Winapp2.ini additions

CCleaner for Windows
641

I found http://www.vistapcguy.net/?p=173 which says that locallowappdatya is valid for vista so it would be nice if %LocalLowAppData% was docuents in the first post of this thread.

I did find a zapmessenger.exe that removed WLMessenger so was hoping to find someone who could send me compressed copies of the follwing folders on their system:

FileKey8=%ProgramFiles%\Common Files\Windows Live\.cache|*.*|RECURSE

FileKey9=%LocalAppData%\Microsoft\Windows Live\Setup|*.*|RECURSE

call the first one PF.zip and the 2nd one LAD.zip - then tell me the web addresses of =where they are stored. I'll download them and go from there.

Here's the link for the .cache PF.zip: http://www.sendspace.com/file/resisw

I couldn't find the Setup location on WinXP.

642

Here's the link for the .cache PF.zip: http://www.sendspace.com/file/resisw

I couldn't find the Setup location on WinXP.

Do you have a:

%userprofile%\Local Settings\Application Data\Microsoft\Windows Live\Setup

folder? If so that is what I will also need. and a HUGE thank you for PF.ZIP too

643

Do you have a:

%userprofile%\Local Settings\Application Data\Microsoft\Windows Live\Setup

folder? If so that is what I will also need. and a HUGE thank you for PF.ZIP too

No Setup subfolder. The only thing there is:

%userprofile%\Local Settings\Application Data\Microsoft\Windows Live\SqmApi

The SqmApi folder is empty.

644

This code cleans up after a registry defrag via TuneUp Utilities 2011.

[TuneUp Utilities 2011 Reg Defrag Cleanup*]
LangSecRef=3024
Detect=HKCU\Software\TuneUp\Utilities\10.0
Default=False
FileKey1=%WinDir%\System32\config\|SECURITY_tureg_old
FileKey2=%WinDir%\System32\config\|SOFTWARE_tureg_old
FileKey3=%WinDir%\System32\config\|SYSTEM_tureg_old
FileKey4=%WinDir%\System32\config\|DEFAULT_tureg_new.LOG1
FileKey5=%WinDir%\System32\config\|DEFAULT_tureg_new.LOG2
FileKey6=%WinDir%\System32\config\|SAM_tureg_new.LOG1
FileKey7=%WinDir%\System32\config\|SAM_tureg_new.LOG2
FileKey8=%WinDir%\System32\config\|SECURITY_tureg_new.LOG1
FileKey9=%WinDir%\System32\config\|SECURITY_tureg_new.LOG2
FileKey10=%WinDir%\System32\config\|SOFTWARE_tureg_new.LOG1
FileKey11=%WinDir%\System32\config\|SOFTWARE_tureg_new.LOG2
FileKey12=%WinDir%\System32\config\|SYSTEM_tureg_new.LOG1
FileKey13=%WinDir%\System32\config\|SYSTEM_tureg_new.LOG2
FileKey14=%WinDir%\System32\config\|DEFAULT_tureg_old
FileKey15=%WinDir%\System32\config\|SAM_tureg_old
FileKey16=%WinDir%\ServiceProfiles\LocalService\|NTUSER.DAT_tureg_old
FileKey17=%WinDir%\ServiceProfiles\LocalService\|NTUSER.DAT_tureg_new.LOG1
FileKey18=%WinDir%\ServiceProfiles\LocalService\|NTUSER.DAT_tureg_new.LOG2
FileKey19=%WinDir%\ServiceProfiles\NetworkService\|NTUSER.DAT_tureg_old
FileKey20=%WinDir%\ServiceProfiles\NetworkService\|NTUSER.DAT_tureg_new.LOG1
FileKey21=%WinDir%\ServiceProfiles\NetworkService\|NTUSER.DAT_tureg_new.LOG2
FileKey22=%USERPROFILE%\AppData\Local\Microsoft\Windows|USRCLASS.DAT_tureg_old
FileKey23=%USERPROFILE%\|NTUSER.DAT_tureg_new.LOG1
FileKey24=%USERPROFILE%\|NTUSER.DAT_tureg_new.LOG2
FileKey25=%USERPROFILE%\|NTUSER.DAT_tureg_old
FileKey26=C:\Boot\|BCD_tureg_new.LOG1
FileKey27=C:\Boot\|BCD_tureg_new.LOG2
FileKey28=C:\Boot\|BCD_tureg_old

645

NEW ENTRIES

[Adobe Acrobat Distiller Cache*]

LangSecRef=3021

DetectFile=%AppData%\Adobe\Acrobat\Distiller 10

Default=False

FileKey1=%AppData%\Adobe\Acrobat\Distiller 10\Cache|*.*|RECURSE

[Paltalk Messenger*]

LangSecRef=3022

DetectFile=%ProgramFiles%\Paltalk Messenger\paltalk.exe

Default=False

FileKey1=%AppData%\Paltalk|*.*|RECURSE

[unity Web Player Cache*]

LangSecRef=3023

DetectFile=%LocalLowAppData%\Unity

Default=False

FileKey1=%LocalLowAppData%\Unity\Web Player\Cache|*.*|RECURSE

FileKey2=%LocalLowAppData%\Unity\WebPlayer\Cache|*.*|RECURSE

MODIFIED ENTRY

Please replace the entry listed here with [Acrobat Distiller 10*] if possible. I have corrected the name.

[Adobe Acrobat Distiller 10*]

LangSecRef=3021

DetectFile=%AppData%\Adobe\Acrobat\Distiller 10

Default=False

FileKey1=%AppData%\Adobe\Acrobat\Distiller 10|messages.log

646

Winapp2.ini Version: v1.0.110809

[skype More*]

...

FileKey3=%AppData%\Skype\*|main.db

this kills my contact list!? is/was this intended?

don't like; glad I had a recent backup ...

otherwise: great work, thanks!

647

Winapp2.ini Version: v1.0.110809

this kills my contact list!? is/was this intended?

don't like; glad I had a recent backup ...

otherwise: great work, thanks!

FileKey3=%AppData%\Skype\*|main.db

By deleting/wiping main.db does not effect contact list. It wipes the things listed here ONLY:

Chat History

Call History

by deleting 'config.xml' from the location listed here will delete the contact list:

%AppData%\Skype\*

Where * is Skype user account.

In your case where your Skype contacts were gone. If you remove the whole Skype account folder from the location listed here: %AppData%\Skype\

And login back to Skype, you will get your contact list back.

648

MODIFIED ENTRY

[Adobe Acrobat Distiller 10*]

LangSecRef=3021

DetectFile=%AppData%\Adobe\Acrobat\Distiller 10

Default=False

RegKey1=HKCU\Software\Adobe\Acrobat Distiller\10.0|InPath

FileKey1=%AppData%\Adobe\Acrobat\Distiller 10|messages.log

NEW ENTRY

[stored Application Descriptions*]

LangSecRef=3025

Detect=HKCU\Software\Classes\Local Settings

Default=False

RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

649

NEW ENTRIES

This is for Internet Explorer 9.

[inPrivate Filtering Saved Addresses*]

LangSecRef=3022

DetectFile=%AppData%\Microsoft\Windows\PrivacIE

Default=False

FileKey1=%AppData%\Microsoft\Windows\PrivacIE|*.*|RECURSE

Many webpages use content such as advertisements, maps, or web analysis tools from websites other than the one you are visiting. InPrivate Filtering helps prevent website content providers from collecting information about sites you visit. In this index.dat file you can see web address of such content stored in your system.

Go to the location listed here and open index.dat file with notepad to look at youself that how much sensitive data this .dat file holds.

AppData\Roaming\Microsoft\Windows\PrivacIE\Low

[Malicious Software Removal Tool*]

LangSecRef=3025

DetectFile=%WinDir%\debug

Default=False

FileKey1=%WinDir%\debug|mrt.log

MODIFIED ENTRY

[internet Explorer More*]

LangSecRef=3022

DetectFile=%ProgramFiles%\Internet Explorer\iexplore.exe

Default=False

RegKey1=HKCU\Software\Microsoft\Internet Explorer\International|CNum_CpCache

RegKey2=HKCU\Software\Microsoft\Internet Explorer\International|CpCache

RegKey3=HKCU\Software\Microsoft\Internet Explorer\International\CpMRU

RegKey4=HKCU\Software\Microsoft\Internet Explorer\PageSetup

RegKey5=HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore

RegKey6=HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats

RegKey7=HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached

FileKey1=%LocalLowAppData%\Microsoft\CryptnetUrlCache\Content|*.*

FileKey2=%LocalLowAppData%\Microsoft\CryptnetUrlCache\MetaData|*.*

FileKey3=%AppData%\Microsoft\Internet Explorer\UserData|*.*|RECURSE

FileKey4=%AppData%\Microsoft\Windows\IECompatCache|*.*|RECURSE

FileKey5=%AppData%\Microsoft\Windows\IETldCache|*.*|RECURSE

FileKey6=%LocalAppData%\Microsoft\Internet Explorer|brndlog.*

FileKey7=%LocalAppData%\Microsoft\Internet Explorer|*iconcache.dat

FileKey8=%LocalAppData%\Microsoft\Internet Explorer\iconcache|*.*|REMOVESELF

In this entry I have added 2 more sensitive areas.

FileKey4=%AppData%\Microsoft\Windows\IECompatCache|*.*|RECURSE

FileKey5=%AppData%\Microsoft\Windows\IETldCache|*.*|RECURSE

650

Thanks saad :)

651

Thanks saad :)

You're welcome Winapp2.ini.

How about if we merge [inPrivate Filtering Saved Addresses*] into [internet Explorer More*]?

[internet Explorer More*]

LangSecRef=3022

DetectFile=%ProgramFiles%\Internet Explorer\iexplore.exe

Default=False

RegKey1=HKCU\Software\Microsoft\Internet Explorer\International|CNum_CpCache

RegKey2=HKCU\Software\Microsoft\Internet Explorer\International|CpCache

RegKey3=HKCU\Software\Microsoft\Internet Explorer\International\CpMRU

RegKey4=HKCU\Software\Microsoft\Internet Explorer\PageSetup

RegKey5=HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore

RegKey6=HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats

RegKey7=HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached

FileKey1=%LocalAppData%\Microsoft\Internet Explorer|brndlog.*

FileKey2=%LocalAppData%\Microsoft\Internet Explorer|*iconcache.dat

FileKey3=%LocalAppData%\Microsoft\Internet Explorer\iconcache|*.*|REMOVESELF

FileKey4=%LocalLowAppData%\Microsoft\CryptnetUrlCache\Content|*.*

FileKey5=%LocalLowAppData%\Microsoft\CryptnetUrlCache\MetaData|*.*

FileKey6=%AppData%\Microsoft\Internet Explorer\UserData|*.*|RECURSE

FileKey7=%AppData%\Microsoft\Windows\PrivacIE|*.*|RECURSE

I am removing the paths listed below as they are already included in the program's 'index.dat files' entry. I am sorry about that.

%AppData%\Microsoft\Windows\IECompatCache|*.*|RECURSE

%AppData%\Microsoft\Windows\IETldCache|*.*|RECURSE

I think [inPrivate Filtering Saved Addresses*] (%AppData%\Microsoft\Windows\PrivacIE|*.*|RECURSE) should be added into CCleaner. Also they should correct the index.dat files entry as it does not detect all the index.dat files the ones should be removed.

For example

index.dat files from the locations listed here:

%AppData%\Microsoft\Internet Explorer\UserData

%AppData%\Microsoft\Windows\PrivacIE\Low

652

I am listing all the modified and new entries here that I posted after Winapp2.ini Version: v1.0.110809.

MODIFIED ENTRIES

Please replace this one with [Acrobat Distiller 10*]

[Adobe Acrobat Distiller 10*]

LangSecRef=3021

DetectFile=%AppData%\Adobe\Acrobat\Distiller 10

Default=False

RegKey1=HKCU\Software\Adobe\Acrobat Distiller\10.0|InPath

FileKey1=%AppData%\Adobe\Acrobat\Distiller 10|messages.log

[internet Explorer More*]

LangSecRef=3022

DetectFile=%ProgramFiles%\Internet Explorer\iexplore.exe

Default=False

RegKey1=HKCU\Software\Microsoft\Internet Explorer\International|CNum_CpCache

RegKey2=HKCU\Software\Microsoft\Internet Explorer\International|CpCache

RegKey3=HKCU\Software\Microsoft\Internet Explorer\International\CpMRU

RegKey4=HKCU\Software\Microsoft\Internet Explorer\PageSetup

RegKey5=HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore

RegKey6=HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats

RegKey7=HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached

FileKey1=%LocalAppData%\Microsoft\Internet Explorer|brndlog.*

FileKey2=%LocalAppData%\Microsoft\Internet Explorer|*iconcache.dat

FileKey3=%LocalAppData%\Microsoft\Internet Explorer\iconcache|*.*|REMOVESELF

FileKey4=%LocalLowAppData%\Microsoft\CryptnetUrlCache\Content|*.*

FileKey5=%LocalLowAppData%\Microsoft\CryptnetUrlCache\MetaData|*.*

FileKey6=%AppData%\Microsoft\Internet Explorer\UserData|*.*|RECURSE

FileKey7=%AppData%\Microsoft\Windows\PrivacIE|*.*|RECURSE

NEW ENTRIES

[Adobe Acrobat Distiller Cache*]

LangSecRef=3021

DetectFile=%AppData%\Adobe\Acrobat\Distiller 10

Default=False

FileKey1=%AppData%\Adobe\Acrobat\Distiller 10\Cache|*.*|RECURSE

[Malicious Software Removal Tool*]

LangSecRef=3025

DetectFile=%WinDir%\debug

Default=False

FileKey1=%WinDir%\debug|mrt.log

[Paltalk Messenger*]

LangSecRef=3022

DetectFile=%ProgramFiles%\Paltalk Messenger\paltalk.exe

Default=False

FileKey1=%AppData%\Paltalk|*.*|RECURSE

[stored Application Descriptions*]

LangSecRef=3025

Detect=HKCU\Software\Classes\Local Settings

Default=False

RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

[unity Web Player Cache*]

LangSecRef=3023

DetectFile=%LocalLowAppData%\Unity

Default=False

FileKey1=%LocalLowAppData%\Unity\Web Player\Cache|*.*|RECURSE

FileKey2=%LocalLowAppData%\Unity\WebPlayer\Cache|*.*|RECURSE

653

thanks for explaining!

>By deleting/wiping main.db does not effect contact list.

deleting main.db DOES affect display of contacts + display of online status:

contacts are gone, online status is ONLINE, my real name + contact pic are gone

until

>login back to Skype, you will get your contact list back.

you're right, I didn't wait long enough last time.

>by deleting 'config.xml' from the location listed here will delete the contact list

right, but I didn't delete this file.

>If you remove the whole Skype account folder from the location listed here: %AppData%\Skype\

understandable, but I didn't remove it

for myself, I don't consider it save to remove main.db + hence will keep unchecked SkypeMore.

but I DO appreciate your enhancing of winapp2.ini!

cheers, andreas

654

Hm, I noticed the the contacts list does repopulate, so I'm not certain whether or not the main.db file should be excluded so as not to convince people CCleaner broke their skype.

655

Hm, I noticed the the contacts list does repopulate, so I'm not certain whether or not the main.db file should be excluded so as not to convince people CCleaner broke their skype.

Yes you could remove that line. Let me work on it.

656

Yeah, it seems like it may be a good idea to remove the main.db filekey.

657

Yeah, it seems like it may be a good idea to remove the main.db filekey.

[skype More*]

LangSecRef=3022

DetectFile=%AppData%\Skype

Default=False

FileKey1=%AppData%\Skype\*\chatsync|*.*|RECURSE

FileKey2=%AppData%\Skype\*\httpfe|cookies.dat

Main CCleaner entry for Skype does not delete Skype Cookies. Thats is why I have added this line in this entry and removed *.lck line as there is no need to delete it.

658

RE-MODIFIED ENTRY :)

Added: FileKey4=%LocalAppData%\Microsoft\Internet Explorer\Recovery\Last Active|*.*|RECURSE

[internet Explorer More*]

LangSecRef=3022

DetectFile=%ProgramFiles%\Internet Explorer\iexplore.exe

Default=False

RegKey1=HKCU\Software\Microsoft\Internet Explorer\International|CNum_CpCache

RegKey2=HKCU\Software\Microsoft\Internet Explorer\International|CpCache

RegKey3=HKCU\Software\Microsoft\Internet Explorer\International\CpMRU

RegKey4=HKCU\Software\Microsoft\Internet Explorer\PageSetup

RegKey5=HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore

RegKey6=HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats

RegKey7=HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached

FileKey1=%LocalAppData%\Microsoft\Internet Explorer|brndlog.*

FileKey2=%LocalAppData%\Microsoft\Internet Explorer|*iconcache.dat

FileKey3=%LocalAppData%\Microsoft\Internet Explorer\iconcache|*.*|REMOVESELF

FileKey4=%LocalAppData%\Microsoft\Internet Explorer\Recovery\Last Active|*.*|RECURSE

FileKey5=%LocalLowAppData%\Microsoft\CryptnetUrlCache\Content|*.*

FileKey6=%LocalLowAppData%\Microsoft\CryptnetUrlCache\MetaData|*.*

FileKey7=%AppData%\Microsoft\Internet Explorer\UserData|*.*|RECURSE

FileKey8=%AppData%\Microsoft\Windows\PrivacIE|*.*|RECURSE

MODIFIED ENTRIES

[Corel PaintShop Photo Pro X3*]

LangSecRef=3023

DetectFile=%ProgramFiles%\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\Corel Paint Shop Pro Photo.exe

Default=False

RegKey1=HKCU\Software\Corel\PhotoDownloader\2\PhotoDownloader\DownloadFolder

RegKey2=HKCU\Software\Corel\PhotoDownloader\2\PhotoDownloader\DefaultDownloadFolder

FileKey1=%LocalAppData%\Corel\Thumbs|*.*|RECURSE

FileKey2=%LocalAppData%\Corel|*.db

FileKey3=%LocalAppData%\Corel|*.PspCache

FileKey4=%AppData%\Corel\PaintShop Photo Pro\13\Cache|*.*|RECURSE

[MS Clip Organizer*]

LangSecRef=3025

DetectFile=%AppData%\Microsoft\Clip Organizer

Default=False

RegKey1=HKCU\Software\Microsoft\Office\12.0\Clip Organizer\Search\Last Query

RegKey2=HKCU\Software\Microsoft\Office\14.0\Clip Organizer\Search\Last Query

FileKey1=%AppData%\Microsoft\Clip Organizer|mstore12.mgc

FileKey2=%AppData%\Microsoft\Clip Organizer|mstore14.mgc

659

[skype More*]

thanks for revising this entry!

660

thanks for revising this entry!

You're welcome.