SMalik
8 August 2012 05:58
1942
MODIFIED ENTRY
[Freemake Video Downloader More*]
LangSecRef=3022
Detect=HKCU\Software\Freemake\FreemakeVideoDownloader
Default=False
FileKey1=%ProgramFiles%\Freemake\Freemake Video Downloader|*.log
FileKey2=%Program Files (x86)%\Freemake\Freemake Video Downloader|*.log
FileKey3=%Documents%\Freemake\FreemakeVideoDownloader|fvd.bin
FileKey4=%Documents%\Freemake\FreemakeVideoDownloader\History\Thumbnails|*.*
FileKey5=%Documents%\Freemake\FreemakeVideoDownloader\History|*.xml
I search my hard drive for *.bak and *.tmp files and would like help in creating Winapp2.ini entries to remove them please.
C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\OPA11.BAK
C:\Documents and Settings\Charles\Application Data\Microsoft\File Transfer Manager\ftmTransferList.txt.bak
C:\Documents and Settings\Charles\Local Settings\jv16PT_temp.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\DIO4.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\DIO9.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\MAR1.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\MAR2.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG1A0.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG1A1.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG19A.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG19B.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG19C.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG19E.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG19F.tmp
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.tmp
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.tmp
C:\Program Files\Google\GoogleToolbarNotifier\GooA32.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\gthA2B.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\gtnA2A.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swgA29.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\gthA2E.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\gtnA2D.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swgA2C.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\gthA31.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\gtnA30.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swgA2F.tmp
C:\Program Files\Secunia\PSI\RCX3CA.tmp
C:\Program Files\TuneXP\docs\hardware.html.bak
C:\Program Files\TuneXP\docs\memoryfs.html.bak
C:\Program Files\Yahoo!\Messenger\Cache\9G0IMTf7KSnOtr1pRkveNQ--.ProfileMap.dat.tmp
C:\RECYCLER\S-1-5-21-1202660629-854245398-1801674531-1003\Dc1.bak
C:\RECYCLER\S-1-5-21-1202660629-854245398-1801674531-1003\Dc2.bak
C:\WINDOWS\msdownld.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2A.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP6B.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP14.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP74D.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP80.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP113A.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP229.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP349.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPDB.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPF21.tmp
C:\WINDOWS\pchealth\helpctr\Config\Cache\Professional_32_1033.dat.bak
C:\WINDOWS\system32\REN72.tmp
C:\WINDOWS\system32\wuapi.dll.wusetup.139324421.bak
C:\WINDOWS\system32\wuauclt.exe.wusetup.139325171.bak
C:\WINDOWS\system32\wuaueng.dll.wusetup.139325937.bak
C:\WINDOWS\system32\NtmsData\NTMSDATA.BAK
Thanks in advance
@ CSGalloway
If you delete this file, you WILL have to reinstall Microsoft Office:
C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\ OPA11.BAK
CCleaner should already be deleting stuff in here by default (make sure you have enabled/ticked in the large Cleaner button: Windows->System->Temporary Files):
C:\Documents and Settings\Charles\Local Settings\Temp\
I also have this file, but have no ideal if it's safe to remove or not, which is why I've left it alone on my system, more noteworthy many disk cleaning tools that religiously target the .BAK extension don't even offer to clean it:
C:\WINDOWS\system32\NtmsData\ NTMSDATA.BAK
@ CSGalloway
If you delete this file, you WILL have to reinstall Microsoft Office:
C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\ OPA11.BAK
CCleaner should already be deleting stuff in here by default (make sure you have enabled/ticked in the large Cleaner button: Windows->System->Temporary Files):
C:\Documents and Settings\Charles\Local Settings\Temp\
I also have this file, but have no ideal if it's safe to remove or not, which is why I've left it alone on my system, more noteworthy many disk cleaning tools that religiously target the .BAK extension don't even offer to clean it:
C:\WINDOWS\system32\NtmsData\ NTMSDATA.BAK
re: OPA11.BAK
I have Microsfot Ofice Standard Edition 2003 - not sure if this file can be removed or not.
re: NTMSDATA.BAK
look at http://www.google.com/search?sourceid=navclient&aq=f&oq=NTMSDATA.BAK&ie=UTF-8&rlz=1T4GGHP_enUS442US442&q=NTMSDATA.BAK&gs_upl=0l0l0l2000lllllllllll0&aqi=g-K1
re: OPA11.BAK
I have Microsfot Ofice Standard Edition 2003 - not sure if this file can be removed or not.
Like I've already stated if you delete it then Microsoft Office is going to need reinstalled, no way around that as I've been there and done that in the past which is why in EasyCleaner I have it ignored.
That Google search doesn't tell me much though. It isn't some piece of malware on my system as most of those search results seem to think. Possibly just some junk file created by Windows, and looking at it in a hex editor doesn't reveal much either.
Nergal
12 August 2012 19:06
1947
I'm not convinced that ntmsdata.bak is safe for regular cleaning but only in extreme cases such as
http://support.microsoft.com/default.aspx?scid=kb;EN-US;235032
On my system NTMSDATA.BAK is identical to the regular one without an extension "NTMSDATA", they have matching MD5 / SHA-1 checksums. That and AVG Free and MBAM find nothing wrong with it and neither does Jotti or VirSCAN.org.
I'm hoping to do an update in the next 24 hours, just a heads up
After being annoyed by the Notepad window size which wouldn't remember my settings I came up with this new cleaning entry:
[MS Notepad*]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Notepad
Default=False
Warning=If Notepad stops remembering your window size settings using this cleaner will reset it back to the original Windows default size.
RegKey1=HKCU\Software\Microsoft\Notepad|iWindowPosDX
RegKey2=HKCU\Software\Microsoft\Notepad|iWindowPosDY
RegKey3=HKCU\Software\Microsoft\Notepad|iWindowPosX
RegKey4=HKCU\Software\Microsoft\Notepad|iWindowPosY
I search my hard drive for *.bak and *.tmp files and would like help in creating Winapp2.ini entries to remove them please.
C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\OPA11.BAK
C:\Documents and Settings\Charles\Application Data\Microsoft\File Transfer Manager\ftmTransferList.txt.bak
C:\Documents and Settings\Charles\Local Settings\jv16PT_temp.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\DIO4.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\DIO9.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\MAR1.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\MAR2.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG1A0.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG1A1.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG19A.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG19B.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG19C.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG19E.tmp
C:\Documents and Settings\Charles\Local Settings\Temp\REG19F.tmp
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.tmp
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.tmp
C:\Program Files\Google\GoogleToolbarNotifier\GooA32.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\gthA2B.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\gtnA2A.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swgA29.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\gthA2E.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\gtnA2D.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swgA2C.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\gthA31.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\gtnA30.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swgA2F.tmp
C:\Program Files\Secunia\PSI\RCX3CA.tmp
C:\Program Files\TuneXP\docs\hardware.html.bak
C:\Program Files\TuneXP\docs\memoryfs.html.bak
C:\Program Files\Yahoo!\Messenger\Cache\9G0IMTf7KSnOtr1pRkveNQ--.ProfileMap.dat.tmp
C:\RECYCLER\S-1-5-21-1202660629-854245398-1801674531-1003\Dc1.bak
C:\RECYCLER\S-1-5-21-1202660629-854245398-1801674531-1003\Dc2.bak
C:\WINDOWS\msdownld.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2A.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP6B.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP14.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP74D.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP80.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP113A.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP229.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP349.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPDB.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPF21.tmp
C:\WINDOWS\pchealth\helpctr\Config\Cache\Professional_32_1033.dat.bak
C:\WINDOWS\system32\REN72.tmp
C:\WINDOWS\system32\wuapi.dll.wusetup.139324421.bak
C:\WINDOWS\system32\wuauclt.exe.wusetup.139325171.bak
C:\WINDOWS\system32\wuaueng.dll.wusetup.139325937.bak
C:\WINDOWS\system32\NtmsData\NTMSDATA.BAK
Thanks in advance
I just ran CCleaner with the least program open and then did the same DIR as above and got this:
C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\OPA11.BAK
C:\Documents and Settings\Charles\Application Data\Microsoft\File Transfer Manager\ftmTransferList.txt.bak
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.tmp
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.tmp
C:\Program Files\Google\GoogleToolbarNotifier\GooA32.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\gthA2B.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\gtnA2A.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swgA29.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\gthA2E.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\gtnA2D.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swgA2C.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\gthA31.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\gtnA30.tmp
C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swgA2F.tmp
C:\Program Files\Secunia\PSI\RCX3CA.tmp
C:\Program Files\TuneXP\docs\hardware.html.bak
C:\Program Files\TuneXP\docs\memoryfs.html.bak
C:\WINDOWS\msdownld.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2A.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP6B.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP14.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP74D.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP80.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP113A.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP229.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP349.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPDB.tmp
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPF21.tmp
C:\WINDOWS\pchealth\helpctr\Config\Cache\Professional_32_1033.dat.bak
C:\WINDOWS\system32\REN72.tmp
C:\WINDOWS\system32\wuapi.dll.wusetup.139324421.bak
C:\WINDOWS\system32\wuauclt.exe.wusetup.139325171.bak
C:\WINDOWS\system32\wuaueng.dll.wusetup.139325937.bak
C:\WINDOWS\system32\NtmsData\NTMSDATA.BAK
so one can see there are some BAK files from Google... and other places that could be cleaned.
For users of Yahoo Messenger it would be nice if someone would make an winapp2.ini enry to set the chat window size and location back tpo the "just installed" state. Not sure what key it would be but at least HKCU\Software\Yahoo!\pager would be a good start.
I have come up with close to good entries for my BAK and TMP file posts. I'll post the ones I am not sure of at the bottom:
New Entry
[Google Toolbar Notifier*]
LangSecRef=3022
Detect=HKCU\Software\Google\GoogleToolbarNotifier
Default=False
FileKey1=%ProgramFiles%\Google\GoogleToolbarNotifier|*.tmp|RECURSE
[TuneUp XP*]
LangSecRef=3021
DetectFile=%ProgramFiles%\TuneXP
Default=False
FileKey1=%ProgramFiles%\TuneXP\docs\*.bak
[Windows Assembly*]
LangSecRef=????
DetectFile=%WinDir%\assemply
Default=False
FileKey1=%WinDir%\assemply|*.tmp|Recurse
[Misc Windows Tmp/Bak's *]
LangSecRef=3022 <== Not sure ?
DetectFile=%WinDir%\system32
Default=False
FileKey1=%WinDir%\system32|*.bak
FileKey2=%WinDir%\system32|*.tmp
[Registry Backup Files]
LangSecRef=3024
DetectFile1=%UserProfile%\..\LocalService
DetectFile2=%UserProfile%\..\NetworkService
Default=False
Warning=This removes additional registry hive bakcup files
FileKey1=%UserProfile%\..\LocalService\Local Settings\Application Data\Microsoft\Windows|UsrClass.dat.tmp
FileKey2=%UserProfile%\..\NetworkService\Local Settings\Application Data\Microsoft\Windows|UsrClass.dat.tmp
[File Transfer Manager]
LangSecRef=3022 <== ????
DetectFile=%appdata%\Microsoft\File Transfer Manager
Default=False
FileKey1=%appdata%\Microsoft\File Transfer Manager|*.bak
;=====================================================================
Revise Entry
[secunia PSI*]
LangSecRef=3021
Detect1=HKLM\SOFTWARE\Secunia\PSI
Detect2=HKCU\Software\Secunia\PSI
Default=False
FileKey1=%ProgramFiles%\secunia\PSI|sualog.txt
FileKey2=%ProgramFiles%\Secunia\PSI|psialog.txt*
FileKey3=%ProgramFiles%\Secunia\PSI|*.tmp <== ADD
The ones I am not sure of are:
C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\OPA11.BAK
C:\WINDOWS\pchealth\helpctr\Config\Cache\Professional_32_1033.dat.bak
C:\WINDOWS\system32\NtmsData\NTMSDATA.BAK
Thank you.
OPA11.bak and OPA11.dat are your Office 2007 activation files,
According to the KB link below 'NTMSDATA' files are used by the W2K Server/Pro operating systems for backup to media:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;235032
It is also referenced here:
http://support.microsoft.com/kb/235469
[TuneUp XP*]
LangSecRef=3021
DetectFile=%ProgramFiles%\TuneXP
Default=False
FileKey1=%ProgramFiles%\TuneXP\docs\ *.bak
You've got a backslash \ (highlighted in bold red in the quote above) , when it needs that thing I think is called a pipe |
Does that cleaner even work?
If not maybe this:
[TuneUp XP*]
LangSecRef=3021
DetectFile=%ProgramFiles%\TuneXP
Default=False
FileKey1=%ProgramFiles%\TuneXP\docs|*.bak
whoops, I'll hotfix that. one sec.
Thank you very much for the update.
Missed posts:
#1824 (2 new entries)
#1875 (2 modified entries)
#1877 (modified entry)
#1879 (new entry "NetworkService Temps")
#1926 (modified "JDownloader" entries)
#1942 (modified entry)
Modified entry:
[FlashGot*]
LangSecRef=3026
SpecialDetect=DET_MOZILLA
Default=False
FileKey1=%AppData%\Mozilla\Firefox\Profiles\*| FlashGot.log
FileKey2=%AppData%\Mozilla\Firefox\Profiles\*| FlashGot.log.bak*
Modified entry:
[spybot Search and Destroy History*]
LangSecRef=3024
Detect=HKLM\Software\Safer Networking Limited\SpybotSnD
Default=False
FileKey1=%CommonAppData%\Spybot – Search & Destroy\Backups|*.*|RECURSE
FileKey2=%CommonAppData%\Spybot – Search & Destroy\Recovery|*.*|RECURSE
FileKey3=%CommonAppData%\Spybot – Search & Destroy\Snapshots|*.*|RECURSE
FileKey4=%CommonAppData%\Spybot – Search & Destroy\Snapshots2|*.*|RECURSE
Please rename [TuneUp XP*] to [TuneXP*].
And above the entry [Windows Audio/Video (Stats)*] is a blank line missing.
Update for this one, changed from DetectFile to Detect:
[Config.msi Folder*]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Installer
Default=False
FileKey1=%SystemDrive%\Config.msi|*.*|REMOVESELF
New:
[Emsisoft HiJackFree*]
LangSecRef=3024
Detect=HKLM\SOFTWARE\Emsi Software GmbH\a-squared HiJackFree
Default=False
FileKey1=%ProgramFiles%\Emsisoft HiJackFree\Logs|*.*
FileKey2=%ProgramFiles%\Emsisoft HiJackFree|*.old
New - since this is the default location suggested by the PortableApps.com installer, why not:
[ultraDefrag Portable (Log)*]
LangSecRef=3024
DetectFile=%systemdrive%\PortableApps\UltraDefragPortable\UltraDefragPortable.exe
Default=False
FileKey1=%systemdrive%\PortableApps\UltraDefragPortable\Data|UltraDefragPortable.log
New - this registry key keeps a debug record of many .exe files you run:
[Windows ESENT Process (MRU)*]
LangSecRef=3025
Detect=HKLM\SOFTWARE\Microsoft\ESENT
Default=False
RegKey1=HKLM\SOFTWARE\Microsoft\ESENT\Process
----------------------
Shouldn't the name of this be renamed? It has detection for two versions and could be misleading having a version number in the name:
Old:
[Avidemux 2.5 log*]
LangSecRef=3023
Detect1=HKLM\Software\Avidemux 2.5
Detect2=HKLM\Software\Avidemux 2.4
Default=False
FileKey1=%AppData%\avidemux|admlog.txt
Updated:
[Avidemux log*]
LangSecRef=3023
Detect1=HKLM\Software\Avidemux 2.5
Detect2=HKLM\Software\Avidemux 2.4
Default=False
FileKey1=%AppData%\avidemux|admlog.txt
----------------------
I have a question:
Does CCleaner understand when using all current compatible OSes it works on that %Documents% refers to "My Documents"?
Crap, I can't believe I keep missing out on certain entries. I will DEFINITELY make sure they get into the next version, 'cause I'm adding them into the update file right meow!
Edit: Yes, Andavari, as far as I am aware that is the case.