Winapp2.ini additions

[Andavari]

4 hours ago, APMichael said:

We revised the entry [Cortana *] a few weeks ago because it always broke the search for settings. We fixed that by adding an ExcludeKey for a cache file ("SettingsCache.txt"). But now it looks like the other files ("AppCache###.txt") should not be deleted either. I think we should then exclude the entire folder ("\LocalState\DeviceSearchCache").

(An easy way to restore Cortana: Right-click on the Cortana icon and click on "More" and then on "App Settings". Now click on "Reset" and wait a few seconds.)

Does this look right to exclude that whole path you refer to?
ExcludeKey1=PATH|%LocalAppData%\Packages\Microsoft.Windows.Cortana_*\LocalState\|DeviceSearchCache

Edit:
Couldn't get it to exclude using a path, however I got this to work as intended:
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Windows.Cortana_*\LocalState\DeviceSearchCache\|*.*

Also the way you suggest to restore Cortana functionality does not work if Cortana is purposely disabled by the user, and the user is instead just using it as a normal local search, hence the reason I use a batch script to restore the functionality.

[CSGalloway]

58 minutes ago, Andavari said:

Does this look right to exclude that whole path you refer to?
ExcludeKey1=PATH|%LocalAppData%\Packages\Microsoft.Windows.Cortana_*\LocalState\|DeviceSearchCache

Edit:
Couldn't get it to exclude using a path, however I got this to work as intended:
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Windows.Cortana_*\LocalState\DeviceSearchCache\|*.*

Also the way you suggest to restore Cortana functionality does not work if Cortana is purposely disabled by the user, and the user is instead just using it as a normal local search, hence the reason I use a batch script to restore the functionality.

Please share the batch script you mentioned.....

[Andavari]

6 hours ago, CSGalloway said:

Please share the batch script you mentioned.....

Don't remember the download site for it, but since it has no copyright info inside it here you go:

1. What it does: Repairs Cortana/Search in Windows 10 after a cleaning program unintentionally breaks the functionality.

2. Copy+Paste this into Notepad:

@echo off
net stop wsearch
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Search" /v SetupCompletedSuccessfully /t REG_DWORD /d 0 /f
del "%ProgramData%\Microsoft\Search\Data\Applications\Windows\Windows.edb"
:wsearch
net start wsearch
IF NOT %ERRORLEVEL%==0 (goto :wsearch) ELSE goto :END
:END

3. Save as a useful name such as:
Reset And Rebuild Search Index (Requires Admin Priveleges).bat

4. When using the .bat file right click and: Run as administrator

5. After using the .bat file you must restart your computer for the repair to work.

[siliconman01]

Suggested Modified entry:  [MS Search *]

Remove FileKey1=%CommonAppData%\Microsoft\Search\Data\Applications\Windows|Windows.edb

This causes "Corrupted Index" error messages in the Event Viewer and forces Search to restart and rebuild the Index.

[MS Search *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
FileKey1=%CommonAppData%\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex|*.*|RECURSE
FileKey2=%CommonAppData%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap|*.*|RECURSE
FileKey3=%CommonAppData%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore|*.*|RECURSE
FileKey4=%UserProfile%\Searches|*.search-ms
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Search\JumplistData
RegKey2=HKLM\Software\Microsoft\Windows Search\VolumeInfoCache

NOTE:  It does appear that [MS Search *] is not at all compatible with the upcoming April update of Windows 10.  Insider Build 18334 issues numerous red "error" reports in the Event Viewer if [MS Search *] is active.  

[APMichael]

15 hours ago, Andavari said:

Does this look right to exclude that whole path you refer to?
ExcludeKey1=PATH|%LocalAppData%\Packages\Microsoft.Windows.Cortana_*\LocalState\|DeviceSearchCache

Edit:
Couldn't get it to exclude using a path, however I got this to work as intended:
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.Windows.Cortana_*\LocalState\DeviceSearchCache\|*.*

The use of PATH is correct, but also requires the "\|*.*" at the end.

15 hours ago, Andavari said:

Also the way you suggest to restore Cortana functionality does not work if Cortana is purposely disabled by the user, and the user is instead just using it as a normal local search, hence the reason I use a batch script to restore the functionality.

Strange, I have disabled Cortana on all my systems (using group policies) and was able to restore it (rebuild those cache files) using the suggested way.

[APMichael]

25 minutes ago, siliconman01 said:

... Remove FileKey1=%CommonAppData%\Microsoft\Search\Data\Applications\Windows|Windows.edb ...

Is the file no longer locked by the "Windows Search" service? Normally, you cannot delete it without stopping the service.

[siliconman01]

9 minutes ago, APMichael said:

Is the file no longer locked by the "Windows Search" service? Normally, you cannot delete it without stopping the service.

It does appear to be locked.  However, if I run MS Search with that FileKey in MS Search and then reboot my system, the Event Viewer issues a message that Search has to rebuild the system index.  If that FileKey is removed, this does not occur on reboot.  

[APMichael]

What a strange error! Since the file "Windows.edb" is not really crap (only if you have disabled the service "Windows Search", but this is not the system default), removing the FileKey should not be a problem.

[APMichael]

Thanks for the new and revised entries.

Winapp2.ini update:
https://github.com/MoscaDotTo/Winapp2/commit/cccdfc0b67f2b5e55cc7e598f2ddf9e2746db5d0

[Andavari]

6 hours ago, APMichael said:

What a strange error! Since the file "Windows.edb" is not really crap (only if you have disabled the service "Windows Search", but this is not the system default), removing the FileKey should not be a problem.

I'm wondering if some of the discoveries of things to remove from cleaners that cause issues would instead be better serviced by instead changing them into an ExcludeKey. The ideal behind this is if/when someone decides to "update" the cleaner it will be obvious they shouldn't add in something that's already being excluded. Just an ideal.

[APMichael]

Yes, we might want to think about that. But usually all removed keys or entries are moved to the Winapp3.ini.

[siliconman01]

Here is what works on all my systems(including my Insider test machine) and eliminates numerous SEARCH errors in the Event Viewer if a user has [MS Search *] check marked, runs CCleaner, and then reboots.   Up until the last few days I have always left MS Search and MS Search * unchecked because of all the red errors MS Search * causes in its current state

[MS Search *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
FileKey1=%CommonAppData%\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex|*.*|RECURSE
;FileKey2=%CommonAppData%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap|*.*|RECURSE
;FileKey3=%CommonAppData%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore|*.*|RECURSE
FileKey2=%UserProfile%\Searches|*.search-ms
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Search\JumplistData
;RegKey2=HKLM\Software\Microsoft\Windows Search\VolumeInfoCache

 

[APMichael]

Thank you for your research. Should we update the entry or should we wait to see if it's just related to the insider build?

[Andavari]

I've just discovered something inadvertently when I copied my own maintained winapp2.ini file to my mother's laptop, and it's a good thing I clicked Analyze first or I would've been reinstalling her installed version of Firefox Quantum.

So I would say to anyone don't trust your own cleaners just because you've made them for your own personal systems and then expect them to work safely as intended on another system they've never been used on before. Especially if like me you primarily use the portable version of software because it has the potential to wreak havoc on another system that uses the installed version of a software.

Since I use Firefox Portable I have a cleaner that will remove its AppData files if it ever crashes, I've used that cleaner and Firefox Portable for years. Now if that cleaner is ran against an installed version of Firefox it will damage it by incorrectly targeting files that should exist.

This is my error that I luckily avoided (would've been a really bad screw up since I had Default=True):
[Crash Cleanup *]
Section=Firefox ESR Portable
SpecialDetect=DET_MOZILLA
Default=True
FileKey1=%AppData%\Mozilla\Extensions|*.*|REMOVESELF
FileKey2=%AppData%\Mozilla\Firefox|*.*|REMOVESELF

[SMalik]

5 hours ago, APMichael said:

Thank you for your research. Should we update the entry or should we wait to see if it's just related to the insider build?

It is not a wise idea to test entries against Windows Insider Preview.

[SMalik]

New Entry

[Complete Internet Repair *]
LangSecRef=3024
DetectFile=%ProgramFiles%\Rizonesoft\Complete Internet Repair\ComIntRep.exe
Default=False
FileKey1=%AppData%\Rizonesoft\ComIntRep\Logging|*.*|RECURSE

[siliconman01]

11 hours ago, APMichael said:

Thank you for your research. Should we update the entry or should we wait to see if it's just related to the insider build?

These errors were also occurring on Build 17763.292 Build 1809 on all my non-Insider Build systems.  I recommend that we go with the code below

[MS Search *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
FileKey1=%CommonAppData%\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex|*.*|RECURSE
FileKey2=%UserProfile%\Searches|*.search-ms
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Search\JumplistData

 

[SMalik]

[MS Search  *] entry does not work as expected because some of the files require the system to be restarted to be wiped and CCleaner does not have that option. This entry works fine in Windows Safe Mode.

I think all of the FileKey’s and RegKey’s in the current entry should stay. These traces should be wiped including PropMap and SecStore. All known privacy cleaner programs, like R-Wipe & Clean and east-tec Eraser wipe these traces.

Entries or part of the entries that require the system to restart should not be moved to Winapp3.ini just because of this.

Edited February 13, 2019 by SMalik
easr-tec Eraser > east-tec Eraser

[siliconman01]

1 hour ago, SMalik said:

[MS Search  *] entry does not work as expected because some of the files require the system to be restarted to be wiped and CCleaner does not have that option. This entry works fine in Windows Safe Mode.

I think all of the FileKey’s and RegKey’s in the current entry should stay. These traces should be wiped including PropMap and SecStore. All known privacy cleaner programs, like R-Wipe & Clean and easr-tec Eraser wipe these traces.

Entries or part of the entries that require the system to restart should not be moved to Winapp3.ini just because of this.

I disagree with leaving it all the keys in for Winapp2.ini.  The normal user doesn't even have a warning that it "it works fine in Windows Safe Mode".  I suggest your version of this be placed in Winapp3.ini and my suggested version be in Winapp2.ini because it keeps the files trimmed out of GatherLogs ( 2 files added daily) and doesn't result in a multitude of error messages in Event Viewer on system reboot ( I bet 98% of global computer users don't even know what Event Viewer is, much less know how to correct errors that affect their system's performance).  In addition, this reg key causes SmartSense issues with Casper 10 system backup software.   Or perhaps we could set up a "SECTION=Use only in Windows Safe Mode" in Winapp2.ini. 

RegKey2=HKLM\Software\Microsoft\Windows Search\VolumeInfoCache

[SMalik]

Internet Explorer, Microsoft Edge, some Microsoft Store apps, Cached File Extensions, Compatibility Assistant, Delivery Optimization, Fonts Cache, Icon Cache, Jump Lists, LocalService, LocalSystem, MS Search, NetworkService, Power Efficiency Diagnostics, Push Notifications, Windows Error Reporting, Windows Logs, Windows ShellBags, Windows Subsystems, Windows Update and some built-in CCleaner entries require the system to be restarted to wipe those traces successfully.

If we take these entries out from CCleaner and Winapp2.ini, what will we have left? On one hand, you have Winapp3.ini to destroy programs’ functionality and on the other hand, you cannot accept entries that won’t break programs’ functionality, but just require a system restart to get them to work properly.

By the way, I always wipe PropMap and SecStore in Windows Search and I have never gotten any errors related to Search in Event Viewer. The only time I get errors in Event Viewer is when I try to wipe Windows.edb from Windows Search.

[Andavari]

Maybe some entries need beta testing & testers (who know beforehand to backup their system drive) before those cleaners go live in winapp2.ini, especially if what's being cleaned is in question such as removing things associated with the Windows OS.

[Andavari]

New entry. Includes both Detect, and DetectFile because CCleaner's registry cleaner will remove the empty Detect= key HKCU\Software\APR.

[Autoplay Repair *]
LangSecRef=3024
Detect=HKCU\Software\APR
DetectFile=%ProgramFiles%\Autoplay Repair\Autoplay Repair.exe
Default=False
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Run\APR_DEACTIVATED
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\APR_DEACTIVATED
RegKey3=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\APR_DEACTIVATED
RegKey4=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\APR_DEACTIVATED

[APMichael]

12 hours ago, SMalik said:

... entries require the system to be restarted to wipe those traces successfully.

Can you please explain a little more? You mean that the system should be rebooted immediately after using CCleaner, right? Is the reason that Windows caches the content in the memory (RAM)? Or what else does the reboot do? Files that CCleaner can not delete are also not deleted after a reboot, right? (I ask this because I usually don't reboot after cleaning and I haven't noticed any side effects yet.)

 

12 hours ago, SMalik said:

By the way, I always wipe PropMap and SecStore in Windows Search and I have never gotten any errors related to Search in Event Viewer. ...

I think that's the only thing we should be judging. Are there errors due to the current entry or not? Unfortunately I have disabled Windows Search on all my systems, so I can't help here. Can someone else please tell here if the entry causes errors on their system? Thanks!

[SMalik]

11 hours ago, APMichael said:

Can you please explain a little more? You mean that the system should be rebooted immediately after using CCleaner, right? Is the reason that Windows caches the content in the memory (RAM)? Or what else does the reboot do? Files that CCleaner can not delete are also not deleted after a reboot, right? (I ask this because I usually don't reboot after cleaning and I haven't noticed any side effects yet.)

 

I think that's the only thing we should be judging. Are there errors due to the current entry or not? Unfortunately I have disabled Windows Search on all my systems, so I can't help here. Can someone else please tell here if the entry causes errors on their system? Thanks!

The programs I mentioned in my previous post wipe the traces and then restart the system to wipe files locked by Windows or other programs.

[siliconman01]

In my opinion it is not the intent of the CCleaner developers to force or advocate users to reboot their system following using CCleaner.  And I do not feel that we should put entries or keys in Winapp2.ini that only work properly if the system is rebooted following a CCleaner execution with Winapp2.ini.  Heck, I run CCleaner more than once each day and I certainly do not want to be rebooting after CCleaner is used.  I doubt that most users would be pleased if they had to reboot each time CCleaner is run.