SMalik Posted October 26, 2017 Share Posted October 26, 2017 Revised Entries Adobe Acrobat DC shows up even though I don't have that program on my system, I just have Adobe Acrobat Reader DC. Adobe Acrobat Reader DC creates HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat. When I delete that key and open Adobe Acrobat Reader DC, it re-creates that path again. So let's change the Detect. CCleaner's winapp.ini also has HKLM\Software\Adobe\Acrobat Reader\DC Changed Detect=HKCU\Software\Adobe\Adobe Acrobat\DC to Detect=HKLM\Software\Adobe\Adobe Acrobat\DC [Adobe Acrobat DC*] LangSecRef=3021 Detect=HKLM\Software\Adobe\Adobe Acrobat\DC Default=False FileKey1=%LocalAppData%\Adobe\Acrobat\DC\Cache|*.lst FileKey2=%LocalAppData%\Adobe\Acrobat\DC\ToolsSearchCacheAcro|*.*|RECURSE FileKey3=%LocalAppData%\Adobe\Acrobat\DC|*.lst FileKey4=%LocalAppData%\Adobe\Acrobat\DC|UserCache.bin FileKey5=%LocalLowAppData%\Adobe\Acrobat\DC\Search|*.* RegKey1=HKCU\Software\Adobe\Adobe Acrobat\DC\AVConversionFromPDF\cSettings RegKey2=HKCU\Software\Adobe\Adobe Acrobat\DC\AVConversionToPDF\cSettings RegKey3=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cDockables RegKey4=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles RegKey5=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFolders RegKey6=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentToolsList RegKey7=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cToolbars RegKey8=HKCU\Software\Adobe\Adobe Acrobat\DC\RememberedViews\cNoCategoryFiles RegKey9=HKCU\Software\Adobe\Adobe Acrobat\DC\ShareIdentity RegKey10=HKCU\Software\Adobe\Adobe Synchronizer\DC Changed Detect=HKCU\Software\Adobe\Acrobat Reader\DC to Detect=HKLM\Software\Adobe\Acrobat Reader\DC [Adobe Reader DC More*] LangSecRef=3021 Detect=HKLM\Software\Adobe\Acrobat Reader\DC Default=False FileKey1=%LocalAppData%\Adobe\Acrobat\DC|UserCache.bin RegKey1=HKCU\Software\Adobe\Acrobat Reader\DC\AVConversionFromPDF RegKey2=HKCU\Software\Adobe\Acrobat Reader\DC\AVConversionToPDF RegKey3=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral\cDockables RegKey4=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral\cRecentToolsList RegKey5=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral\cToolbars RegKey6=HKCU\Software\Adobe\Acrobat Reader\DC\RememberedViews\cNoCategoryFiles RegKey7=HKCU\Software\Adobe\Acrobat Reader\DC\ShareIdentity RegKey8=HKCU\Software\Adobe\Adobe Synchronizer\DC Link to comment Share on other sites More sharing options...
siliconman01 Posted October 27, 2017 Share Posted October 27, 2017 Modified Entries: [snagit 13*] and [snagit More*] Incorporated the newly released Snagit 2018 [Snagit 13/18*] LangSecRef=3024 Detect1=HKCU\Software\TechSmith\Snagit\13 Detect2=HKCU\Software\TechSmith\Snagit\18 Default=False RegKey1=HKCU\Software\TechSmith\Snagit\13\Recent Captures RegKey2=HKCU\Software\TechSmith\Snagit\13\SnagitEditor\Recent File List RegKey3=HKCU\Software\TechSmith\Snagit\18\Recent Captures RegKey4=HKCU\Software\TechSmith\Snagit\18\SnagitEditor\Recent File List FileKey1=%LocalAppData%\TechSmith\Snagit|Tray.bin FileKey2=%LocalAppData%\TechSmith\Snagit\DataStore\AppIcons|*.ico FileKey3=%LocalAppData%\TechSmith\Snagit\DataStore\WebSiteIcons|*.ico FileKey4=%LocalAppData%\TechSmith\Snagit\Thumbnails|*.* [Snagit More*] LangSecRef=3024 Detect=HKCU\Software\TechSmith\Snagit Default=False Warning=This will delete the backups of the captures. FileKey1=%Documents%|SnagitDebug.log FileKey2=%LocalAppData%\TechSmith\Logs|*.log FileKey3=%LocalAppData%\TechSmith\Snagit\DataStore|*.SNAG;*.SNAGundo;*.MP4 FileKey4=%LocalAppData%\TechSmith\Snagit\TrackerbirdFiles|*.log RegKey1=HKCU\Software\TechSmith\Snagit\9|StampCustomFolder RegKey2=HKCU\Software\TechSmith\Snagit\10|StampCustomFolder RegKey3=HKCU\Software\TechSmith\Snagit\11|CaptureCount RegKey4=HKCU\Software\TechSmith\Snagit\11|CaptureOpenCount RegKey5=HKCU\Software\TechSmith\Snagit\12|CaptureCount RegKey6=HKCU\Software\TechSmith\Snagit\12|CaptureOpenCount RegKey7=HKCU\Software\TechSmith\Snagit\13|CaptureCount RegKey8=HKCU\Software\TechSmith\Snagit\13|CaptureOpenCount RegKey9=HKCU\Software\TechSmith\Snagit\18|CaptureCount RegKey10=HKCU\Software\TechSmith\Snagit\18|CaptureOpenCount RegKey11=HKCU\Software\TechSmith\Snagit\Stamps|StampCustomFolder Windows 10 x64 Pro on ASUS Maximus VIII Extreme motherboard, i7-6700k CPU,H220 X2 Liquid Cooler, 64 gbyte RipJaws DDR4 3200 RAM, Samsung 970 Pro NVMe M.2 500 gbyte SSD + Samsung 850 Pro 512 gbyte SSD, EVGA RTX 3060 Titan graphics card (Home Built System); Windows 11x64 Pro on 512 gigabyte Dell XPS 15 2-in-1 Laptop/tablet and Dell XPS 8940 PC and Dell XPS 16 9640 Laptop. ASUS RT-AC88U router, 14 tbyte WD My Cloud PR2100 NAS Server, 200 Mbps cable Internet, MS Edge Chromium, MS Office 2021 (Local), Casper 11, DisplayFusion (3 Flat Panel Displays per system): Latest Bitdefender Internet Security, Quicken, Weather Watcher Live, ThumbsPlus 10, Sticky Password 8, WD Smartware, CyberLink PowerDVD23, MSI AfterBurner, Rainmeter, 8GadgetPack, and many more. Link to comment Share on other sites More sharing options...
APMichael Posted October 27, 2017 Share Posted October 27, 2017 Updated the file, but no change log this time as I removed and replaced the file so it didn't show any changes. Fixed all the trailing backslashes and updated with all the suggestions above. Thanks for the update! Missed post: #6485 I found some more entries with a wrong or inconsistent VirtualStore path. And fixed them: [Multi-Edit 2008 11.04*] LangSecRef=3021 Detect=HKCU\Software\Multi Edit Software\Multi-Edit\11.0 Default=False FileKey1=%AppData%\Multi Edit Software\Multi-Edit\11\Config.04|*.bak FileKey2=%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\Tmp|*.* FileKey3=%LocalAppData%\VirtualStore\Program Files*\Multi-Edit 2008\Config|*.tmp FileKey4=%ProgramFiles%\Multi-Edit 2008\Config|*.tmp [My Horse and Me*] Section=Games Detect1=HKLM\SOFTWARE\My Horse and Me 2 Detect2=HKLM\SOFTWARE\Atari\Mein Pferd und ich Demo Detect3=HKLM\SOFTWARE\Atari\Mein Pferd und ich Detect4=HKLM\SOFTWARE\Wow6432Node\Atari\Mein Pferd und ich Demo Detect5=HKLM\SOFTWARE\Wow6432Node\Atari\Mein Pferd und ich Default=False FileKey1=%LocalAppData%\VirtualStore\Program Files*\Atari\Mein Pferd und ich*\System|++ Finish log.txt;++ Start log.txt;*.log|RECURSE FileKey2=%LocalAppData%\VirtualStore\Program Files*\Atari\My Horse and Me|++ Finish log.txt;++ Start log.txt;*.log|RECURSE FileKey3=%LocalAppData%\VirtualStore\Program Files*\Atari\W!Games\My Horse and Me|++ Finish log.txt;++ Start log.txt;*.log|RECURSE FileKey4=%ProgramFiles%\Atari\Mein Pferd und ich*\System|++ Finish log.txt;++ Start log.txt;*.log|RECURSE FileKey5=%ProgramFiles%\Atari\My Horse and Me|++ Finish log.txt;++ Start log.txt;*.log|RECURSE FileKey6=%ProgramFiles%\Atari\W!Games\My Horse and Me|++ Finish log.txt;++ Start log.txt;*.log|RECURSE [Warcraft III*] Section=Games Detect=HKLM\Software\Blizzard Entertainment\Warcraft III DetectFile=%ProgramFiles%\Warcraft III\Warcraft III.exe Default=False FileKey1=%LocalAppData%\VirtualStore\Program Files*\Warcraft III|*.log;*.html FileKey2=%LocalAppData%\VirtualStore\Program Files*\Warcraft III\Errors|*.dmp;*.txt FileKey3=%ProgramFiles%\Warcraft III|*.log;*.html FileKey4=%ProgramFiles%\Warcraft III\Errors|*.dmp;*.txt ExcludeKey1=FILE|%ProgramFiles%\Warcraft III|*CustomKeyInfo.txt;*CustomKeysSample.txt [Yahoo Messenger Cache*] LangSecRef=3022 Detect=HKCU\Software\Yahoo\pager Default=False FileKey1=%AppData%\Yahoo!\Messenger|*.*|RECURSE FileKey2=%LocalAppData%\VirtualStore\Program Files*\Yahoo!\Messenger\Cache|*.*|RECURSE [Yahoo Messenger Logs*] LangSecRef=3022 Detect=HKCU\Software\Yahoo\pager Default=False FileKey1=%LocalAppData%\VirtualStore\Program Files*\Yahoo!\Messenger\Cache|*.log;*.tmp FileKey2=%LocalAppData%\VirtualStore\Program Files*\Yahoo!\Messenger\logs|*.log|RECURSE FileKey3=%ProgramFiles%\Yahoo!\Messenger|*.log ExcludeKey1=FILE|%ProgramFiles%\Yahoo!\Messenger\INSTALL.LOG [Yahoo Messenger Profiles*] LangSecRef=3022 Detect=HKCU\Software\Yahoo\pager Default=False Warning=This will also delete your saved chat histories. FileKey1=%LocalAppData%\VirtualStore\Program Files*\Yahoo!\Messenger\Profiles|*.*|RECURSE FileKey2=%ProgramFiles%\Yahoo!\Messenger\Profiles|*.*|RECURSE Link to comment Share on other sites More sharing options...
CSGalloway Posted October 27, 2017 Share Posted October 27, 2017 Edited as the only TMP/BAK file would be in: "%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\Tmp" [Multi-Edit 2008 11.04*]LangSecRef=3021Detect=HKCU\Software\Multi Edit Software\Multi-Edit\11.0Default=FalseFileKey1=%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\Tmp|*.TMP 1 - All the Yahoo Messenger ones in the above post can be removed. All those are outdated and one must use the Yahoo Messenger App instead now. messenger.yahoo.com for more. *New Entry [Yahoo Messenger App Cache*]LangSecRef=3022Detect=HKCU\Software\Yahoo\pagerDefault=False Warning=You will need to reload the App next time its started. Select View, Reload from the menu.FileKey1=%AppData%\Yahoo Messenger\Cache|*.*|RECURSE *New entry [Yahoo Messenger App Logs*]LangSecRef=3022Detect=HKCU\Software\Yahoo\pagerDefault=FalseFileKey1=%LocalAppData%\yahoomessenger|SquirrelSetup.log Link to comment Share on other sites More sharing options...
SMalik Posted October 28, 2017 Share Posted October 28, 2017 Revised Entry Merged [McAfee SiteAdvisor*] into this entry Added more rules [McAfee*]LangSecRef=3024Detect=HKLM\Software\McAfeeDefault=FalseFileKey1=%CommonAppData%\McAfee\AMCore\datreputation\Logs|*.*|RECURSEFileKey2=%CommonAppData%\McAfee\CSP\ETW|*.bakFileKey3=%CommonAppData%\McAfee\Jcm|*.tmpFileKey4=%CommonAppData%\McAfee\MCLOGS|*.bak;*.log|RECURSEFileKey5=%CommonAppData%\McAfee\MHN|*.bakFileKey6=%CommonAppData%\McAfee\modulecoreservice.exe|*.txtFileKey7=%CommonAppData%\McAfee\MPF\data|*.*|RECURSEFileKey8=%CommonAppData%\McAfee\MSC\Logs|*.logFileKey9=%CommonAppData%\McAfee\SiteAdvisor|*.txt|RECURSEFileKey10=%CommonAppData%\McAfee\Update|*.*|RECURSE FileKey11=%CommonAppData%\McAfee\VirusScan\Data|*.log;*.oldFileKey12=%CommonAppData%\McAfee\VirusScan\Logs|*.*|RECURSEFileKey13=%LocalAppData%\VirtualStore\ProgramData\McAfee\AMCore\datreputation\Logs|*.*|RECURSEFileKey14=%LocalAppData%\VirtualStore\ProgramData\McAfee\CSP\ETW|*.bakFileKey15=%LocalAppData%\VirtualStore\ProgramData\McAfee\Jcm|*.tmpFileKey16=%LocalAppData%\VirtualStore\ProgramData\McAfee\MCLOGS|*.bak;*.log|RECURSEFileKey17=%LocalAppData%\VirtualStore\ProgramData\McAfee\MHN|*.bakFileKey18=%LocalAppData%\VirtualStore\ProgramData\McAfee\modulecoreservice.exe|*.txtFileKey19=%LocalAppData%\VirtualStore\ProgramData\McAfee\MPF\data|*.*|RECURSEFileKey20=%LocalAppData%\VirtualStore\ProgramData\McAfee\MSC\Logs|*.logFileKey21=%LocalAppData%\VirtualStore\ProgramData\McAfee\SiteAdvisor|*.txt|RECURSEFileKey22=%LocalAppData%\VirtualStore\ProgramData\McAfee\Update|*.*|RECURSEFileKey23=%LocalAppData%\VirtualStore\ProgramData\McAfee\VirusScan\Data|*.log;*.oldFileKey24=%LocalAppData%\VirtualStore\ProgramData\McAfee\VirusScan\Logs|*.*|RECURSE Link to comment Share on other sites More sharing options...
ROCKNROLL Posted October 28, 2017 Share Posted October 28, 2017 [My Horse and Me*]Section=GamesDetect1=HKLM\SOFTWARE\My Horse and Me 2Detect2=HKLM\SOFTWARE\Atari\Mein Pferd und ich DemoDetect3=HKLM\SOFTWARE\Atari\Mein Pferd und ichDetect4=HKLM\SOFTWARE\Wow6432Node\Atari\Mein Pferd und ich DemoDetect5=HKLM\SOFTWARE\Wow6432Node\Atari\Mein Pferd und ichDefault=FalseFileKey1=%LocalAppData%\VirtualStore\Program Files*\Atari\Mein Pferd und ich*\System|++ Finish log.txt;++ Start log.txt;*.log|RECURSEFileKey2=%LocalAppData%\VirtualStore\Program Files*\Atari\My Horse and Me|++ Finish log.txt;++ Start log.txt;*.log|RECURSEFileKey3=%LocalAppData%\VirtualStore\Program Files*\Atari\W!Games\My Horse and Me|++ Finish log.txt;++ Start log.txt;*.log|RECURSEFileKey4=%ProgramFiles%\Atari\Mein Pferd und ich*\System|++ Finish log.txt;++ Start log.txt;*.log|RECURSEFileKey5=%ProgramFiles%\Atari\My Horse and Me|++ Finish log.txt;++ Start log.txt;*.log|RECURSEFileKey6=%ProgramFiles%\Atari\W!Games\My Horse and Me|++ Finish log.txt;++ Start log.txt;*.log|RECURSE Does anyone know what Detect 2-5 in this entry is suppose to be? I don't think these are suppose to be here. They seem like custom german entries to me. I am a maintainer for Winapp2. I also have a open-source group on Steam. http://steamcommunity.com/groups/opencommunity Link to comment Share on other sites More sharing options...
APMichael Posted October 28, 2017 Share Posted October 28, 2017 [My Horse and Me*] ... Does anyone know what Detect 2-5 in this entry is suppose to be? I don't think these are suppose to be here. They seem like custom german entries to me. I don't know the game. It looks like there's a special German version available. But Detect4 and 5 are not necessary, because CC checks "Wow6432Node" automatically. I found many entries with an unnecessary "Wow6432Node" Detect, using the following regular expression: ^Detect.+\\Wow6432Node\\.+ Link to comment Share on other sites More sharing options...
SMalik Posted October 28, 2017 Share Posted October 28, 2017 Revised Entry Added: %UserProfile%\MicrosoftEdgeBackups\backups\*|*.*|REMOVESELF [Microsoft Edge More*] LangSecRef=3022 Detect=HKCU\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe DetectFile=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe Default=False FileKey1=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!001\INetCookies|*.*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!001\MicrosoftEdge\Cookies|*.*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!002\INetCookies|*.*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!002\MicrosoftEdge\Cookies|*.*|RECURSE FileKey5=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!001\Microsoft\CryptnetUrlCache|*.*|RECURSE FileKey6=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!002\Microsoft\CryptnetUrlCache|*.*|RECURSE FileKey7=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\Microsoft\CryptnetUrlCache|*.*|RECURSE FileKey8=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\Cookies|*.*|RECURSE FileKey9=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\User\Default\DataStore\Indexed\Data|*.*|RECURSE FileKey10=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\User\Default\ImageStore|*.*|RECURSE FileKey11=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\user\Default\datastore\Data\nouser1\*\DBStore|*.*|RECURSE FileKey12=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\user\Default\datastore\Data\nouser1\*\Favorites|*.*|RECURSE FileKey13=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AppData\User\Default\Indexed DB|*.edb;*.jfm;*.jrs;*.log FileKey14=%UserProfile%\MicrosoftEdgeBackups\backups\*|*.*|REMOVESELF ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\user\Default\datastore\Data\nouser1\*\DBStore|*.edb ExcludeKey2=FILE|%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\user\Default\datastore\Data\nouser1\*\DBStore|*.jfm Link to comment Share on other sites More sharing options...
ROCKNROLL Posted October 28, 2017 Share Posted October 28, 2017 Updates: https://github.com/MoscaDotTo/Winapp2/commit/37e45e25b37ff1c1899edfc37b00d7b7a4cf92bd I am a maintainer for Winapp2. I also have a open-source group on Steam. http://steamcommunity.com/groups/opencommunity Link to comment Share on other sites More sharing options...
CSGalloway Posted October 28, 2017 Share Posted October 28, 2017 Correction to my post https://forum.piriform.com/index.php?showtopic=32310&page=326&do=findComment&comment=288022 Revised entries *Revised Entry - changed Detect [Yahoo Messenger App Cache*]LangSecRef=3022Detect=HKCU\Software\Yahoo\MessengerDefault=False Warning=You will need to reload the App next time its started. Select View, Reload from the menu.FileKey1=%AppData%\Yahoo Messenger\Cache|*.*|RECURSE *Revised entry, changed Detect [Yahoo Messenger App Logs*]LangSecRef=3022Detect=HKCU\Software\Yahoo\MessengerDefault=FalseFileKey1=%LocalAppData%\yahoomessenger|SquirrelSetup.log Link to comment Share on other sites More sharing options...
CSGalloway Posted October 28, 2017 Share Posted October 28, 2017 Can remove as newer version is available [Multi-Edit 9.0*]LangSecRef=3021Detect=HKCU\Software\American Cybernetics\Multi-Edit\9.0Default=FalseFileKey1=%LocalAppData%\VirtualStore\Program Files*\Multi-Edit 9\Config\Tmp|*.*FileKey2=%ProgramFiles%\Multi-Edit 9\Config\Tmp|*.* *Revised entry, added all ExcludeKeys... [Multi-Edit 2008 Logs*]LangSecRef=3024DetectFile=%AppData%\Multi Edit SoftwareDefault=FalseFileKey1=%AppData%\Multi Edit Software|*.log|RECURSEExcludeKey1=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|EVOLVE.LOGExcludeKey2=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|FILEPANE.LOGExcludeKey3=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|INSTALL.LOGExcludeKey4=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|POLYSTYLE.LOGExcludeKey5=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|TMPLPANE.LOGExcludeKey6=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|WINLIST.LOG Link to comment Share on other sites More sharing options...
SMalik Posted October 28, 2017 Share Posted October 28, 2017 Please remove "CBS Logs" entry. It is included in CCleaner's "Windows Log Files". Link to comment Share on other sites More sharing options...
SMalik Posted October 28, 2017 Share Posted October 28, 2017 Revised Entry Added: %WinDir%\Panther\Rollback|*.txt [Panther*]LangSecRef=3025DetectFile=%Windir%\PantherDefault=FalseFileKey1=%WinDir%\Panther|cbs.log;DDACLSys.log;miglog.xml;Migrep.html;PostGatherPnPList.log;PreGatherPnPList.logFileKey2=%WinDir%\Panther\FastCleanup|*.logFileKey3=%WinDir%\Panther\Rollback|*.txtFileKey4=%WinDir%\Panther\UnattendGC|diagerr.xml;diagwrn.xmlFileKey5=%WinDir%\System32\sysprep\Panther\IE|diagerr.xml;diagwrn.xml;*.log Link to comment Share on other sites More sharing options...
siliconman01 Posted October 29, 2017 Share Posted October 29, 2017 Please remove "CBS Logs" entry. It is included in CCleaner's "Windows Log Files". cbs_log.png I wonder if the "Windows Log Files" in winapp.ini also removes the .cab files that are part of [CBS Logs*] ?? [CBS Logs*] LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows Default=False FileKey1=%WinDir%\Logs\CBS|cbs.log;*.cab Windows 10 x64 Pro on ASUS Maximus VIII Extreme motherboard, i7-6700k CPU,H220 X2 Liquid Cooler, 64 gbyte RipJaws DDR4 3200 RAM, Samsung 970 Pro NVMe M.2 500 gbyte SSD + Samsung 850 Pro 512 gbyte SSD, EVGA RTX 3060 Titan graphics card (Home Built System); Windows 11x64 Pro on 512 gigabyte Dell XPS 15 2-in-1 Laptop/tablet and Dell XPS 8940 PC and Dell XPS 16 9640 Laptop. ASUS RT-AC88U router, 14 tbyte WD My Cloud PR2100 NAS Server, 200 Mbps cable Internet, MS Edge Chromium, MS Office 2021 (Local), Casper 11, DisplayFusion (3 Flat Panel Displays per system): Latest Bitdefender Internet Security, Quicken, Weather Watcher Live, ThumbsPlus 10, Sticky Password 8, WD Smartware, CyberLink PowerDVD23, MSI AfterBurner, Rainmeter, 8GadgetPack, and many more. Link to comment Share on other sites More sharing options...
APMichael Posted October 29, 2017 Share Posted October 29, 2017 I wonder if the "Windows Log Files" in winapp.ini also removes the .cab files that are part of [CBS Logs*] ?? No, CC doesn't remove the .cab files! (winsys.ini: FileKey15=%windir%\Logs|*.log|RECURSE) Modified entry: [CBS Logs*] LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows Default=False FileKey1=%WinDir%\Logs\CBS|*.cab Link to comment Share on other sites More sharing options...
APMichael Posted October 29, 2017 Share Posted October 29, 2017 I found many entries with an unnecessary "Wow6432Node" Detect, using the following regular expression: ^Detect.+\\Wow6432Node\\.+ Modified entries: Revised those Detect lines. [Active Setup Temp Folder*] LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Active Setup Temp Folders [Age of Empires*] Section=Games Detect1=HKLM\Software\Microsoft\Games\Age of Empires Detect2=HKLM\Software\Microsoft\Microsoft Games\Age of Empires Detect3=HKLM\Software\Microsoft\microsoft games\age of empires 3 [Auslogics Registry Cleaner*] LangSecRef=3024 Detect1=HKCU\Software\Auslogics\Registry Cleaner Detect2=HKLM\Software\Auslogics\Registry Cleaner\3.x Detect3=HKLM\Software\Auslogics\Registry Cleaner\4.x Detect4=HKLM\Software\Auslogics\Registry Cleaner\5.X [Bitcoin*] LangSecRef=3022 Detect1=HKCU\Software\Bitcoin Detect2=HKCU\Software\Bitcoin Core Detect3=HKLM\SOFTWARE\Bitcoin Core [Copernic DesktopSearch4 Logs*] LangSecRef=3024 Detect=HKLM\SOFTWARE\Copernic\DesktopSearch4 [Crysis 3*] Section=Games Detect=HKLM\Software\Crytek\Crysis 3 [CyberLink PhotoDirector*] LangSecRef=3023 Detect1=HKCU\Software\CyberLink\PhotoDirector3 Detect2=HKLM\Software\CyberLink\PhotoDirector4 Detect3=HKLM\SOFTWARE\CyberLink\PhotoDirector6 Detect4=HKCU\Software\Cyberlink\PowerDirector7 Detect5=HKCU\Software\CyberLink\PowerDirector10 Detect6=HKCU\Software\CyberLink\PowerDirector11 Detect7=HKCU\Software\CyberLink\PowerDirector12 Detect8=HKCU\Software\CyberLink\PowerDirector13 [Dragon Age: Origins*] Section=Games Detect1=HKCU\Software\BioWare\Dragon Age Detect2=HKLM\Software\BioWare\Dragon Age [DVBDream*] LangSecRef=3024 Detect=HKLM\SOFTWARE\DVBDream [Forte Agent*] LangSecRef=3025 Detect=HKLM\SOFTWARE\Forte [FossaMail Corrupt SQLites*] LangSecRef=3030 Detect=HKLM\SOFTWARE\Mozilla\FossaMail [FossaMail Crash Reports*] LangSecRef=3030 Detect=HKLM\SOFTWARE\Mozilla\FossaMail [FossaMail Extensions Log*] LangSecRef=3030 Detect=HKLM\SOFTWARE\Mozilla\FossaMail [FossaMail Log*] LangSecRef=3030 Detect=HKLM\SOFTWARE\Mozilla\FossaMail [FossaMail Maintenance Service*] LangSecRef=3030 Detect=HKLM\SOFTWARE\Mozilla\FossaMail [FossaMail Minidumps*] LangSecRef=3030 Detect=HKLM\SOFTWARE\Mozilla\FossaMail [FossaMail Net Predictions*] LangSecRef=3030 Detect=HKLM\SOFTWARE\Mozilla\FossaMail [FossaMail Startup Cache*] LangSecRef=3030 Detect=HKLM\SOFTWARE\Mozilla\FossaMail [FossaMail TestPilot Error Logs*] LangSecRef=3030 Detect=HKLM\SOFTWARE\Mozilla\FossaMail [FossaMail Update Logs*] LangSecRef=3030 Detect=HKLM\SOFTWARE\Mozilla\FossaMail [FossaMail webappsstore.sqlite*] LangSecRef=3030 Detect=HKLM\SOFTWARE\Mozilla\FossaMail [Hedgewars VideoTemp*] Section=Games Detect=HKLM\SOFTWARE\Hedgewars [HitmanPro*] LangSecRef=3024 Detect1=HKCU\Software\HitMan Pro Detect2=HKCU\Software\HitMan Pro 2 Detect3=HKCU\Software\HitMan Pro 3 Detect4=HKLM\SOFTWARE\HitmanPro [League of Legends*] Section=Games Detect1=HKCU\Software\Bugsplat\lol_beta_riotgames_com Detect2=HKCU\Software\Riot Games Detect3=HKLM\Software\Riot Games [Logitech Desktop Messenger*] LangSecRef=3024 Detect1=HKCU\Software\Logitech\DesktopMessenger Detect2=HKLM\SOFTWARE\Logitech\DesktopMessenger Detect3=HKLM\SOFTWARE\Logitech\Logitech Desktop Messenger [Microsoft XNA Game Studio*] Section=Games Detect=HKLM\Software\Microsoft\XNA [Midori - Cache*] LangSecRef=3022 Detect=HKLM\Software\Midori [Midori - Cookies*] LangSecRef=3022 Detect=HKLM\Software\Midori [Midori - History*] LangSecRef=3022 Detect=HKLM\Software\Midori [Midori - Session*] LangSecRef=3022 Detect=HKLM\Software\Midori [Neostar CMS Station Client Logs*] LangSecRef=3024 Detect=HKLM\SOFTWARE\company\Neostar CMS [Nero*] LangSecRef=3021 Detect1=HKLM\Software\Nero\Nero 11\Nero11Suite Detect2=HKLM\Software\Nero\Nero 12\Nero12Suite [OpenOffice.org Setup Files*] LangSecRef=3021 Detect1=HKLM\Software\OpenOffice Detect2=HKLM\Software\OpenOffice.org [OpenOffice.org*] LangSecRef=3021 Detect1=HKLM\Software\OpenOffice Detect2=HKLM\Software\OpenOffice.org [Samsung Magician Logs*] LangSecRef=3021 Detect=HKLM\Software\Samsung Magician [Seagate SeaTools for Windows Logs*] LangSecRef=3024 Detect=HKLM\SOFTWARE\SeaToolsforWindows [TrendMicro RUBotted Logs*] LangSecRef=3024 Detect=HKLM\SOFTWARE\TrendMicro\RUBotted [UltraDefrag Logs*] LangSecRef=3024 Detect=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\UltraDefrag DetectFile=%WinDir%\UltraDefrag\ultradefrag.exe [Windows Live Writer Logs*] LangSecRef=3024 Detect=HKLM\SOFTWARE\Microsoft\Windows Live Writer [Wistron Corp Launch Manager Logs*] LangSecRef=3024 Detect=HKLM\SOFTWARE\Wistron Corp\Launch Manager [Wondershare PDF Editor*] LangSecRef=3021 Detect=HKLM\Software\Wondershare\Wondershare PDF Editor [Wondershare Video Converter Ultimate More*] LangSecRef=3023 Detect=HKLM\SOFTWARE\Wondershare\Wondershare Video Converter Ultimate [XnView More*] LangSecRef=3023 Detect1=HKCU\Software\XnView Detect2=HKLM\Software\XnView Link to comment Share on other sites More sharing options...
APMichael Posted October 29, 2017 Share Posted October 29, 2017 (edited) *Revised entry, added all ExcludeKeys... [Multi-Edit 2008 Logs*] ... Modified entry: Changed Detect and removed unnecessary pipe symbols from ExcludeKeys. [Multi-Edit 2008 Logs*] LangSecRef=3024 Detect=HKCU\Software\Multi Edit Software\Multi-Edit\11.0 Default=False FileKey1=%AppData%\Multi Edit Software|*.log|RECURSE ExcludeKey1=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\EVOLVE.LOG ExcludeKey2=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\FILEPANE.LOG ExcludeKey3=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\INSTALL.LOG ExcludeKey4=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\POLYSTYLE.LOG ExcludeKey5=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\TMPLPANE.LOG ExcludeKey6=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\WINLIST.LOG Modified entry: Changed name from [Multi-Edit 2008 11.04*] to [Multi-Edit 2008 Temps*] and corrected LangSecRef. [Multi-Edit 2008 Temps*] LangSecRef=3024 Detect=HKCU\Software\Multi Edit Software\Multi-Edit\11.0 Default=False FileKey1=%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\Tmp|*.TMP Edit: Fixed entry. Edited October 30, 2017 by APMichael Link to comment Share on other sites More sharing options...
APMichael Posted October 29, 2017 Share Posted October 29, 2017 Modified entry: Removed unnecessary pipe symbols from ExcludeKeys. [FlashPlayer SharedObjects*] LangSecRef=3029 SpecialDetect=DET_CHROME Detect1=HKCU\Software\Chromium Detect2=HKCU\Software\SuperBird Detect3=HKCU\Software\Torch Detect4=HKCU\Software\Vivaldi Default=False FileKey1=%LocalAppData%\Amigo\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE FileKey2=%LocalAppData%\Chrome Plus\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE FileKey3=%LocalAppData%\Chromium\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE FileKey4=%LocalAppData%\Flock\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE FileKey5=%LocalAppData%\Google\Chrome*\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE FileKey6=%LocalAppData%\Rockmelt\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE FileKey7=%LocalAppData%\SRWare Iron\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE FileKey8=%LocalAppData%\SuperBird\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE FileKey9=%LocalAppData%\Torch\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE FileKey10=%LocalAppData%\Vivaldi\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE ExcludeKey1=FILE|%LocalAppData%\Amigo\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol ExcludeKey2=FILE|%LocalAppData%\Chrome Plus\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol ExcludeKey3=FILE|%LocalAppData%\Chromium\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol ExcludeKey4=FILE|%LocalAppData%\Flock\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol ExcludeKey5=FILE|%LocalAppData%\Google\Chrome*\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol ExcludeKey6=FILE|%LocalAppData%\Rockmelt\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol ExcludeKey7=FILE|%LocalAppData%\SRWare Iron\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol ExcludeKey8=FILE|%LocalAppData%\SuperBird\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol ExcludeKey9=FILE|%LocalAppData%\Torch\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol ExcludeKey10=FILE|%LocalAppData%\Vivaldi\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol Modified entry: Removed unnecessary pipe symbol from ExcludeKey. [Jump Lists*] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows Default=False FileKey1=%AppData%\Microsoft\windows\recent\Automaticdestinations|*.*|RECURSE FileKey2=%AppData%\Microsoft\windows\recent\CustomDestinations|*.*|RECURSE ExcludeKey1=FILE|%AppData%\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms Link to comment Share on other sites More sharing options...
CSGalloway Posted October 29, 2017 Share Posted October 29, 2017 I wonder if the "Windows Log Files" in winapp.ini also removes the .cab files that are part of [CBS Logs*] ?? [CBS Logs*] LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows Default=False FileKey1=%WinDir%\Logs\CBS|cbs.log;*.cab CAB was not found in any of the 3 INI files once I exported them from the current CC version.... Link to comment Share on other sites More sharing options...
SMalik Posted October 29, 2017 Share Posted October 29, 2017 No, CC doesn't remove the .cab files! (winsys.ini: FileKey15=%windir%\Logs|*.log|RECURSE) Modified entry: [CBS Logs*] LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows Default=False FileKey1=%WinDir%\Logs\CBS|*.cab I never saw files with the .cab extension in that location. I think this was added into this entry mistakenly. Link to comment Share on other sites More sharing options...
SMalik Posted October 29, 2017 Share Posted October 29, 2017 CAB was not found in any of the 3 INI files once I exported them from the current CC version.... It is in winsys.ini. I have highlighted the entry. Link to comment Share on other sites More sharing options...
SMalik Posted October 29, 2017 Share Posted October 29, 2017 Modified entry: Removed unnecessary pipe symbols from ExcludeKeys. [FlashPlayer SharedObjects*] LangSecRef=3029 SpecialDetect=DET_CHROME Detect1=HKCU\Software\Chromium Detect2=HKCU\Software\SuperBird Detect3=HKCU\Software\Torch Detect4=HKCU\Software\Vivaldi Default=False FileKey1=%LocalAppData%\Amigo\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE FileKey2=%LocalAppData%\Chrome Plus\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE FileKey3=%LocalAppData%\Chromium\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE FileKey4=%LocalAppData%\Flock\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE FileKey5=%LocalAppData%\Google\Chrome*\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE FileKey6=%LocalAppData%\Rockmelt\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE FileKey7=%LocalAppData%\SRWare Iron\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE FileKey8=%LocalAppData%\SuperBird\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE FileKey9=%LocalAppData%\Torch\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE FileKey10=%LocalAppData%\Vivaldi\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE ExcludeKey1=FILE|%LocalAppData%\Amigo\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol ExcludeKey2=FILE|%LocalAppData%\Chrome Plus\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol ExcludeKey3=FILE|%LocalAppData%\Chromium\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol ExcludeKey4=FILE|%LocalAppData%\Flock\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol ExcludeKey5=FILE|%LocalAppData%\Google\Chrome*\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol ExcludeKey6=FILE|%LocalAppData%\Rockmelt\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol ExcludeKey7=FILE|%LocalAppData%\SRWare Iron\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol ExcludeKey8=FILE|%LocalAppData%\SuperBird\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol ExcludeKey9=FILE|%LocalAppData%\Torch\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol ExcludeKey10=FILE|%LocalAppData%\Vivaldi\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol Modified entry: Removed unnecessary pipe symbol from ExcludeKey. [Jump Lists*] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows Default=False FileKey1=%AppData%\Microsoft\windows\recent\Automaticdestinations|*.*|RECURSE FileKey2=%AppData%\Microsoft\windows\recent\CustomDestinations|*.*|RECURSE ExcludeKey1=FILE|%AppData%\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms There are no extra pipe symbols in these entries. You must have an old Winapp2.ini. Link to comment Share on other sites More sharing options...
SMalik Posted October 29, 2017 Share Posted October 29, 2017 There are no extra pipe symbols in these entries. You must have an old Winapp2.ini. I see it. ExcludeKey1=FILE|%AppData%\Microsoft\Windows\Recent\AutomaticDestinations\|f01b4d95cf55d32a.automaticDestinations-ms Link to comment Share on other sites More sharing options...
CSGalloway Posted October 29, 2017 Share Posted October 29, 2017 It is in winsys.ini. I have highlighted the entry. windows_log_files.png You highlighted the %windir%\Logs folder and it recursively looks for *.log files - NO mention of *.CAB - Link to comment Share on other sites More sharing options...
SMalik Posted October 29, 2017 Share Posted October 29, 2017 You highlighted the %windir%\Logs folder and it recursively looks for *.log files - NO mention of *.CAB - Please look at this post https://forum.piriform.com/index.php?showtopic=32310&p=288084 Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now