemDrive%\Documents and Settings\NetworkService.NT*\Local Settings\Temporary Internet Files|*.*|RECURSE FileKey5=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files|*.*|RECURSE FileKey6=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Content.IE5|*.*|RECURSE [systemprofile Cookies*] LangSecRef=3022 Detect=HKCU\Software\Microsoft\Windows Default=False FileKey1=%WinDir%\System32\config\SystemProfile\Cookies|*.*|RECURSE FileKey2=%WinDir%\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies|*.*|RECURSE FileKey3=%WinDir%\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies|*.*|RECURSE [systemprofile History*] LangSecRef=3022 Detect=HKCU\Software\Microsoft\Windows Default=False FileKey1=%WinDir%\System32\config\SystemProfile\History|*.*|RECURSE FileKey2=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History|*.*|RECURSE FileKey3=%WinDir%\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\History|*.*|RECURSE [systemprofile Temporary Internet Files*] LangSecRef=3022 Detect=HKCU\Software\Microsoft\Windows Default=False FileKey1=%WinDir%\System32\config\SystemProfile\Local Settings\Temporary Internet Files|*.*|RECURSE FileKey2=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files|*.*|RECURSE FileKey3=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files|*.*|RECURSE

Revised Entry Changed name from [NetworkService Temps*] to [NetworkService Temporary Files*] same like [LocalService Temporary Files*] and [systemprofile Temporary Files*]. [NetworkService Temporary Files*] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows Default=False FileKey1=%SystemDrive%\Documents and Settings\NetworkService\Local Settings\Temp|*.*|RECURSE FileKey2=%SystemDrive%\Documents and Settings\NetworkService.NT*\Local Settings\Temp|*.*|RECURSE FileKey3=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Temp|*.*|RECURSE

Can we change the Detect to the proper path and move this entry to the Windows section instead of the Windows Store?

What is this entry about and why is it in the Windows Store Apps section? I think it should be removed. [Windows Retail Demo*] DetectOS=10.0| Section=3031 Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft Default=False FileKey1=%CommonAppData%\Microsoft\Windows\RetailDemo|*.*|REMOVESELF

Revised Entry Removed: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager|PendingFileRenameOperations [session Manager*] LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows Default=False FileKey1=%WinDir%\AppCompat\Programs|*.txt;*.xml FileKey2=%WinDir%\AppCompat\Programs\Install|*.txt;*.xml RegKey1=HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache|AppCompatCache RegKey2=HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache|CacheMainSdb RegKey3=HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache|SdbTime

Revised Entry Changed |REMOVESELF with |RECURSE [NetworkService Cookies*] LangSecRef=3022 Detect=HKCU\Software\Microsoft\Windows Default=False FileKey1=%SystemDrive%\Documents and Settings\NetworkService\Cookies|*.*|RECURSE FileKey2=%SystemDrive%\Documents and Settings\NetworkService.NT*\Cookies|*.*|RECURSE FileKey3=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Temp\Cookies|*.*|RECURSE FileKey4=%WinDir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies|*.*|RECURSE

Distributed [Windows System Profile*] into separate entries. So please add these and remove [Windows System Profile*]. [systemprofile Cookies*] LangSecRef=3022 Detect=HKCU\Software\Microsoft\Windows Default=False FileKey1=%WinDir%\System32\config\SystemProfile\Cookies|*.*|RECURSE FileKey2=%WinDir%\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies|*.*|RECURSE FileKey3=%WinDir%\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies|*.*|RECURSE [systemprofile History*] LangSecRef=3022 Detect=HKCU\Software\Microsoft\Windows Default=False FileKey1=%WinDir%\System32\config\SystemProfile\History|*.*|RECURSE FileKey2=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History|*.*|RECURSE FileKey3=%WinDir%\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\History|*.*|RECURSE [systemprofile Temporary Files*] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows Default=False FileKey1=%WinDir%\System32\config\SystemProfile\Local Settings\Temp|*.*|RECURSE FileKey2=%WinDir%\System32\config\systemprofile\AppData\Local\Temp|*.*|RECURSE FileKey3=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Temp|*.*|RECURSE [systemprofile Temporary Internet Files*] LangSecRef=3022 Detect=HKCU\Software\Microsoft\Windows Default=False FileKey1=%WinDir%\System32\config\SystemProfile\Local Settings\Temporary Internet Files|*.*|RECURSE FileKey2=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files|*.*|RECURSE FileKey3=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files|*.*|RECURSE

I agree with you. RegKey1 should be excluded.

This could contain information about programs that were once on the system and now are not. There are two other known privacy eraser programs that have included this into their programs. My suggestion is, open some portable apps then remove it from the system completely, and purge from the Recycle bin. Then, uninstall a few programs from the system and then view the "AppCompatCache" value and you will see for yourself.

Revised Entry Changed name from [Windows Backup*] to [Windows Backup Logs*] and corrected the Detect. [Windows Backup Logs*] LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows Default=False FileKey1=%WinDir%\Logs\WindowsBackup|*.etl

I agree. I think "Windows" can be removed from [Windows Error Reporting More*], [Windows Installer Temps*], [Windows Memory Leak Detection*], [Windows System Profile*] and [Windows Tracing*].

I agree, but there are some entries that have "Windows" in it. There is no CCleaner default rule for this. They have an entry with the name "Memory Dump". EDIT You're right, there is a built-in rule for this. I'm sorry. I think we should keep the same name.

Revised Entry Added RegKey4, RegKey5 and RegKey6. [Windows Error Reporting More*] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows\Windows Error Reporting Default=False FileKey1=%WinDir%\System32\config\systemprofile\AppData\Local\CrashDumps|*.dmp FileKey2=%WinDir%\System32\config\systemprofile\Local Settings\Application Data\CrashDumps|*.dmp FileKey3=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\CrashDumps|*.dmp FileKey4=%WinDir%\SysWOW64\config\systemprofile\Local Settings\Application Data\CrashDumps|*.dmp RegKey1=HKCU\Software\Microsoft\Windows\Windows Error Reporting\Debug|StoreLocation RegKey2=HKLM\Software\Microsoft\Windows\Windows Error Reporting\Debug|StoreLocation RegKey3=HKLM\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps RegKey4=HKLM\Software\Microsoft\Windows\Windows Error Reporting\FullLiveKernelReports|LastFullLiveReport RegKey5=HKLM\Software\Microsoft\Windows\Windows Error Reporting\FullLiveKernelReports\win32k.sys RegKey6=HKLM\Software\Microsoft\Windows\Windows Error Reporting\LiveKernelReports\win32k.sys RegKey7=HKU\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting\Debug|StoreLocation RegKey8=HKU\S-1-5-18\Software\Microsoft\Windows\Windows Error Reporting\Debug|StoreLocation

For some reason, Adobe Acrobat DC creates some registry data for the previous Acrobat programs like it is showing in the attached snapshot. Then, CCleaner shows Acrobat programs that are not even installed on the system. So I think we should change the Detects to fix this issue. Changed Detect from HKLM\Software\Adobe\Adobe Acrobat\DC to HKCU\Software\Adobe\Adobe Acrobat\DC [Adobe Acrobat DC*] LangSecRef=3021 Detect=HKCU\Software\Adobe\Adobe Acrobat\DC Default=False FileKey1=%LocalAppData%\Adobe\Acrobat\DC\Cache|*.lst FileKey2=%LocalAppData%\Adobe\Acrobat\DC\ToolsSearchCacheAcro|*.*|RECURSE FileKey3=%LocalAppData%\Adobe\Acrobat\DC|*.lst FileKey4=%LocalAppData%\Adobe\Acrobat\DC|UserCache.bin FileKey5=%LocalLowAppData%\Adobe\Acrobat\DC\Search|*.* RegKey1=HKCU\Software\Adobe\Adobe Acrobat\DC\AVConversionFromPDF\cSettings RegKey2=HKCU\Software\Adobe\Adobe Acrobat\DC\AVConversionToPDF\cSettings RegKey3=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cDockables RegKey4=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles RegKey5=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFolders RegKey6=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentToolsList RegKey7=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cToolbars RegKey8=HKCU\Software\Adobe\Adobe Acrobat\DC\RememberedViews\cNoCategoryFiles RegKey9=HKCU\Software\Adobe\Adobe Acrobat\DC\ShareIdentity RegKey10=HKCU\Software\Adobe\Adobe Synchronizer\DC Changed Detect from HKLM\Software\Adobe\Acrobat Reader\DC to HKCU\Software\Adobe\Acrobat Reader\DC [Adobe Reader DC More*] LangSecRef=3021 Detect=HKCU\Software\Adobe\Acrobat Reader\DC Default=False FileKey1=%LocalAppData%\Adobe\Acrobat\DC|UserCache.bin RegKey1=HKCU\Software\Adobe\Acrobat Reader\DC\AVConversionFromPDF RegKey2=HKCU\Software\Adobe\Acrobat Reader\DC\AVConversionToPDF RegKey3=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral\cDockables RegKey4=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral\cRecentToolsList RegKey5=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral\cToolbars RegKey6=HKCU\Software\Adobe\Acrobat Reader\DC\RememberedViews\cNoCategoryFiles RegKey7=HKCU\Software\Adobe\Acrobat Reader\DC\ShareIdentity RegKey8=HKCU\Software\Adobe\Adobe Synchronizer\DC Changed Detect from HKLM\Software\Adobe\Adobe Acrobat\11.0 to HKCU\Software\Adobe\Adobe Acrobat\11.0 [Adobe Acrobat XI More*] LangSecRef=3021 Detect=HKCU\Software\Adobe\Adobe Acrobat\11.0 Default=False FileKey1=%LocalAppData%\Adobe\Acrobat|*.idx|RECURSE FileKey2=%LocalAppData%\Adobe\Acrobat\11.0|UserCache.bin FileKey3=%LocalAppData%\Adobe\Acrobat\11.0\Cache|*.* Changed Detect from HKLM\Software\Adobe\Acrobat Distiller\11.0 to HKCU\Software\Adobe\Acrobat Distiller\11.0 [Adobe Acrobat Distiller XI*] LangSecRef=3021 Detect=HKCU\Software\Adobe\Acrobat Distiller\11.0 Default=False FileKey1=%AppData%\Adobe\Acrobat\Distiller 11|*.log FileKey2=%AppData%\Adobe\Acrobat\Distiller 11\Cache|*.* RegKey1=HKCU\Software\Adobe\Acrobat Distiller\PrinterJobControl Changed Detect from HKLM\SOFTWARE\Adobe\Acrobat Reader\11.0 to HKCU\Software\Adobe\Acrobat Reader\11.0 [Adobe Reader XI More*] LangSecRef=3021 Detect=HKCU\SOFTWARE\Adobe\Acrobat Reader\11.0 Default=False RegKey1=HKCU\Software\Adobe\Acrobat Reader\11.0\AVConversionFromPDF RegKey2=HKCU\Software\Adobe\Acrobat Reader\11.0\AVConversionToPDF RegKey3=HKCU\Software\Adobe\Acrobat Reader\11.0\AVGeneral\cDockables RegKey4=HKCU\Software\Adobe\Acrobat Reader\11.0\AVGeneral\cToolbars RegKey5=HKCU\Software\Adobe\Acrobat Reader\11.0\RememberedViews\cNoCategoryFiles RegKey6=HKCU\Software\Adobe\Adobe Synchronizer\11.0 The entry listed below should be removed as there is no Distiller in the latest Adobe Acrobat DC. Look like someone just copied it from the previous Distiller entry. [Adobe Acrobat Distiller DC*] LangSecRef=3021 Detect=HKLM\SOFTWARE\Adobe\Acrobat Distiller\DC Default=False FileKey1=%LocalAppData%\Adobe\Acrobat\Distiller DC|*.log FileKey2=%LocalAppData%\Adobe\Acrobat\Distiller DC\Cache|*.* RegKey1=HKCU\Software\Adobe\Acrobat Distiller\PrinterJobControl The entry listed below should be removed as this removes colors from Adobe Acrobat DC Start Menu shortcut and removes valid icons. [Adobe Incompatible Icons*] LangSecRef=3021 Detect=HKCU\Software\Adobe Default=False FileKey1=%CommonProgramFiles%\Adobe|*.icns|RECURSE FileKey2=%ProgramFiles%\Adobe|*.icns|RECURSE The entry listed below belongs to Adobe Photoshop Elements 8 and it shows up on all Adobe Photoshop Elements. There is not another routine entry for Adobe Photoshop Elements 8. So I think this entry should be removed. [Adobe Photoshop Elements Sync Agent*] LangSecRef=3023 Detect=HKCU\Software\Adobe\Photoshop Elements Default=False FileKey1=%AppData%\Adobe\Photoshop Elements Sync Agent\1.0\Logs|*.log