Winapp2.ini additions

SMalik · May 25, 2014

Thanks

You're welcome and thank you for updating Winapp2.ini.

Winapp2.ini · May 25, 2014

Does AutoPlay devices wipe out the default action for devices connected to the computer?

SMalik · May 25, 2014

Does AutoPlay devices wipe out the default action for devices connected to the computer?

This explains more:

http://answers.microsoft.com/en-us/windows/forum/windows_vista-hardware/obsolete-devices-in-autoplay-list-multiple-entries/6058b961-fb2a-4da0-af3f-7c4f96d3aa81

Winapp2.ini · May 25, 2014

That clarifies it somewhat, but it seems like it could mess with people not expecting it to wipe out their known device defaults

back_track · May 25, 2014

thx for the big update:

[BlueStacks Setup*]
Warning=You have to download this files again at a reinstall
LangSecRef=3021
Detect1=HKCU\Software\Bluestacks
Detect2=HKLM\Software\Bluestacks
DetectFile=%CommonAppData%\BlueStacks
Default=False
FileKey1=%CommonAppData%\BlueStacksSetup\Images\|*.*|REMOVESELF
FileKey2=%CommonAppData%\BlueStacksSetup|runtimedata_*.zip;runtimedata_*.zip.manifest
FileKey3=%LocalAppData%\VirtualStore\ProgramData\BlueStacksSetup\Images\|*.*|REMOVESELF
FileKey4=%LocalAppData%\VirtualStore\ProgramData\BlueStacksSetup|runtimedata_*.zip;runtimedata_*.zip.manifest

Improve key 2 and 4

-new


[NVIDIA GLCache*]
LangSecRef=3023
Detect=HKLM\Software\NVIDIA Corporation
Default=False
FileKey1=%AppData%\NVIDIA\GLCache|*.*|RECURSE


[Mixxx*]
LangSecRef=3023
DetectFile=%UserProfile%\Local Settings\Application Data\Mixxx
Default=False
FileKey1=%UserProfile%\Local Settings\Temp|*.*
FileKey2=%UserProfile%\Local Settings\Application Data\Mixxx|*.log

mta · May 25, 2014

That clarifies it somewhat, but it seems like it could mess with people not expecting it to wipe out their known device defaults

will wipe out any device ever connected where the user told Autoplay how to handle that device.

so maybe a warning would be best.

back_track · May 25, 2014

C:\Windows\SoftwareDistribution\Download

could be delt?

Nergal · May 25, 2014

C:\Windows\SoftwareDistribution\Download
could be delt?

Often suggested but it can cause issues

Winapp2.ini · May 25, 2014

C:\Windows\SoftwareDistribution\Download

could be delt?

As Nergal above me mentioned, deleting this folder can cause issues with Windows Updates (it can also fix them ) and largely self manages unless there's an error

Winapp2.ini · May 26, 2014

I got this email today, I haven't gotten around to... decoding it just yet

Thanks for the big Update Winapp2.ini 612 KB to 731 KB is a great improvement. Whatever, here's filelist of new entries, modifications and bugs (Probably) you should remove. Thanks. [Trend Micro Logs*] LangSecRef=3023 Detect=HKCU\Software\Trend Micro DetectFile=%CommonAppData%\Trend Micro Default=False FileKey1=%CommonAppData%\Trend Micro|*.log|RECURSE I have added Detectfile, because really lot of log files weren't found. The Registry Detect only doesn't work (on all systems probably). I cleaned, but it didn't find these logs. Hope this time it works. Found these: C:\ProgramData\Trend Micro\_Trend_Vizor_Remove_S-1-5-21-2213765280-380165501-1463282434-1000.log 1.476 KB C:\ProgramData\Trend Micro\_Trend_Vizor_Remove_S-1-5-21-2824826491-677968899-3539912517-500.log 6 KB C:\ProgramData\Trend Micro\_Trend_Vizor_ShortCut.log 14 KB C:\ProgramData\Trend Micro\_Trend_Vizor_ShortCut_S-1-5-21-2213765280-380165501-1463282434-1000.log 395 KB C:\ProgramData\Trend Micro\_Trend_Vizor_TiMiniService.log 111 KB C:\ProgramData\Trend Micro\_Trend_Vizor_TiMiniService_S-1-5-21-2213765280-380165501-1463282434-1000.log 2 KB C:\ProgramData\Trend Micro\_Trend_Vizor_TiMiniService_S-1-5-21-2824826491-677968899-3539912517-500.log 1 KB C:\ProgramData\Trend Micro\_Trend_Vizor_TiResumeSrv.log 356 KB C:\ProgramData\Trend Micro\_Trend_Vizor_VizorHtmlDialog_S-1-5-21-2213765280-380165501-1463282434-1000.log 2.453 KB C:\ProgramData\Trend Micro\_Trend_Vizor_VizorHtmlDialog_S-1-5-21-2824826491-677968899-3539912517-500.log 2 KB C:\ProgramData\Trend Micro\_Trend_Vizor_Remove_S-1-5-21-2213765280-380165501-1463282434-1000.log 1.476 KB C:\ProgramData\Trend Micro\_Trend_Vizor_Remove_S-1-5-21-2824826491-677968899-3539912517-500.log 6 KB C:\ProgramData\Trend Micro\_Trend_Vizor_ShortCut.log 14 KB C:\ProgramData\Trend Micro\_Trend_Vizor_ShortCut_S-1-5-21-2213765280-380165501-1463282434-1000.log 395 KB C:\ProgramData\Trend Micro\_Trend_Vizor_TiMiniService.log 111 KB C:\ProgramData\Trend Micro\_Trend_Vizor_TiMiniService_S-1-5-21-2213765280-380165501-1463282434-1000.log 2 KB C:\ProgramData\Trend Micro\_Trend_Vizor_TiMiniService_S-1-5-21-2824826491-677968899-3539912517-500.log 1 KB C:\ProgramData\Trend Micro\_Trend_Vizor_TiResumeSrv.log 356 KB C:\ProgramData\Trend Micro\_Trend_Vizor_VizorHtmlDialog_S-1-5-21-2213765280-380165501-1463282434-1000.log 2.453 KB C:\ProgramData\Trend Micro\_Trend_Vizor_VizorHtmlDialog_S-1-5-21-2824826491-677968899-3539912517-500.log 2 KB [Realtek (Logs)*] LangSecRef=3021 Detect=HKLM\Software\Realtek Default=False FileKey1=%ProgramFiles%\Realtek*|*.log;*.txt|RECURSE FileKey2=%SystemDrive%|RHDSetup.log|RECURSE ExcludeKey1=FILE|%ProgramFiles%\Realtek\*\InstCtrl.txt ExcludeKey2=FILE|%ProgramFiles%\Realtek\*\setupctrl.txt Found these: C:\RHDSetup.log 3 KB [MSI Afterburner Hardware Monitoring*] LangSecRef=3024 Detect=HKCU\Software\MSI Default=False FileKey1=%ProgramFiles%\MSI Afterburner|HardwareMonitoring.hml Found these: C:\Program Files (x86)\MSI Afterburner\HardwareMonitoring.hml [Wistron Corp Launch Manager Logs*] LangSecRef=3024 Detect1=HKLM\SOFTWARE\Wistron Corp\Launch Manager Detect2=HKLM\SOFTWARE\Wow6432Node\Wistron Corp\Launch Manager Default=False FileKey=%Programfiles%\Launch Manager|*.log Found these: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Wistron Corp\Launch Manager C:\Program Files (x86)\Launch Manager\setup.log [Dell Backup and Recovery Logs*] LangSecRef=3024 Detect1=HKLM\SOFTWARE\Dell Detect2=HKLM\SOFTWARE\Wow6432Node\Dell Default=False FileKey=%Programfiles%\Dell Backup and Recovery|*.log Found these: C:\Program Files (x86)\Dell Backup and Recovery\DSLCheck.exe.20140521235809_1.log HKLM\SOFTWARE\Dell HKLM\SOFTWARE\Wow6432Node\Dell [Downloaded Installations*] LangSecRef=3025 DetectFile1=%LocalAppData%\Downloaded Installations DetectFile2=%Documents%\Downloaded Installations DetectFile3=%CommonAppData%\Downloaded Installations Default=False FileKey1=%LocalAppData%\Downloaded Installations|*.*|RECURSE FileKey2=%Documents%\Downloaded Installations FileKey2=%CommonAppData%\Downloaded Installations -Slimdriver Installation Files are downloaded to the Documents folder or Programdata Folder. It is not important after installation or for unistallation. [Realtek Cam Driver Installation Files*] LangSecRef=3024 Detect1=HKLM\SOFTWARE\Realtek Semiconductor Corp.\Realtek PC Camera Detect2=HKLM\SOFTWARE\Vimicro Corporation\Lenovo USB2.0 UVC Camera Detect3=HKLM\SOFTWARE\Wow6432Node\Vimicro Corporation\Lenovo USB2.0 UVC Camera Warning=This will delete your Realtek Cam Driver installation files. Default=False FileKey1=%SystemDrive%\Cam Driver|*.*|REMOVESELF FileKey2=%SystemDrive%\Realtek Cam Driver|*.*|REMOVESELF [Lenovo Cam S MIC Driver Installation Files*] LangSecRef=3024 Detect=HKLM\SOFTWARE\Lenovo Warning=This will delete your Lenovo Cam S MIC Driver installation files. Default=False FileKey1=%SystemDrive%\Cam S MIC Driver|*.*|REMOVESELF [Lenovo ST SensorHub Easy FW Update Driver Installation Files*] LangSecRef=3024 Detect=HKLM\SOFTWARE\Lenovo Warning=This will delete your Lenovo Cam S MIC Driver installation files. Default=False FileKey1=%SystemDrive%\SensorHub FW|*.*|REMOVESELF [Lenovo Silk Wireless Keyboard Driver Installation Files*] LangSecRef=3024 Detect=HKLM\SOFTWARE\Lenovo Warning=This will delete your Silk Wireless Keyboard Driver installation files. Default=False FileKey1=%SystemDrive%\Lenovo Silver Silk Keyboard Driver|*.*|REMOVESELF [Future Technology E-dice Dongle Driver Installation Files*] LangSecRef=3024 DetectFile=%SystemDrive%\E-dice Dongle Driver Warning=This will delete your Future Technology E-dice Dongle Driver installation files. Default=False FileKey1=%SystemDrive%\E-dice Dongle Driver|*.*|REMOVESELF [TOSHIBA Driver Installation Files*] LangSecRef=3024 Detect=HKLM\SOFTWARE\TOSHIBA Warning=This will delete your TOSHIBA Driver installation files. Default=False FileKey1=%SystemDrive%\drivers|*.*|REMOVESELF Found these: HKEY_LOCAL_MACHINE\SOFTWARE\TOSHIBA C:\drivers [CONEXANT Logs*] LangSecRef=3021 DetectFile=%ProgramFiles%\CONEXANT Warning=This will delete your CONEXANT Driver installation files. Default=False FileKey1=%ProgramFiles%\CONEXANT\PREINSTALL|*.*|REMOVESELF [Helium Music Manager*] LangSecRef=3023 Detect1=HKCU\Software\Intermedia Software\Helium 8 Detect2=HKCU\Software\Intermedia Software\Helium 9 Default=False FileKey1=%AppData%\Intermedia Software\Helium *\Logs|*.* I have used a "*", which is deleting version 8 and 9. The rest: I think I have added most of this. Let's wait next version, if these get deleted. C:\Users\{Username}\AppData\Local\Avg2014\log\avgdiagex.log 9 KB C:\ProgramData\Atheros\atheros_installer.log 10 KB C:\ProgramData\Atheros\InstallHelper.log 1 KB C:\ProgramData\Atheros\atheros_installer.log 10 KB C:\ProgramData\Atheros\InstallHelper.log 1 KB C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12qhk.tmp 0 KB C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12rqn.tmp 0 KB C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12stn.tmp 0 KB C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12ua3.tmp 0 KB C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12w27.tmp 0 KB C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12xg1.tmp 0 KB C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12ua3.tmp_\dict-en.oxt\changelog.txt 3 KB C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12w27.tmp_\dict-it.oxt\dictionaries\CHANGELOG.txt 1 KB C:\ProgramData\Microsoft\Microsoft Antimalware\Network Inspection System\Support\NisLog.txt 656 KB C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppSetup.log 10 KB C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppSetup.log 10 KB C:\Windows\System32\InstallPackage_ETW.Log 30 KB C:\Windows\System32\LocalGroupAdminAdd.log 1 KB C:\Windows\System32\Local_LLU.log 1 KB C:\Windows\System32\Network_LLU.log 1 KB C:\Windows\System32\desktop.ini 1 KB C:\Windows\System32\InstallPackage_ETW.Log 30 KB C:\Windows\System32\LocalGroupAdminAdd.log 1 KB C:\Windows\System32\Local_LLU.log 1 KB C:\Windows\System32\Network_LLU.log 1 KB C:\Windows\System32\OEM\Devices.log 4 KB C:\Windows\System32\OEM\Devices.log 4 KB C:\Windows\System32\sysprep\Panther\setuperr.log 0 KB C:\Windows\System32\sysprep\Panther\IE\setupact.log 31 KB C:\Windows\System32\sysprep\Panther\IE\setuperr.log 0 KB C:\Windows\System32\sysprep\Panther\IE\setupact.log 31 KB C:\Windows\System32\sysprep\Panther\IE\setuperr.log 0 KB C:\Windows\Panther\cbs_unattend.log 32.682 KB C:\Windows\Panther\cbs_unattend.log 32.682 KB C:\Program Files (x86)\GUT816F.tmp 5.860 KB -I have found similar files starting with GUT and a number. I really don't know, where it's coming. Perhaps the forum knows. Thanks. ---------------------------------------------------------------------------------------------------------------------------- Bugs regarding Regkeys deletion. I don't it it very well, but Regkeys should be deletet with \ and not | or is somehow else. Please ask the forum.There are a lot Regkey which should be delete with \ and |. But you should ask the forum. [Windows Live Photo Gallery*] LangSecRef=3023 Detect=HKCU\Software\Microsoft\Windows Live\Photo Gallery Default=False FileKey1=%LocalAppData%\Microsoft\Windows Live Photo Gallery|*.*|RECURSE RegKey1=HKCU\Software\Microsoft\Windows Live\Photo Gallery|galleryscopedfolders RegKey2=HKCU\Software\Microsoft\Windows Live\Photo Aquisition\Camera|FinenameTemplate RegKey3=HKCU\Software\Microsoft\Windows Live\Photo Aquisition\Camera|RootDirectory [Windows Media Player (MediaGuide)*] LangSecRef=3023 Detect=HKCU\Software\Microsoft\MediaPlayer Default=False RegKey1=HKCU\Software\Microsoft\MediaPlayer\Preferences|CurrentBackgroundScanFolder [Windows Photo Gallery*] LangSecRef=3023 Detect=HKCU\Software\Microsoft\Windows Photo Gallery Default=False RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Camera|FilenameTemplate RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Camera|RootDirectory RegKey3=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\DestinationMru RegKey4=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\OpticalMedia|FilenameTemplate RegKey5=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\OpticalMedia|RootDirectory RegKey6=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Scanner|FilenameTemplate RegKey7=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Scanner|RootDirectory RegKey8=HKCU\Software\Microsoft\Windows Photo Gallery\Library\PreviewAssignment\MRU [Windows Session Manager*] LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows Default=False FileKey1=%WinDir%\AppCompat\Programs|*.xml FileKey2=%WinDir%\AppCompat\Programs\Install|*.xml RegKey1=HKLM\SYSTEM\ControlSet001\Control\Session Manager|PendingFileRenameOperations RegKey2=HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCompatCache|AppCompatCache RegKey3=HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCompatCache|CacheMainSdb RegKey4=HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCompatCache|SdbTime [WinHasher*] LangSecRef=3024 Detect=HKCU\Software\GPF Comics\WinHasher Default=False RegKey1=HKCU\Software\GPF Comics\WinHasher|LastDirectory [WinImage*] LangSecRef=3024 Detect=HKCU\Software\WinImage Default=False RegKey1=HKCU\Software\WinImage|File1 RegKey2=HKCU\Software\WinImage|File2 RegKey3=HKCU\Software\WinImage|File3 RegKey4=HKCU\Software\WinImage|File4 RegKey5=HKCU\Software\WinImage|File5 RegKey6=HKCU\Software\WinImage|File6 RegKey7=HKCU\Software\WinImage|File7 RegKey8=HKCU\Software\WinImage|File8 RegKey9=HKCU\Software\WinImage|File9 RegKey10=HKCU\Software\WinImage|PathExtract [WinZip Registry Optimizer*] LangSecRef=3024 DetectFile=%AppData%\Nico Mak Computing\WinZip Registry Optimizer Default=False FileKey1=%AppData%\Nico Mak Computing\WinZip Registry Optimizer\*|log*.* --------------------------------------------------------------------------------------------------------------------------------- Bugs regarding to deletion "Unmasking" (These doesn't get delete because of "\" instead of "|"): [Privacy Suite*] LangSecRef=3024 Detect=HKCU\Software\CyberScrub\Privacy Suite Default=False FileKey1=%AppData%\CyberScrub\Privacy Suite\cybscrub.log [Diablo III Logs*] Section=Games Detect=HKCU\Software\Blizzard Entertainment\D3 Default=False FileKey1=%CommonAppData%\Battle.net\Setup\diablo3_engb\Log FileKey2=%ProgramFiles%\Diablo III\Logs FileKey3=%ProgramFiles%\Diablo III Beta\Logs|*.* FileKey4=%LocalAppData%\VirtualStore\Program Files*\Diablo III\Logs FileKey5=%LocalAppData%\VirtualStore\Program Files*\Diablo III Beta\Logs|*.* FileKey6=%LocalAppData%\VirtualStore\ProgramData\Battle.net\Setup\diablo3_engb\Log [Maxthon Browser 3 Cache*] LangSecRef=3022 Detect=HKCU\Software\Maxthon3 Default=False FileKey1=%Tmp%\Maxthon3Cache\Temp\Webkit\Cache [Pidgin More*] LangSecRef=3022 Detect=HKCU\Software\Pidgin Default=False FileKey1=%AppData%\.purple|*.xml~ FileKey2=%UserProfile%\Recently-Used.xbel [QIP 2012 Privacy items*] LangSecRef=3022 Detect=HKCU\Software\QIP DetectFile=%AppData%\QIP Default=False Warning=Selecting this will delete any contact list backups, chat history, received files, opened tabs settings and other non-encrypted privacy items. FileKey1=%AppData%\QIP\Profiles\*\BackupCL|*.* FileKey2=%AppData%\QIP\Profiles\*\History|*.*|RECURSE FileKey3=%AppData%\QIP\Profiles\*\ICQ|*.*|RECURSE FileKey4=%AppData%\QIP\Profiles\*\RcvdFiles|*.*|RECURSE FileKey5=%AppData%\QIP\Profiles\*\session.tabs [Registry Clean Expert*] LangSecRef=3023 Detect=HKCU\Software\SuniSoft\IncUpdate\Registry Clean Expert Default=False FileKey1=%ProgramFiles%\Registry Clean Expert\fixlog.ini FileKey2=%LocalAppData%\VirtualStore\Program Files*\Registry Clean Expert\fixlog.ini [VoipBuster Logs*] LangSecRef=3022 DetectFile=%AppData%\VoipBuster Default=False FileKey1=%AppData%\VoipBuster|*.log FileKey2=%WinDir%\System32\VoipBuster*.log FileKey3=%WinDir%\SysWOW64\VoipBuster*.log [Yahoo! Autosync*] LangSecRef=3022 Detect=HKCU\Software\Yahoo!\Autosync for Yahoo! Default=False FileKey1=%ProgramFiles%\Yahoo!\Yahoo! Autosync\Logs FileKey2=%LocalAppData%\VirtualStore\Program Files*\Yahoo!\Yahoo! Autosync\Logs ------------------------------------------------------------------------------------------------------------------------------------------------------- Bugs regarding the working of Excludekey: I think these Excludekey should not work, because you use | instead of \, cause Excludekeys work like this. [Active@ KillDisk*] LangSecRef=3024 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{0F62EFB8-3C1C-4EE6-B6EF-9593007F9B03}_is1 Default=False FileKey1=%ProgramFiles%\LSoft Technologies\Active@ KillDisk*|*.log;*.pdf;*.xml FileKey2=%LocalAppData%\VirtualStore\Program Files*\LSoft Technologies\Active@ KillDisk*|*.log;*.pdf;*.xml ExcludeKey1=FILE|%ProgramFiles%\LSoft Technologies\Active@ KillDisk*|BootDisk.pdf ExcludeKey2=FILE|%ProgramFiles%\LSoft Technologies\Active@ KillDisk*|KillDisk.pdf ExcludeKey3=FILE|%LocalAppData%\VirtualStore\Program Files*\LSoft Technologies\Active@ KillDisk*|BootDisk.pdf ExcludeKey4=FILE|%LocalAppData%\VirtualStore\Program Files*\LSoft Technologies\Active@ KillDisk*|KillDisk.pdf [Age of Empires*] Section=Games Detect1=HKLM\Software\Microsoft\Games\Age of Empires Detect2=HKLM\Software\Microsoft\Microsoft Games\Age of Empires Detect3=HKLM\Software\Wow6432Node\Microsoft\microsoft games\age of empires 3 Default=False FileKey1=%Documents%\My Games\Age of Mythology|*.txt FileKey2=%Documents%\My Games\Age of Empires 3|*.txt FileKey3=%Documents%\My Games\Age of Empires 3\RM|*.dmp.txt RegKey1=HKLM\Software\Microsoft\Games\Age of Empires\1.00|Zone RegKey2=HKLM\Software\Microsoft\Microsoft Games\Age of Empires|Zone RegKey3=HKLM\Software\Microsoft\Microsoft Games\Age of Empires Expansion\1.0|Zone RegKey4=HKLM\Software\Microsoft\Microsoft Games\Age of Empires\2.0|Zone RegKey5=HKLM\Software\Microsoft\Microsoft Games\Age of Empires II: The Conquerors Expansion\1.0|Zone ExcludeKey1=FILE|%ProgramFiles%\Microsoft Games\Age of Mythology|*Readme.rtf;*Readmex.rtf ExcludeKey2=FILE|%ProgramFiles%\Microsoft Games\Age of Empires III|*Readme.rtf;*ReadmeX.rtf;*ReadmeY.rtf [Comodo Dragon (More)*] LangSecRef=3029 Detect=HKLM\Software\ComodoGroup\Dragon Default=False ExcludeKey1=FILE|%LocalAppData%\COMODO\Dragon\User Data\|First Run ExcludeKey2=FILE|%LocalAppData%\COMODO\Dragon\User Data\|Local State FileKey1=%LocalAppData%\COMODO|*.lock|RECURSE FileKey2=%LocalAppData%\COMODO|*.old|RECURSE FileKey3=%LocalAppData%\COMODO\Dragon\User Data|*.* FileKey4=%LocalAppData%\COMODO\Dragon\User Data\Temp|*.*|RECURSE FileKey5=%LocalAppData%\COMODO\Dragon\User Data\Default|Extension Cookies FileKey6=%LocalAppData%\COMODO\Dragon\User Data\Default|Archived History FileKey7=%LocalAppData%\COMODO\Dragon\User Data\Default|Archived History-journal FileKey8=%LocalAppData%\COMODO\Dragon\User Data\Default|History FileKey9=%LocalAppData%\COMODO\Dragon\User Data\Default|History Index FileKey10=%LocalAppData%\COMODO\Dragon\User Data\Default|History Index * FileKey11=%LocalAppData%\COMODO\Dragon\User Data\Default|History-journal FileKey12=%LocalAppData%\COMODO\Dragon\User Data\Default|Network Action Predictor-journal FileKey13=%LocalAppData%\COMODO\Dragon\User Data\Default|Top Sites FileKey14=%LocalAppData%\COMODO\Dragon\User Data\Default|Top Sites-journal FileKey15=%LocalAppData%\COMODO\Dragon\User Data\Default|Visited Links FileKey16=%LocalAppData%\COMODO\Dragon\User Data\Default\Application Cache|*.*|RECURSE FileKey17=%LocalAppData%\COMODO\Dragon\User Data\Default\Extensions\Temp|*.* FileKey18=%LocalAppData%\COMODO\Dragon\User Data\Default\Extension Rules|*.*|RECURSE FileKey19=%LocalAppData%\COMODO\Dragon\User Data\Default\File System|*.*|RECURSE FileKey20=%LocalAppData%\COMODO\Dragon\User Data\Default\GPUCache|*.*|RECURSE FileKey21=%LocalAppData%\COMODO\Dragon\User Data\Default\Media Cache|*.*|RECURSE FileKey22=%LocalAppData%\COMODO\Dragon\User Data\Default\Session Storage|*.*|RECURSE FileKey23=%LocalAppData%\COMODO\Dragon\User Data\Default\Temp|*.*|RECURSE FileKey24=%LocalAppData%\COMODO\Dragon\User Data\Performance Monitor Databases|*.*|REMOVESELF FileKey25=%SystemDrive%\first_launch|*.*|REMOVESELF [CyberLink PhotoDirector 3 More*] LangSecRef=3023 Detect=HKCU\Software\CyberLink\PhotoDirector3 Default=False FileKey1=%Pictures%\PhotoDirector\3.0\*|*.*|RECURSE ExcludeKey1=FILE|%Pictures%\PhotoDirector\3.0\*|*.phd [CyberLink PhotoDirector 4*] LangSecRef=3023 Detect1=HKLM\Software\CyberLink\PhotoDirector4 Detect2=HKLM\Software\Wow6432Node\CyberLink\PhotoDirector4 Default=False FileKey1=%CommonAppData%\CyberLink\Downloader|*.* FileKey2=%Pictures%\PhotoDirector\4.0\*|*.*|RECURSE FileKey3=%LocalAppData%\VirtualStore\ProgramData\CyberLink\Downloader|*.* ExcludeKey1=FILE|%Pictures%\PhotoDirector\4.0\*|*.phd [TVersity*] LangSecRef=3023 Detect=HKLM\Software\TVersity\Media Server Default=False FileKey1=%ProgramFiles%\TVersity\Media Server|*.rtf;*.url;*TVersityCodecPackSetup* FileKey2=%ProgramFiles%\TVersity\Media Server\logs|*.log;*.txt;*.xml;*.zip|RECURSE FileKey3=%ProgramFiles%\TVersity Codec Pack|*.exe;*.url FileKey5=%WinDir%\System32\config\systemprofile\AppData\Local\Temp\TVersity Media Server|*.*|REMOVESELF FileKey6=%WinDir%\System32\config\systemprofile\Local Settings\Application Data\Temp\TVersity Media Server|*.*|REMOVESELF FileKey7=%WinDir%\System32|tversity.cookies;TVersityMediaServer.log;*.1;*.2;*.3 FileKey8=%LocalAppData%\VirtualStore\Program Files*\TVersity\Media Server\logs|*.log;*.txt;*.xml;*.zip|RECURSE FileKey9=%LocalAppData%\VirtualStore\Program Files*\TVersity Codec Pack|*.exe;*.url ExcludeKey1=FILE|%ProgramFiles%\TVersity\Media Server|version.txt;*HOWTO Share Media.txt ExcludeKey2=FILE|%ProgramFiles%\TVersity Codec Pack\uninst.exe [Microsoft Flight Simulator X*] Section=Games Detect=HKLM\Software\Microsoft\Microsoft Games\Flight Simulator\10.0 Default=False FileKey1=%ProgramFiles%\Microsoft Games\Microsoft Flight Simulator X|*.log;*.rtf;*.html;*.URL FileKey2=%ProgramFiles%\Microsoft Games\Microsoft Flight Simulator X\Modules|*.log FileKey3=%LocalAppData%\VirtualStore\Program Files*\Microsoft Games\Microsoft Flight Simulator X|*.log;*.rtf;*.html;*.URL FileKey4=%LocalAppData%\VirtualStore\Program Files*\Microsoft Games\Microsoft Flight Simulator X\Modules|*.log ExcludeKey1=FILE|%ProgramFiles%\Microsoft Games\Microsoft Flight Simulator X|*kiosk.rtf;*readme.rtf;*Readme.htm [Pando Cache*] Detect=HKCU\Software\Pando Networks\Pando Warning=Make sure Pando is totally shut down before using this LangSecRef=3024 Default=False FileKey1=%LocalAppData%\Pando\Pando Files|*.*|RECURSE ExcludeKey1=FILE|%LocalAppData%\Pando\Pando Files|*Pando.prev.log;pando.save;pando.txt;pando.prev.log;pando.sav;pando.log ExcludeKey2=PATH|%LocalAppData%\Pando\Pando Files\Cert [VMware Workstation*] LangSecRef=3024 Detect=HKLM\Software\VMware, Inc.\Installer\VMware Workstation Default=False FileKey1=%CommonAppData%\VMware\hostd|*.log;*.gz|RECURSE FileKey2=%CommonAppData%\VMware\Installer|*.*|REMOVESELF FileKey3=%CommonAppData%\VMware\VMware vCenter Converter Standalone|*.log;*.gz;*.zip|RECURSE FileKey4=%Documents%\My Virtual Machines|*.log|RECURSE FileKey5=%LocalAppData%\VMware\VMware vCenter Converter Standalone Client\Logs|*.log;*.gz FileKey6=%ProgramFiles%\VMware\VMware vCenter Converter Standalone|*.rtf;*.zip|RECURSE FileKey7=%ProgramFiles%\VMware\VMware VIX|*.txt;*.rtf FileKey8=%LocalAppData%\VirtualStore\Program Files*\VMware\VMware vCenter Converter Standalone|*.rtf;*.zip|RECURSE FileKey9=%LocalAppData%\VirtualStore\Program Files*\VMware\VMware VIX|*.txt;*.rtf FileKey10=%LocalAppData%\VirtualStore\ProgramData\VMware\hostd|*.log;*.gz|RECURSE FileKey11=%LocalAppData%\VirtualStore\ProgramData\VMware\Installer|*.*|REMOVESELF FileKey12=%LocalAppData%\VirtualStore\ProgramData\VMware\VMware vCenter Converter Standalone|*.log;*.gz;*.zip|RECURSE ExcludeKey1=FILE|%ProgramFiles%\VMware\VMware vCenter Converter Standalone\Help|*.txt|RECURSE ExcludeKey2=FILE|%ProgramFiles%\VMware\VMware VIX\vixwrapper-config.txt ExcludeKey3=FILE|%ProgramFiles%\VMware\VMware Workstation\vixwrapper-product-config.txt [Warcraft III*] Section=Games Detect=HKLM\Software\Blizzard Entertainment\Warcraft III DetectFile=%ProgramFiles%\Warcraft III\Warcraft III.exe Default=False FileKey1=%ProgramFiles%\Warcraft III|*.log;*.html FileKey2=%ProgramFiles%\Warcraft III\Errors|*.dmp;*.txt FileKey3=%LocalAppData%\VirtualStore\*\Warcraft III\Errors|*.dmp;*.txt FileKey4=%LocalAppData%\VirtualStore\Program Files*\Warcraft III|*.log;*.html ExcludeKey1=FILE|%ProgramFiles%\Warcraft III|*CustomKeyInfo.txt;*CustomKeysSample.txt ----------------------------------------------------------------------------------------------------------------------------- Bugs regarding Detect OS: I don't know, if the "|" behind or before DetectOS is necarssary. [sync Traces*] DetectOS=6.2| LangSecRef=3025 Default=False FileKey1=%LocalAppData%\Microsoft\Windows\SettingSync\metastore|*.jrs FileKey2=%LocalAppData%\Microsoft\Windows\SettingSync\remotemetastore\*|*.jrs [Device Manager Cache XP*] LangSecRef=3025 DetectOS=|5.1 Default=False Warning=This clears cached drivers of connected devices. As soon as you connect a new device with your computer or restart the PC the Windows OS will rebuild this file! FileKey1=%WinDir%\inf|INFCACHE.1 [Device Manager Cache*] LangSecRef=3025 DetectOS=6.0| Default=False Warning=This clears cached drivers of connected devices. As soon as you connect a new device with your computer or restart the PC the Windows OS will rebuild this file! FileKey1=%WinDir%\System32\DriverStore|INFCACHE.1 [Notification Cache*] DetectOS=6.2| LangSecRef=3025 Default=False FileKey1=%LocalAppData%\Microsoft\Windows\Notifications|*.*|RECURSE [store*] DetectOS=6.2| Section=3031 Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\WinStore_cw5n1h2txyewy Default=False FileKey1=%LocalAppData%\Packages\WinStore_*\AC\AppCache|*.*|RECURSE FileKey2=%LocalAppData%\Packages\WinStore_*\AC\INetCache|*.*|RECURSE FileKey3=%LocalAppData%\Packages\WinStore_*\AC\INetCookies|*.*|RECURSE FileKey4=%LocalAppData%\Packages\WinStore_*\AC\INetHistory|*.*|RECURSE FileKey5=%LocalAppData%\Packages\WinStore_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE FileKey6=%LocalAppData%\Packages\WinStore_*\AC\Microsoft\CryptnetUrlCache\Content|*.* FileKey7=%LocalAppData%\Packages\WinStore_*\AC\Microsoft\CryptnetUrlCache\MetaData|*.* FileKey8=%LocalAppData%\Packages\WinStore_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE FileKey9=%LocalAppData%\Packages\WinStore_*\AC\Microsoft\Windows Store\Cache|*.*|RECURSE FileKey10=%LocalAppData%\Packages\WinStore_*\AC\Microsoft\Windows Store\Data|history.dat FileKey11=%LocalAppData%\Packages\WinStore_*\AC\PRICache|*.* FileKey12=%LocalAppData%\Packages\WinStore_*\AC\Temp|*.* FileKey13=%LocalAppData%\Packages\WinStore_*\LocalState\Cache|*.*|RECURSE FileKey14=%LocalAppData%\Packages\WinStore_*\LocalState\LiveTile|*.*|RECURSE FileKey15=%LocalAppData%\Packages\WinStore_*\LocalState\navigationHistory|*.*|RECURSE FileKey16=%LocalAppData%\Microsoft\Windows Store\Cache Medium IL|*.*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\WinStore_cw5n1h2txyewy\SearchHistory [Windows 7/8 MUICache*] DetectOS=6.1| LangSecRef=3025 Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell Default=False RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache [Windows 7/8 QuickLaunch*] DetectOS=6.1| LangSecRef=3025 Detect=HKCU\Software\Microsoft\Internet Explorer Default=False Warning=This will remove all of your QuickLaunch icons. FileKey1=%AppData%\Microsoft\Internet Explorer\Quick Launch|*.lnk [Windows 7/8 ShellBags*] DetectOS=6.1| LangSecRef=3025 Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell Default=False Warning=This will delete window size, window position and view setting of all folders. RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags RegKey2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU [Windows 8 ScreenShot Index*] DetectOS=6.2| LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows Default=False Warning=This Resets Screenshot Naming Back To "Screenshot (1).png" RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer|ScreenshotIndex [Windows 8 Search History*] DetectOS=6.2| LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows Default=False RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SearchHistory FileKey1=%LocalAppData%\Microsoft\Windows\ConnectedSearch\History|*.* [Windows 8 Sharing MFU*] DetectOS=6.2| LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows Default=False Warning=This will remove the frequently shared list. e.g. email addresses that have been used to share. This does not remove the Apps listed under sharing. RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SharingMFU [Windows 8 Start Menu Cache*] DetectOS=6.2| LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\UFH Default=False RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\UFH\SHC [Windows Defender Definition Updates*] LangSecRef=3024 DetectOS=|6.1 Detect=HKLM\Software\Microsoft\Windows Defender Default=False FileKey1=%CommonAppData%\Microsoft\Windows Defender\Definition Updates|*.*|RECURSE FileKey2=%LocalAppData%\VirtualStore\ProgramData\Microsoft\Windows Defender\Definition Updates|*.*|RECURSE [Windows Defender Definition Updates*] LangSecRef=3024 DetectOS=|6.1 Detect=HKLM\Software\Microsoft\Windows Defender Default=False FileKey1=%CommonAppData%\Microsoft\Windows Defender\Definition Updates|*.*|RECURSE FileKey2=%LocalAppData%\VirtualStore\ProgramData\Microsoft\Windows Defender\Definition Updates|*.*|RECURSE [Windows QuickLaunch ImplicitAppShortcuts*] DetectOS=6.1| LangSecRef=3025 DetectFile=%AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts Default=False Warning=This will break pinned configuration shortcuts (like control panel). FileKey1=%AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts|*.*|RECURSE [Windows XP ARPCache*] DetectOS=|5.1 LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows Default=False Warning=This cleans the Add/Remove Programs cache and will fix very large areas of black gaps in it. Using this will cause Add/Remove Programs to take a very long time to load since it will have to rebuild the cache. RegKey1=HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache [Windows XP Error Reporting*] DetectOS=|5.2 LangSecRef=3025 Default=False Warning=This deletes the error reports generated by Windows (such as failed Windows Updates) that Microsoft Error Reporting requests to upload directly to Microsoft. Make sure you upload the error reports before using this cleaner, that way Microsoft may be able to fix the problem in a future Windows Update. FileKey1=%WinDir%\pchealth\ERRORREP|*.*|RECURSE FileKey2=%LocalAppData%\PCHealth\ErrorRep\QSignoff|*.* [Windows XP MUICache*] DetectOS=|5.1 LangSecRef=3025 Detect1=HKCU\Software\Microsoft\Windows\ShellNoRoam Detect2=HKCU\Software\Microsoft\Windows\Shell Default=False RegKey1=HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache RegKey2=HKCU\Software\Microsoft\Windows\Shell\MUICache [Windows XP ShellBags*] DetectOS=|5.1 LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows\ShellNoRoam Default=False Warning=This will delete window size, window position and view setting of all folders. RegKey1=HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU RegKey2=HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags [Windows XP System Profile*] DetectOS=|5.1 LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows Default=False FileKey1=%WinDir%\System32\config\SystemProfile\Application Data\Microsoft\CryptnetUrlCache\Content|*.* FileKey2=%WinDir%\System32\config\SystemProfile\Application Data\Microsoft\CryptnetUrlCache\MetaData|*.* FileKey3=%WinDir%\System32\config\SystemProfile\Cookies|*.*|RECURSE FileKey4=%WinDir%\System32\config\SystemProfile\IETldCache|*.*|RECURSE FileKey5=%WinDir%\System32\config\SystemProfile\Local Settings\History|*.*|RECURSE FileKey6=%WinDir%\System32\config\SystemProfile\Local Settings\Temp|*.*|RECURSE FileKey7=%WinDir%\System32\config\SystemProfile\Local Settings\Temporary Internet Files|*.*|RECURSE

mta · May 26, 2014

Damn! good luck with that one....

back_track · May 28, 2014

I got this email today, I haven't gotten around to... decoding it just yet

Thanks for the big Update Winapp2.ini 612 KB to 731 KB is a great improvement. Whatever, here's filelist of new entries, modifications and bugs (Probably) you should remove. Thanks.

[Trend Micro Logs*] LangSecRef=3023 Detect=HKCU\Software\Trend Micro DetectFile=%CommonAppData%\Trend Micro Default=False

FileKey1=%CommonAppData%\Trend Micro|*.log|RECURSE

I have added Detectfile, because really lot of log files weren't found. The Registry Detect only doesn't work (on all systems probably). I cleaned, but it didn't find these logs. Hope this time it works.

Found these:

C:\ProgramData\Trend Micro\_Trend_Vizor_Remove_S-1-5-21-2213765280-380165501-1463282434-1000.log 1.476 KB

C:\ProgramData\Trend Micro\_Trend_Vizor_Remove_S-1-5-21-2824826491-677968899-3539912517-500.log 6 KB

C:\ProgramData\Trend Micro\_Trend_Vizor_ShortCut.log 14 KB

C:\ProgramData\Trend Micro\_Trend_Vizor_ShortCut_S-1-5-21-2213765280-380165501-1463282434-1000.log 395 KB

C:\ProgramData\Trend Micro\_Trend_Vizor_TiMiniService.log 111 KB

C:\ProgramData\Trend Micro\_Trend_Vizor_TiMiniService_S-1-5-21-2213765280-380165501-1463282434-1000.log 2 KB

C:\ProgramData\Trend Micro\_Trend_Vizor_TiMiniService_S-1-5-21-2824826491-677968899-3539912517-500.log 1 KB

C:\ProgramData\Trend Micro\_Trend_Vizor_TiResumeSrv.log 356 KB

C:\ProgramData\Trend Micro\_Trend_Vizor_VizorHtmlDialog_S-1-5-21-2213765280-380165501-1463282434-1000.log 2.453 KB

C:\ProgramData\Trend Micro\_Trend_Vizor_VizorHtmlDialog_S-1-5-21-2824826491-677968899-3539912517-500.log 2 KB

C:\ProgramData\Trend Micro\_Trend_Vizor_Remove_S-1-5-21-2213765280-380165501-1463282434-1000.log 1.476 KB

C:\ProgramData\Trend Micro\_Trend_Vizor_Remove_S-1-5-21-2824826491-677968899-3539912517-500.log 6 KB

C:\ProgramData\Trend Micro\_Trend_Vizor_ShortCut.log 14 KB

C:\ProgramData\Trend Micro\_Trend_Vizor_ShortCut_S-1-5-21-2213765280-380165501-1463282434-1000.log 395 KB

C:\ProgramData\Trend Micro\_Trend_Vizor_TiMiniService.log 111 KB

C:\ProgramData\Trend Micro\_Trend_Vizor_TiMiniService_S-1-5-21-2213765280-380165501-1463282434-1000.log 2 KB

C:\ProgramData\Trend Micro\_Trend_Vizor_TiMiniService_S-1-5-21-2824826491-677968899-3539912517-500.log 1 KB

C:\ProgramData\Trend Micro\_Trend_Vizor_TiResumeSrv.log 356 KB

C:\ProgramData\Trend Micro\_Trend_Vizor_VizorHtmlDialog_S-1-5-21-2213765280-380165501-1463282434-1000.log 2.453 KB

C:\ProgramData\Trend Micro\_Trend_Vizor_VizorHtmlDialog_S-1-5-21-2824826491-677968899-3539912517-500.log 2 KB

[Realtek (Logs)*] LangSecRef=3021 Detect=HKLM\Software\Realtek Default=False

FileKey1=%ProgramFiles%\Realtek*|*.log;*.txt|RECURSE

FileKey2=%SystemDrive%|RHDSetup.log|RECURSE ExcludeKey1=FILE|%ProgramFiles%\Realtek\*\InstCtrl.txt ExcludeKey2=FILE|%ProgramFiles%\Realtek\*\setupctrl.txt

Found these:

C:\RHDSetup.log 3 KB

[MSI Afterburner Hardware Monitoring*] LangSecRef=3024 Detect=HKCU\Software\MSI Default=False

FileKey1=%ProgramFiles%\MSI Afterburner|HardwareMonitoring.hml

Found these:

C:\Program Files (x86)\MSI Afterburner\HardwareMonitoring.hml

[Wistron Corp Launch Manager Logs*] LangSecRef=3024 Detect1=HKLM\SOFTWARE\Wistron Corp\Launch Manager Detect2=HKLM\SOFTWARE\Wow6432Node\Wistron Corp\Launch Manager Default=False

FileKey=%Programfiles%\Launch Manager|*.log

Found these: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Wistron Corp\Launch Manager

C:\Program Files (x86)\Launch Manager\setup.log

[Dell Backup and Recovery Logs*] LangSecRef=3024 Detect1=HKLM\SOFTWARE\Dell Detect2=HKLM\SOFTWARE\Wow6432Node\Dell Default=False

FileKey=%Programfiles%\Dell Backup and Recovery|*.log

Found these:

C:\Program Files (x86)\Dell Backup and Recovery\DSLCheck.exe.20140521235809_1.log HKLM\SOFTWARE\Dell HKLM\SOFTWARE\Wow6432Node\Dell

[Downloaded Installations*] LangSecRef=3025 DetectFile1=%LocalAppData%\Downloaded Installations DetectFile2=%Documents%\Downloaded Installations DetectFile3=%CommonAppData%\Downloaded Installations Default=False

FileKey1=%LocalAppData%\Downloaded Installations|*.*|RECURSE

FileKey2=%Documents%\Downloaded Installations

FileKey2=%CommonAppData%\Downloaded Installations -Slimdriver Installation Files are downloaded to the Documents folder or Programdata Folder. It is not important after installation or for unistallation.

[Realtek Cam Driver Installation Files*]

LangSecRef=3024 Detect1=HKLM\SOFTWARE\Realtek Semiconductor Corp.\Realtek PC Camera Detect2=HKLM\SOFTWARE\Vimicro Corporation\Lenovo USB2.0 UVC Camera Detect3=HKLM\SOFTWARE\Wow6432Node\Vimicro Corporation\Lenovo USB2.0 UVC Camera Warning=This will delete your Realtek Cam Driver installation files. Default=False

FileKey1=%SystemDrive%\Cam Driver|*.*|REMOVESELF

FileKey2=%SystemDrive%\Realtek Cam Driver|*.*|REMOVESELF

[Lenovo Cam S MIC Driver Installation Files*] LangSecRef=3024 Detect=HKLM\SOFTWARE\Lenovo Warning=This will delete your Lenovo Cam S MIC Driver installation files. Default=False

FileKey1=%SystemDrive%\Cam S MIC Driver|*.*|REMOVESELF

[Lenovo ST SensorHub Easy FW Update Driver Installation Files*] LangSecRef=3024 Detect=HKLM\SOFTWARE\Lenovo Warning=This will delete your Lenovo Cam S MIC Driver installation files. Default=False

FileKey1=%SystemDrive%\SensorHub FW|*.*|REMOVESELF

[Lenovo Silk Wireless Keyboard Driver Installation Files*] LangSecRef=3024 Detect=HKLM\SOFTWARE\Lenovo Warning=This will delete your Silk Wireless Keyboard Driver installation files. Default=False

FileKey1=%SystemDrive%\Lenovo Silver Silk Keyboard Driver|*.*|REMOVESELF

[Future Technology E-dice Dongle Driver Installation Files*] LangSecRef=3024 DetectFile=%SystemDrive%\E-dice Dongle Driver Warning=This will delete your Future Technology E-dice Dongle Driver installation files. Default=False

FileKey1=%SystemDrive%\E-dice Dongle Driver|*.*|REMOVESELF

[TOSHIBA Driver Installation Files*] LangSecRef=3024 Detect=HKLM\SOFTWARE\TOSHIBA Warning=This will delete your TOSHIBA Driver installation files. Default=False

FileKey1=%SystemDrive%\drivers|*.*|REMOVESELF

Found these: HKEY_LOCAL_MACHINE\SOFTWARE\TOSHIBA

C:\drivers

[CONEXANT Logs*] LangSecRef=3021 DetectFile=%ProgramFiles%\CONEXANT Warning=This will delete your CONEXANT Driver installation files. Default=False

FileKey1=%ProgramFiles%\CONEXANT\PREINSTALL|*.*|REMOVESELF

[Helium Music Manager*] LangSecRef=3023 Detect1=HKCU\Software\Intermedia Software\Helium 8 Detect2=HKCU\Software\Intermedia Software\Helium 9 Default=False

FileKey1=%AppData%\Intermedia Software\Helium *\Logs|*.*

I have used a "*", which is deleting version 8 and 9. The rest: I think I have added most of this. Let's wait next version, if these get deleted.

C:\Users\{Username}\AppData\Local\Avg2014\log\avgdiagex.log 9 KB

C:\ProgramData\Atheros\atheros_installer.log 10 KB

C:\ProgramData\Atheros\InstallHelper.log 1 KB

C:\ProgramData\Atheros\atheros_installer.log 10 KB

C:\ProgramData\Atheros\InstallHelper.log 1 KB

C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12qhk.tmp 0 KB

C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12rqn.tmp 0 KB

C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12stn.tmp 0 KB

C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12ua3.tmp 0 KB

C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12w27.tmp 0 KB

C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12xg1.tmp 0 KB

C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12ua3.tmp_\dict-en.oxt\changelog.txt 3 KB

C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12w27.tmp_\dict-it.oxt\dictionaries\CHANGELOG.txt 1 KB

C:\ProgramData\Microsoft\Microsoft Antimalware\Network Inspection System\Support\NisLog.txt 656 KB

C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppSetup.log 10 KB

C:\Windows\System32\InstallPackage_ETW.Log 30 KB

C:\Windows\System32\LocalGroupAdminAdd.log 1 KB

C:\Windows\System32\Local_LLU.log 1 KB

C:\Windows\System32\Network_LLU.log 1 KB

C:\Windows\System32\desktop.ini 1 KB

C:\Windows\System32\InstallPackage_ETW.Log 30 KB

C:\Windows\System32\LocalGroupAdminAdd.log 1 KB

C:\Windows\System32\Local_LLU.log 1 KB

C:\Windows\System32\Network_LLU.log 1 KB

C:\Windows\System32\OEM\Devices.log 4 KB

C:\Windows\System32\sysprep\Panther\setuperr.log 0 KB

C:\Windows\System32\sysprep\Panther\IE\setupact.log 31 KB

C:\Windows\System32\sysprep\Panther\IE\setuperr.log 0 KB

C:\Windows\System32\sysprep\Panther\IE\setupact.log 31 KB

C:\Windows\System32\sysprep\Panther\IE\setuperr.log 0 KB

C:\Windows\Panther\cbs_unattend.log 32.682 KB

C:\Program Files (x86)\GUT816F.tmp 5.860 KB

-I have found similar files starting with GUT and a number. I really don't know, where it's coming.

Perhaps the forum knows. Thanks.

---------------------------------------------------------------------------------------------------------------------------- Bugs regarding Regkeys deletion. I don't it it very well, but Regkeys should be deletet with \ and not | or is somehow else. Please ask the forum.There are a lot Regkey which should be delete with \ and |. But you should ask the forum.

[Windows Live Photo Gallery*] LangSecRef=3023 Detect=HKCU\Software\Microsoft\Windows Live\Photo Gallery Default=False

FileKey1=%LocalAppData%\Microsoft\Windows Live Photo Gallery|*.*|RECURSE RegKey1=HKCU\Software\Microsoft\Windows Live\Photo Gallery|galleryscopedfolders RegKey2=HKCU\Software\Microsoft\Windows Live\Photo Aquisition\Camera|FinenameTemplate RegKey3=HKCU\Software\Microsoft\Windows Live\Photo Aquisition\Camera|RootDirectory

[Windows Media Player (MediaGuide)*] LangSecRef=3023 Detect=HKCU\Software\Microsoft\MediaPlayer Default=False RegKey1=HKCU\Software\Microsoft\MediaPlayer\Preferences|CurrentBackgroundScanFolder

[Windows Photo Gallery*] LangSecRef=3023 Detect=HKCU\Software\Microsoft\Windows Photo Gallery Default=False RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Camera|FilenameTemplate RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Camera|RootDirectory RegKey3=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\DestinationMru RegKey4=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\OpticalMedia|FilenameTemplate RegKey5=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\OpticalMedia|RootDirectory RegKey6=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Scanner|FilenameTemplate RegKey7=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Scanner|RootDirectory RegKey8=HKCU\Software\Microsoft\Windows Photo Gallery\Library\PreviewAssignment\MRU

[Windows Session Manager*] LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows Default=False

FileKey1=%WinDir%\AppCompat\Programs|*.xml

FileKey2=%WinDir%\AppCompat\Programs\Install|*.xml RegKey1=HKLM\SYSTEM\ControlSet001\Control\Session Manager|PendingFileRenameOperations RegKey2=HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCompatCache|AppCompatCache RegKey3=HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCompatCache|CacheMainSdb RegKey4=HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCompatCache|SdbTime

[WinHasher*] LangSecRef=3024 Detect=HKCU\Software\GPF Comics\WinHasher Default=False RegKey1=HKCU\Software\GPF Comics\WinHasher|LastDirectory

[WinZip Registry Optimizer*] LangSecRef=3024 DetectFile=%AppData%\Nico Mak Computing\WinZip Registry Optimizer Default=False

FileKey1=%AppData%\Nico Mak Computing\WinZip Registry Optimizer\*|log*.*

--------------------------------------------------------------------------------------------------------------------------------- Bugs regarding to deletion "Unmasking" (These doesn't get delete because of "\" instead of "|"):

[Privacy Suite*] LangSecRef=3024 Detect=HKCU\Software\CyberScrub\Privacy Suite Default=False

FileKey1=%AppData%\CyberScrub\Privacy Suite\cybscrub.log

[Diablo III Logs*] Section=Games Detect=HKCU\Software\Blizzard Entertainment\D3 Default=False

FileKey1=%CommonAppData%\Battle.net\Setup\diablo3_engb\Log

FileKey2=%ProgramFiles%\Diablo III\Logs

FileKey3=%ProgramFiles%\Diablo III Beta\Logs|*.*

FileKey4=%LocalAppData%\VirtualStore\Program Files*\Diablo III\Logs

FileKey5=%LocalAppData%\VirtualStore\Program Files*\Diablo III Beta\Logs|*.*

FileKey6=%LocalAppData%\VirtualStore\ProgramData\Battle.net\Setup\diablo3_engb\Log

[Maxthon Browser 3 Cache*] LangSecRef=3022 Detect=HKCU\Software\Maxthon3 Default=False

FileKey1=%Tmp%\Maxthon3Cache\Temp\Webkit\Cache

[Pidgin More*] LangSecRef=3022 Detect=HKCU\Software\Pidgin Default=False

FileKey1=%AppData%\.purple|*.xml~

FileKey2=%UserProfile%\Recently-Used.xbel

[QIP 2012 Privacy items*] LangSecRef=3022 Detect=HKCU\Software\QIP DetectFile=%AppData%\QIP Default=False Warning=Selecting this will delete any contact list backups, chat history, received files, opened tabs settings and other non-encrypted privacy items.

FileKey1=%AppData%\QIP\Profiles\*\BackupCL|*.*

FileKey2=%AppData%\QIP\Profiles\*\History|*.*|RECURSE

FileKey3=%AppData%\QIP\Profiles\*\ICQ|*.*|RECURSE

FileKey4=%AppData%\QIP\Profiles\*\RcvdFiles|*.*|RECURSE

FileKey5=%AppData%\QIP\Profiles\*\session.tabs

[Registry Clean Expert*] LangSecRef=3023 Detect=HKCU\Software\SuniSoft\IncUpdate\Registry Clean Expert Default=False

FileKey1=%ProgramFiles%\Registry Clean Expert\fixlog.ini

FileKey2=%LocalAppData%\VirtualStore\Program Files*\Registry Clean Expert\fixlog.ini

[VoipBuster Logs*] LangSecRef=3022 DetectFile=%AppData%\VoipBuster Default=False

FileKey1=%AppData%\VoipBuster|*.log

FileKey2=%WinDir%\System32\VoipBuster*.log

FileKey3=%WinDir%\SysWOW64\VoipBuster*.log

[Yahoo! Autosync*] LangSecRef=3022 Detect=HKCU\Software\Yahoo!\Autosync for Yahoo! Default=False

FileKey1=%ProgramFiles%\Yahoo!\Yahoo! Autosync\Logs

FileKey2=%LocalAppData%\VirtualStore\Program Files*\Yahoo!\Yahoo! Autosync\Logs

------------------------------------------------------------------------------------------------------------------------------------------------------- Bugs regarding the working of Excludekey: I think these Excludekey should not work, because you use | instead of \, cause Excludekeys work like this.

[Active@ KillDisk*] LangSecRef=3024 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{0F62EFB8-3C1C-4EE6-B6EF-9593007F9B03}_is1 Default=False

FileKey1=%ProgramFiles%\LSoft Technologies\Active@ KillDisk*|*.log;*.pdf;*.xml

FileKey2=%LocalAppData%\VirtualStore\Program Files*\LSoft Technologies\Active@ KillDisk*|*.log;*.pdf;*.xml ExcludeKey1=FILE|%ProgramFiles%\LSoft Technologies\Active@ KillDisk*|BootDisk.pdf ExcludeKey2=FILE|%ProgramFiles%\LSoft Technologies\Active@ KillDisk*|KillDisk.pdf ExcludeKey3=FILE|%LocalAppData%\VirtualStore\Program Files*\LSoft Technologies\Active@ KillDisk*|BootDisk.pdf ExcludeKey4=FILE|%LocalAppData%\VirtualStore\Program Files*\LSoft Technologies\Active@ KillDisk*|KillDisk.pdf

[Age of Empires*] Section=Games Detect1=HKLM\Software\Microsoft\Games\Age of Empires Detect2=HKLM\Software\Microsoft\Microsoft Games\Age of Empires Detect3=HKLM\Software\Wow6432Node\Microsoft\microsoft games\age of empires 3 Default=False

FileKey1=%Documents%\My Games\Age of Mythology|*.txt

FileKey2=%Documents%\My Games\Age of Empires 3|*.txt

FileKey3=%Documents%\My Games\Age of Empires 3\RM|*.dmp.txt RegKey1=HKLM\Software\Microsoft\Games\Age of Empires\1.00|Zone RegKey2=HKLM\Software\Microsoft\Microsoft Games\Age of Empires|Zone RegKey3=HKLM\Software\Microsoft\Microsoft Games\Age of Empires Expansion\1.0|Zone RegKey4=HKLM\Software\Microsoft\Microsoft Games\Age of Empires\2.0|Zone RegKey5=HKLM\Software\Microsoft\Microsoft Games\Age of Empires II: The Conquerors Expansion\1.0|Zone ExcludeKey1=FILE|%ProgramFiles%\Microsoft Games\Age of Mythology|*Readme.rtf;*Readmex.rtf ExcludeKey2=FILE|%ProgramFiles%\Microsoft Games\Age of Empires III|*Readme.rtf;*ReadmeX.rtf;*ReadmeY.rtf

[Comodo Dragon (More)*] LangSecRef=3029 Detect=HKLM\Software\ComodoGroup\Dragon Default=False ExcludeKey1=FILE|%LocalAppData%\COMODO\Dragon\User Data\|First Run ExcludeKey2=FILE|%LocalAppData%\COMODO\Dragon\User Data\|Local State

FileKey1=%LocalAppData%\COMODO|*.lock|RECURSE

FileKey2=%LocalAppData%\COMODO|*.old|RECURSE

FileKey3=%LocalAppData%\COMODO\Dragon\User Data|*.*

FileKey4=%LocalAppData%\COMODO\Dragon\User Data\Temp|*.*|RECURSE

FileKey5=%LocalAppData%\COMODO\Dragon\User Data\Default|Extension Cookies

FileKey6=%LocalAppData%\COMODO\Dragon\User Data\Default|Archived History

FileKey7=%LocalAppData%\COMODO\Dragon\User Data\Default|Archived History-journal

FileKey8=%LocalAppData%\COMODO\Dragon\User Data\Default|History

FileKey9=%LocalAppData%\COMODO\Dragon\User Data\Default|History Index

FileKey10=%LocalAppData%\COMODO\Dragon\User Data\Default|History Index *

FileKey11=%LocalAppData%\COMODO\Dragon\User Data\Default|History-journal

FileKey12=%LocalAppData%\COMODO\Dragon\User Data\Default|Network Action Predictor-journal

FileKey13=%LocalAppData%\COMODO\Dragon\User Data\Default|Top Sites

FileKey14=%LocalAppData%\COMODO\Dragon\User Data\Default|Top Sites-journal

FileKey15=%LocalAppData%\COMODO\Dragon\User Data\Default|Visited Links

FileKey16=%LocalAppData%\COMODO\Dragon\User Data\Default\Application Cache|*.*|RECURSE

FileKey17=%LocalAppData%\COMODO\Dragon\User Data\Default\Extensions\Temp|*.*

FileKey18=%LocalAppData%\COMODO\Dragon\User Data\Default\Extension Rules|*.*|RECURSE

FileKey19=%LocalAppData%\COMODO\Dragon\User Data\Default\File System|*.*|RECURSE

FileKey20=%LocalAppData%\COMODO\Dragon\User Data\Default\GPUCache|*.*|RECURSE

FileKey21=%LocalAppData%\COMODO\Dragon\User Data\Default\Media Cache|*.*|RECURSE

FileKey22=%LocalAppData%\COMODO\Dragon\User Data\Default\Session Storage|*.*|RECURSE

FileKey23=%LocalAppData%\COMODO\Dragon\User Data\Default\Temp|*.*|RECURSE

FileKey24=%LocalAppData%\COMODO\Dragon\User Data\Performance Monitor Databases|*.*|REMOVESELF

FileKey25=%SystemDrive%\first_launch|*.*|REMOVESELF

[CyberLink PhotoDirector 3 More*] LangSecRef=3023 Detect=HKCU\Software\CyberLink\PhotoDirector3 Default=False

FileKey1=%Pictures%\PhotoDirector\3.0\*|*.*|RECURSE ExcludeKey1=FILE|%Pictures%\PhotoDirector\3.0\*|*.phd

[CyberLink PhotoDirector 4*] LangSecRef=3023 Detect1=HKLM\Software\CyberLink\PhotoDirector4 Detect2=HKLM\Software\Wow6432Node\CyberLink\PhotoDirector4 Default=False

FileKey1=%CommonAppData%\CyberLink\Downloader|*.*

FileKey2=%Pictures%\PhotoDirector\4.0\*|*.*|RECURSE

FileKey3=%LocalAppData%\VirtualStore\ProgramData\CyberLink\Downloader|*.* ExcludeKey1=FILE|%Pictures%\PhotoDirector\4.0\*|*.phd

[TVersity*] LangSecRef=3023 Detect=HKLM\Software\TVersity\Media Server Default=False

FileKey1=%ProgramFiles%\TVersity\Media Server|*.rtf;*.url;*TVersityCodecPackSetup*

FileKey2=%ProgramFiles%\TVersity\Media Server\logs|*.log;*.txt;*.xml;*.zip|RECURSE

FileKey3=%ProgramFiles%\TVersity Codec Pack|*.exe;*.url

FileKey5=%WinDir%\System32\config\systemprofile\AppData\Local\Temp\TVersity Media Server|*.*|REMOVESELF

FileKey6=%WinDir%\System32\config\systemprofile\Local Settings\Application Data\Temp\TVersity Media Server|*.*|REMOVESELF

FileKey7=%WinDir%\System32|tversity.cookies;TVersityMediaServer.log;*.1;*.2;*.3

FileKey8=%LocalAppData%\VirtualStore\Program Files*\TVersity\Media Server\logs|*.log;*.txt;*.xml;*.zip|RECURSE

FileKey9=%LocalAppData%\VirtualStore\Program Files*\TVersity Codec Pack|*.exe;*.url ExcludeKey1=FILE|%ProgramFiles%\TVersity\Media Server|version.txt;*HOWTO Share Media.txt ExcludeKey2=FILE|%ProgramFiles%\TVersity Codec Pack\uninst.exe

[Microsoft Flight Simulator X*] Section=Games Detect=HKLM\Software\Microsoft\Microsoft Games\Flight Simulator\10.0 Default=False

FileKey1=%ProgramFiles%\Microsoft Games\Microsoft Flight Simulator X|*.log;*.rtf;*.html;*.URL

FileKey2=%ProgramFiles%\Microsoft Games\Microsoft Flight Simulator X\Modules|*.log

FileKey3=%LocalAppData%\VirtualStore\Program Files*\Microsoft Games\Microsoft Flight Simulator X|*.log;*.rtf;*.html;*.URL

FileKey4=%LocalAppData%\VirtualStore\Program Files*\Microsoft Games\Microsoft Flight Simulator X\Modules|*.log ExcludeKey1=FILE|%ProgramFiles%\Microsoft Games\Microsoft Flight Simulator X|*kiosk.rtf;*readme.rtf;*Readme.htm

[Pando Cache*] Detect=HKCU\Software\Pando Networks\Pando Warning=Make sure Pando is totally shut down before using this LangSecRef=3024 Default=False

[VMware Workstation*] LangSecRef=3024 Detect=HKLM\Software\VMware, Inc.\Installer\VMware Workstation Default=False

FileKey1=%CommonAppData%\VMware\hostd|*.log;*.gz|RECURSE

FileKey2=%CommonAppData%\VMware\Installer|*.*|REMOVESELF

FileKey3=%CommonAppData%\VMware\VMware vCenter Converter Standalone|*.log;*.gz;*.zip|RECURSE

FileKey4=%Documents%\My Virtual Machines|*.log|RECURSE

FileKey5=%LocalAppData%\VMware\VMware vCenter Converter Standalone Client\Logs|*.log;*.gz

FileKey6=%ProgramFiles%\VMware\VMware vCenter Converter Standalone|*.rtf;*.zip|RECURSE

FileKey7=%ProgramFiles%\VMware\VMware VIX|*.txt;*.rtf

FileKey8=%LocalAppData%\VirtualStore\Program Files*\VMware\VMware vCenter Converter Standalone|*.rtf;*.zip|RECURSE

FileKey9=%LocalAppData%\VirtualStore\Program Files*\VMware\VMware VIX|*.txt;*.rtf

FileKey10=%LocalAppData%\VirtualStore\ProgramData\VMware\hostd|*.log;*.gz|RECURSE

FileKey11=%LocalAppData%\VirtualStore\ProgramData\VMware\Installer|*.*|REMOVESELF

FileKey12=%LocalAppData%\VirtualStore\ProgramData\VMware\VMware vCenter Converter Standalone|*.log;*.gz;*.zip|RECURSE ExcludeKey1=FILE|%ProgramFiles%\VMware\VMware vCenter Converter Standalone\Help|*.txt|RECURSE ExcludeKey2=FILE|%ProgramFiles%\VMware\VMware VIX\vixwrapper-config.txt ExcludeKey3=FILE|%ProgramFiles%\VMware\VMware Workstation\vixwrapper-product-config.txt

[Warcraft III*] Section=Games Detect=HKLM\Software\Blizzard Entertainment\Warcraft III DetectFile=%ProgramFiles%\Warcraft III\Warcraft III.exe Default=False

FileKey1=%ProgramFiles%\Warcraft III|*.log;*.html

FileKey2=%ProgramFiles%\Warcraft III\Errors|*.dmp;*.txt

FileKey3=%LocalAppData%\VirtualStore\*\Warcraft III\Errors|*.dmp;*.txt

FileKey4=%LocalAppData%\VirtualStore\Program Files*\Warcraft III|*.log;*.html ExcludeKey1=FILE|%ProgramFiles%\Warcraft III|*CustomKeyInfo.txt;*CustomKeysSample.txt

----------------------------------------------------------------------------------------------------------------------------- Bugs regarding Detect OS: I don't know, if the "|" behind or before DetectOS is necarssary.

[sync Traces*] DetectOS=6.2| LangSecRef=3025 Default=False

FileKey1=%LocalAppData%\Microsoft\Windows\SettingSync\metastore|*.jrs

FileKey2=%LocalAppData%\Microsoft\Windows\SettingSync\remotemetastore\*|*.jrs

[Device Manager Cache XP*] LangSecRef=3025 DetectOS=|5.1 Default=False Warning=This clears cached drivers of connected devices. As soon as you connect a new device with your computer or restart the PC the Windows OS will rebuild this file!

FileKey1=%WinDir%\inf|INFCACHE.1

[Device Manager Cache*] LangSecRef=3025 DetectOS=6.0| Default=False Warning=This clears cached drivers of connected devices. As soon as you connect a new device with your computer or restart the PC the Windows OS will rebuild this file!

FileKey1=%WinDir%\System32\DriverStore|INFCACHE.1

[Notification Cache*] DetectOS=6.2| LangSecRef=3025 Default=False

FileKey1=%LocalAppData%\Microsoft\Windows\Notifications|*.*|RECURSE

[store*] DetectOS=6.2| Section=3031 Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\WinStore_cw5n1h2txyewy Default=False

FileKey1=%LocalAppData%\Packages\WinStore_*\AC\AppCache|*.*|RECURSE

FileKey2=%LocalAppData%\Packages\WinStore_*\AC\INetCache|*.*|RECURSE

FileKey3=%LocalAppData%\Packages\WinStore_*\AC\INetCookies|*.*|RECURSE

FileKey4=%LocalAppData%\Packages\WinStore_*\AC\INetHistory|*.*|RECURSE

FileKey5=%LocalAppData%\Packages\WinStore_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE

FileKey6=%LocalAppData%\Packages\WinStore_*\AC\Microsoft\CryptnetUrlCache\Content|*.*

FileKey7=%LocalAppData%\Packages\WinStore_*\AC\Microsoft\CryptnetUrlCache\MetaData|*.*

FileKey8=%LocalAppData%\Packages\WinStore_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE

FileKey9=%LocalAppData%\Packages\WinStore_*\AC\Microsoft\Windows Store\Cache|*.*|RECURSE

FileKey10=%LocalAppData%\Packages\WinStore_*\AC\Microsoft\Windows Store\Data|history.dat

FileKey11=%LocalAppData%\Packages\WinStore_*\AC\PRICache|*.*

FileKey12=%LocalAppData%\Packages\WinStore_*\AC\Temp|*.*

FileKey13=%LocalAppData%\Packages\WinStore_*\LocalState\Cache|*.*|RECURSE

FileKey14=%LocalAppData%\Packages\WinStore_*\LocalState\LiveTile|*.*|RECURSE

FileKey15=%LocalAppData%\Packages\WinStore_*\LocalState\navigationHistory|*.*|RECURSE

FileKey16=%LocalAppData%\Microsoft\Windows Store\Cache Medium IL|*.*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\WinStore_cw5n1h2txyewy\SearchHistory

[Windows 7/8 MUICache*] DetectOS=6.1| LangSecRef=3025 Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell Default=False RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

[Windows 7/8 QuickLaunch*] DetectOS=6.1| LangSecRef=3025 Detect=HKCU\Software\Microsoft\Internet Explorer Default=False Warning=This will remove all of your QuickLaunch icons.

FileKey1=%AppData%\Microsoft\Internet Explorer\Quick Launch|*.lnk

[Windows 7/8 ShellBags*] DetectOS=6.1| LangSecRef=3025 Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell Default=False Warning=This will delete window size, window position and view setting of all folders. RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags RegKey2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU

[Windows 8 ScreenShot Index*] DetectOS=6.2| LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows Default=False Warning=This Resets Screenshot Naming Back To "Screenshot (1).png" RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer|ScreenshotIndex

[Windows 8 Search History*] DetectOS=6.2| LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows Default=False RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SearchHistory

FileKey1=%LocalAppData%\Microsoft\Windows\ConnectedSearch\History|*.*

[Windows 8 Sharing MFU*] DetectOS=6.2| LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows Default=False Warning=This will remove the frequently shared list. e.g. email addresses that have been used to share. This does not remove the Apps listed under sharing. RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SharingMFU

[Windows 8 Start Menu Cache*] DetectOS=6.2| LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\UFH Default=False RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\UFH\SHC

[Windows Defender Definition Updates*] LangSecRef=3024 DetectOS=|6.1 Detect=HKLM\Software\Microsoft\Windows Defender Default=False

FileKey1=%CommonAppData%\Microsoft\Windows Defender\Definition Updates|*.*|RECURSE

FileKey2=%LocalAppData%\VirtualStore\ProgramData\Microsoft\Windows Defender\Definition Updates|*.*|RECURSE

[Windows Defender Definition Updates*] LangSecRef=3024 DetectOS=|6.1 Detect=HKLM\Software\Microsoft\Windows Defender Default=False

FileKey1=%CommonAppData%\Microsoft\Windows Defender\Definition Updates|*.*|RECURSE

FileKey2=%LocalAppData%\VirtualStore\ProgramData\Microsoft\Windows Defender\Definition Updates|*.*|RECURSE

[Windows QuickLaunch ImplicitAppShortcuts*] DetectOS=6.1| LangSecRef=3025 DetectFile=%AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts Default=False Warning=This will break pinned configuration shortcuts (like control panel).

FileKey1=%AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts|*.*|RECURSE

[Windows XP ARPCache*] DetectOS=|5.1 LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows Default=False Warning=This cleans the Add/Remove Programs cache and will fix very large areas of black gaps in it. Using this will cause Add/Remove Programs to take a very long time to load since it will have to rebuild the cache. RegKey1=HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache

[Windows XP Error Reporting*] DetectOS=|5.2 LangSecRef=3025 Default=False Warning=This deletes the error reports generated by Windows (such as failed Windows Updates) that Microsoft Error Reporting requests to upload directly to Microsoft. Make sure you upload the error reports before using this cleaner, that way Microsoft may be able to fix the problem in a future Windows Update.

FileKey1=%WinDir%\pchealth\ERRORREP|*.*|RECURSE

FileKey2=%LocalAppData%\PCHealth\ErrorRep\QSignoff|*.*

[Windows XP MUICache*] DetectOS=|5.1 LangSecRef=3025 Detect1=HKCU\Software\Microsoft\Windows\ShellNoRoam Detect2=HKCU\Software\Microsoft\Windows\Shell Default=False RegKey1=HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache RegKey2=HKCU\Software\Microsoft\Windows\Shell\MUICache

[Windows XP ShellBags*] DetectOS=|5.1 LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows\ShellNoRoam Default=False Warning=This will delete window size, window position and view setting of all folders. RegKey1=HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU RegKey2=HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags

[Windows XP System Profile*] DetectOS=|5.1 LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows Default=False

FileKey1=%WinDir%\System32\config\SystemProfile\Application Data\Microsoft\CryptnetUrlCache\Content|*.*

FileKey2=%WinDir%\System32\config\SystemProfile\Application Data\Microsoft\CryptnetUrlCache\MetaData|*.*

FileKey3=%WinDir%\System32\config\SystemProfile\Cookies|*.*|RECURSE

FileKey4=%WinDir%\System32\config\SystemProfile\IETldCache|*.*|RECURSE

FileKey5=%WinDir%\System32\config\SystemProfile\Local Settings\History|*.*|RECURSE

FileKey6=%WinDir%\System32\config\SystemProfile\Local Settings\Temp|*.*|RECURSE

FileKey7=%WinDir%\System32\config\SystemProfile\Local Settings\Temporary Internet Files|*.*|RECURSE

back_track · May 28, 2014

--------------------------------------------------------------------------------------------------------------------------------- Bugs regarding to deletion "Unmasking" (These doesn't get delete because of "\" instead of "|"):

its true !!!

_________________________________________________________________

working of Excludekey: I think these Excludekey should not work, because you use | instead of \, cause Excludekeys work like this.

also true !!!!

but second bug:

ExcludeKey1=FILE|C:\Users\Admin\Desktop\Musik\1.txt;2.txt

; dont work, serperate each file ......

___________________________________________________________________

from winapp2.ini

[Diablo III Logs*]
Section=Games
Detect=HKCU\Software\Blizzard Entertainment\D3
Default=False
FileKey1=%CommonAppData%\Battle.net\Setup\diablo3_engb\Log
FileKey2=%ProgramFiles%\Diablo III\Logs
FileKey3=%ProgramFiles%\Diablo III Beta\Logs|*.*
FileKey4=%LocalAppData%\VirtualStore\Program Files*\Diablo III\Logs
FileKey5=%LocalAppData%\VirtualStore\Program Files*\Diablo III Beta\Logs|*.*
FileKey6=%LocalAppData%\VirtualStore\ProgramData\Battle.net\Setup\diablo3_engb\Log

File key 1 ,2 ,6 not cleaning definition! could it work ? like *.log e.g.

______________________________________________________________________

detection throu

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node

is not the best way in ,my opinion .....

but we have to discuss!

________________________________________________________________________

from doku

This second example is for a program which stores its preferences in Registry keys:

[Adobe ImageReady CS]LangSecRef=3021Detect=HKCU\Software\Adobe\ImageReady 8.0Default=TrueRegKey1=HKCU\Software\Adobe\ImageReady 8.0\Preferences\URLHistoryRegKey2=HKCU\Software\Adobe\ImageReady 8.0\Preferences|SaveDirRegKey3=HKCU\Software\Adobe\ImageReady 8.0\Preferences\RecentFiles

The fifth and subsequent lines (RegKeyX) indicate the Registry keys to clean. They are in the format:

http://www.piriform.com/docs/ccleaner/advanced-usage/ccleaner-ini-files/how-to-add-your-own-program-for-ccleaner-to-clean

I say both works you have to test it ^^

______________________________________________________________________________________________

form the orginal winapp file:

[Game Explorer]
ID=2174
LangSecRef=3025
DetectOS=6.0
DetectFile=%%LocalAppData%\Microsoft Games
DetectFile2=%LocalAppData%\Microsoft\Windows\GameExplorer
DetectFile3=%LocalAppData%\Microsoft\GFWLive
Default=False
FileKey1=%LocalAppData%\Microsoft Games|*.xml.bak|RECURSE
FileKey2=%LocalAppData%\Microsoft\Windows\GameExplorer\GameStatistics|*.*|REMOVESELF
FileKey3=%LocalAppData%\Microsoft\GFWLive|*.log|RECURSE

no | !!!! right ???? could it be older and newer ? like >1 1 <

__________________________________________________________________________________

Andavari · May 28, 2014

Bugs regarding Regkeys deletion. I don't it it very well, but Regkeys should be deletet with \ and not | or is somehow else. Please ask the forum.There are a lot Regkey which should be delete with \ and |. But you should ask the forum.

RegKey3=HKCU\Software\Microsoft\Windows Live\Photo Aquisition\Camera|RootDirectory

In the quoted example above you provided:

"|RootDirectory" would tell CCleaner it's a sub-value (think of it as a text INI file with settings in it) of "Camera" which lets CCleaner know what settings to delete inside of "Camera" in particular and precisely "RootDirectory" instead of deleting the whole Camera key.

If it had "\RootDirectory" with a backslash, that would tell CCleaner it's a sub-key (think of it as a sub-folder/path) and CCleaner would then think it had to delete a sub-key but wouldn't be able to because "RootDirectory is a sub-value not a sub-key.

Kind of difficult to explain with backslash and upperslash, it's confusing enough but Piriform could've made it more confusing but luckily didn't, I hope you understood my explanation.

Edited May 28, 2014 by Andavari
clarification

Winapp2.ini · May 29, 2014

I got a follow up email that decoded it. Attached below.

Additionally, I accidentally may have deleted literally thousands of someone's emails today, so one of the Windows Live Mail messages probably needs tweaking (I can't confirm it was winapp2.ini, but it seems a likely suspect)

Winapp2.ini · May 29, 2014

email

(No, this email's not real, it's http://deadfake.com)

--------------------------------------------------------------------

Thanks for the big Update Winapp2.ini
612 KB to 731 KB is a great improvement.

Whatever, here's filelist of new entries, modifications and bugs (Probably) you should remove.
Thanks.

[Trend Micro Logs*]
LangSecRef=3023
Detect=HKCU\Software\Trend Micro
DetectFile=%CommonAppData%\Trend Micro
Default=False
FileKey1=%CommonAppData%\Trend Micro|*.log|RECURSE

I have added Detectfile, because really lot of log files weren't found.
The Registry Detect only doesn't work (on all systems probably). I cleaned, but it didn't find these logs.
Hope this time it works.

Found these:
C:\ProgramData\Trend Micro\_Trend_Vizor_Remove_S-1-5-21-2213765280-380165501-1463282434-1000.log    1.476 KB
C:\ProgramData\Trend Micro\_Trend_Vizor_Remove_S-1-5-21-2824826491-677968899-3539912517-500.log    6 KB
C:\ProgramData\Trend Micro\_Trend_Vizor_ShortCut.log    14 KB
C:\ProgramData\Trend Micro\_Trend_Vizor_ShortCut_S-1-5-21-2213765280-380165501-1463282434-1000.log    395 KB
C:\ProgramData\Trend Micro\_Trend_Vizor_TiMiniService.log    111 KB
C:\ProgramData\Trend Micro\_Trend_Vizor_TiMiniService_S-1-5-21-2213765280-380165501-1463282434-1000.log    2 KB
C:\ProgramData\Trend Micro\_Trend_Vizor_TiMiniService_S-1-5-21-2824826491-677968899-3539912517-500.log    1 KB
C:\ProgramData\Trend Micro\_Trend_Vizor_TiResumeSrv.log    356 KB
C:\ProgramData\Trend Micro\_Trend_Vizor_VizorHtmlDialog_S-1-5-21-2213765280-380165501-1463282434-1000.log    2.453 KB
C:\ProgramData\Trend Micro\_Trend_Vizor_VizorHtmlDialog_S-1-5-21-2824826491-677968899-3539912517-500.log    2 KB
C:\ProgramData\Trend Micro\_Trend_Vizor_Remove_S-1-5-21-2213765280-380165501-1463282434-1000.log    1.476 KB
C:\ProgramData\Trend Micro\_Trend_Vizor_Remove_S-1-5-21-2824826491-677968899-3539912517-500.log    6 KB
C:\ProgramData\Trend Micro\_Trend_Vizor_ShortCut.log    14 KB
C:\ProgramData\Trend Micro\_Trend_Vizor_ShortCut_S-1-5-21-2213765280-380165501-1463282434-1000.log    395 KB
C:\ProgramData\Trend Micro\_Trend_Vizor_TiMiniService.log    111 KB
C:\ProgramData\Trend Micro\_Trend_Vizor_TiMiniService_S-1-5-21-2213765280-380165501-1463282434-1000.log    2 KB
C:\ProgramData\Trend Micro\_Trend_Vizor_TiMiniService_S-1-5-21-2824826491-677968899-3539912517-500.log    1 KB
C:\ProgramData\Trend Micro\_Trend_Vizor_TiResumeSrv.log    356 KB
C:\ProgramData\Trend Micro\_Trend_Vizor_VizorHtmlDialog_S-1-5-21-2213765280-380165501-1463282434-1000.log    2.453 KB
C:\ProgramData\Trend Micro\_Trend_Vizor_VizorHtmlDialog_S-1-5-21-2824826491-677968899-3539912517-500.log    2 KB

[Realtek (Logs)*]
LangSecRef=3021
Detect=HKLM\Software\Realtek
Default=False
FileKey1=%ProgramFiles%\Realtek*|*.log;*.txt|RECURSE
FileKey2=%SystemDrive%|RHDSetup.log|RECURSE
ExcludeKey1=FILE|%ProgramFiles%\Realtek\*\InstCtrl.txt
ExcludeKey2=FILE|%ProgramFiles%\Realtek\*\setupctrl.txt

Found these:
C:\RHDSetup.log    3 KB

[MSI Afterburner Hardware Monitoring*]
LangSecRef=3024
Detect=HKCU\Software\MSI
Default=False
FileKey1=%ProgramFiles%\MSI Afterburner|HardwareMonitoring.hml

Found these:
C:\Program Files (x86)\MSI Afterburner\HardwareMonitoring.hml

[Wistron Corp Launch Manager Logs*]
LangSecRef=3024
Detect1=HKLM\SOFTWARE\Wistron Corp\Launch Manager
Detect2=HKLM\SOFTWARE\Wow6432Node\Wistron Corp\Launch Manager
Default=False
FileKey=%Programfiles%\Launch Manager|*.log

Found these:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Wistron Corp\Launch Manager
C:\Program Files (x86)\Launch Manager\setup.log

[Dell Backup and Recovery Logs*]
LangSecRef=3024
Detect1=HKLM\SOFTWARE\Dell
Detect2=HKLM\SOFTWARE\Wow6432Node\Dell
Default=False
FileKey=%Programfiles%\Dell Backup and Recovery|*.log

Found these:
C:\Program Files (x86)\Dell Backup and Recovery\DSLCheck.exe.20140521235809_1.log
HKLM\SOFTWARE\Dell
HKLM\SOFTWARE\Wow6432Node\Dell

[Downloaded Installations*]
LangSecRef=3025
DetectFile1=%LocalAppData%\Downloaded Installations
DetectFile2=%Documents%\Downloaded Installations
DetectFile3=%CommonAppData%\Downloaded Installations
Default=False
FileKey1=%LocalAppData%\Downloaded Installations|*.*|RECURSE
FileKey2=%Documents%\Downloaded Installations
FileKey2=%CommonAppData%\Downloaded Installations

-Slimdriver Installation Files are downloaded to the Documents folder or Programdata Folder.
It is not important after installation or for unistallation.

[Realtek Cam Driver Installation Files*]
LangSecRef=3024
Detect1=HKLM\SOFTWARE\Realtek Semiconductor Corp.\Realtek PC Camera
Detect2=HKLM\SOFTWARE\Vimicro Corporation\Lenovo USB2.0 UVC Camera
Detect3=HKLM\SOFTWARE\Wow6432Node\Vimicro Corporation\Lenovo USB2.0 UVC Camera
Warning=This will delete your Realtek Cam Driver installation files.
Default=False
FileKey1=%SystemDrive%\Cam Driver|*.*|REMOVESELF
FileKey2=%SystemDrive%\Realtek Cam Driver|*.*|REMOVESELF

[Lenovo Cam S MIC Driver Installation Files*]
LangSecRef=3024
Detect=HKLM\SOFTWARE\Lenovo
Warning=This will delete your Lenovo Cam S MIC Driver installation files.
Default=False
FileKey1=%SystemDrive%\Cam S MIC Driver|*.*|REMOVESELF

[Lenovo ST SensorHub Easy FW Update Driver Installation Files*]
LangSecRef=3024
Detect=HKLM\SOFTWARE\Lenovo
Warning=This will delete your Lenovo Cam S MIC Driver installation files.
Default=False
FileKey1=%SystemDrive%\SensorHub FW|*.*|REMOVESELF

[Lenovo Silk Wireless Keyboard Driver Installation Files*]
LangSecRef=3024
Detect=HKLM\SOFTWARE\Lenovo
Warning=This will delete your Silk Wireless Keyboard Driver installation files.
Default=False
FileKey1=%SystemDrive%\Lenovo Silver Silk Keyboard Driver|*.*|REMOVESELF

[Future Technology E-dice Dongle Driver Installation Files*]
LangSecRef=3024
DetectFile=%SystemDrive%\E-dice Dongle Driver
Warning=This will delete your Future Technology E-dice Dongle Driver installation files.
Default=False
FileKey1=%SystemDrive%\E-dice Dongle Driver|*.*|REMOVESELF

[TOSHIBA Driver Installation Files*]
LangSecRef=3024
Detect=HKLM\SOFTWARE\TOSHIBA
Warning=This will delete your TOSHIBA Driver installation files.
Default=False
FileKey1=%SystemDrive%\drivers|*.*|REMOVESELF

Found these:
HKEY_LOCAL_MACHINE\SOFTWARE\TOSHIBA
C:\drivers

[CONEXANT Logs*]
LangSecRef=3021
DetectFile=%ProgramFiles%\CONEXANT
Warning=This will delete your CONEXANT Driver installation files.
Default=False
FileKey1=%ProgramFiles%\CONEXANT\PREINSTALL|*.*|REMOVESELF

[Helium Music Manager*]
LangSecRef=3023
Detect1=HKCU\Software\Intermedia Software\Helium 8
Detect2=HKCU\Software\Intermedia Software\Helium 9
Default=False
FileKey1=%AppData%\Intermedia Software\Helium *\Logs|*.*

I have used a "*", which is deleting version 8 and 9.

The rest:

I think I have added most of this. Let's wait next version, if these get deleted.

C:\Users\{Username}\AppData\Local\Avg2014\log\avgdiagex.log    9 KB

C:\ProgramData\Atheros\atheros_installer.log    10 KB
C:\ProgramData\Atheros\InstallHelper.log    1 KB
C:\ProgramData\Atheros\atheros_installer.log    10 KB
C:\ProgramData\Atheros\InstallHelper.log    1 KB

C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12qhk.tmp    0 KB
C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12rqn.tmp    0 KB
C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12stn.tmp    0 KB
C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12ua3.tmp    0 KB
C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12w27.tmp    0 KB
C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12xg1.tmp    0 KB
C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12ua3.tmp_\dict-en.oxt\changelog.txt    3 KB
C:\Users\{Username}\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\sv12w27.tmp_\dict-it.oxt\dictionaries\CHANGELOG.txt    1 KB

C:\ProgramData\Microsoft\Microsoft Antimalware\Network Inspection System\Support\NisLog.txt    656 KB
C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppSetup.log    10 KB
C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppSetup.log    10 KB
C:\Windows\System32\InstallPackage_ETW.Log    30 KB
C:\Windows\System32\LocalGroupAdminAdd.log    1 KB
C:\Windows\System32\Local_LLU.log    1 KB
C:\Windows\System32\Network_LLU.log    1 KB
C:\Windows\System32\desktop.ini    1 KB
C:\Windows\System32\InstallPackage_ETW.Log    30 KB
C:\Windows\System32\LocalGroupAdminAdd.log    1 KB
C:\Windows\System32\Local_LLU.log    1 KB
C:\Windows\System32\Network_LLU.log    1 KB
C:\Windows\System32\OEM\Devices.log    4 KB
C:\Windows\System32\OEM\Devices.log    4 KB
C:\Windows\System32\sysprep\Panther\setuperr.log    0 KB
C:\Windows\System32\sysprep\Panther\IE\setupact.log    31 KB
C:\Windows\System32\sysprep\Panther\IE\setuperr.log    0 KB
C:\Windows\System32\sysprep\Panther\IE\setupact.log    31 KB
C:\Windows\System32\sysprep\Panther\IE\setuperr.log    0 KB

C:\Windows\Panther\cbs_unattend.log    32.682 KB
C:\Windows\Panther\cbs_unattend.log    32.682 KB

C:\Program Files (x86)\GUT816F.tmp    5.860 KB

-I have found similar files starting with GUT and a number. I really don't know, where it's coming.
Perhaps the forum knows. Thanks.
----------------------------------------------------------------------------------------------------------------------------
Bugs regarding Regkeys deletion. I don't it it very well, but Regkeys should be deletet with \ and not | or is somehow else.
Please ask the forum.There are a lot Regkey which should be delete with \ and |. But you should ask the forum.

[Windows Live Photo Gallery*]
LangSecRef=3023
Detect=HKCU\Software\Microsoft\Windows Live\Photo Gallery
Default=False
FileKey1=%LocalAppData%\Microsoft\Windows Live Photo Gallery|*.*|RECURSE
RegKey1=HKCU\Software\Microsoft\Windows Live\Photo Gallery|galleryscopedfolders
RegKey2=HKCU\Software\Microsoft\Windows Live\Photo Aquisition\Camera|FinenameTemplate
RegKey3=HKCU\Software\Microsoft\Windows Live\Photo Aquisition\Camera|RootDirectory

[Windows Media Player (MediaGuide)*]
LangSecRef=3023
Detect=HKCU\Software\Microsoft\MediaPlayer
Default=False
RegKey1=HKCU\Software\Microsoft\MediaPlayer\Preferences|CurrentBackgroundScanFolder

[Windows Photo Gallery*]
LangSecRef=3023
Detect=HKCU\Software\Microsoft\Windows Photo Gallery
Default=False
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Camera|FilenameTemplate
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Camera|RootDirectory
RegKey3=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\DestinationMru
RegKey4=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\OpticalMedia|FilenameTemplate
RegKey5=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\OpticalMedia|RootDirectory
RegKey6=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Scanner|FilenameTemplate
RegKey7=HKCU\Software\Microsoft\Windows\CurrentVersion\Photo Aquisition\Scanner|RootDirectory
RegKey8=HKCU\Software\Microsoft\Windows Photo Gallery\Library\PreviewAssignment\MRU

[Windows Session Manager*]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
Default=False
FileKey1=%WinDir%\AppCompat\Programs|*.xml
FileKey2=%WinDir%\AppCompat\Programs\Install|*.xml
RegKey1=HKLM\SYSTEM\ControlSet001\Control\Session Manager|PendingFileRenameOperations
RegKey2=HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCompatCache|AppCompatCache
RegKey3=HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCompatCache|CacheMainSdb
RegKey4=HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCompatCache|SdbTime

[WinHasher*]
LangSecRef=3024
Detect=HKCU\Software\GPF Comics\WinHasher
Default=False
RegKey1=HKCU\Software\GPF Comics\WinHasher|LastDirectory

[WinImage*]
LangSecRef=3024
Detect=HKCU\Software\WinImage
Default=False
RegKey1=HKCU\Software\WinImage|File1
RegKey2=HKCU\Software\WinImage|File2
RegKey3=HKCU\Software\WinImage|File3
RegKey4=HKCU\Software\WinImage|File4
RegKey5=HKCU\Software\WinImage|File5
RegKey6=HKCU\Software\WinImage|File6
RegKey7=HKCU\Software\WinImage|File7
RegKey8=HKCU\Software\WinImage|File8
RegKey9=HKCU\Software\WinImage|File9
RegKey10=HKCU\Software\WinImage|PathExtract

[WinZip Registry Optimizer*]
LangSecRef=3024
DetectFile=%AppData%\Nico Mak Computing\WinZip Registry Optimizer
Default=False
FileKey1=%AppData%\Nico Mak Computing\WinZip Registry Optimizer\*|log*.*
---------------------------------------------------------------------------------------------------------------------------------
Bugs regarding to deletion "Unmasking" (These doesn't get delete because of "\" instead of "|"):

[Privacy Suite*]
LangSecRef=3024
Detect=HKCU\Software\CyberScrub\Privacy Suite
Default=False
FileKey1=%AppData%\CyberScrub\Privacy Suite\cybscrub.log

[Diablo III Logs*]
Section=Games
Detect=HKCU\Software\Blizzard Entertainment\D3
Default=False
FileKey1=%CommonAppData%\Battle.net\Setup\diablo3_engb\Log
FileKey2=%ProgramFiles%\Diablo III\Logs
FileKey3=%ProgramFiles%\Diablo III Beta\Logs|*.*
FileKey4=%LocalAppData%\VirtualStore\Program Files*\Diablo III\Logs
FileKey5=%LocalAppData%\VirtualStore\Program Files*\Diablo III Beta\Logs|*.*
FileKey6=%LocalAppData%\VirtualStore\ProgramData\Battle.net\Setup\diablo3_engb\Log

[Maxthon Browser 3 Cache*]
LangSecRef=3022
Detect=HKCU\Software\Maxthon3
Default=False
FileKey1=%Tmp%\Maxthon3Cache\Temp\Webkit\Cache

[Pidgin More*]
LangSecRef=3022
Detect=HKCU\Software\Pidgin
Default=False
FileKey1=%AppData%\.purple|*.xml~
FileKey2=%UserProfile%\Recently-Used.xbel

[QIP 2012 Privacy items*]
LangSecRef=3022
Detect=HKCU\Software\QIP
DetectFile=%AppData%\QIP
Default=False
Warning=Selecting this will delete any contact list backups, chat history, received files, opened tabs settings and other non-encrypted privacy items.
FileKey1=%AppData%\QIP\Profiles\*\BackupCL|*.*
FileKey2=%AppData%\QIP\Profiles\*\History|*.*|RECURSE
FileKey3=%AppData%\QIP\Profiles\*\ICQ|*.*|RECURSE
FileKey4=%AppData%\QIP\Profiles\*\RcvdFiles|*.*|RECURSE
FileKey5=%AppData%\QIP\Profiles\*\session.tabs

[Registry Clean Expert*]
LangSecRef=3023
Detect=HKCU\Software\SuniSoft\IncUpdate\Registry Clean Expert
Default=False
FileKey1=%ProgramFiles%\Registry Clean Expert\fixlog.ini
FileKey2=%LocalAppData%\VirtualStore\Program Files*\Registry Clean Expert\fixlog.ini

[VoipBuster Logs*]
LangSecRef=3022
DetectFile=%AppData%\VoipBuster
Default=False
FileKey1=%AppData%\VoipBuster|*.log
FileKey2=%WinDir%\System32\VoipBuster*.log
FileKey3=%WinDir%\SysWOW64\VoipBuster*.log

[Yahoo! Autosync*]
LangSecRef=3022
Detect=HKCU\Software\Yahoo!\Autosync for Yahoo!
Default=False
FileKey1=%ProgramFiles%\Yahoo!\Yahoo! Autosync\Logs
FileKey2=%LocalAppData%\VirtualStore\Program Files*\Yahoo!\Yahoo! Autosync\Logs
-------------------------------------------------------------------------------------------------------------------------------------------------------
Bugs regarding the working of Excludekey: I think these Excludekey should not work, because you use | instead of \, cause Excludekeys work like this.

[Active@ KillDisk*]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{0F62EFB8-3C1C-4EE6-B6EF-9593007F9B03}_is1
Default=False
FileKey1=%ProgramFiles%\LSoft Technologies\Active@ KillDisk*|*.log;*.pdf;*.xml
FileKey2=%LocalAppData%\VirtualStore\Program Files*\LSoft Technologies\Active@ KillDisk*|*.log;*.pdf;*.xml
ExcludeKey1=FILE|%ProgramFiles%\LSoft Technologies\Active@ KillDisk*|BootDisk.pdf
ExcludeKey2=FILE|%ProgramFiles%\LSoft Technologies\Active@ KillDisk*|KillDisk.pdf
ExcludeKey3=FILE|%LocalAppData%\VirtualStore\Program Files*\LSoft Technologies\Active@ KillDisk*|BootDisk.pdf
ExcludeKey4=FILE|%LocalAppData%\VirtualStore\Program Files*\LSoft Technologies\Active@ KillDisk*|KillDisk.pdf

[Age of Empires*]
Section=Games
Detect1=HKLM\Software\Microsoft\Games\Age of Empires
Detect2=HKLM\Software\Microsoft\Microsoft Games\Age of Empires
Detect3=HKLM\Software\Wow6432Node\Microsoft\microsoft games\age of empires 3
Default=False
FileKey1=%Documents%\My Games\Age of Mythology|*.txt
FileKey2=%Documents%\My Games\Age of Empires 3|*.txt
FileKey3=%Documents%\My Games\Age of Empires 3\RM|*.dmp.txt
RegKey1=HKLM\Software\Microsoft\Games\Age of Empires\1.00|Zone
RegKey2=HKLM\Software\Microsoft\Microsoft Games\Age of Empires|Zone
RegKey3=HKLM\Software\Microsoft\Microsoft Games\Age of Empires Expansion\1.0|Zone
RegKey4=HKLM\Software\Microsoft\Microsoft Games\Age of Empires\2.0|Zone
RegKey5=HKLM\Software\Microsoft\Microsoft Games\Age of Empires II: The Conquerors Expansion\1.0|Zone
ExcludeKey1=FILE|%ProgramFiles%\Microsoft Games\Age of Mythology|*Readme.rtf;*Readmex.rtf
ExcludeKey2=FILE|%ProgramFiles%\Microsoft Games\Age of Empires III|*Readme.rtf;*ReadmeX.rtf;*ReadmeY.rtf

[Comodo Dragon (More)*]
LangSecRef=3029
Detect=HKLM\Software\ComodoGroup\Dragon
Default=False
ExcludeKey1=FILE|%LocalAppData%\COMODO\Dragon\User Data\|First Run
ExcludeKey2=FILE|%LocalAppData%\COMODO\Dragon\User Data\|Local State
FileKey1=%LocalAppData%\COMODO|*.lock|RECURSE
FileKey2=%LocalAppData%\COMODO|*.old|RECURSE
FileKey3=%LocalAppData%\COMODO\Dragon\User Data|*.*
FileKey4=%LocalAppData%\COMODO\Dragon\User Data\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\COMODO\Dragon\User Data\Default|Extension Cookies
FileKey6=%LocalAppData%\COMODO\Dragon\User Data\Default|Archived History
FileKey7=%LocalAppData%\COMODO\Dragon\User Data\Default|Archived History-journal
FileKey8=%LocalAppData%\COMODO\Dragon\User Data\Default|History
FileKey9=%LocalAppData%\COMODO\Dragon\User Data\Default|History Index
FileKey10=%LocalAppData%\COMODO\Dragon\User Data\Default|History Index *
FileKey11=%LocalAppData%\COMODO\Dragon\User Data\Default|History-journal
FileKey12=%LocalAppData%\COMODO\Dragon\User Data\Default|Network Action Predictor-journal
FileKey13=%LocalAppData%\COMODO\Dragon\User Data\Default|Top Sites
FileKey14=%LocalAppData%\COMODO\Dragon\User Data\Default|Top Sites-journal
FileKey15=%LocalAppData%\COMODO\Dragon\User Data\Default|Visited Links
FileKey16=%LocalAppData%\COMODO\Dragon\User Data\Default\Application Cache|*.*|RECURSE
FileKey17=%LocalAppData%\COMODO\Dragon\User Data\Default\Extensions\Temp|*.*
FileKey18=%LocalAppData%\COMODO\Dragon\User Data\Default\Extension Rules|*.*|RECURSE
FileKey19=%LocalAppData%\COMODO\Dragon\User Data\Default\File System|*.*|RECURSE
FileKey20=%LocalAppData%\COMODO\Dragon\User Data\Default\GPUCache|*.*|RECURSE
FileKey21=%LocalAppData%\COMODO\Dragon\User Data\Default\Media Cache|*.*|RECURSE
FileKey22=%LocalAppData%\COMODO\Dragon\User Data\Default\Session Storage|*.*|RECURSE
FileKey23=%LocalAppData%\COMODO\Dragon\User Data\Default\Temp|*.*|RECURSE
FileKey24=%LocalAppData%\COMODO\Dragon\User Data\Performance Monitor Databases|*.*|REMOVESELF
FileKey25=%SystemDrive%\first_launch|*.*|REMOVESELF

[CyberLink PhotoDirector 3 More*]
LangSecRef=3023
Detect=HKCU\Software\CyberLink\PhotoDirector3
Default=False
FileKey1=%Pictures%\PhotoDirector\3.0\*|*.*|RECURSE
ExcludeKey1=FILE|%Pictures%\PhotoDirector\3.0\*|*.phd

[CyberLink PhotoDirector 4*]
LangSecRef=3023
Detect1=HKLM\Software\CyberLink\PhotoDirector4
Detect2=HKLM\Software\Wow6432Node\CyberLink\PhotoDirector4
Default=False
FileKey1=%CommonAppData%\CyberLink\Downloader|*.*
FileKey2=%Pictures%\PhotoDirector\4.0\*|*.*|RECURSE
FileKey3=%LocalAppData%\VirtualStore\ProgramData\CyberLink\Downloader|*.*
ExcludeKey1=FILE|%Pictures%\PhotoDirector\4.0\*|*.phd

[TVersity*]
LangSecRef=3023
Detect=HKLM\Software\TVersity\Media Server
Default=False
FileKey1=%ProgramFiles%\TVersity\Media Server|*.rtf;*.url;*TVersityCodecPackSetup*
FileKey2=%ProgramFiles%\TVersity\Media Server\logs|*.log;*.txt;*.xml;*.zip|RECURSE
FileKey3=%ProgramFiles%\TVersity Codec Pack|*.exe;*.url
FileKey5=%WinDir%\System32\config\systemprofile\AppData\Local\Temp\TVersity Media Server|*.*|REMOVESELF
FileKey6=%WinDir%\System32\config\systemprofile\Local Settings\Application Data\Temp\TVersity Media Server|*.*|REMOVESELF
FileKey7=%WinDir%\System32|tversity.cookies;TVersityMediaServer.log;*.1;*.2;*.3
FileKey8=%LocalAppData%\VirtualStore\Program Files*\TVersity\Media Server\logs|*.log;*.txt;*.xml;*.zip|RECURSE
FileKey9=%LocalAppData%\VirtualStore\Program Files*\TVersity Codec Pack|*.exe;*.url
ExcludeKey1=FILE|%ProgramFiles%\TVersity\Media Server|version.txt;*HOWTO Share Media.txt
ExcludeKey2=FILE|%ProgramFiles%\TVersity Codec Pack\uninst.exe

[Microsoft Flight Simulator X*]
Section=Games
Detect=HKLM\Software\Microsoft\Microsoft Games\Flight Simulator\10.0
Default=False
FileKey1=%ProgramFiles%\Microsoft Games\Microsoft Flight Simulator X|*.log;*.rtf;*.html;*.URL
FileKey2=%ProgramFiles%\Microsoft Games\Microsoft Flight Simulator X\Modules|*.log
FileKey3=%LocalAppData%\VirtualStore\Program Files*\Microsoft Games\Microsoft Flight Simulator X|*.log;*.rtf;*.html;*.URL
FileKey4=%LocalAppData%\VirtualStore\Program Files*\Microsoft Games\Microsoft Flight Simulator X\Modules|*.log
ExcludeKey1=FILE|%ProgramFiles%\Microsoft Games\Microsoft Flight Simulator X|*kiosk.rtf;*readme.rtf;*Readme.htm

[Pando Cache*]
Detect=HKCU\Software\Pando Networks\Pando
Warning=Make sure Pando is totally shut down before using this
LangSecRef=3024
Default=False
FileKey1=%LocalAppData%\Pando\Pando Files|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Pando\Pando Files|*Pando.prev.log;pando.save;pando.txt;pando.prev.log;pando.sav;pando.log
ExcludeKey2=PATH|%LocalAppData%\Pando\Pando Files\Cert

[VMware Workstation*]
LangSecRef=3024
Detect=HKLM\Software\VMware, Inc.\Installer\VMware Workstation
Default=False
FileKey1=%CommonAppData%\VMware\hostd|*.log;*.gz|RECURSE
FileKey2=%CommonAppData%\VMware\Installer|*.*|REMOVESELF
FileKey3=%CommonAppData%\VMware\VMware vCenter Converter Standalone|*.log;*.gz;*.zip|RECURSE
FileKey4=%Documents%\My Virtual Machines|*.log|RECURSE
FileKey5=%LocalAppData%\VMware\VMware vCenter Converter Standalone Client\Logs|*.log;*.gz
FileKey6=%ProgramFiles%\VMware\VMware vCenter Converter Standalone|*.rtf;*.zip|RECURSE
FileKey7=%ProgramFiles%\VMware\VMware VIX|*.txt;*.rtf
FileKey8=%LocalAppData%\VirtualStore\Program Files*\VMware\VMware vCenter Converter Standalone|*.rtf;*.zip|RECURSE
FileKey9=%LocalAppData%\VirtualStore\Program Files*\VMware\VMware VIX|*.txt;*.rtf
FileKey10=%LocalAppData%\VirtualStore\ProgramData\VMware\hostd|*.log;*.gz|RECURSE
FileKey11=%LocalAppData%\VirtualStore\ProgramData\VMware\Installer|*.*|REMOVESELF
FileKey12=%LocalAppData%\VirtualStore\ProgramData\VMware\VMware vCenter Converter Standalone|*.log;*.gz;*.zip|RECURSE
ExcludeKey1=FILE|%ProgramFiles%\VMware\VMware vCenter Converter Standalone\Help|*.txt|RECURSE
ExcludeKey2=FILE|%ProgramFiles%\VMware\VMware VIX\vixwrapper-config.txt
ExcludeKey3=FILE|%ProgramFiles%\VMware\VMware Workstation\vixwrapper-product-config.txt

[Warcraft III*]
Section=Games
Detect=HKLM\Software\Blizzard Entertainment\Warcraft III
DetectFile=%ProgramFiles%\Warcraft III\Warcraft III.exe
Default=False
FileKey1=%ProgramFiles%\Warcraft III|*.log;*.html
FileKey2=%ProgramFiles%\Warcraft III\Errors|*.dmp;*.txt
FileKey3=%LocalAppData%\VirtualStore\*\Warcraft III\Errors|*.dmp;*.txt
FileKey4=%LocalAppData%\VirtualStore\Program Files*\Warcraft III|*.log;*.html
ExcludeKey1=FILE|%ProgramFiles%\Warcraft III|*CustomKeyInfo.txt;*CustomKeysSample.txt

-----------------------------------------------------------------------------------------------------------------------------
Bugs regarding Detect OS: I don't know, if the "|" behind or before DetectOS is necarssary.

[sync Traces*]
DetectOS=6.2|
LangSecRef=3025
Default=False
FileKey1=%LocalAppData%\Microsoft\Windows\SettingSync\metastore|*.jrs
FileKey2=%LocalAppData%\Microsoft\Windows\SettingSync\remotemetastore\*|*.jrs

[Device Manager Cache XP*]
LangSecRef=3025
DetectOS=|5.1
Default=False
Warning=This clears cached drivers of connected devices. As soon as you connect a new device with your computer or restart the PC the Windows OS will rebuild this file!
FileKey1=%WinDir%\inf|INFCACHE.1

[Device Manager Cache*]
LangSecRef=3025
DetectOS=6.0|
Default=False
Warning=This clears cached drivers of connected devices. As soon as you connect a new device with your computer or restart the PC the Windows OS will rebuild this file!
FileKey1=%WinDir%\System32\DriverStore|INFCACHE.1

[Notification Cache*]
DetectOS=6.2|
LangSecRef=3025
Default=False
FileKey1=%LocalAppData%\Microsoft\Windows\Notifications|*.*|RECURSE

[store*]
DetectOS=6.2|
Section=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\WinStore_cw5n1h2txyewy
Default=False
FileKey1=%LocalAppData%\Packages\WinStore_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\WinStore_*\AC\INetCache|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\WinStore_*\AC\INetCookies|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\WinStore_*\AC\INetHistory|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\WinStore_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\WinStore_*\AC\Microsoft\CryptnetUrlCache\Content|*.*
FileKey7=%LocalAppData%\Packages\WinStore_*\AC\Microsoft\CryptnetUrlCache\MetaData|*.*
FileKey8=%LocalAppData%\Packages\WinStore_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\WinStore_*\AC\Microsoft\Windows Store\Cache|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\WinStore_*\AC\Microsoft\Windows Store\Data|history.dat
FileKey11=%LocalAppData%\Packages\WinStore_*\AC\PRICache|*.*
FileKey12=%LocalAppData%\Packages\WinStore_*\AC\Temp|*.*
FileKey13=%LocalAppData%\Packages\WinStore_*\LocalState\Cache|*.*|RECURSE
FileKey14=%LocalAppData%\Packages\WinStore_*\LocalState\LiveTile|*.*|RECURSE
FileKey15=%LocalAppData%\Packages\WinStore_*\LocalState\navigationHistory|*.*|RECURSE
FileKey16=%LocalAppData%\Microsoft\Windows Store\Cache Medium IL|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\WinStore_cw5n1h2txyewy\SearchHistory

[Windows 7/8 MUICache*]
DetectOS=6.1|
LangSecRef=3025
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell
Default=False
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

[Windows 7/8 QuickLaunch*]
DetectOS=6.1|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Internet Explorer
Default=False
Warning=This will remove all of your QuickLaunch icons.
FileKey1=%AppData%\Microsoft\Internet Explorer\Quick Launch|*.lnk

[Windows 7/8 ShellBags*]
DetectOS=6.1|
LangSecRef=3025
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell
Default=False
Warning=This will delete window size, window position and view setting of all folders.
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags
RegKey2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU

[Windows 8 ScreenShot Index*]
DetectOS=6.2|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
Warning=This Resets Screenshot Naming Back To "Screenshot (1).png"
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer|ScreenshotIndex

[Windows 8 Search History*]
DetectOS=6.2|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SearchHistory
FileKey1=%LocalAppData%\Microsoft\Windows\ConnectedSearch\History|*.*

[Windows 8 Sharing MFU*]
DetectOS=6.2|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
Warning=This will remove the frequently shared list. e.g. email addresses that have been used to share. This does not remove the Apps listed under sharing.
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SharingMFU

[Windows 8 Start Menu Cache*]
DetectOS=6.2|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\UFH
Default=False
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\UFH\SHC

[Windows Defender Definition Updates*]
LangSecRef=3024
DetectOS=|6.1
Detect=HKLM\Software\Microsoft\Windows Defender
Default=False
FileKey1=%CommonAppData%\Microsoft\Windows Defender\Definition Updates|*.*|RECURSE
FileKey2=%LocalAppData%\VirtualStore\ProgramData\Microsoft\Windows Defender\Definition Updates|*.*|RECURSE

[Windows Defender Definition Updates*]
LangSecRef=3024
DetectOS=|6.1
Detect=HKLM\Software\Microsoft\Windows Defender
Default=False
FileKey1=%CommonAppData%\Microsoft\Windows Defender\Definition Updates|*.*|RECURSE
FileKey2=%LocalAppData%\VirtualStore\ProgramData\Microsoft\Windows Defender\Definition Updates|*.*|RECURSE

[Windows QuickLaunch ImplicitAppShortcuts*]
DetectOS=6.1|
LangSecRef=3025
DetectFile=%AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts
Default=False
Warning=This will break pinned configuration shortcuts (like control panel).
FileKey1=%AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts|*.*|RECURSE

[Windows XP ARPCache*]
DetectOS=|5.1
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
Default=False
Warning=This cleans the Add/Remove Programs cache and will fix very large areas of black gaps in it. Using this will cause Add/Remove Programs to take a very long time to load since it will have to rebuild the cache.
RegKey1=HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache

[Windows XP Error Reporting*]
DetectOS=|5.2
LangSecRef=3025
Default=False
Warning=This deletes the error reports generated by Windows (such as failed Windows Updates) that Microsoft Error Reporting requests to upload directly to Microsoft. Make sure you upload the error reports before using this cleaner, that way Microsoft may be able to fix the problem in a future Windows Update.
FileKey1=%WinDir%\pchealth\ERRORREP|*.*|RECURSE
FileKey2=%LocalAppData%\PCHealth\ErrorRep\QSignoff|*.*

[Windows XP MUICache*]
DetectOS=|5.1
LangSecRef=3025
Detect1=HKCU\Software\Microsoft\Windows\ShellNoRoam
Detect2=HKCU\Software\Microsoft\Windows\Shell
Default=False
RegKey1=HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
RegKey2=HKCU\Software\Microsoft\Windows\Shell\MUICache

[Windows XP ShellBags*]
DetectOS=|5.1
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows\ShellNoRoam
Default=False
Warning=This will delete window size, window position and view setting of all folders.
RegKey1=HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU
RegKey2=HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags

[Windows XP System Profile*]
DetectOS=|5.1
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
FileKey1=%WinDir%\System32\config\SystemProfile\Application Data\Microsoft\CryptnetUrlCache\Content|*.*
FileKey2=%WinDir%\System32\config\SystemProfile\Application Data\Microsoft\CryptnetUrlCache\MetaData|*.*
FileKey3=%WinDir%\System32\config\SystemProfile\Cookies|*.*|RECURSE
FileKey4=%WinDir%\System32\config\SystemProfile\IETldCache|*.*|RECURSE
FileKey5=%WinDir%\System32\config\SystemProfile\Local Settings\History|*.*|RECURSE
FileKey6=%WinDir%\System32\config\SystemProfile\Local Settings\Temp|*.*|RECURSE
FileKey7=%WinDir%\System32\config\SystemProfile\Local Settings\Temporary Internet Files|*.*|RECURSE

Nergal · May 29, 2014

email

Isn'tthis is backtrack's two posts a few posts up?

Winapp2.ini · May 29, 2014

~~Isn't~~this is backtrack's two posts a few posts up?

It's the follow up from the original emailer who I suppose saw that his came through not-so-well. Forgot to post it when I got it, I feel badly if back_track did all that decrypting by hand

Winapp2.ini · May 29, 2014

Email

(No, this email's not real, it's http://deadfake.com'>http://deadfake.com)

HI,

I'm showing up today again. Also first of all I'm very sorry, that this file was decoded, but

I didn't know, it was HTML editor.

Second I'm sorry, that the user "back_track" enconde the whole file. Sorry man.

Third, I want you to make all this public Winapp2.ini ,please, because all user should know,

that I have updated [useless Files Extension] to [useless Files Extension 2], which is

finding more entries. I think most of User could help us to find more files.

But before, most of you should understand the principle of this entry.

It's not a global entry, which is for the update of winapp2.ini or whatever. It's just helping

most of user's to find more crash, that we could add to this project and not otherwise.

For example, most user don't know, that there are other Cleaing Program (which's name I don't want to mention here)

that have options like "Advanced File Cleaning", which is just searching for useless file extension, which can be DANGEROUS.

It's seeking for *.log;*.tmp and this goes on. At the end, you have find a bunch of files more.

Now I need to exlain the working of [useless Files Extension] for those, who don't understand it.

It's a entry made from the forum to boost winapp2.ini updates. I personally run CCleaner on most

Pc I see, because they have already installed it. I add Winapp2.ini and update CCleaner to the last

and then I tick on all and clean. But there are still a lot Programs, which have not been added to CCleaner

or Winapp2.ini. Or it's added, but it's not working, because they are problems regarding:

1.Detection: It doesn't Detect the entry, because of not carefully adding the Detect or Detectfile.

2.Deletion: Cause the backslash or upperslash have been added wrong.

3.DetectOS: Perhaps, it's working for lower OS, but some user wrongly recommended a higher requierment.

4.Windows or a program, which is preventing to delete it. Like this is in Teamviewer.

5.It has some more logs, which have not been added to the file. For example in "C:\" there are stored logs of programs

for the installation in some cased.

Whatever I have recognized, that [useless Files Extension] is finding a lot files, so I recommended all people

to first clean their PC with the last CCleaner and Winapp2.ini version. After that it will just find a few files.

But most of these files are not getting cleaned, because these are protected windows logs or Teamviewer logs,

which don't get deleted.

So I have had a Idea, that I the Excludekeys for the common protected logs and tmps and co.

So [useless Files Extension 2] will find just the useless files, which are REALLY not added to this project.

But I would recommended to you to share the regkeys for these programs, if they are not added yet.

So we will find more useless files. But you should never clean your pc with that entry, because it could delete more

secure thing, that you may want to keep.

For all people helping the community, here's a step to step explantation, how to do:

------------------------------------------------------------------------------------------------------------------

1. Download the last CCleaner.

2. Download the last Winapp2.ini

3. Install CCleaner

4. Move "Winapp2.ini" to your CCleaner Program folder

5. Tick on all entries you want to clean.

6. Clean you pc.

7. Add the following entry to the "Winapp2.ini" file. Just copy it into the file.

[useless File Extension 2*]

LangSecRef=3025

Detect=HKLM\SOFTWARE\Microsoft

Default=False

FileKey1=%SystemDrive%|*.diz;*.tmp;*.temp;*.chk;*.old;*.gid;*.nch;*.wbk;*.fts;*.ftg;*.$$$;*log.txt;*.err;*.---;*.~*;*.??$;*.___;*.log;*.~mp;*._mp;*.dmp;*.prv;*.sik;*.bak;CHKLIST.MS;*.ilk;*.aps;*.ncb;*.pch;*.$db;*.?$?;*.??~;*.?~?;*.db$;*.^;*._dd;*._detmp;chklist.*;mscreate.dir;log*.txt;*.log?;*ERRORLOG*|RECURSE

ExcludeKey1=FILE|%CommonAppData%\Microsoft\Search\Data\Applications\Windows\MSS.chk

ExcludeKey2=FILE|%CommonAppData%\Microsoft\Search\Data\Applications\Windows\MSS0004B.log

ExcludeKey3=FILE|%WinDir%\ServiceProfiles\LocalService\NTUSER.bak

ExcludeKey4=FILE|%WinDir%\ServiceProfiles\LocalService\NTUSER.rhk.LOG1

ExcludeKey5=FILE|%WinDir%\ServiceProfiles\LocalService\NTUSER.rhk.LOG2

ExcludeKey6=FILE|%WinDir%\ServiceProfiles\NetworkService\NTUSER.bak

ExcludeKey7=FILE|%WinDir%\ServiceProfiles\NetworkService\NTUSER.rhk.LOG1

ExcludeKey8=FILE|%WinDir%\ServiceProfiles\NetworkService\NTUSER.rhk.LOG2

ExcludeKey9=FILE|%WinDir%\System32\LocalGroupAdminAdd.log

ExcludeKey10=FILE|%WinDir%\System32\Local_LLU.log

ExcludeKey11=FILE|%WinDir%\System32\Network_LLU.log

ExcludeKey12=FILE|%WinDir%\System32\config\BCD-Template.LOG

ExcludeKey13=FILE|%WinDir%\System32\config\COMPONENTS.LOG

ExcludeKey14=FILE|%WinDir%\System32\config\DEFAULT.LOG

ExcludeKey15=FILE|%WinDir%\System32\config\SAM.LOG

ExcludeKey16=FILE|%WinDir%\System32\config\SECURITY.LOG

ExcludeKey17=FILE|%WinDir%\System32\config\SOFTWARE.LOG

ExcludeKey18=FILE|%WinDir%\System32\config\SYSTEM.LOG

ExcludeKey19=FILE|%WinDir%\System32\config\COMPONENTS.LOG

ExcludeKey20=FILE|%WinDir%\System32\config\COMPONENTS.LOG1

ExcludeKey21=FILE|%WinDir%\System32\config\COMPONENTS.LOG2

ExcludeKey22=FILE|%WinDir%\System32\config\RegBack\DEFAULT.LOG1

ExcludeKey23=FILE|%WinDir%\System32\config\RegBack\DEFAULT.LOG2

ExcludeKey24=FILE|%WinDir%\System32\config\RegBack\SAM.LOG1

ExcludeKey25=FILE|%WinDir%\System32\config\RegBack\SAM.LOG2

ExcludeKey26=FILE|%WinDir%\System32\config\RegBack\SECURITY.LOG1

ExcludeKey27=FILE|%WinDir%\System32\config\RegBack\SECURITY.LOG2

ExcludeKey28=FILE|%WinDir%\System32\config\RegBack\SOFTWARE.LOG1

ExcludeKey29=FILE|%WinDir%\System32\config\RegBack\SOFTWARE.LOG2

ExcludeKey30=FILE|%WinDir%\System32\config\RegBack\SYSTEM.LOG1

ExcludeKey31=FILE|%WinDir%\System32\config\RegBack\SYSTEM.LOG2

ExcludeKey32=FILE|%WinDir%\System32\config\systemprofile\ntuser.dat.LOG

ExcludeKey33=FILE|%WinDir%\System32\config\systemprofile\ntuser.dat.LOG1

ExcludeKey34=FILE|%WinDir%\System32\config\systemprofile\ntuser.dat.LOG2

ExcludeKey35=FILE|%WinDir%\System32\Msdtc\MSDTC.LOG

ExcludeKey36=FILE|%WinDir%\System32\Msdtc\Trace\dtctrace.log

ExcludeKey37=FILE|%WinDir%\System32\SMI\Store\Machine\schema.dat.LOG

ExcludeKey38=FILE|%WinDir%\System32\SMI\Store\Machine\SCHEMA.DAT.LOG1

ExcludeKey39=FILE|%WinDir%\System32\SMI\Store\Machine\SCHEMA.DAT.LOG2

ExcludeKey40=FILE|%WinDir%\System32\sysprep\Panther\setupact.log

ExcludeKey41=FILE|%WinDir%\System32\sysprep\Panther\setuperr.log

ExcludeKey42=FILE|%WinDir%\System32\sysprep\Panther\IE\setupact.log

ExcludeKey43=FILE|%WinDir%\System32\sysprep\Panther\IE\setuperr.log

ExcludeKey44=FILE|%WinDir%\SysWOW64\config\DEFAULT.ba

ExcludeKey45=FILE|%WinDir%\SysWOW64\config\SAM.bak

ExcludeKey46=FILE|%WinDir%\SysWOW64\config\SECURITY.bak

ExcludeKey47=FILE|%WinDir%\SysWOW64\config\SOFTWARE.bak

ExcludeKey48=FILE|%WinDir%\SysWOW64\config\DEFAULT.rhk.LOG1

ExcludeKey49=FILE|%WinDir%\SysWOW64\config\DEFAULT.rhk.LOG2

ExcludeKey50=FILE|%WinDir%\SysWOW64\config\SAM.rhk.LOG1

ExcludeKey51=FILE|%WinDir%\SysWOW64\config\SAM.rhk.LOG2

ExcludeKey52=FILE|%WinDir%\SysWOW64\config\SECURITY.rhk.LOG1

ExcludeKey53=FILE|%WinDir%\SysWOW64\config\SECURITY.rhk.LOG2

8. Tick on the entry and run a SCAN, don't "START" it.

9. After a few minutes (or even hours, if you should have a lot of trash in there) you should get a detailed information.

10. Right Click on the information and now the mouse context menu should show up : Saving to txt file

11. Save it to the desktop or where you want.

11.5: Open you file and go to replace and replace you username with "{Username}". For example your

username is "CArl" than you could replace it with "{Username}", so there's no problem with privacy.

12. Go to following Web page : forum.piriform.com/index.php?showtopic=32310?&page=214 (to get to the site number 214)

13. Login to you account

14. click on reply

15. Copy the content of your file to the reply box.

16. That's it. We will add to the next update.

17. Please remove the entry from you winapp2.ini file, so you cannot remove dangerous files.