Winapp2.ini additions

MODIFIED ENTRY

[Freemake Video Downloader More*]

LangSecRef=3022

Detect=HKCU\Software\Freemake\FreemakeVideoDownloader

Default=False

FileKey1=%ProgramFiles%\Freemake\Freemake Video Downloader|*.log

FileKey2=%Program Files (x86)%\Freemake\Freemake Video Downloader|*.log

FileKey3=%Documents%\Freemake\FreemakeVideoDownloader|fvd.bin

FileKey4=%Documents%\Freemake\FreemakeVideoDownloader\History\Thumbnails|*.*

FileKey5=%Documents%\Freemake\FreemakeVideoDownloader\History|*.xml

I search my hard drive for *.bak and *.tmp files and would like help in creating Winapp2.ini entries to remove them please.

C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\OPA11.BAK
C:\Documents and Settings\Charles\Application Data\Microsoft\File Transfer Manager\ftmTransferList.txt.bak
C:\Documents and Settings\Charles\Local Settings\jv16PT_temp.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\DIO4.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\DIO9.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\MAR1.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\MAR2.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG1A0.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG1A1.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG19A.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG19B.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG19C.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG19E.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG19F.tmp
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.tmp
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.tmp
C:\Program Files\Google\GoogleToolbarNotifier\GooA32.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\gthA2B.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\gtnA2A.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swgA29.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\gthA2E.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\gtnA2D.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swgA2C.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\gthA31.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\gtnA30.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swgA2F.tmp
C:\Program Files\Secunia\PSI\RCX3CA.tmp
C:\Program Files\TuneXP\docs\hardware.html.bak
C:\Program Files\TuneXP\docs\memoryfs.html.bak
C:\Program Files\Yahoo!\Messenger\Cache\9G0IMTf7KSnOtr1pRkveNQ--.ProfileMap.dat.tmp
C:\RECYCLER\S-1-5-21-1202660629-854245398-1801674531-1003\Dc1.bak
C:\RECYCLER\S-1-5-21-1202660629-854245398-1801674531-1003\Dc2.bak
C:\WINDOWS\msdownld.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2A.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP6B.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP14.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP74D.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP80.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP113A.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP229.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP349.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPDB.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPF21.tmp
C:\WINDOWS\pchealth\helpctr\Config\Cache\Professional_32_1033.dat.bak
C:\WINDOWS\system32\REN72.tmp
C:\WINDOWS\system32\wuapi.dll.wusetup.139324421.bak
C:\WINDOWS\system32\wuauclt.exe.wusetup.139325171.bak
C:\WINDOWS\system32\wuaueng.dll.wusetup.139325937.bak
C:\WINDOWS\system32\NtmsData\NTMSDATA.BAK

Thanks in advance

@ CSGalloway

If you delete this file, you WILL have to reinstall Microsoft Office:

C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\OPA11.BAK

CCleaner should already be deleting stuff in here by default (make sure you have enabled/ticked in the large Cleaner button: Windows->System->Temporary Files):

C:\Documents and Settings\Charles\Local Settings\Temp\

I also have this file, but have no ideal if it's safe to remove or not, which is why I've left it alone on my system, more noteworthy many disk cleaning tools that religiously target the .BAK extension don't even offer to clean it:

C:\WINDOWS\system32\NtmsData\NTMSDATA.BAK

@ CSGalloway

If you delete this file, you WILL have to reinstall Microsoft Office:

C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\OPA11.BAK

CCleaner should already be deleting stuff in here by default (make sure you have enabled/ticked in the large Cleaner button: Windows->System->Temporary Files):

C:\Documents and Settings\Charles\Local Settings\Temp\

I also have this file, but have no ideal if it's safe to remove or not, which is why I've left it alone on my system, more noteworthy many disk cleaning tools that religiously target the .BAK extension don't even offer to clean it:

C:\WINDOWS\system32\NtmsData\NTMSDATA.BAK

re: OPA11.BAK

I have Microsfot Ofice Standard Edition 2003 - not sure if this file can be removed or not.

re: NTMSDATA.BAK

look at http://www.google.com/search?sourceid=navclient&aq=f&oq=NTMSDATA.BAK&ie=UTF-8&rlz=1T4GGHP_enUS442US442&q=NTMSDATA.BAK&gs_upl=0l0l0l2000lllllllllll0&aqi=g-K1

re: OPA11.BAK

I have Microsfot Ofice Standard Edition 2003 - not sure if this file can be removed or not.

Like I've already stated if you delete it then Microsoft Office is going to need reinstalled, no way around that as I've been there and done that in the past which is why in EasyCleaner I have it ignored.

re: NTMSDATA.BAK

look at http://www.google.co...lllll0&aqi=g-K1

That Google search doesn't tell me much though. :lol: It isn't some piece of malware on my system as most of those search results seem to think. Possibly just some junk file created by Windows, and looking at it in a hex editor doesn't reveal much either.

I'm not convinced that ntmsdata.bak is safe for regular cleaning but only in extreme cases such as

http://support.microsoft.com/default.aspx?scid=kb;EN-US;235032

On my system NTMSDATA.BAK is identical to the regular one without an extension "NTMSDATA", they have matching MD5 / SHA-1 checksums. That and AVG Free and MBAM find nothing wrong with it and neither does Jotti or VirSCAN.org.

I'm hoping to do an update in the next 24 hours, just a heads up :)

After being annoyed by the Notepad window size which wouldn't remember my settings I came up with this new cleaning entry:

[MS Notepad*]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Notepad
Default=False
Warning=If Notepad stops remembering your window size settings using this cleaner will reset it back to the original Windows default size.
RegKey1=HKCU\Software\Microsoft\Notepad|iWindowPosDX
RegKey2=HKCU\Software\Microsoft\Notepad|iWindowPosDY
RegKey3=HKCU\Software\Microsoft\Notepad|iWindowPosX
RegKey4=HKCU\Software\Microsoft\Notepad|iWindowPosY

I search my hard drive for *.bak and *.tmp files and would like help in creating Winapp2.ini entries to remove them please.

C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\OPA11.BAK
C:\Documents and Settings\Charles\Application Data\Microsoft\File Transfer Manager\ftmTransferList.txt.bak
C:\Documents and Settings\Charles\Local Settings\jv16PT_temp.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\DIO4.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\DIO9.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\MAR1.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\MAR2.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG1A0.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG1A1.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG19A.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG19B.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG19C.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG19E.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG19F.tmp
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.tmp
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.tmp
C:\Program Files\Google\GoogleToolbarNotifier\GooA32.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\gthA2B.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\gtnA2A.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swgA29.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\gthA2E.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\gtnA2D.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swgA2C.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\gthA31.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\gtnA30.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swgA2F.tmp
C:\Program Files\Secunia\PSI\RCX3CA.tmp
C:\Program Files\TuneXP\docs\hardware.html.bak
C:\Program Files\TuneXP\docs\memoryfs.html.bak
C:\Program Files\Yahoo!\Messenger\Cache\9G0IMTf7KSnOtr1pRkveNQ--.ProfileMap.dat.tmp
C:\RECYCLER\S-1-5-21-1202660629-854245398-1801674531-1003\Dc1.bak
C:\RECYCLER\S-1-5-21-1202660629-854245398-1801674531-1003\Dc2.bak
C:\WINDOWS\msdownld.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2A.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP6B.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP14.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP74D.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP80.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP113A.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP229.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP349.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPDB.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPF21.tmp
C:\WINDOWS\pchealth\helpctr\Config\Cache\Professional_32_1033.dat.bak
C:\WINDOWS\system32\REN72.tmp
C:\WINDOWS\system32\wuapi.dll.wusetup.139324421.bak
C:\WINDOWS\system32\wuauclt.exe.wusetup.139325171.bak
C:\WINDOWS\system32\wuaueng.dll.wusetup.139325937.bak
C:\WINDOWS\system32\NtmsData\NTMSDATA.BAK

Thanks in advance

I just ran CCleaner with the least program open and then did the same DIR as above and got this:

C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\OPA11.BAK
C:\Documents and Settings\Charles\Application Data\Microsoft\File Transfer Manager\ftmTransferList.txt.bak
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.tmp
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.tmp
C:\Program Files\Google\GoogleToolbarNotifier\GooA32.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\gthA2B.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\gtnA2A.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swgA29.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\gthA2E.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\gtnA2D.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swgA2C.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\gthA31.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\gtnA30.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swgA2F.tmp
C:\Program Files\Secunia\PSI\RCX3CA.tmp
C:\Program Files\TuneXP\docs\hardware.html.bak
C:\Program Files\TuneXP\docs\memoryfs.html.bak
C:\WINDOWS\msdownld.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2A.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP6B.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP14.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP74D.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP80.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP113A.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP229.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP349.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPDB.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPF21.tmp
C:\WINDOWS\pchealth\helpctr\Config\Cache\Professional_32_1033.dat.bak
C:\WINDOWS\system32\REN72.tmp
C:\WINDOWS\system32\wuapi.dll.wusetup.139324421.bak
C:\WINDOWS\system32\wuauclt.exe.wusetup.139325171.bak
C:\WINDOWS\system32\wuaueng.dll.wusetup.139325937.bak
C:\WINDOWS\system32\NtmsData\NTMSDATA.BAK

so one can see there are some BAK files from Google... and other places that could be cleaned.

For users of Yahoo Messenger it would be nice if someone would make an winapp2.ini enry to set the chat window size and location back tpo the "just installed" state. Not sure what key it would be but at least HKCU\Software\Yahoo!\pager would be a good start.

I have come up with close to good entries for my BAK and TMP file posts. I'll post the ones I am not sure of at the bottom:

New Entry
[Google Toolbar Notifier*]
LangSecRef=3022
Detect=HKCU\Software\Google\GoogleToolbarNotifier
Default=False
FileKey1=%ProgramFiles%\Google\GoogleToolbarNotifier|*.tmp|RECURSE
[TuneUp XP*]
LangSecRef=3021
DetectFile=%ProgramFiles%\TuneXP
Default=False
FileKey1=%ProgramFiles%\TuneXP\docs\*.bak
[Windows Assembly*]
LangSecRef=????
DetectFile=%WinDir%\assemply
Default=False
FileKey1=%WinDir%\assemply|*.tmp|Recurse
[Misc Windows Tmp/Bak's *]
LangSecRef=3022	 <== Not sure ?
DetectFile=%WinDir%\system32
Default=False
FileKey1=%WinDir%\system32|*.bak
FileKey2=%WinDir%\system32|*.tmp
[Registry Backup Files]
LangSecRef=3024
DetectFile1=%UserProfile%\..\LocalService
DetectFile2=%UserProfile%\..\NetworkService
Default=False
Warning=This removes additional registry hive bakcup files
FileKey1=%UserProfile%\..\LocalService\Local Settings\Application Data\Microsoft\Windows|UsrClass.dat.tmp
FileKey2=%UserProfile%\..\NetworkService\Local Settings\Application Data\Microsoft\Windows|UsrClass.dat.tmp
[File Transfer Manager]
LangSecRef=3022 <== ????
DetectFile=%appdata%\Microsoft\File Transfer Manager
Default=False
FileKey1=%appdata%\Microsoft\File Transfer Manager|*.bak
;=====================================================================
Revise Entry
[secunia PSI*]
LangSecRef=3021
Detect1=HKLM\SOFTWARE\Secunia\PSI
Detect2=HKCU\Software\Secunia\PSI
Default=False
FileKey1=%ProgramFiles%\secunia\PSI|sualog.txt
FileKey2=%ProgramFiles%\Secunia\PSI|psialog.txt*
FileKey3=%ProgramFiles%\Secunia\PSI|*.tmp	  <== ADD

The ones I am not sure of are:

C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\OPA11.BAK
C:\WINDOWS\pchealth\helpctr\Config\Cache\Professional_32_1033.dat.bak
C:\WINDOWS\system32\NtmsData\NTMSDATA.BAK

Thank you.

OPA11.bak and OPA11.dat are your Office 2007 activation files,

According to the KB link below 'NTMSDATA' files are used by the W2K Server/Pro operating systems for backup to media:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;235032

It is also referenced here:

http://support.microsoft.com/kb/235469

Updated

[TuneUp XP*]

LangSecRef=3021

DetectFile=%ProgramFiles%\TuneXP

Default=False

FileKey1=%ProgramFiles%\TuneXP\docs\*.bak

You've got a backslash \ (highlighted in bold red in the quote above), when it needs that thing I think is called a pipe |

Does that cleaner even work?

If not maybe this:

[TuneUp XP*]

LangSecRef=3021

DetectFile=%ProgramFiles%\TuneXP

Default=False

FileKey1=%ProgramFiles%\TuneXP\docs|*.bak

whoops, I'll hotfix that. one sec.

Thank you very much for the update.

Missed posts:

#1824 (2 new entries)

#1875 (2 modified entries)

#1877 (modified entry)

#1879 (new entry "NetworkService Temps")

#1926 (modified "JDownloader" entries)

#1942 (modified entry)

Modified entry:

[FlashGot*]

LangSecRef=3026

SpecialDetect=DET_MOZILLA

Default=False

FileKey1=%AppData%\Mozilla\Firefox\Profiles\*|FlashGot.log

FileKey2=%AppData%\Mozilla\Firefox\Profiles\*|FlashGot.log.bak*

Modified entry:

[spybot Search and Destroy History*]

LangSecRef=3024

Detect=HKLM\Software\Safer Networking Limited\SpybotSnD

Default=False

FileKey1=%CommonAppData%\Spybot – Search & Destroy\Backups|*.*|RECURSE

FileKey2=%CommonAppData%\Spybot – Search & Destroy\Recovery|*.*|RECURSE

FileKey3=%CommonAppData%\Spybot – Search & Destroy\Snapshots|*.*|RECURSE

FileKey4=%CommonAppData%\Spybot – Search & Destroy\Snapshots2|*.*|RECURSE

Please rename [TuneUp XP*] to [TuneXP*].

And above the entry [Windows Audio/Video (Stats)*] is a blank line missing.

Update for this one, changed from DetectFile to Detect:

[Config.msi Folder*]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Installer
Default=False
FileKey1=%SystemDrive%\Config.msi|*.*|REMOVESELF

New:

[Emsisoft HiJackFree*]
LangSecRef=3024
Detect=HKLM\SOFTWARE\Emsi Software GmbH\a-squared HiJackFree
Default=False
FileKey1=%ProgramFiles%\Emsisoft HiJackFree\Logs|*.*
FileKey2=%ProgramFiles%\Emsisoft HiJackFree|*.old

New - since this is the default location suggested by the PortableApps.com installer, why not:

[ultraDefrag Portable (Log)*]
LangSecRef=3024
DetectFile=%systemdrive%\PortableApps\UltraDefragPortable\UltraDefragPortable.exe
Default=False
FileKey1=%systemdrive%\PortableApps\UltraDefragPortable\Data|UltraDefragPortable.log

New - this registry key keeps a debug record of many .exe files you run:

[Windows ESENT Process (MRU)*]
LangSecRef=3025
Detect=HKLM\SOFTWARE\Microsoft\ESENT
Default=False
RegKey1=HKLM\SOFTWARE\Microsoft\ESENT\Process

----------------------

Shouldn't the name of this be renamed? It has detection for two versions and could be misleading having a version number in the name:

Old:

[Avidemux 2.5 log*]
LangSecRef=3023
Detect1=HKLM\Software\Avidemux 2.5
Detect2=HKLM\Software\Avidemux 2.4
Default=False
FileKey1=%AppData%\avidemux|admlog.txt

Updated:

[Avidemux log*]
LangSecRef=3023
Detect1=HKLM\Software\Avidemux 2.5
Detect2=HKLM\Software\Avidemux 2.4
Default=False
FileKey1=%AppData%\avidemux|admlog.txt

----------------------

I have a question:

Does CCleaner understand when using all current compatible OSes it works on that %Documents% refers to "My Documents"?

Crap, I can't believe I keep missing out on certain entries. I will DEFINITELY make sure they get into the next version, 'cause I'm adding them into the update file right meow!

Edit: Yes, Andavari, as far as I am aware that is the case.