Winapp2.ini additions

[Nergal]

No not all bak or old are junk that's what we keep saying

[CSGalloway]

Well then do not include the entry in winapp2.ini - thanks

[Andavari]

Well then do not include the entry in winapp2.ini - thanks

 

It would help if you'd just edit it out of your post of winapp2.ini entries you submitted, that way Winapp2.ini (person) doesn't accidentally include it when he updates and it could save the casual lurker from copying it and using it at their dismay.

Edited January 22, 2015 by Andavari

[CSGalloway]

It would help if you'd just edit it out of your post of winapp2.ini entries you submitted, that way Winapp2.ini (person) doesn't accidentally include it when he updates and it could save the casual lurker from copying it and using it at their dismay.

 

Done.....

[dvdbane]

New:

[Google Chrome ART*]
LangSecRef=3022
SpecialDetect=DET_CHROME
Default=False
FileKey1=%CommonProgramFiles%\Microsoft\ART\Backup\Google Chrome\Default\Preferences.bak
FileKey2=%CommonProgramFiles%\Microsoft\ART\Backup\Google Chrome\Default|*.tmp|RECURSE

i checked my XP,7 and 8 with chrome installed and i can't find this folder %CommonProgramFiles%\Microsoft\ART\Backup\Google Chrome\ 

searching through the internet i only see threads of infected people with unwanted toolbar

i don't know if this folder related to the unwanted toolbar or not but you better perform an antimalware scan just incase you're infected

[nodles]

MODIFIED ENTRY

[Neverwinter*]
Section=Games
Detect=HKCU\Software\Cryptic\Neverwinter
Default=False
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Cryptic Studios|*.log|RECURSE
FileKey2=%ProgramFiles%\Steam\SteamApps\common\Cryptic Studios\localdata|_SWMWindowPosList.txt
FileKey3=%SystemDrive%\Users\Public\Games\Cryptic Studios|*.log|RECURSE
FileKey4=%SystemDrive%\Users\Public\Games\Cryptic Studios\localdata|_SWMWindowPosList.tx

Removed "(beta)" from title & added FK1+FK2.

[CSGalloway]

i checked my XP,7 and 8 with chrome installed and i can't find this folder %CommonProgramFiles%\Microsoft\ART\Backup\Google Chrome\ 

searching through the internet i only see threads of infected people with unwanted toolbar

i don't know if this folder related to the unwanted toolbar or not but you better perform an antimalware scan just incase you're infected

 

You have to use CMD as administrator then search for the folder -

[Coffee4Joe]

Edited (from winapp.ini)
added FileKey3=
 

[InkScape*]
LangSecRef=3023
Detect=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\inkscape.exe
Default=False
FileKey1=%AppData%\InkScape|*.log|RECURSE
FileKey2=%UserProfile%|.recently-used.xbel
FileKey3=%LocalAppData%|recently-used.xbel

[Coffee4Joe]

Added FileKey6=
Minecrafts new launcher has it's own java runtime.
 

[Minecraft*]
Section=Games
DetectFile=%AppData%\.minecraft
Default=False
FileKey1=%AppData%\.minecraft|*.log;*.log.*
FileKey2=%AppData%\.minecraft\crash-reports|*.*
FileKey3=%AppData%\.minecraft\server|server.log
FileKey4=%AppData%\.minecraft\stats|*.old
FileKey5=%AppData%\.minecraft\logs|*.*
FileKey6=%AppData%\java|*.*|REMOVESELF

[SMalik]

New Entry

 

[system TuneUp*]
LangSecRef=3024
Detect=HKCU\Software\Acelogix\System TuneUp
Default=False
FileKey1=%LocalAppData%\Acelogix\System TuneUp\Backups|*.reg

[SMalik]

Revised Entry

Changed FileKey1

Added:  *.log.lock

 

[AVG 2015*]
LangSecRef=3024
Detect=HKLM\Software\AVG\AVG2015
Default=False
FileKey1=%CommonAppData%\AVG2015\log|*.log;*.log.lock;history.xml
FileKey2=%CommonAppData%\AVG2015\scanlogs|*.log
FileKey3=%CommonAppData%\AVG2015\update\backup|*.*
FileKey4=%CommonAppData%\AVG2015\Emc\log|*.*
FileKey5=%CommonAppData%\AVG2015\IDS\config|List.zip.bak
FileKey6=%CommonAppData%\AVG2015\IDS\profile|globalLoadable.bak
FileKey7=%CommonAppData%\AVG2015\temp|*.*
FileKey8=%CommonAppData%\AVG2015\SetupBackup|*.*|REMOVESELF
FileKey9=%CommonAppData%\MFAData\logs|*.*
FileKey10=%CommonAppData%\MFAData\pack|*.*
FileKey11=%CommonAppData%\MFAData|msistorg.dat.bkp;public_installation_log.xml
FileKey12=%LocalAppData%\AVG2015\log|*.log;*.log.*
FileKey13=%LocalAppData%\AVG2015\update|*.*
FileKey14=%LocalAppData%\AVG2015\temp|*.*
FileKey15=%LocalAppData%\MFAData\logs|*.*
FileKey16=%ProgramFiles%\AVG\AVG2015|updatecomps.bak;*.old
FileKey17=%WinDir%\System32\config\systemprofile\AppData\Local\Avg2015\dumps|*.*
FileKey18=%WinDir%\System32\config\systemprofile\Local Settings\Application Data\Avg2015\dumps|*.*
FileKey19=%WinDir%\System32\config\systemprofile\AppData\Local\Avg2015\log|*.*
FileKey20=%WinDir%\System32\config\systemprofile\Local Settings\Application Data\log|*.*
FileKey21=%WinDir%\System32\config\systemprofile\AppData\Local\Avg2015\temp|*.*
FileKey22=%WinDir%\System32\config\systemprofile\Local Settings\Application Data\temp|*.*
FileKey23=%WinDir%\System32\config\systemprofile\AppData\Local\MFAData\logs|*.*
FileKey24=%WinDir%\System32\config\systemprofile\Local Settings\MFAData\logs|*.*
FileKey25=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Avg2015\dumps|*.*
FileKey26=%WinDir%\SysWOW64\config\systemprofile\Local Settings\Application Data\dumps|*.*
FileKey27=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Avg2015\log|*.*
FileKey28=%WinDir%\SysWOW64\config\systemprofile\Local Settings\Application Data\log|*.*
FileKey29=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Avg2015\temp|*.*
FileKey30=%WinDir%\SysWOW64\config\systemprofile\Local Settings\Application Data\temp|*.*
FileKey31=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\MFAData\logs|*.*
FileKey32=%WinDir%\SysWOW64\config\systemprofile\Local Settings\MFAData\logs|*.*

[Winapp2.ini]

Updated

 

 

 

What's new in winapp2.ini 5.02.150126

General:

32 New Entries
32 Modified Entries
04 Removed Entries

Note:

 Changes now exclude minor pathing changes (REMOVESELF -> RECURSE, adding/removing minor wildcards, etc)

Verbose:

------------------------------------------------------------------------------

New Entries:

[Adblock Edge for Firefox*]
LangSecRef=3026
SpecialDetect=DET_MOZILLA
Default=False
FileKey1=%AppData%\Mozilla\Firefox\Profiles\*\adblockedge|patterns-backup*.ini;*.tmp

[AVG 2015*]
LangSecRef=3024
Detect=HKLM\Software\AVG\AVG2015
Default=False
FileKey1=%CommonAppData%\AVG2015\log|*.log;history.xml
FileKey2=%CommonAppData%\AVG2015\scanlogs|*.log
FileKey3=%CommonAppData%\AVG2015\update\backup|*.*
FileKey4=%CommonAppData%\AVG2015\Emc\log|*.*
FileKey5=%CommonAppData%\AVG2015\IDS\config|List.zip.bak
FileKey6=%CommonAppData%\AVG2015\IDS\profile|globalLoadable.bak
FileKey7=%CommonAppData%\AVG2015\temp|*.*
FileKey8=%CommonAppData%\AVG2015\SetupBackup|*.*|REMOVESELF
FileKey9=%CommonAppData%\MFAData\logs|*.*
FileKey10=%CommonAppData%\MFAData\pack|*.*
FileKey11=%CommonAppData%\MFAData|msistorg.dat.bkp;public_installation_log.xml
FileKey12=%LocalAppData%\AVG2015\log|*.log;*.log.*
FileKey13=%LocalAppData%\AVG2015\update|*.*
FileKey14=%LocalAppData%\AVG2015\temp|*.*
FileKey15=%LocalAppData%\MFAData\logs|*.*
FileKey16=%ProgramFiles%\AVG\AVG2015|updatecomps.bak;*.old
FileKey17=%WinDir%\System32\config\systemprofile\AppData\Local\Avg2015\dumps|*.*
FileKey18=%WinDir%\System32\config\systemprofile\Local Settings\Application Data\Avg2015\dumps|*.*
FileKey19=%WinDir%\System32\config\systemprofile\AppData\Local\Avg2015\log|*.*
FileKey20=%WinDir%\System32\config\systemprofile\Local Settings\Application Data\log|*.*
FileKey21=%WinDir%\System32\config\systemprofile\AppData\Local\Avg2015\temp|*.*
FileKey22=%WinDir%\System32\config\systemprofile\Local Settings\Application Data\temp|*.*
FileKey23=%WinDir%\System32\config\systemprofile\AppData\Local\MFAData\logs|*.*
FileKey24=%WinDir%\System32\config\systemprofile\Local Settings\MFAData\logs|*.*
FileKey25=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Avg2015\dumps|*.*
FileKey26=%WinDir%\SysWOW64\config\systemprofile\Local Settings\Application Data\dumps|*.*
FileKey27=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Avg2015\log|*.*
FileKey28=%WinDir%\SysWOW64\config\systemprofile\Local Settings\Application Data\log|*.*
FileKey29=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Avg2015\temp|*.*
FileKey30=%WinDir%\SysWOW64\config\systemprofile\Local Settings\Application Data\temp|*.*
FileKey31=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\MFAData\logs|*.*
FileKey32=%WinDir%\SysWOW64\config\systemprofile\Local Settings\MFAData\logs|*.*

[bitTorrent Sync*]
LangSecRef=3023
DetectFile=%AppData%\BitTorrent Sync
Default=False
FileKey1=%AppData%\BitTorrent Sync|*.log;*.old

[blade of Destiny*]
Section=Games
DetectFile=%Documents%\BladeofDestiny
Default=False
FileKey1=%Documents%\BladeofDestiny\Consolelog|*.*|RECURSE

[Corel PaintShop Pro X7*]
LangSecRef=3023
Detect=HKCU\Software\Corel\PaintShop Pro\X7
Default=False
FileKey1=%LocalAppData%\Corel PaintShop Pro\17.0\Cache|*.*
FileKey2=%LocalAppData%\Corel PaintShop Pro\17.0\Database|*.db
RegKey1=HKCU\Software\Corel\PaintShop Pro\X7\CoreMemoryManager\0
 
[Corel PaintShop Pro X7 (AutoPreserve)*]
LangSecRef=3023
Detect=HKCU\Software\Corel\PaintShop Pro\X7
Default=False
FileKey1=%Pictures%\Corel Auto-Preserve|*.*
 
[Corel VideoStudio Pro X7*]
LangSecRef=3023
Detect=HKCU\Software\Ulead Systems\Corel VideoStudio Pro\17.0
Default=False
FileKey1=%Documents%\Corel VideoStudio Pro\17.0\AudioTmp|*.*
FileKey2=%Documents%\Corel VideoStudio Pro\17.0\SmartProxy|*.*
RegKey1=HKCU\Software\Ulead Systems\Corel VideoStudio Pro\17.0\HerRFL

[CyberLink MediaCache*]
LangSecRef=3023
Detect=HKCU\Software\CyberLink
Default=False
FileKey1=%AppData%\CyberLink\MediaCache|*.*|RECURSE
RegKey1=HKCU\Software\CyberLink\MediaCache5\Data5
RegKey2=HKCU\Software\CyberLink\MediaCache5\Thumbnail5

[CyberLink PowerToGo9*]
LangSecRef=3024
Detect=HKCU\Software\CyberLink\Power2Go9
Default=False
FileKey1=%ProgramFiles%\Cyberlink\Power2Go9\Template\Cyberlink\frame|*.tmp


[Dr. Kaiser - (DKS) PC Watcher*]
LangSecRef=3024
DetectFile=%WinDir%\DKSService.exe
Default=False
FileKey1=%WinDir%|DksSystem.log

[Elder Scrolls Online*]
Section=Games
DetectFile=%Documents%\Elder Scrolls Online
Default=False
FileKey1=%Documents%\Elder Scrolls Online\Errors|*.*
FileKey2=%Documents%\Elder Scrolls Online\Logs|*.*

[Extensions Databases*]
LangSecRef=3029
SpecialDetect=DET_CHROME
DetectFile=%LocalAppData%\Google\Chrome
FileKey1=%LocalAppData%\Google\Chrome\User Data\Default\IndexedDB|*.*|RECURSE
 
[Extensions State*]
LangSecRef=3029
SpecialDetect=DET_CHROME
DetectFile=%LocalAppData%\Google\Chrome
FileKey1=%LocalAppData%\Google\Chrome\User Data\Default\Extension State|*.*|RECURSE

[Google Chrome ART*]
LangSecRef=3022
SpecialDetect=DET_CHROME
Default=False
FileKey1=%CommonProgramFiles%\Microsoft\ART\Backup\Google Chrome\Default\Preferences.bak
FileKey2=%CommonProgramFiles%\Microsoft\ART\Backup\Google Chrome\Default|*.tmp|RECURSE

[History*]
LangSecRef=3029
SpecialDetect=DET_CHROME
DetectFile=%LocalAppData%\Google\Chrome
FileKey1=%LocalAppData%\Google\Chrome\User Data\Default|History

[iMobie PhoneRescue*]
LangSecRef=3024
DetectFile=%AppData%\iMobie\PhoneRescue
Default=False
FileKey1=%AppData%\iMobie\PhoneRescue\AutoUpdate|*.*|RECURSE
FileKey2=%AppData%\iMobie\PhoneRescue\Configue|Settings.plist
FileKey3=%AppData%\iMobie\PhoneRescue\ErrorLog|*.*|RECURSE
FileKey4=%AppData%\iMobie\PhoneRescue\Files|*.*|RECURSE
FileKey5=%AppData%\iMobie\PhoneRescue|iTunesPrefs

[Kodi Cache*]
LangSecRef=3023
DetectFile=%AppData%\kodi
Default=False
FileKey1=%AppData%\kodi\cache|*.*|RECURSE

[Kodi Packages*]
LangSecRef=3023
DetectFile=%AppData%\kodi
Default=False
FileKey1=%AppData%\kodi\addons\packages|*.*|RECURSE

[Kodi Thumbnails*]
LangSecRef=3023
DetectFile=%AppData%\kodi
Default=False
FileKey1=%AppData%\kodi\userdata\thumbnails|*.*|RECURSE
FileKey2=%AppData%\kodi.old\userdata\thumbnails|*.*|RECURSE

[MaceCraft PowerTools hosts backups*]
LangSecRef=3024
Default=False
DetectFile=%CommonProgramFiles%\jv16 PowerTools *\jv16PT.exe
FileKey1=%windir%\System32\drivers\etc|hosts_PTBackup*.bak

[Microsoft Deployment Toolkit*]
LangSecRef=3024
Warning=To Get a new Component list, check for Updates in the Management Console!
DetectFile=%ProgramFiles%\Microsoft Deployment Toolkit
Default=False
FileKey1=%ProgramFiles%\Microsoft Deployment Toolkit\Downloads|*.*|RECURSE

[Microsoft Message Analyzer*]
LangSecRef=3024
DetectFile=%LocalAppData%\Microsoft\MessageAnalyzer
Warning=This will remove Traces, Logs and remove the Configuration!
Default=False
FileKey1=%Documents%\MessageAnalyzer\Traces|*.*|RECURSE
FileKey2=%LocalAppData%\Microsoft\MessageAnalyzer|*.log
FileKey3=%AppData%\Microsoft\MessageAnalyzer|*.cfg

[Quota Manager Data*]
LangSecRef=3029
SpecialDetect=DET_CHROME
DetectFile=%LocalAppData%\Google\Chrome
FileKey1=%LocalAppData%\Google\Chrome\User Data\Default|QuotaManager

[Rage*]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\9200
Default=False
FileKey1=%AppData%\id software\rage|*.*|RECURSE

[Registry First Aid 10*]
LangSecRef=3024
Detect=HKCU\Software\KsL Software\RFA\10.0
Default=False
FileKey1=%ProgramFiles%\RFA 10|*.diz;*.url
FileKey2=%LocalAppData%\VirtualStore\Program Files*\RFA 10|*.diz;*.url

[Reus*]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\222730
Default=False
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Reus|errorReport*.txt
FileKey2=%LocalAppData%\VirtualStore\Program Files*\Steam\SteamApps\common\Reus|errorReport*.txt

[sAM Broadcaster*]
LangSecRef=3023
Detect1=HKCU\Software\SAMBC
Default=False
FileKey1=%LocalAppData%\SpacialAudio\SAMBC|*.log|RECURSE
FileKey2=%LocalAppData%\SpacialAudio\SAMBC\backup|*.*|RECURSE

[search Engines Data*]
LangSecRef=3029
SpecialDetect=DET_CHROME
DetectFile=%LocalAppData%\Google\Chrome
FileKey1=%LocalAppData%\Google\Chrome\User Data\Default|Web Data
 
[session Storage*]
LangSecRef=3029
SpecialDetect=DET_CHROME
DetectFile=%LocalAppData%\Google\Chrome
FileKey1=%LocalAppData%\Google\Chrome\User Data\Default\Session Storage|*.*|RECURSE

[system TuneUp*]
LangSecRef=3024
Detect=HKCU\Software\Acelogix\System TuneUp
Default=False
FileKey1=%LocalAppData%\Acelogix\System TuneUp\Backups|*.reg

[Windows WebCache]
LangSecRef=3025
DetectFile=%LocalAppData%\Microsoft\Windows\WebCache\
Default=False
FileKey1=%LocalAppData%\Microsoft\Windows\WebCache|*.tmp

[Windows Device Icon Downloads *]
LangSecRef=3025
Detect=%windir%\System32\config\systemprofile\AppData\Local\Microsoft\Device Metadata\dmrccache\downloads\
Default=False
FileKey1=%windir%\System32\config\systemprofile\AppData\Local\Microsoft\Device Metadata\dmrccache\downloads|*.tmp

------------------------------------------------------------------------------

Modified Entries:

[Adblock Plus*]
LangSecRef=3026
SpecialDetect=DET_MOZILLA
Default=False
FileKey1=%AppData%\Mozilla\Firefox\Profiles\*\adblockplus|patterns-backup*.ini;*.tmp

    - Renamed

[Adblock Plus for IE*]
LangSecRef=3022
Detect=HKLM\Software\Adblock Plus for IE
DetectFile=%LocalAppData%\Adblock Plus for IE
Default=False
FileKey1=%LocalAppData%\Adblock Plus for IE|patterns-backup*.ini
FileKey2=%LocalLowAppData%\Adblock Plus for IE|patterns-backup*.ini
FileKey3=%WinDir%\System32\config\systemprofile\AppData\LocalLow\Adblock Plus for IE|patterns-backup*.ini

    - Renamed
    
[Adobe Updater*]
LangSecRef=3021
Detect=HKCU\Software\Adobe
Default=False
FileKey1=%ProgramFiles%\Common Files\Adobe\Installers|*.*|RECURSE
FileKey2=%CommonAppData%\Adobe\ARM|*.*|RECURSE
FileKey3=%LocalAppData%\Adobe\AAMUpdater|*.Log|RECURSE
FileKey4=%LocalAppData%\Adobe\Updater*|*.log|RECURSE
FileKey5=%LocalAppData%\Adobe\Acrobat\*\Updater|*.log
FileKey6=%AppData%\Adobe\LogTransport*\Logs|ulog_*.tmp
FileKey7=%AppData%\Adobe\Acrobat\*\Updater|*.log

    - Renamed
    - Added FileKeys1 and 2

[Apple Installer Cache*]
LangSecRef=3023
Detect=HKCU\Software\Apple Computer, Inc.
Default=False
Warning=You have to reinstall iTunes after adding a new windows user account.
FileKey1=%CommonAppData%\Apple\Installer Cache|*.*|REMOVESELF
FileKey2=%CommonAppData%\Apple Computer\Installer Cache|*.*|REMOVESELF

    - Added REMOVESELF
    
[Ashampoo Snap 7*]
LangSecRef=3024
Detect=HKCU\Software\Ashampoo\Ashampoo Snap 7
Default=False
FileKey1=%LocalAppData%\CrashRpt\UnsentCrashReports|*.*|RECURSE
FileKey2=%AppData%\Ashampoo\Ashampoo Snap 7|*.*|RECURSE
FileKey3=%ProgramFiles%\Ashampoo\Ashampoo Snap 7|_NLogMsg.txt

    - Added FileKey2
    
[Chrome HTML5 Storage*]
LangSecRef=3029
SpecialDetect=DET_CHROME
DetectFile1=%LocalAppData%\Chromium
DetectFile2=%LocalAppData%\Google\Chrome
DetectFile3=%LocalAppData%\Google\Chrome SxS
DetectFile4=%ProgramFiles%\Google\Chrome
DetectFile5=%ProgramFiles%\Google\Chrome SxS
DetectFile6=%LocalAppData%\Torch
DetectFile7=%LocalAppData%\SuperBird
Default=False
FileKey1=%LocalAppData%\Chrome Plus\User Data\*\File System|*.log;*MANIFEST*;*.old|RECURSE
FileKey2=%LocalAppData%\Chromium\User Data\*\File System|*.log;*MANIFEST*;*.old|RECURSE
FileKey3=%LocalAppData%\Flock\User Data\*\File System|*.log;*MANIFEST*;*.old|RECURSE
FileKey4=%LocalAppData%\Google\Chrome\User Data\*\File System|*.log;*MANIFEST*;*.old|RECURSE
FileKey5=%LocalAppData%\Google\Chrome SxS\User Data\*\File System|*.log;*MANIFEST*;*.old|RECURSE
FileKey6=%LocalAppData%\Rockmelt\User Data\*\File System|*.log;*MANIFEST*;*.old|RECURSE
FileKey7=%LocalAppData%\SRWare Iron\User Data\*\File System|*.log;*MANIFEST*;*.old|RECURSE
FileKey8=%LocalAppData%\Torch\User Data\*\File System|*.log;*MANIFEST*;*.old|RECURSE
FileKey9=%LocalAppData%\SuperBird\User Data\*\File System|*.log;*MANIFEST*;*.old|RECURSE

    - Removed *.* file target from all filekeys
    
[Chrome Logs*]
LangSecRef=3029
SpecialDetect=DET_CHROME
DetectFile1=%LocalAppData%\Torch
DetectFile2=%LocalAppData%\SuperBird
Default=False
FileKey1=%LocalAppData%\Chrome Plus\Application|debug.log
FileKey2=%LocalAppData%\Chrome Plus\User Data\*|*LOG.*;Log;*.log|RECURSE
FileKey3=%LocalAppData%\Chromium\Application|debug.log
FileKey4=%LocalAppData%\Chromium\User Data\*|*LOG.*;Log;*.log|RECURSE
FileKey5=%LocalAppData%\Flock\Application|debug.log
FileKey6=%LocalAppData%\Flock\User Data\*|*LOG.*;Log;*.log|RECURSE
FileKey7=%LocalAppData%\Google\Chrome\Application|debug.log
FileKey8=%LocalAppData%\Google\Chrome\User Data\*|*LOG.*;Log;*.log|RECURSE
FileKey9=%LocalAppData%\Google\Chrome SxS\Application|debug.log
FileKey10=%LocalAppData%\Google\Chrome SxS\User Data\*|*LOG.*;Log;*.log|RECURSE
FileKey16=%LocalAppData%\Rockmelt\Application|debug.log
FileKey17=%LocalAppData%\Rockmelt\User Data\*|*LOG.*;Log;*.log|RECURSE
FileKey19=%LocalAppData%\SRWare Iron\Application|debug.log
FileKey20=%LocalAppData%\SRWare Iron\User Data\*|*LOG.*;Log;*.log|RECURSE
FileKey21=%LocalAppData%\Torch\Application|debug.log
FileKey22=%LocalAppData%\Torch\User Data\*|*LOG.*;Log;*.log|RECURSE
FileKey23=%LocalAppData%\SuperBird\Application|debug.log
FileKey24=%LocalAppData%\SuperBird\User Data\*|*LOG.*;Log;*.log|RECURSE
FileKey25=%LocalAppData%\VirtualStore\Program Files*\Google\Chrome\Application|debug.log
ExcludeKey1=PATH|%LocalAppData%\Google\Chrome\User Data\*\Local Extension Settings\|*.*
ExcludeKey2=PATH|%LocalAppData%\Google\Chrome\User Data\*\Local App Settings\|*.*
ExcludeKey3=PATH|%LocalAppData%\Chrome Plus\User Data\*\Local Extension Settings\|*.*
ExcludeKey4=PATH|%LocalAppData%\Chrome Plus\User Data\*\Local App Settings\|*.*
ExcludeKey5=PATH|%LocalAppData%\Chromium\User Data\*\Local Extension Settings\|*.*
ExcludeKey6=PATH|%LocalAppData%\Chromium\User Data\*\Local App Settings\|*.*
ExcludeKey7=PATH|%LocalAppData%\Flock\User Data\*\Local Extension Settings\|*.*
ExcludeKey8=PATH|%LocalAppData%\Flock\User Data\*\Local App Settings\|*.*
ExcludeKey9=PATH|%LocalAppData%\Google\Chrome SxS\User Data\*\Local Extension Settings\|*.*
ExcludeKey10=PATH|%LocalAppData%\Google\Chrome SxS\User Data\*\Local App Settings\|*.*
ExcludeKey11=PATH|%LocalAppData%\Rockmelt\User Data\*\Local Extension Settings\|*.*
ExcludeKey12=PATH|%LocalAppData%\Rockmelt\User Data\*\Local App Settings\|*.*
ExcludeKey13=PATH|%LocalAppData%\SRWare Iron\User Data\*\Local Extension Settings\|*.*
ExcludeKey14=PATH|%LocalAppData%\SRWare Iron\User Data\*\Local App Settings\|*.*
ExcludeKey15=PATH|%LocalAppData%\Torch\User Data\*\Local Extension Settings\|*.*
ExcludeKey16=PATH|%LocalAppData%\Torch\User Data\*\Local App Settings\|*.*
ExcludeKey17=PATH|%LocalAppData%\Superbird\User Data\*\Local Extension Settings\|*.*
ExcludeKey18=PATH|%LocalAppData%\Superbird\User Data\*\Local App Settings\|*.*

    - Added Exclude Keys
        
[CyberLink PowerDirector 10*]
LangSecRef=3023
Detect=HKCU\Software\CyberLink\PowerDirector10
Default=False
FileKey1=%AppData%\CyberLink\PowerDirector\10.0\AutoSave|*.*|RECURSE
FileKey2=%AppData%\CyberLink\PowerDirector\10.0\photoTmp|*.*|RECURSE
FileKey3=%AppData%\Cyberlink\PowerDirector\10.0\WaveForms|*.*|RECURSE
FileKey4=%AppData%\Cyberlink\PowerDirector\10.0|Recentfiles.ini
FileKey5=%Documents%\CyberLink\PowerDirector\10.0|Snapshot(*).jpg
FileKey6=%Documents%\CyberLink\PowerDirector\10.0\MyTitles|*.*|RECURSE
FileKey7=%Documents%\CyberLink\PowerDirector\10.0\Preview Cache Files|*.*
FileKey8=%Documents%\CyberLink\PowerDirector\10.0\ShadowEditFiles|*.MPG
FileKey9=%Documents%\CyberLink\PowerDirector\10.0\SplitterIndex|*.maidx
RegKey1=HKCU\Software\CyberLink\Hanuman
RegKey2=HKCU\Software\CyberLink\PowerDirector10\MediaObj\MediaCache5\Data5
RegKey3=HKCU\Software\CyberLink\PowerDirector10\MediaObj\MediaCache5\Thumbnail5    
    
    - Added FileKeys1-4
    
[CyberLink PowerDirector 11*]
LangSecRef=3023
Detect=HKCU\Software\CyberLink\PowerDirector11
Default=False
FileKey1=%AppData%\CyberLink\PowerDirector\11.0\AutoSave|*.*|RECURSE
FileKey2=%AppData%\CyberLink\PowerDirector\11.0\photoTmp|*.*|RECURSE
FileKey3=%AppData%\Cyberlink\PowerDirector\11.0\WaveForms|*.*|RECURSE
FileKey4=%AppData%\Cyberlink\PowerDirector\11.0|Recentfiles.ini
FileKey5=%Documents%\CyberLink\PowerDirector\11.0|Snapshot(*).jpg
FileKey6=%Documents%\CyberLink\PowerDirector\11.0\MyTitles|*.*|RECURSE
FileKey7=%Documents%\CyberLink\PowerDirector\11.0\Preview Cache Files|*.*
FileKey8=%Documents%\CyberLink\PowerDirector\11.0\ShadowEditFiles|*.MPG
FileKey9=%Documents%\CyberLink\PowerDirector\11.0\SplitterIndex|*.maidx
RegKey1=HKCU\Software\CyberLink\Hanuman
RegKey2=HKCU\Software\CyberLink\PowerDirector11\MediaObj\MediaCache5\Data5
RegKey3=HKCU\Software\CyberLink\PowerDirector11\MediaObj\MediaCache5\Thumbnail5

    - Added FileKeys1-4
    
[CyberLink PowerDirector 12*]
LangSecRef=3023
Detect=HKCU\Software\CyberLink\PowerDirector12
Default=False
FileKey1=%AppData%\CyberLink\PowerDirector\12.0\AutoSave|*.*|RECURSE
FileKey2=%AppData%\CyberLink\PowerDirector\12.0\photoTmp|*.*|RECURSE
FileKey3=%AppData%\Cyberlink\PowerDirector\12.0\WaveForms|*.*|RECURSE
FileKey4=%AppData%\Cyberlink\PowerDirector\12.0|Recentfiles.ini
FileKey5=%Documents%\CyberLink\PowerDirector\12.0|Snapshot(*).jpg
FileKey6=%Documents%\CyberLink\PowerDirector\12.0\MyTitles|*.*|RECURSE
FileKey7=%Documents%\CyberLink\PowerDirector\12.0\Preview Cache Files|*.*
FileKey8=%Documents%\CyberLink\PowerDirector\12.0\ShadowEditFiles|*.MPG
FileKey9=%Documents%\CyberLink\PowerDirector\12.0\SplitterIndex|*.maidx
RegKey1=HKCU\Software\CyberLink\Hanuman
RegKey2=HKCU\Software\CyberLink\PowerDirector12\MediaObj\MediaCache5\Data5
RegKey3=HKCU\Software\CyberLink\PowerDirector12\MediaObj\MediaCache5\Thumbnail5

    - Added FileKeys1-4
    
[CyberLink PowerDirector 13*]
LangSecRef=3023
Detect=HKCU\Software\CyberLink\PowerDirector13
Default=False
FileKey1=%AppData%\CyberLink\PowerDirector\13.0\AutoSave|*.*|RECURSE
FileKey2=%AppData%\CyberLink\PowerDirector\13.0\photoTmp|*.*|RECURSE
FileKey3=%AppData%\Cyberlink\PowerDirector\13.0\WaveForms|*.*|RECURSE
FileKey4=%AppData%\Cyberlink\PowerDirector\13.0|Recentfiles.ini
FileKey5=%Documents%\CyberLink\PowerDirector\13.0|Snapshot(*).jpg
FileKey6=%Documents%\CyberLink\PowerDirector\13.0\MyTitles|*.*|RECURSE
FileKey7=%Documents%\CyberLink\PowerDirector\13.0\Preview Cache Files|*.*
FileKey8=%Documents%\CyberLink\PowerDirector\13.0\ShadowEditFiles|*.MPG
FileKey9=%Documents%\CyberLink\PowerDirector\13.0\SplitterIndex|*.maidx
RegKey1=HKCU\Software\CyberLink\Hanuman
RegKey2=HKCU\Software\CyberLink\PowerDirector13\MediaObj\MediaCache5\Data5
RegKey3=HKCU\Software\CyberLink\PowerDirector13\MediaObj\MediaCache5\Thumbnail5

    - Added FileKeys1-4
    
[inkScape*]
LangSecRef=3023
Detect=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\inkscape.exe
Default=False
FileKey1=%AppData%\InkScape|*.log|RECURSE
FileKey2=%UserProfile%|.recently-used.xbel
FileKey3=%LocalAppData%|recently-used.xbel

    - Added FileKey3
    
[iTunes Temporary Files*]
LangSecRef=3023
Detect=HKLM\Software\Apple Computer, Inc.\iTunes
Default=False
FileKey1=%Music%\iTunes|*.tmp|RECURSE
FileKey2=%CommonAppData%\Apple Computer\iTunes\iPhone Temporary Files|*.*|RECURSE
FileKey3=%LocalAppData%\VirtualStore\ProgramData\Apple Computer\iTunes\iPhone Temporary Files|*.*|RECURSE

    - Added FileKeys2 and 3    

[Malwarebytes Anti-Exploit*]
LangSecRef=3024
DetectFile=%CommonAppData%\Malwarebytes\Malwarebytes Anti-Exploit
Default=False
FileKey1=%CommonAppData%\Malwarebytes\Malwarebytes Anti-Exploit|*.log
FileKey2=%LocalAppData%\VirtualStore\ProgramData\Malwarebytes\Malwarebytes Anti-Exploit|*.log

    - Renamed
    
[Microsoft Security Essentials*]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\Microsoft Antimalware
Default=False
FileKey1=%CommonAppData%\Microsoft\Microsoft Antimalware\LocalCopy|*.*|RECURSE
FileKey2=%CommonAppData%\Microsoft\Microsoft Antimalware\Scans\History\Service|*.log|RECURSE
FileKey3=%CommonAppData%\Microsoft\Microsoft Security Client\Support|MSSecurityClient*.log
FileKey4=%LocalAppData%\VirtualStore\ProgramData\Microsoft\Microsoft Antimalware\LocalCopy|*.*|RECURSE
FileKey5=%LocalAppData%\VirtualStore\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Service|*.log|RECURSE
FileKey6=%LocalAppData%\VirtualStore\ProgramData\Microsoft\Microsoft Security Client\Support|MSSecurityClient*.log
FileKey7=%CommonAppData%\Microsoft\Microsoft Antimalware\Network Inspection System\Support\NisLog.txt.bak

    - Added FileKey7
    
[Minecraft*]
Section=Games
DetectFile=%AppData%\.minecraft
Default=False
FileKey1=%AppData%\.minecraft|*.log;*.log.*
FileKey2=%AppData%\.minecraft\crash-reports|*.*
FileKey3=%AppData%\.minecraft\server|server.log
FileKey4=%AppData%\.minecraft\stats|*.old
FileKey5=%AppData%\.minecraft\logs|*.*
FileKey6=%AppData%\java|*.*|REMOVESELF

    - Added FileKey6
    
[McAfee*]
LangSecRef=3024
Detect=HKLM\Software\McAfee
Default=False
FileKey1=%CommonAppData%\McAfee\MCLOGS|*.*|RECURSE
FileKey2=%CommonAppData%\McAfee\MPF\data|*.*|RECURSE
FileKey3=%CommonAppData%\McAfee\MSC\Logs|*.*|RECURSE
FileKey4=%CommonAppData%\McAfee\VirusScan\Data|*.log;*.old
FileKey5=%CommonAppData%\McAfee\VirusScan\Logs|*.*|RECURSE
FileKey6=%LocalAppData%\VirtualStore\ProgramData\McAfee\MCLOGS|*.*|RECURSE
FileKey7=%LocalAppData%\VirtualStore\ProgramData\McAfee\MPF\data|*.*|RECURSE
FileKey8=%LocalAppData%\VirtualStore\ProgramData\McAfee\MSC\Logs|*.*|RECURSE
FileKey9=%LocalAppData%\VirtualStore\ProgramData\McAfee\VirusScan\Data|*.log;*.old
FileKey10=%LocalAppData%\VirtualStore\ProgramData\McAfee\VirusScan\Logs|*.*|RECURSE

    - Renamed
    
[MS Word Document Building Blocks*]
LangSecRef=3021
DetectFile=%AppData%\Microsoft\Document Building Blocks
Default=False
FileKey1=%AppData%\Microsoft\Document Building Blocks|*.*|RECURSE

    - Renamed
    
[Neverwinter*]
Section=Games
Detect=HKCU\Software\Cryptic\Neverwinter
Default=False
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Cryptic Studios|*.log|RECURSE
FileKey2=%ProgramFiles%\Steam\SteamApps\common\Cryptic Studios\localdata|_SWMWindowPosList.txt
FileKey3=%SystemDrive%\Users\Public\Games\Cryptic Studios|*.log|RECURSE
FileKey4=%SystemDrive%\Users\Public\Games\Cryptic Studios\localdata|_SWMWindowPosList.tx

    - Renamed
    - Added FileKeys1 and 2
    
[Norton Dumps*]
LangSecRef=3024
DetectFile=%CommonAppData%\Norton\LocalDumps
Default=False
FileKey1=%CommonAppData%\Norton\LocalDumps|*.dmp
FileKey2=%LocalAppData%\VirtualStore\ProgramData\Norton\LocalDumps|*.dmp

    - Renamed
    
[OpenRA (Logs and Replays)*]
Section=Games
Warning=This will also remove your Replays!
DetectFile=%Documents%\OpenRA
Default=False
FileKey1=%Documents%\OpenRA\Replays|*.*|RECURSE
FileKey2=%Documents%\OpenRA\Logs|*.*

    - Renamed
    - Added FileKey1
    
[Private Internet Access VPN*]
LangSecRef=3022
DetectFile=%AppData%\Titanium\appdata\com.privateinternetaccess.vpn
Default=False
FileKey1=%AppData%\Titanium\appdata\com.privateinternetaccess.vpn|*.log
FileKey2=%ProgramFiles%\pia_manager\log|*.*
FileKey3=%ProgramFiles%\pia_manager\tmp|*.*

    - Added FileKey3
    
[snagit 11 More*]
LangSecRef=3024
Detect=HKCU\Software\TechSmith\SnagIt\11
Default=False
Warning=This will delete the backups of the captures that you have performed with SnagIt 11.
FileKey1=%LocalAppData%\TechSmith\Snagit\DataStore|*.sdf;*.SNAG;*.SNAGundo;*.MP4
FileKey2=%Documents%\|SnagItDebug.log
RegKey1=HKCU\Software\TechSmith\Snagit\11|CaptureCount
RegKey2=HKCU\Software\TechSmith\Snagit\Stamps|StampCustomFolder

    - Removed FileKey1
    
[snagit 12 More*]
LangSecRef=3024
Detect=HKCU\Software\TechSmith\SnagIt\12
Default=False
Warning=This will delete the backups of the captures that you have performed with SnagIt 12.
FileKey1=%LocalAppData%\TechSmith\Snagit\DataStore|*.sdf;*.SNAG;*.SNAGundo;*.MP4
FileKey2=%Documents%\|SnagItDebug.log
RegKey1=HKCU\Software\TechSmith\Snagit\12|CaptureCount
RegKey2=HKCU\Software\TechSmith\Snagit\Stamps|StampCustomFolder

    - Removed FileKey1
    - Tweaked new FileKey1

[starCraft II Logs*]
Section=Games
Detect=HKCU\Software\Blizzard Entertainment\StarCraft II
Default=False
FileKey1=%ProgramFiles%\Starcraft II\Logs|*.*
FileKey2=%Public%\games\Starcraft II\Logs|*.*
FileKey3=%SystemDrive%\Starcraft II\Logs|*.*
FileKey4=%Documents%\StarCraft II\GameLogs|*.*|RECURSE
FileKey5=%LocalAppData%\VirtualStore\Program Files*\Starcraft II\Logs|*.*
FileKey6=%Documents%\StarCraft II\UserLogs|*.*|RECURSE

    - Added FileKey6
    
[steam Browser Cache*]
Section=Games
Detect=HKCU\Software\Valve\Steam
Warning=This will also delete the thumbnails and custom background images of the games in your Library.
FileKey1=%ProgramFiles%\Steam\appcache\httpcache|*.*|RECURSE
FileKey2=%ProgramFiles%\Steam\config\cookies|*.*|RECURSE
FileKey3=%ProgramFiles%\Steam\config\htmlcache|*.*|RECURSE
FileKey4=%ProgramFiles%\Steam\config\overlaycookies|*.*|RECURSE
FileKey5=%ProgramFiles%\Steam\config\overlayhtmlcache|*.*|RECURSE
FileKey6=%ProgramFiles%\Steam\userdata\*\ugcmsgcache|*.*|RECURSE
FileKey7=%LocalAppData%\VirtualStore\Program Files*\Steam\appcache\httpcache|*.*|RECURSE
FileKey8=%LocalAppData%\VirtualStore\Program Files*\Steam\config\cookies|*.*|RECURSE
FileKey9=%LocalAppData%\VirtualStore\Program Files*\Steam\config\htmlcache|*.*|RECURSE
FileKey10=%LocalAppData%\VirtualStore\Program Files*\Steam\config\overlaycookies|*.*|RECURSE
FileKey11=%LocalAppData%\VirtualStore\Program Files*\Steam\config\overlayhtmlcache|*.*|RECURSE

    - Added FileKey6
    
[steam Logs*]
Section=Games
Detect=HKCU\Software\Valve\Steam
Default=False
FileKey1=%ProgramFiles%\Steam|*.log;*log.last;connection_log_*.txt;*_log.txt;remote_connections.txt;vr*_*.txt|RECURSE
FileKey2=%ProgramFiles%\Steam|Steam.log;.crash
FileKey3=%ProgramFiles%\Steam\SteamLogs|*.log
FileKey4=%ProgramFiles%\Steam\vr\runtime\logs|*.*|RECURSE
FileKey5=%AppData%\SteamVR\Logs|*.*|REMOVESELF
FileKey6=%LocalAppData%\VirtualStore\Program Files*\Steam|*.log;*log.last;connection_log_*.txt;*_log.txt;remote_connections.txt;vr*_*.txt|RECURSE
FileKey7=%LocalAppData%\VirtualStore\Program Files*\Steam|Steam.log
FileKey8=%LocalAppData%\VirtualStore\Program Files*\Steam\SteamLogs|*.log

    - Improved FileKey2, removed outdated 'Valve' reference
    
[Team Fortress 2 Cache and Cookies*]
Section=Games
Detect=HKCU\Software\Valve\Steam\Apps\440
Default=False
FileKey1=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\config\cookies|*.*|RECURSE
FileKey2=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\config\html\AppCache|*.*|RECURSE
FileKey3=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\tf\cache|*.*|RECURSE
FileKey4=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\tf\materials\temp|*.vtf|RECURSE
FileKey5=%ProgramFiles%\Steam\SteamApps\common\Team Fortress 2\tf\download\user_custom|*.*|RECURSE

    - Added FileKey5
    
[VoidTools Search Everything Error Logs*]
LangSecRef=3024
DetectFile=%ProgramFiles%\Everything
Default=False
FileKey1=%AppData%\Everything|Errorlog.txt;Run History.csv
FileKey2=%AppData%\Everything\Logs|*Log.txt
FileKey3=%ProgramFiles%\Everything|Errorlog.txt
FileKey4=%LocalAppData%\VirtualStore\Program Files*\Everything|Errorlog.txt

    - Renamed
    
[VoidTools Search Everything (History)*]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Everything
DetectFile=%AppData%\Everything
Default=False
FileKey1=%AppData%\Everything|*.csv
FileKey2=%ProgramFiles%\Everything|*.txt
FileKey3=%LocalAppData%\VirtualStore\Program Files*\Everything|*.txt

    - Renamed
    
[Vuze More*]
LangSecRef=3022
Detect=HKCR\Azureus
Default=False
FileKey1=%AppData%\Azureus\plugins\advancedstatistics|*.txt
FileKey2=%AppData%\Azureus\plugins\progressbar|*.txt
FileKey3=%ProgramFiles%\Vuze|*.log
FileKey4=%ProgramFiles%\Vuze\.install4j|*.log

    - Added FileKeys
    
[Windows Live Messenger More*]
LangSecRef=3022
Detect=HKLM\Software\Microsoft\Windows Live\Messenger
Default=False
FileKey1=%CommonProgramFiles%\Windows Live\.cache|*.*|RECURSE
FileKey2=%LocalAppData%\Microsoft\Messenger|*.uccapilog;*.bak;*.txt|RECURSE
FileKey3=%LocalAppData%\Microsoft\Windows Live|*.log;*.jrs;*.sqm|RECURSE
FileKey4=%LocalAppData%\Microsoft\Windows Live Contacts|*.log;*.jrs|RECURSE
FileKey5=%LocalAppData%\Microsoft\Windows Live Contacts\*\*\*\Backup|*.*|RECURSE
FileKey6=%ProgramFiles%\Windows Live\Messenger|*.bak|RECURSE
FileKey7=%WinDir%\System32\config\systemprofile\Documents|wlidsvctrace*.txt
FileKey8=%WinDir%\SysWOW64\config\systemprofile\Documents|wlidsvctrace*.txt
FileKey9=%LocalAppData%\VirtualStore\Program Files*\Windows Live\Messenger|*.bak|RECURSE
FileKey10=%LocalAppData%\VirtualStore\Program Files*\Common Files\Windows Live\.cache|*.*|RECURSE
FileKey11=%CommonProgramFiles%\Windows Live\.cache|*.tmp

    - Added FileKey11

    
------------------------------------------------------------------------------
Removed Entries:

[Adobe Updater ARM*]
LangSecRef=3021
Detect=HKCU\Software\Adobe
Default=False
FileKey1=%CommonAppData%\Adobe\ARM|*.*|RECURSE

[Firefox Console Log*]
LangSecRef=3026
SpecialDetect=DET_MOZILLA
Default=False
FileKey1=%AppData%\Mozilla\Firefox|console.log

[Firefox Extensions Log*]
LangSecRef=3026
SpecialDetect=DET_MOZILLA
Default=False
FileKey1=%AppData%\Mozilla\Firefox\Profiles\*|extensions.log

[iPhone Temporary Files*]
LangSecRef=3023
Detect=HKLM\Software\Apple Computer, Inc.\iTunes
Default=False
FileKey1=%CommonAppData%\Apple Computer\iTunes\iPhone Temporary Files|*.*|RECURSE
FileKey2=%LocalAppData%\VirtualStore\ProgramData\Apple Computer\iTunes\iPhone Temporary Files|*.*|RECURSE



------------------------------------------------------------------------------
 

 

 

 

LMK what I missed

[ROCKNROLL]

[Vuze More*]
LangSecRef=3022
Detect=HKCR\Azureus
Default=False
FileKey1=%AppData%\Azureus\plugins\advancedstatistics|*.txt
FileKey2=%AppData%\Azureus\plugins\progressbar|*.txt
FileKey3=%ProgramFiles%\Vuze|*.log
FileKey4=%ProgramFiles%\Vuze\.install4j|*.log

 

- Added FileKeys

 

Should say Added FileKey 3 and 4. Also, I would like to see the reasons why entries get removed.

[Winapp2.ini]

[Vuze More*]

LangSecRef=3022

Detect=HKCR\Azureus

Default=False

FileKey1=%AppData%\Azureus\plugins\advancedstatistics|*.txt

FileKey2=%AppData%\Azureus\plugins\progressbar|*.txt

FileKey3=%ProgramFiles%\Vuze|*.log

FileKey4=%ProgramFiles%\Vuze\.install4j|*.log

 

- Added FileKeys

 

Should say Added FileKey 3 and 4. Also, I would like to see the reasons why entries get removed.

 

All the removed entries were merged into other entries or otherwise redundant because of other entries

[JDPower]

Just a VERY minor point, cos I know it don't happen often, but would be handy if when an entry changes name you could state what from so we can find it in our existing file to replace easier

[SMalik]

Thanks for the update. Everything looks good except you forgot to change the name of [snagit 11 Local Dumps (.dmp)*] entry.

 

[snagit 11 Local Dumps*]
LangSecRef=3024
Detect=HKCU\Software\TechSmith\SnagIt\11
Default=False
FileKey1=%LocalAppData%\TechSmith\Snagit\CrashDumps|*.*

[siliconman01]

Modified Entry:  [AVG PC TuneUp & TuneUp Utilities Reg Defrag Cleanup*]

 

-  Added SOFTWARE_tureg_new;SYSTEM_tureg_new  to FileKey10

-  Added FileKey13

-  Added FileKey14
 

[AVG PC TuneUp & TuneUp Utilities Reg Defrag Cleanup*]
LangSecRef=3024
Detect1=HKCU\Software\TuneUp\Utilities\10.0
Detect2=HKCU\Software\TuneUp\Utilities\12.0
Detect3=HKCU\Software\TuneUp\Utilities\13.0
Detect4=HKCU\Software\TuneUp\Utilities\14.0
Detect5=HKCU\Software\AVG\AWL\RegistryCleaner
Default=False
FileKey1=%LocalAppData%\Microsoft\Windows|USRCLASS.DAT_tureg_new.LOG*;USRCLASS.DAT_tureg_old
FileKey2=%SystemDrive%\Boot|BCD_tureg_new.LOG*;BCD_tureg_old
FileKey3=%SystemDrive%\Documents and Settings\LocalService|NTUSER.DAT_tureg_new.LOG*;NTUSER.DAT_tureg_old
FileKey4=%SystemDrive%\Documents and Settings\LocalService.NT*|NTUSER.DAT_tureg_new.LOG*;NTUSER.DAT_tureg_old
FileKey5=%SystemDrive%\Documents and Settings\NetworkService|NTUSER.DAT_tureg_new.LOG*;NTUSER.DAT_tureg_old
FileKey6=%SystemDrive%\Documents and Settings\NetworkService.NT*|NTUSER.DAT_tureg_new.LOG*;NTUSER.DAT_tureg_old
FileKey7=%UserProfile%|NTUSER.DAT_tureg_new.LOG*;NTUSER.DAT_tureg_old
FileKey8=%WinDir%\ServiceProfiles\LocalService|NTUSER.DAT_tureg_new.LOG*;NTUSER.DAT_tureg_old
FileKey9=%WinDir%\ServiceProfiles\NetworkService|NTUSER.DAT_tureg_new.LOG*;NTUSER.DAT_tureg_old
FileKey10=%WinDir%\System32\config|COMPONENTS_tureg_new.LOG*;COMPONENTS_tureg_old;DEFAULT_tureg_new.LOG*;DEFAULT_tureg_old;SAM_tureg_new.LOG*;SAM_tureg_old;SECURITY_tureg_new.LOG*;SECURITY_tureg_old;SOFTWARE_tureg_new.LOG*;SOFTWARE_tureg_old;SYSTEM_tureg_new.LOG*;SYSTEM_tureg_old;DRIVERS_tureg_new.LOG*;DRIVERS_tureg_old;SOFTWARE_tureg_new;SYSTEM_tureg_new
FileKey11=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\|USRCLASS.DAT_tureg_old;USRCLASS.DAT_tureg_new.LOG*
FileKey12=%WinDir%\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\|USRCLASS.DAT_tureg_old;USRCLASS.DAT_tureg_new.LOG*
FileKey13=%CommonAppData%|NTUSER.DAT_tureg_new.LOG1;NTUSER.DAT_tureg_new.LOG2;NTUSER.DAT_tureg_old
FileKey14=%SystemDrive%\Users\Public|NTUSER.DAT_tureg_new.LOG1;NTUSER.DAT_tureg_new.LOG2;NTUSER.DAT_tureg_old

[medmedin2014]

I can't download Trim.bat from http://www.winapp2.com/trim.bat i get the following error:

Forbidden

You don't have permission to access /trim.bat on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

[ricktendo64]

Updated Beyond Compare 3*, now works on all versions (3, 4, etc)

[Beyond Compare*]
LangSecRef=3021
Detect=HKCU\Software\Scooter Software\Beyond Compare
Default=False
FileKey1=%AppData%\Scooter Software\Beyond Compare*|*.bak;BCCommands.xml;BCSessions.xml

[APMichael]

Thanks for the update!

Modified: Typo.

[Java More*]
LangSecRef=3022
Detect=HKLM\Software\JavaSoft\Java Runtime Environment
Default=False
FileKey1=%AppData%\Sun\Java\Deployment\SystemCache|*.*|RECURSE
FileKey2=%LocalAppData%\Sun\Java\Deployment\cache|*.*|RECURSE
FileKey3=%LocalAppData%\Sun\Java\Deployment\SystemCache|*.*|RECURSE
FileKey4=%LocalLowAppData%\Sun\Java\Deployment\SystemCache|*.*|RECURSE
FileKey5=%WinDir%\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\Cache|*.*|RECURSE
FileKey6=%WinDir%\SysWOW64\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\Cache|*.*|RECURSE
FileKey7=%ProgramFiles%\Java\jre*|*PATCH.ERR
FileKey8=%ProgramFiles%\Java\jre*\lib\security|*.bak
FileKey9=%LocalAppData%\VirtualStore\Program Files*\Java\jre*|*PATCH.ERR
FileKey10=%LocalAppData%\VirtualStore\Program Files*\Java\jre*\lib\security|*.bak

 
Modified: I think DetectFile should be:

[MaceCraft PowerTools hosts backups*]
LangSecRef=3024
Default=False
DetectFile=%ProgramFiles%\jv16 PowerTools *\jv16PT.exe
FileKey1=%windir%\System32\drivers\etc|hosts_PTBackup*.bak

 
Space before asterisk:

[Windows Device Icon Downloads *]

Remove: Already inside [internet Explorer 10/11] (FileKey7).

[Windows WebCache**]
LangSecRef=3025
DetectFile=%LocalAppData%\Microsoft\Windows\WebCache\
Default=False
FileKey1=%LocalAppData%\Microsoft\Windows\WebCache|*.tmp

[dvdbane]

 

[VoidTools Search Everything Error Logs*]

LangSecRef=3024

DetectFile=%ProgramFiles%\Everything

Default=False

FileKey1=%AppData%\Everything|Errorlog.txt;Run History.csv

FileKey2=%AppData%\Everything\Logs|*Log.txt

FileKey3=%ProgramFiles%\Everything|Errorlog.txt

FileKey4=%LocalAppData%\VirtualStore\Program Files*\Everything|Errorlog.txt

 

    - Renamed

    

[VoidTools Search Everything (History)*]

LangSecRef=3024

Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Everything

DetectFile=%AppData%\Everything

Default=False

FileKey1=%AppData%\Everything|*.csv

FileKey2=%ProgramFiles%\Everything|*.txt

FileKey3=%LocalAppData%\VirtualStore\Program Files*\Everything|*.txt

if you going to make it separate entries, then it should be like this

 

 

[VoidTools Search Everything Error Logs*]

LangSecRef=3024

DetectFile1=%ProgramFiles%\Everything

DetectFile2=%AppData%\Everything

Default=False

FileKey1=%AppData%\Everything|*.txt

FileKey2=%ProgramFiles%\Everything|*.txt

FileKey3=%LocalAppData%\VirtualStore\Program Files*\Everything|*.txt

 

[VoidTools Search Everything (History)*]

LangSecRef=3024

DetectFile1=%ProgramFiles%\Everything

DetectFile2=%AppData%\Everything

Default=False

FileKey1=%AppData%\Everything|*.csv

FileKey2=%ProgramFiles%\Everything|*.csv

changes

 - add DetectFile1,DetectFile2

 - tweak FileKey according to entry name

 

or you can use my combined entry here http://forum.piriform.com/index.php?showtopic=32310&page=235&do=findComment&comment=257393

usually it's hard to get error log and normally just a 2 line text file

my history won't go to 1MB so i prefer it to be combine together

you missed my [sUMo Database*] entry on the same post

[qsdewa]

I can't download Trim.bat from http://www.winapp2.com/trim.bat i get the following error:

Forbidden

You don't have permission to access /trim.bat on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

Me too. I can't download any .bat files from winapp2.com

[CSGalloway]

I use {VOLDEMORT} and it wouldn't download the updated winapp2,ini so I had to finally use Chrome to download the INI to the desktop then move I to the CCleaner folder.

 

[Winapp2.ini]

I use {VOLDEMORT} and it wouldn't download the updated winapp2,ini so I had to finally use Chrome to download the INI to the desktop then move I to the CCleaner folder.

Shane has been travelling and hasn't had time to update the download on his end, where voldemort draws his magic from

[CSGalloway]

I guess mentioning other party tools is against the rules?  Sorry.

 

| Shane has been travelling and hasn't had time to update the download on his end, where voldemort draws his magic from

 

I would assume he just replaces the old winapp2.ini with the newer one.  Hence the actually link does not change.  I have heard people are having troubles downloading other files like Trim.bat - so I think it's a access rule that is not correct...