qsdewa

For DivX: %CommonAppData%\DivX\Setup|DivXSetup.log For Skype: %CommonAppData%\Skype|*.tmp For Search Everything (includes names and locations of all files, will just be regenerated on next start): %ProgramFiles%\Everything|Everything.db New: [PhrozenSoft Databases*] LangSecRef=3024 DetectFile=%AppData%\PhrozenSoft Default=False FileKey1=%AppData%\PhrozenSoft|*.db|RECURSE VTUploader creates history file \PVTUploader\phrzvtu.db and Keylogger (not necessarily malware) creates pkl.db which contains all recorded keystrokes and also the password used to open the logger which will be reseted if you delete that file (so I guess that's an issue with that file). So maybe do it like this: FileKey1=%AppData%\PhrozenSoft\PVTUploader|phrzvtu.db Question: Does CCleaner not clean all the stuff cleanmgr deletes? Like the Service-Pack-Backups? Could not find them in the Winapp.ini and Winapp2.

OK, thanks for the help anyways. Edit: Googled and this was the only thing I found: http://www.neowin.net/forum/topic/547013-cleaning-the-virtualstore/?view=findpost&p=588405349 Edit2: Actually found this: http://forum.piriform.com/?showtopic=21915 The download link for the extra program seems to be down. I really hope someone can help with this topic.

So I did this: VJoy is the program which wants to write to C:\Program Files (x86)\VJoy\VJoy.ini and this file is in C:\Users\username\AppData\Local\VirtualStore\Program Files (x86)\VJoy. I guess because I don't run it as admin. So I made the following rule: [VJoy*] LangSecRef=3024 DetectFile=%ProgramFiles%\VJoy Default=False FileKey1=%ProgramFiles%\VJoy|VJoy.ini And CCleaner didn't find anything.

So I can't just copy it. How to test it then? Edit: I know now. I have one of these "badboy" prgrams and I will just write a rule for CCleaner which deletes the programs files.

It seems it does not work. I copied C:\Program Files (x86)\Mozilla Firefox into C:\Users\username\AppData\Local\VirtualStore\Program Files (x86). CCleaner with Winapp2.ini detected the .log files in the original location but not under VirtualStore. I did not test it with registry keys yet, but so far CCleaner does not seem to be able to do its job properly. Maybe someone else tries to do what I did and posts the results.

Well, that sounds good. I will try to test it later. Thanks

Edited DetectFile and added FileKey8: [ComboFix*] LangSecRef=3024 DetectFile=%SystemDrive%\ComboFix.txt Default=False Warning=This will delete ComboFix History. Do not delete until you have reviewed these logs. FileKey1=%SystemDrive%\Qoobox|*.txt FileKey2=%SystemDrive%\Qoobox\Quarantine|*.log FileKey3=%SystemDrive%\CE.tmp|*.*|REMOVESELF FileKey4=%SystemDrive%\D6.tmp|*.*|REMOVESELF FileKey5=%SystemDrive%\Qoobox\LastRun|*.*|REMOVESELF FileKey6=%SystemDrive%\Qoobox\Test|*.*|REMOVESELF FileKey7=%SystemDrive%\Qoobox\TestC|*.*|REMOVESELF FileKey8=%SystemDrive%|ComboFix.txt Combofix didn't create "ComboFix" for me. Instead it created ComboFix.txt, which is a log file. So an (better) alternative would be: DetectFile=%SystemDrive%\Qoobox Missed Iron and FileKey4 and 7? http://forum.piriform.com/index.php?showtopic=32310&view=findpost&p=247312The Steam entries work wonders so far. One more: %ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\tf\download|*.*|RECURSE Quote from readme.txt in that folder: "It is generally safe to delete this directory at any time." I have over 1GB in that folder. Maybe Warning=This will delete all downloaded custom server files.One more: %ProgramFiles%\Steam|*.cache|RECURSE

http://www.softpedia.com/get/Internet/Popup-Ad-Spyware-Blockers/SpyDefense.shtml http://www.softpedia.com/get/Internet/Popup-Ad-Spyware-Blockers/Spyware-Doctor-Starter-Edition.shtml http://www.softpedia.com/get/Antivirus/Windows-Live-OneCare.shtml No, no and no. At least offer a second file with all the entries. You can also use Trim.bat like already mentioned by siliconman01. Many people use software even after it has been discontinued, like you can see it now happen with Windows XP. It's really not the best idea, especially with antivirus programs, but some of them can still remove older malware. Some people may also have uninstalled the discontinued software and then CCleaner can remove the files they have left behind.

No one?

Under Windows Vista the UAC was introduced and to prevent older programs, not running as admin, which want to access their folder under Program Files, to crash because of missing privileges, Microsoft introduced the VirtualStore. This folder can be found on the file system and in the registry. More info: https://en.wikipedia.org/wiki/User_Account_Control#Features My question: Does CCleaner scan this folder too when searching e.g. in Program Files (x86)? For example: C:\Program Files (x86)\Internet Explorer\debug.log Would this file be deleted if it was located in C:\Users\username\AppData\Local\VirtualStore\Program Files (x86)\Internet Explorer\debug.log ?

It just seems odd to me that there are wildcards for the file system but not for the registry. Yes, maybe it's just me. For comparison: UAC off, Windows 7 Home Premium 64-bit SP1, logged in as admin and CCleaner (latest version) running as admin, Java (latest version) installer ran with admin rights and no installation options were changed.

[Marionette Log*] is a duplicate of [Firefox Logs*] I guess. Hope it is not off-topic: 1. Why are wildcards for registry keys not supported? 2. [Java More*] FileKey5 and 6 could not be cleaned on my PC. I tried to access them via the Explorer and I had to gain ownership of the folders first needing administrative rights to open them. Is there any way to fix that problem? Or why can't CCleaner do it?

Added FileKey2: [Firefox Logs*] LangSecRef=3026 SpecialDetect=DET_MOZILLA Default=False FileKey1=%ProgramFiles%\Mozilla Firefox|*.log FileKey2=%AppData%\Mozilla|*.log|RECURSE Finds marionette.log and submit.log which seem to be log files from Firefox.

I guess it's just for a better overall view. @SMalik +1 For the cached certificates. If that works it would be great. I have like 10.000 files in these folders.

When to use Recurse and when to use Removeself? I don't quite understand https://www.piriform.com/docs/ccleaner/advanced-usage/ccleaner-ini-files/how-to-add-your-own-program-for-ccleaner-to-clean (Sorry for dumb questions). Addition for TF2 entry ( http://forum.piriform.com/index.php?showtopic=32310&page=202&do=findComment&comment=247478 ): [TF2 Cache and Cookies*] Section=Games Detect=HKCU\Software\Valve\Steam Default=False FileKey1=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\config\cookies|*.*|RECURSE FileKey2=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\config\html\AppCache|*.*|RECURSE FileKey3=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\tf\cache|*.*|RECURSE FileKey4=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\tf\materials\temp|*.vtf|RECURSE More Info: http://redd.it/1yrds8 New [Steam Old Files*] Section=Games Detect=HKCU\Software\Valve\Steam Default=False FileKey1=%ProgramFiles%\Steam|*.old

What happened to this project? http://forum.piriform.com/index.php?showtopic=24837 Seems to be pretty useful but the download link is not working anymore. For example: I found all this crap on my PC where such a tool would be very helpful. %LocalAppData%\Microsoft\Windows\UsrClass.dat.LOG1 %LocalAppData%\Microsoft\Windows\UsrClass.dat.LOG2 %LocalAppData%\Opera\Opera\upgrade.log %LocalAppData%\Overwolf\Log\InstallerTrace.log %LocalAppData%\Overwolf\Log\MSI_2013_9_14_18_55.log.gz %LocalAppData%\Overwolf\Log\Trace.log %LocalAppData%\Packard Bell\InfoCtr\*.log %LocalAppData%\Packard Bell\iUpdator\*.log %LocalAppData%\Thunderbird\Mozilla Thunderbird\updates\backup-update.log %LocalAppData%\Thunderbird\Mozilla Thunderbird\updates\last-update.log %AppData%\I2P\wrapper.log %AppData%\LockHunter\LockHunter.log.txt %AppData%\Mozilla\B2G\Profiles\*\marionette.log %AppData%\Mozilla\Firefox\Profiles\*\PreferencesCleaner\pcln.log %AppData%\Mozilla\Firefox\Profiles\*\marionette.log %AppData%\Mozilla\Firefox\Profiles\*\startup.log %AppData%\Padman\wop\games.log Question: What about %LocalAppData%\VirtualStore ? Does CCleaner scan this folder? It contains files from program folders that the program could not access because of missing administrative rights.Very advanced entry (not happy with that): New [VirtualStore*] LangSecRef=3025 Detect/DetectFile= ?Help Default=False Warning=This will remove some files from older programs. FileKey1=%LocalAppData%\VirtualStore|*.*|RECURSE Missed?New [SRWare Iron debug.log*] LangSecRef=3029 DetectFile1=%LocalAppData%\Torch Correct? Default=False FileKey1=%ProgramFiles%\SRWare Iron|debug.log Edited [Steam Logs*] Section=Games Detect=HKCU\Software\Valve\Steam Default=False FileKey1=%ProgramFiles%\Steam|*.log;*.last|RECURSE Steam may start very slowly after cleaning this but I never had any problems (edit of http://forum.piriform.com/index.php?showtopic=32310&page=201&do=findComment&comment=247312 ): New [Steam Cache and Cookies*] Section=Games Detect=HKCU\Software\Valve\Steam Default=False FileKey1=%ProgramFiles%\Steam\config\cookies|*.*|RECURSE FileKey2=%ProgramFiles%\Steam\config\overlaycookies|*.*|RECURSE FileKey3=%ProgramFiles%\Steam\appcache|*.*|RECURSE FileKey4=%ProgramFiles%\Steam\steam\cached|*.*|RECURSE FileKey5=%ProgramFiles%\Steam\depotcache|*.*|RECURSE FileKey6=%ProgramFiles%\Steam\config\overlayhtmlcache|*.*|RECURSE [TF2 Cache and Cookies*] Section=Games Detect=HKCU\Software\Valve\Steam Default=False FileKey1=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\config\cookies|*.*|RECURSE FileKey2=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\config\html\AppCache|*.*|RECURSE FileKey3=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\tf\cache|*.*|RECURSE

New [SRWare Iron debug.log*] LangSecRef=3029 DetectFile1=%LocalAppData%\Torch #Correct? Default=False FileKey1=%ProgramFiles%\SRWare Iron|debug.log The Steam folder is always full of crap. I delete pretty much any folder that has "cookie" or "cache" in its name and never had problems with it. But can and should such a wildcard be made?Otherwise: New [Steam Cache and Cookies*] Section=Games Detect=HKCU\Software\Valve\Steam Default=False FileKey1=%ProgramFiles%\Steam\config\cookies|*.*|REMOVESELF FileKey2=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\config\cookies|*.*|REMOVESELF FileKey3=%ProgramFiles%\Steam\config\overlaycookies|*.*|REMOVESELF FileKey4=%ProgramFiles%\Steam\appcache|*.*|REMOVESELF FileKey5=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\config\html\AppCache|*.*|REMOVESELF FileKey6=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\tf\cache|*.*|REMOVESELF FileKey7=%ProgramFiles%\Steam\steam\cached|*.*|REMOVESELF FileKey8=%ProgramFiles%\Steam\depotcache|*.*|REMOVESELF FileKey9=%ProgramFiles%\Steam\config\htmlcache|*.*|REMOVESELF FileKey10=%ProgramFiles%\Steam\config\overlayhtmlcache|*.*|REMOVESELF

[Pale Moon - Adblock Lite Backups*] LangSecRef=3026 Detect=HKLM\Software\Mozilla\Pale Moon DetectFile=%ProgramFiles%\Pale Moon\palemoon.exe Default=False FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\adblocklite|patterns-backup*.ini [Pale Moon - Adblock Plus Backups*] LangSecRef=3026 Detect=HKLM\Software\Mozilla\Pale Moon DetectFile=%ProgramFiles%\Pale Moon\palemoon.exe Default=False FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\adblockplus|patterns-backup*.ini Merge to get: [Pale Moon - Adblock Backups*] LangSecRef=3026 Detect=HKLM\Software\Mozilla\Pale Moon DetectFile=%ProgramFiles%\Pale Moon\palemoon.exe Default=False FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\adblock*|patterns-backup*.ini Also found these two programs: I may write rules for the files they clean later if I have enough time. I will also accept anyone volunteering.

New [Adobe Photoshop Elements Sync Agent*] LangSecRef=3021 Detect=HKCU\Software\Adobe\Photoshop Elements Default=False FileKey1=%AppData%\Adobe\Photoshop Elements Sync Agent\1.0\Logs|*.log New (could not find another detect) [Appupdater Log*] LangSecRef=3024 DetectFile=%AppData%\Appupdater Default=False FileKey1=%AppData%\Appupdater|appupdaterw.log Alternative (don't know which to prefer): FileKey1=%AppData%\Appupdater|*.log New [Chatzilla*] LangSecRef=3026 SpecialDetect=DET_MOZILLA Default=False FileKey1=%AppData%\Mozilla\Firefox\Profiles\*\chatzilla|inputHistory.txt Modified [AdwCleaner 3 Backup*] Warning=You will not be able to undo your changes after running this. [AdwCleaner 3 Quarantine*] Warning=You will not be able to undo your changes after running this. [Peerblock*] FileKey1=%ProgramFiles%\Peerblock|*.log;History.db;*.bak;cache.p2b CCleaner deleted all settings of my Google Chrome extensions. I guess it was just because of my weird hotlinking on my PC but maybe someone who also had this knows why.

Yeah, maybe just forget about the two entries. But please add the ShareX ones.

That could be a problem. It might be that the Installer uses this information but I'm unable to test it right now.

Some new stuff: [shareX Backup*] LangSecRef=3021 DetectFile=%Documents%\ShareX Default=False FileKey1=%Documents%\ShareX\Backup|*.*|RECURSE FileKey2=%Documents%\ShareX|*.bak [shareX Screenshots*] LangSecRef=3021 DetectFile=%Documents%\ShareX Default=False Warning=This will delete all Screenshots captured by ShareX. FileKey1=%Documents%\ShareX\Screenshots|*.*|RECURSE

Missed? http://forum.piriform.com/index.php?showtopic=32310&st=2320#entry223493

[Captcha Brotherhood*] LangSecRef=3024 DetectFile=%LocalAppData%\Captcha_Brotherhood Default=False FileKey1=%LocalAppData%\Captcha_Brotherhood|solver_logFile.txt FileKey2=%LocalAppData%\Captcha_Brotherhood|plugin_logFile.txt FileKey3=%LocalAppData%\Captcha_Brotherhood|solver_captchaLog.txt New FileKey2 and FileKey3

[AdwCleaner*] LangSecRef=3024 DetectFile=%HomeDrive%\AdwCleaner[R1].txt Default=False FileKey1=%HomeDrive%|AdwCleaner[R*].txt AdwCleaner does not leave any other files.