qsdewa
-
Posts
76 -
Joined
Posts posted by qsdewa
-
-
OK, thanks for the help anyways.As I'm doing my taxes, I'm on my pc. I took a break and yes this does not function as I was hoping, perhaps there is a way for it to work but I know not
Edit: Googled and this was the only thing I found: http://www.neowin.net/forum/topic/547013-cleaning-the-virtualstore/?view=findpost&p=588405349
Edit2: Actually found this: http://forum.piriform.com/?showtopic=21915
The download link for the extra program seems to be down.
I really hope someone can help with this topic.
-
So I did this: VJoy is the program which wants to write to C:\Program Files (x86)\VJoy\VJoy.ini and this file is in C:\Users\username\AppData\Local\VirtualStore\Program Files (x86)\VJoy. I guess because I don't run it as admin. So I made the following rule:Install a program that uses it and that ccleaner cleans. It sounds like you're working on theory instead of with a practical example, find one then we'll know
[VJoy*] LangSecRef=3024 DetectFile=%ProgramFiles%\VJoy Default=False FileKey1=%ProgramFiles%\VJoy|VJoy.ini
And CCleaner didn't find anything. -
So I can't just copy it. How to test it then?Can't copy must be placed there by the os for the link to be made, that folder is for "badboy" programs that don't follow Microsoft's no user changeable in program folder without uac elevation
Edit: I know now. I have one of these "badboy" prgrams and I will just write a rule for CCleaner which deletes the programs files.
-
It seems it does not work. I copied C:\Program Files (x86)\Mozilla Firefox into C:\Users\username\AppData\Local\VirtualStore\Program Files (x86).
CCleaner with Winapp2.ini detected the .log files in the original location but not under VirtualStore.
I did not test it with registry keys yet, but so far CCleaner does not seem to be able to do its job properly.
Maybe someone else tries to do what I did and posts the results.
-
Well, that sounds good. I will try to test it later. Thanks
-
Edited DetectFile and added FileKey8:
[ComboFix*] LangSecRef=3024 DetectFile=%SystemDrive%\ComboFix.txt Default=False Warning=This will delete ComboFix History. Do not delete until you have reviewed these logs. FileKey1=%SystemDrive%\Qoobox|*.txt FileKey2=%SystemDrive%\Qoobox\Quarantine|*.log FileKey3=%SystemDrive%\CE.tmp|*.*|REMOVESELF FileKey4=%SystemDrive%\D6.tmp|*.*|REMOVESELF FileKey5=%SystemDrive%\Qoobox\LastRun|*.*|REMOVESELF FileKey6=%SystemDrive%\Qoobox\Test|*.*|REMOVESELF FileKey7=%SystemDrive%\Qoobox\TestC|*.*|REMOVESELF FileKey8=%SystemDrive%|ComboFix.txt
Combofix didn't create "ComboFix" for me. Instead it created ComboFix.txt, which is a log file. So an (better) alternative would be:DetectFile=%SystemDrive%\Qoobox
Missed Iron and FileKey4 and 7? http://forum.piriform.com/index.php?showtopic=32310&view=findpost&p=247312The Steam entries work wonders so far. One more:
%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\tf\download|*.*|RECURSE
Quote from readme.txt in that folder: "It is generally safe to delete this directory at any time." I have over 1GB in that folder. Maybe Warning=This will delete all downloaded custom server files.One more:
%ProgramFiles%\Steam|*.cache|RECURSE
-
http://www.softpedia.com/get/Internet/Popup-Ad-Spyware-Blockers/SpyDefense.shtmlSpydefense, Spyware Doctor, and Windows live OneCare don't even have download links anymore. Thus no one can use them, even if they wanted to. The others I just threw in more as a notice. Was just another suggesstion to shrink Winapp2.
http://www.softpedia.com/get/Internet/Popup-Ad-Spyware-Blockers/Spyware-Doctor-Starter-Edition.shtml
http://www.softpedia.com/get/Antivirus/Windows-Live-OneCare.shtml
No, no and no. At least offer a second file with all the entries. You can also use Trim.bat like already mentioned by siliconman01.
Many people use software even after it has been discontinued, like you can see it now happen with Windows XP. It's really not the best idea, especially with antivirus programs, but some of them can still remove older malware. Some people may also have uninstalled the discontinued software and then CCleaner can remove the files they have left behind.
-
No one?
-
Under Windows Vista the UAC was introduced and to prevent older programs, not running as admin, which want to access their folder under Program Files, to crash because of missing privileges, Microsoft introduced the VirtualStore. This folder can be found on the file system and in the registry.
More info: https://en.wikipedia.org/wiki/User_Account_Control#Features
My question: Does CCleaner scan this folder too when searching e.g. in Program Files (x86)?
For example: C:\Program Files (x86)\Internet Explorer\debug.log
Would this file be deleted if it was located in C:\Users\username\AppData\Local\VirtualStore\Program Files (x86)\Internet Explorer\debug.log ?
-
Because we aren't the developers and it would have to be coded to work not just wished (also I thought that recently changed; can someone confirm/deny?)
It just seems odd to me that there are wildcards for the file system but not for the registry.
on two: lots of variables affect this: UAC on/off, windows version, running as admin, java installed for all users, etc. Could be you fall into a restricted use case
Yes, maybe it's just me. For comparison: UAC off, Windows 7 Home Premium 64-bit SP1, logged in as admin and CCleaner (latest version) running as admin, Java (latest version) installer ran with admin rights and no installation options were changed.
-
[Marionette Log*] is a duplicate of [Firefox Logs*] I guess.
Hope it is not off-topic:
1. Why are wildcards for registry keys not supported?
2. [Java More*] FileKey5 and 6 could not be cleaned on my PC. I tried to access them via the Explorer and I had to gain ownership of the folders first needing administrative rights to open them. Is there any way to fix that problem? Or why can't CCleaner do it?
-
Added FileKey2:
[Firefox Logs*] LangSecRef=3026 SpecialDetect=DET_MOZILLA Default=False FileKey1=%ProgramFiles%\Mozilla Firefox|*.log FileKey2=%AppData%\Mozilla|*.log|RECURSE
Finds marionette.log and submit.log which seem to be log files from Firefox. -
@SMalik
is there any reason why you split the entries?
I guess it's just for a better overall view.
@SMalik
+1 For the cached certificates. If that works it would be great. I have like 10.000 files in these folders.
-
When to use Recurse and when to use Removeself? I don't quite understand https://www.piriform.com/docs/ccleaner/advanced-usage/ccleaner-ini-files/how-to-add-your-own-program-for-ccleaner-to-clean (Sorry for dumb questions).
Addition for TF2 entry ( http://forum.piriform.com/index.php?showtopic=32310&page=202&do=findComment&comment=247478 ):
[TF2 Cache and Cookies*] Section=Games Detect=HKCU\Software\Valve\Steam Default=False FileKey1=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\config\cookies|*.*|RECURSE FileKey2=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\config\html\AppCache|*.*|RECURSE FileKey3=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\tf\cache|*.*|RECURSE FileKey4=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\tf\materials\temp|*.vtf|RECURSE
More Info: http://redd.it/1yrds8New
[Steam Old Files*] Section=Games Detect=HKCU\Software\Valve\Steam Default=False FileKey1=%ProgramFiles%\Steam|*.old
-
What happened to this project? http://forum.piriform.com/index.php?showtopic=24837
Seems to be pretty useful but the download link is not working anymore.
For example: I found all this crap on my PC where such a tool would be very helpful.
%LocalAppData%\Microsoft\Windows\UsrClass.dat.LOG1 %LocalAppData%\Microsoft\Windows\UsrClass.dat.LOG2 %LocalAppData%\Opera\Opera\upgrade.log %LocalAppData%\Overwolf\Log\InstallerTrace.log %LocalAppData%\Overwolf\Log\MSI_2013_9_14_18_55.log.gz %LocalAppData%\Overwolf\Log\Trace.log %LocalAppData%\Packard Bell\InfoCtr\*.log %LocalAppData%\Packard Bell\iUpdator\*.log %LocalAppData%\Thunderbird\Mozilla Thunderbird\updates\backup-update.log %LocalAppData%\Thunderbird\Mozilla Thunderbird\updates\last-update.log %AppData%\I2P\wrapper.log %AppData%\LockHunter\LockHunter.log.txt %AppData%\Mozilla\B2G\Profiles\*\marionette.log %AppData%\Mozilla\Firefox\Profiles\*\PreferencesCleaner\pcln.log %AppData%\Mozilla\Firefox\Profiles\*\marionette.log %AppData%\Mozilla\Firefox\Profiles\*\startup.log %AppData%\Padman\wop\games.log
Question: What about %LocalAppData%\VirtualStore ? Does CCleaner scan this folder? It contains files from program folders that the program could not access because of missing administrative rights.Very advanced entry (not happy with that):
New
[VirtualStore*] LangSecRef=3025 Detect/DetectFile= ?Help Default=False Warning=This will remove some files from older programs. FileKey1=%LocalAppData%\VirtualStore|*.*|RECURSE
Missed?New
[SRWare Iron debug.log*] LangSecRef=3029 DetectFile1=%LocalAppData%\Torch Correct? Default=False FileKey1=%ProgramFiles%\SRWare Iron|debug.log
Edited[Steam Logs*] Section=Games Detect=HKCU\Software\Valve\Steam Default=False FileKey1=%ProgramFiles%\Steam|*.log;*.last|RECURSE
Steam may start very slowly after cleaning this but I never had any problems (edit of http://forum.piriform.com/index.php?showtopic=32310&page=201&do=findComment&comment=247312 ):New
[Steam Cache and Cookies*] Section=Games Detect=HKCU\Software\Valve\Steam Default=False FileKey1=%ProgramFiles%\Steam\config\cookies|*.*|RECURSE FileKey2=%ProgramFiles%\Steam\config\overlaycookies|*.*|RECURSE FileKey3=%ProgramFiles%\Steam\appcache|*.*|RECURSE FileKey4=%ProgramFiles%\Steam\steam\cached|*.*|RECURSE FileKey5=%ProgramFiles%\Steam\depotcache|*.*|RECURSE FileKey6=%ProgramFiles%\Steam\config\overlayhtmlcache|*.*|RECURSE [TF2 Cache and Cookies*] Section=Games Detect=HKCU\Software\Valve\Steam Default=False FileKey1=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\config\cookies|*.*|RECURSE FileKey2=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\config\html\AppCache|*.*|RECURSE FileKey3=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\tf\cache|*.*|RECURSE
-
New
[SRWare Iron debug.log*] LangSecRef=3029 DetectFile1=%LocalAppData%\Torch #Correct? Default=False FileKey1=%ProgramFiles%\SRWare Iron|debug.log
The Steam folder is always full of crap. I delete pretty much any folder that has "cookie" or "cache" in its name and never had problems with it. But can and should such a wildcard be made?Otherwise:
New
[Steam Cache and Cookies*] Section=Games Detect=HKCU\Software\Valve\Steam Default=False FileKey1=%ProgramFiles%\Steam\config\cookies|*.*|REMOVESELF FileKey2=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\config\cookies|*.*|REMOVESELF FileKey3=%ProgramFiles%\Steam\config\overlaycookies|*.*|REMOVESELF FileKey4=%ProgramFiles%\Steam\appcache|*.*|REMOVESELF FileKey5=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\config\html\AppCache|*.*|REMOVESELF FileKey6=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\tf\cache|*.*|REMOVESELF FileKey7=%ProgramFiles%\Steam\steam\cached|*.*|REMOVESELF FileKey8=%ProgramFiles%\Steam\depotcache|*.*|REMOVESELF FileKey9=%ProgramFiles%\Steam\config\htmlcache|*.*|REMOVESELF FileKey10=%ProgramFiles%\Steam\config\overlayhtmlcache|*.*|REMOVESELF
-
[Pale Moon - Adblock Lite Backups*] LangSecRef=3026 Detect=HKLM\Software\Mozilla\Pale Moon DetectFile=%ProgramFiles%\Pale Moon\palemoon.exe Default=False FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\adblocklite|patterns-backup*.ini [Pale Moon - Adblock Plus Backups*] LangSecRef=3026 Detect=HKLM\Software\Mozilla\Pale Moon DetectFile=%ProgramFiles%\Pale Moon\palemoon.exe Default=False FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\adblockplus|patterns-backup*.ini
Merge to get:[Pale Moon - Adblock Backups*] LangSecRef=3026 Detect=HKLM\Software\Mozilla\Pale Moon DetectFile=%ProgramFiles%\Pale Moon\palemoon.exe Default=False FileKey1=%AppData%\Moonchild Productions\Pale Moon\Profiles\*\adblock*|patterns-backup*.ini
Also found these two programs:fpsbanana .com/tools/3595
fpsbanana .com/tools/2543
I may write rules for the files they clean later if I have enough time. I will also accept anyone volunteering.
-
New
[Adobe Photoshop Elements Sync Agent*] LangSecRef=3021 Detect=HKCU\Software\Adobe\Photoshop Elements Default=False FileKey1=%AppData%\Adobe\Photoshop Elements Sync Agent\1.0\Logs|*.log
New (could not find another detect)
[Appupdater Log*] LangSecRef=3024 DetectFile=%AppData%\Appupdater Default=False FileKey1=%AppData%\Appupdater|appupdaterw.log
Alternative (don't know which to prefer):
FileKey1=%AppData%\Appupdater|*.log
New
[Chatzilla*] LangSecRef=3026 SpecialDetect=DET_MOZILLA Default=False FileKey1=%AppData%\Mozilla\Firefox\Profiles\*\chatzilla|inputHistory.txt
Modified
[AdwCleaner 3 Backup*] Warning=You will not be able to undo your changes after running this. [AdwCleaner 3 Quarantine*] Warning=You will not be able to undo your changes after running this. [Peerblock*] FileKey1=%ProgramFiles%\Peerblock|*.log;History.db;*.bak;cache.p2b
CCleaner deleted all settings of my Google Chrome extensions. I guess it was just because of my weird hotlinking on my PC but maybe someone who also had this knows why.
-
By which he means in reference to the *s in
Yeah, maybe just forget about the two entries. But please add the ShareX ones.
-
if im not mistaken, by deleting this key HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*
you won't be able to uninstall any software because it cannot find uninstaller location
That could be a problem. It might be that the Installer uses this information but I'm unable to test it right now.
-
Windows saves the source from where some programs are installed: http://i.imgur.com/EipHkOa.png
Using RegScanner I found the following: http://i.imgur.com/4HEX1oT.png
After I deleted the InstallSource key in HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}: http://i.imgur.com/vcqSgtu.png
It's gone!
Maybe a rule could be:
[Windows Software InstallSource*] LangSecRef=3025 Detect=HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ Default=False RegKey1=HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*|InstallSource
Somewhere is a mistake I'm not able to spot right now. Maybe you could help.
Another thing is the registered user but I don't think CCleaner should remove it. RegScanner: http://i.imgur.com/q5ESTOO.png
Removed key RegOwner in HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}: http://i.imgur.com/6sB7SKB.png
Rule:
[Windows Software Owner*] LangSecRef=3025 Detect=HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ Default=False RegKey1=HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*|RegOwner
Also some mistake. Sry ^^
Some new stuff:
[shareX Backup*] LangSecRef=3021 DetectFile=%Documents%\ShareX Default=False FileKey1=%Documents%\ShareX\Backup|*.*|RECURSE FileKey2=%Documents%\ShareX|*.bak [shareX Screenshots*] LangSecRef=3021 DetectFile=%Documents%\ShareX Default=False Warning=This will delete all Screenshots captured by ShareX. FileKey1=%Documents%\ShareX\Screenshots|*.*|RECURSE
-
-
[Captcha Brotherhood*] LangSecRef=3024 DetectFile=%LocalAppData%\Captcha_Brotherhood Default=False FileKey1=%LocalAppData%\Captcha_Brotherhood|solver_logFile.txt FileKey2=%LocalAppData%\Captcha_Brotherhood|plugin_logFile.txt FileKey3=%LocalAppData%\Captcha_Brotherhood|solver_captchaLog.txt
New FileKey2 and FileKey3
-
[AdwCleaner*] LangSecRef=3024 DetectFile=%HomeDrive%\AdwCleaner[R1].txt Default=False FileKey1=%HomeDrive%|AdwCleaner[R*].txt
AdwCleaner does not leave any other files.
Winapp2.ini additions
in CCleaner
Posted
For DivX:
For Skype: For Search Everything (includes names and locations of all files, will just be regenerated on next start): New: VTUploader creates history file \PVTUploader\phrzvtu.db and Keylogger (not necessarily malware) creates pkl.db which contains all recorded keystrokes and also the password used to open the logger which will be reseted if you delete that file (so I guess that's an issue with that file). So maybe do it like this: Question: Does CCleaner not clean all the stuff cleanmgr deletes? Like the Service-Pack-Backups? Could not find them in the Winapp.ini and Winapp2.