Winapp2.ini additions

[SMalik]

Here is a universal entry that I use for Windows 8 Store Apps and it works fine.

[Store Apps*]
Section=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData
Default=False
FileKey1=%LocalAppData%\Packages\*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\*\AC\INetCache|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\*\AC\INetHistory|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\*\AC\Microsoft\CLR_v4.0|*.log
FileKey5=%LocalAppData%\Packages\*\AC\Microsoft\CLR_v4.0\NativeImages\Temp|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\*\AC\Microsoft\CLR_v4.0_32|*.log
FileKey8=%LocalAppData%\Packages\*\AC\Microsoft\CLR_v4.0_32\NativeImages\Temp|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\*\AC\Microsoft\CLR_v4.0_32\UsageLogs|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\*\AC\Microsoft\CryptnetUrlCache\Content|*.*|RECURSE
FileKey11=%LocalAppData%\Packages\*\AC\Microsoft\CryptnetUrlCache\MetaData|*.*|RECURSE
FileKey12=%LocalAppData%\Packages\*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey13=%LocalAppData%\Packages\*\AC\PRICache|*.*|RECURSE
FileKey14=%LocalAppData%\Packages\*\AC\Temp|*.*|RECURSE
FileKey15=%LocalAppData%\Packages\*\LocalCache|*.*|RECURSE

 

[SMalik]

New Entry

It may be a little aggressive, but safe. It is up to you guys if you like to add it in Winapp2.ini.

 

[McAfee More*]

LangSecRef=3024

Detect=HKLM\Software\McAfee

Default=False

FileKey1=%CommonAppData%\McAfee\VirusScan\Quarantine|*.*|RECURSE

RegKey1=HKLM\SOFTWARE\McAfee\MSC\Settings\Stats

Edited January 15, 2015 by SMalik

[siliconman01]

I don't know why you don't have this location. Let me look into this.

 

I do have a long list of keys at :

 

HKCU\Software\Classes\Local Settings\MuiCache\805\52C64B7E

and

HKCR\Local Settings\MuiCache\805\52C64B7E

and

HKU\Software\Classes\Local Settings\MuiCache\805\52C64B7E

and

S-1-5-18\Software\Classes\Local Settings\MuiCache\805\52C64B7E

and

S-1-5-21-....................1001\Software\Classes\Local Settings\MuiCache\805\52C64B7E

and

S-1-5-21-....................1001_Classes\Local Settings\MuiCache\805\52C64B7E

[dvdbane]

New Entry

It may be a little aggressive, but safe. It is up to you guys if you like to add it in Winapp2.ini.

 

[McAfee More*]

LangSecRef=3024

Detect=HKLM\Software\McAfee

Default=False

FileKey3=%CommonAppData%\McAfee\VirusScan\Quarantine|*.*|RECURSE

RegKey1=HKLM\SOFTWARE\McAfee\MSC\Settings\Stats

prefer not to add this to winapp2.ini

what if false +ve happen, mcafee quarantine it and ccleaner clear out the quarantine?

should be FileKey1?

[SMalik]

prefer not to add this to winapp2.ini

what if false +ve happen, mcafee quarantine it and ccleaner clear out the quarantine?

should be FileKey1?

I just fixed it. It should be FileKey1. Sorry for the typo.

[SMalik]

I do have a long list of keys at :

 

HKCU\Software\Classes\Local Settings\MuiCache\805\52C64B7E

and

HKCR\Local Settings\MuiCache\805\52C64B7E

and

HKU\Software\Classes\Local Settings\MuiCache\805\52C64B7E

and

S-1-5-18\Software\Classes\Local Settings\MuiCache\805\52C64B7E

and

S-1-5-21-....................1001\Software\Classes\Local Settings\MuiCache\805\52C64B7E

and

S-1-5-21-....................1001_Classes\Local Settings\MuiCache\805\52C64B7E

I don't know why you don't have that path.

 

 

[Coffee4Joe]

I have:
HKCR\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

and some in the HKU\S-1-5-21-silly-numbers.... keys

and
HKCR\Local Settings\Software\Microsoft\Windows\Shell\BagMRU

HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU

HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags

HKCU\Software\Microsoft\Windows\Shell\BagMRU

HKCU\Software\Microsoft\Windows\Shell\Bags

and some in more silly number keys


 

[SMalik]

I have:

HKCR\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

and some in the HKU\S-1-5-21-silly-numbers.... keys

 

and

HKCR\Local Settings\Software\Microsoft\Windows\Shell\BagMRU

HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU

HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags

HKCU\Software\Microsoft\Windows\Shell\BagMRU

HKCU\Software\Microsoft\Windows\Shell\Bags

 

and some in more silly number keys

 

 

 

 

You also have HKCR\Local Settings\Software\Microsoft\Windows\Shell\MuiCache. I don't know why siliconman01 does not have this path.

 

All we need to wipe is this path and it will automatically wipe the MuiCache of the current logged in user.

[CSGalloway]

I did a search of %systemdisk% for both BAK and TMP files and would like modifications to winapp2.ini to included these or why each one won't be included please.

C:\Program Files\Common Files\Microsoft\ART\Backup\Google Chrome\Default\Preferences.bak
C:\ProgramData\Microsoft\Microsoft Antimalware\Network Inspection System\Support\NisLog.txt.bak
C:\ProgramData\Microsoft\OFFICE\DATA\OPA11.BAK
C:\Windows\System32\drivers\etc\hosts_PTBackup.bak
C:\Windows\System32\drivers\etc\hosts_PTbackup2.bak
C:\Z_UserFiles\Unkn\BAK_000\settings.bak

C:\Program Files\Common Files\Microsoft\ART\Backup\Google Chrome\Default\JumpListIcons\32FA.tmp
C:\Program Files\Common Files\Microsoft\ART\Backup\Google Chrome\Default\JumpListIconsOld\D03A.tmp
C:\Program Files\Common Files\Microsoft\ART\Backup\Google Chrome\Default\JumpListIconsOld\D03B.tmp
C:\Program Files\Common Files\Microsoft\ART\Backup\Google Chrome\Default\JumpListIconsOld\D03C.tmp
C:\Program Files\Common Files\Microsoft\ART\Backup\Google Chrome\Default\JumpListIconsOld\D03D.tmp
C:\Program Files (x86)\Common Files\Windows Live\.cache\wlc3B52.tmp
C:\Program Files (x86)\Common Files\Windows Live\.cache\wlc8B43.tmp
C:\Program Files (x86)\Common Files\Windows Live\.cache\wlcA893.tmp
C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\leg272.tmp
C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\leg273.tmp
C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\leg274.tmp
C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\leg275.tmp
C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\leg276.tmp
C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\leg277.tmp
C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\legB1B.tmp
C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame\legF2.tmp
C:\Users\Administrator\AppData\Local\Temp\DIOB0C9.tmp
C:\Users\Administrator\AppData\Local\Temp\MAR8E98.tmp
C:\Users\Administrator\AppData\Local\Temp\MAR9202.tmp
C:\Users\Galloway\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\7B8B.tmp
C:\Users\Galloway\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\7B8C.tmp
C:\Users\Galloway\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\7B8D.tmp
C:\Users\Galloway\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons\7B8E.tmp
C:\Users\Galloway\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld\3E6A.tmp
C:\Users\Galloway\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld\3E6B.tmp
C:\Users\Galloway\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.tmp
C:\Users\Galloway\AppData\Local\Temp\DIO5FA.tmp
C:\Users\Galloway\AppData\Local\Temp\DIO7EC2.tmp
C:\Users\Galloway\AppData\Local\Temp\DIO464A.tmp
C:\Users\Galloway\AppData\Local\Temp\DIOAE4A.tmp
C:\Users\Galloway\AppData\Local\Temp\DIOD98.tmp
C:\Users\Galloway\AppData\Local\Temp\DIOD115.tmp
C:\Users\Galloway\AppData\Local\Temp\MAR65B5.tmp
C:\Users\Galloway\AppData\Local\Temp\MAR623B.tmp
C:\Users\Galloway\AppData\Local\Temp\MAR973F.tmp
C:\Users\Galloway\AppData\Local\Temp\MAR975F.tmp
C:\Users\Galloway\AppData\Local\Temp\MAR3557.tmp
C:\Users\Galloway\AppData\Local\Temp\MAR3597.tmp
C:\Users\Galloway\AppData\Local\Temp\MARB7AA.tmp
C:\Users\Galloway\AppData\Local\Temp\MARB866.tmp
C:\Users\Galloway\AppData\Local\Temp\MARE9B2.tmp
C:\Users\Galloway\AppData\Local\Temp\MARE9E2.tmp
C:\Users\Galloway\AppData\Local\Temp\MARECBE.tmp
C:\Users\Galloway\AppData\Local\Temp\MAREEA2.tmp
C:\Users\Galloway\AppData\Local\Temp\~DFD841554722215779.TMP
C:\Users\Galloway\AppData\Local\VirtualStore\Program Files (x86)\Yahoo!\Messenger\Cache\9G0IMTf7KSnOtr1pRkveNQ--.ProfileMap.dat.tmp
C:\Users\Galloway\Music\91F61065-CF82.tmp
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Device Metadata\dmrccache\downloads\BIT2DD1.tmp

Regards

[Nergal]

Wait so you want us to look at a randomly gathered list of possible files and argue against each one? Ir create a new entry for each one?

No, you create entries and we'll happily look at those but your request is not one I'll be attempting.

[ROCKNROLL]

Aren't the ones located in Appdata/Local/Temp already being cleaned by CCleaner? Also, I would assume if they aren't being cleaned, then no one has ever made entries for them.

[CCleaner_Fan]

Submission: BitTorrent Sync

[BitTorrent Sync*]
LangSecRef=3023
DetectFile=%AppData%\BitTorrent Sync
Default=False
FileKey1=%AppData%\BitTorrent Sync|*.log;*.old

[ROCKNROLL]

EDIT:

 

[Vuze More*]
LangSecRef=3022
Detect=HKCR\Azureus

Default=False
FileKey1=%AppData%\Azureus\plugins\advancedstatistics|*.txt
FileKey2=%AppData%\Azureus\plugins\progressbar|*.txt

FileKey3=%ProgramFiles%\Vuze|*.log

FileKey4=%ProgramFiles%\Vuze\.install4j|*.log

 

Added FileKey 3 and 4. Also, I wanted to ask, why doesn't CCleaner automatically set the Default values to false? That way, you don't have to put Default=False in every entry.

[CSGalloway]

For left over BAK files after running CCleaner in Safe mode

New:
[Google Chrome ART*]
LangSecRef= ?
SpecialDetect=DET_CHROME
Default=False
FileKey1=C:\Program Files\Common Files\Microsoft\ART\Backup\Google Chrome\Default\Preferences.bak

Modify [Microsoft Security Essentials*] to add:
FileKey7=C:\ProgramData\Microsoft\Microsoft Antimalware\Network Inspection System\Support\NisLog.txt.bak

NEW:
[MS Office 2003*]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\Office\11.0
Default=False
FileKey1=C:\ProgramData\Microsoft\OFFICE\DATA\OPA11.BAK

New:
[MaceCraft PowerTools hosts backups*]
LangSecRef= not sure here
Default=False
DetectFile=C:\Program Files (x86)\jv16 PowerTools *\jv16PT.exe
FileKey1=%windir%\System32\drivers\etc|hosts_PTBackup*.bak

[Nergal]

 

why doesn't CCleaner automatically set the Default values to false? That way, you don't have to put Default=False in every entry.

At least 3 possibilities occur to me for this (no inside information is imparted by the below list, because as number 3 will point out we aren't the developer)1) Because not everything built-in to ccleaner is default false.2) Because this file is NOT SUPPOSED TO BE ANYTHING BUT A GUIDE. we provide the false because we know people aren't following this rule (including myself mostly). when a user does as they are supposed to and create their own entries most would want it to be true.3) because nobody in this thread is the developer of CCleaner and none of us has access to that closed source part of the program.

[CSGalloway]

For TMP files left after running CCleaner while in Safe mode....

Modify [Google Chrome ART*] to add FileKey2
FileKey2=C:\Program Files\Common Files\Microsoft\ART\Backup\Google Chrome\Default|*.tmp|RECURSE

Modify [Windows Live Messenger More*] to add FileKey11
FileKey11=C:\Program Files (x86)\Common Files\Windows Live\.cache|*.tmp

[CyberLink PowerToGo9*]
LangSecRef= ?
Detect=HKCU\Software\CyberLink\Power2Go9
Default=False
FileKey1=C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame|*.tmp

[Windows WebCache]
LangSecRef= ?
DetectFile=%LocalAppData%\Microsoft\Windows\WebCache\
Default=False
FileKey1=%LocalAppData%\Microsoft\Windows\WebCache|*.tmp

[Music Temp Files]
LangSecRef= ?
DetectFile=%UserProfile%\Music
Default=False
FileKey1=%UserProfile%\Music|*.tmp

[Windows Device Icon Downloads *]
LangSecRef= ?
Detect=%windir%\System32\%LOCALAPPDATA%\Microsoft\Device Metadata\dmrccache\downloads\
Default=False
FileKey1=%windir%\System32\%LOCALAPPDATA%\Microsoft\Device Metadata\dmrccache\downloads|*.tmp

[APMichael]

[MS Office 2003*]

LangSecRef=3021

Detect=HKCU\Software\Microsoft\Office\11.0

Default=False

FileKey1=C:\ProgramData\Microsoft\OFFICE\DATA\OPA11.BAK

 

Is this really safe? Deleting the "OPA11.BAK" file usually de-activates Office (OPA = Office Product Activation).

 

Some FileKeys of your other entries are not correct. Please use the variables only (e.g. %CommonAppData% instead of C:\ProgramData, %ProgramFiles% instead of C:\Program Files). Check the "How to make your own Winapp2.ini entry!" spoiler on page 1 of this thread.

[dvdbane]

@CSGalloway

did you test the entries and changes that you made?

i mean, for bad side effect and is it can be remove

you should read the winapp2-howto on the first page so you can improve your Detect and FileKey

How to make your own Winapp2.ini entry! lol..15 min late..stupid connection

 

and you should edit your original post instead of posting additional rule on new post

just my 1 cent

[ROCKNROLL]

@Nergal: Thank you for your response, but in my opinion, no entry should be Default=True simply because a person should learn what any and all entry does first before they decide to clean it, even if CCleaner was for sure that the entry was 100% harmless. I understand you are not a developer and this is ofcource, just my opinion.

 

EDIT: Sorry about the off topic discussion.

[Andavari]

 

Is this really safe? Deleting the "OPA11.BAK" file usually de-activates Office (OPA = Office Product Activation).

 

It's not safe at all!!! Deleting it will have Microsoft Office wanting the re-install discs the very next time it's used.

[CSGalloway]

New:


[Google Chrome ART*]

LangSecRef=3022

SpecialDetect=DET_CHROME

Default=False

FileKey1=%CommonProgramFiles%\Microsoft\ART\Backup\Google Chrome\Default\Preferences.bak

FileKey2=%CommonProgramFiles%\Microsoft\ART\Backup\Google Chrome\Default|*.tmp|RECURSE


Add FileKey 7


[Microsoft Security Essentials*]

LangSecRef=3021

Detect=HKCU\Software\Microsoft\Microsoft Antimalware

Default=False

FileKey1=%CommonAppData%\Microsoft\Microsoft Antimalware\LocalCopy|*.*|RECURSE

FileKey2=%CommonAppData%\Microsoft\Microsoft Antimalware\Scans\History\Service|*.log|RECURSE

FileKey3=%CommonAppData%\Microsoft\Microsoft Security Client\Support|MSSecurityClient*.log

FileKey4=%LocalAppData%\VirtualStore\ProgramData\Microsoft\Microsoft Antimalware\LocalCopy|*.*|RECURSE

FileKey5=%LocalAppData%\VirtualStore\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Service|*.log|RECURSE

FileKey6=%LocalAppData%\VirtualStore\ProgramData\Microsoft\Microsoft Security Client\Support|MSSecurityClient*.log

FileKey7=%CommonAppData%\Microsoft\Microsoft Antimalware\Network Inspection System\Support\NisLog.txt.bak


New:


[MaceCraft PowerTools hosts backups*]

LangSecRef=3024

Default=False

DetectFile=%CommonProgramFiles%\jv16 PowerTools *\jv16PT.exe

FileKey1=%windir%\System32\drivers\etc|hosts_PTBackup*.bak


Add FileKey11


[Windows Live Messenger More*]

LangSecRef=3022

Detect=HKLM\Software\Microsoft\Windows Live\Messenger

Default=False

FileKey1=%CommonProgramFiles%\Windows Live\.cache|*.*|RECURSE

FileKey2=%LocalAppData%\Microsoft\Messenger|*.uccapilog;*.bak;*.txt|RECURSE

FileKey3=%LocalAppData%\Microsoft\Windows Live|*.log;*.jrs;*.sqm|RECURSE

FileKey4=%LocalAppData%\Microsoft\Windows Live Contacts|*.log;*.jrs|RECURSE

FileKey5=%LocalAppData%\Microsoft\Windows Live Contacts\*\*\*\Backup|*.*|RECURSE

FileKey6=%ProgramFiles%\Windows Live\Messenger|*.bak|RECURSE

FileKey7=%WinDir%\System32\config\systemprofile\Documents|wlidsvctrace*.txt

FileKey8=%WinDir%\SysWOW64\config\systemprofile\Documents|wlidsvctrace*.txt

FileKey9=%LocalAppData%\VirtualStore\Program Files*\Windows Live\Messenger|*.bak|RECURSE

FileKey10=%LocalAppData%\VirtualStore\Program Files*\Common Files\Windows Live\.cache|*.*|RECURSE

FileKey11=%CommonProgramFiles%\Windows Live\.cache|*.tmp


New


[CyberLink PowerToGo9*]

LangSecRef=3024

Detect=HKCU\Software\CyberLink\Power2Go9

Default=False

FileKey1=C:\Program Files (x86)\Cyberlink\Power2Go9\Template\Cyberlink\frame|*.tmp


New


[Windows WebCache]

LangSecRef=3025

DetectFile=%LocalAppData%\Microsoft\Windows\WebCache\

Default=False

FileKey1=%LocalAppData%\Microsoft\Windows\WebCache|*.tmp


New


[Music Temp Files]

LangSecRef=3023

DetectFile=%UserProfile%\Music

Default=False

FileKey1=%UserProfile%\Music|*.tmp


New


[Windows Device Icon Downloads *]

LangSecRef=3025

Detect=%windir%\System32\config\systemprofile\AppData\Local\Microsoft\Device Metadata\dmrccache\downloads\

Default=False

FileKey1=%windir%\System32\config\systemprofile\AppData\Local\Microsoft\Device Metadata\dmrccache\downloads|*.tmp

 

Edited January 22, 2015 by CSGalloway

[JDPower]

[MS Office 2003*]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\Office\11.0
Default=False
FileKey1=C:\ProgramData\Microsoft\OFFICE\DATA\OPA11.BAK

I'm guessing you didn't see the posts about OPA11.bak, unless you have evidence that it doesn't trash your Office install

[Amtrak7]

The TweetDeck one is not clearing out any of the temporary files. I empty the entire TweetDeck subfolder manually, and true to the warning in Winapp2.ini, I have to log in the next time I open the app, but nothing else seems lost. Therefore, I propose FileKey1 be modified to the following.

FileKey1=%LocalAppData%\Twitter\TweetDeck|*.*

[APMichael]

@CSGalloway: Did you see our posts?! Please read post #4767, #4768 and #4770.

[CSGalloway]

I thought BAK files were backups and safe to delete.  And anyway:

 

10/17/2002  20:23           8,200  OPA11.BAK
 3/20/2013  14:22          11,094  opa11.dat
 

so I thought OFFICE would be using the .DAT file and not the .BAK one...