Winapp2.ini additions

September 28, 2015

It deletes much more for bad guys, not normal people... This is the same file hazelnut added months ago (directly after Neverblooms ban) as it was supporting advanced entries for not everybody's use..

September 28, 2015

. This is the same file hazelnut added months ago (directly after Neverblooms ban)

Show me a file I have added to Winapp2.ini

September 28, 2015

updated

What's new in winapp2.ini 5.10.150925

I'll update the hash etc in a few days

Web site still has Version: v5.09.150825

September 28, 2015

Just so you know, Trader5858 is a spammer. Be better off banning him.

September 28, 2015

Just so you know, Trader5858 is a spammer. Be better off banning him.

He was banned earlier today.

September 28, 2015

I think he (Trader5858) was trying to tell us he made a file called winsys2.ini and wanted to combine it with Winapp2 entries. I was looking through them and he has some listed websites that I don't understand what they were for. He also had some more agressive entries in there. I don't know, maybe some of them are ok to add, if anyone wanted to go through them.

I wonder if that was Neverbloom on a alt account? He did mention Neverbloom's ban. Makes you wonder...

Anyways, anyone know when he will be able to update the Winapp2 file. Also, I would suggest throwing it on GitHub. It would help in situations like this.

September 28, 2015

Forks of chrome are already cleaned by cclean

September 28, 2015

I wonder if that was Neverbloom on a alt account? He did mention Neverbloom's ban.

I can only presume that's why he/she was banned, didn't see anything remotely spammy about his/her postings, seemed to be trying to help (in a rather hard to understand way)

September 29, 2015

It has been almost three days since someone uploaded the wrong Winapp2.ini file. It is still not corrected.

Sorry, Winapp2.INI was uploaded, but the link points to Winapp2.ini. Case sensitivity problems. Link should work properly now

September 29, 2015

Silly linux servers lol

October 1, 2015

Sorry, I don`t know English.

I think it is a mistake.

Also GPUCache Chrome.

October 5, 2015

New Entry: [AccuWeather*]

[AccuWeather*]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\AccuWeather.AccuWeatherforWindows8_8zz2pj9h1h1d8
DetectFile=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_8zz2pj9h1h1d8
Default=False
FileKey1=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\AC\INetCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\AC\INetCookies|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\AC\INetHistory|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.log|RECURSE
FileKey5=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\AC\Temp|*.*
FileKey6=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\LocalState|*.tmp
FileKey7=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\TempState\Bing.Maps\Cache|*.*|RECURSE

October 7, 2015

Sorry, I don`t know English.

I think it is a mistake.

Also GPUCache Chrome.

Chrome SXS is Chrome Canary, a developer build of Chrome.

October 23, 2015

I searched my HDD for both *.BAK and *.TMP and came up with:

          8,192 2011-02-11 13:00:42 C:\BOOTSECT.BAK
     33,554,625 2015-10-14 13:04:16 C:\ProgramData\Microsoft\Microsoft Antimalware\Network Inspection System\Support\NisLog.txt.bak
          8,200 2002-10-17 21:23:16 C:\ProgramData\Microsoft\OFFICE\DATA\OPA11.BAK
      1,048,576 2015-06-23 20:47:47 C:\Users\Administrator\AppData\Local\Microsoft\Windows\Explorer\ThumbCacheToDelete\thmEF9C.tmp
      1,048,576 2015-06-23 20:47:47 C:\Users\Administrator\AppData\Local\Microsoft\Windows\Explorer\ThumbCacheToDelete\thmEF9D.tmp
      1,048,576 2015-06-23 20:47:47 C:\Users\Administrator\AppData\Local\Microsoft\Windows\Explorer\ThumbCacheToDelete\thmEF9E.tmp
             24 2015-06-23 20:47:47 C:\Users\Administrator\AppData\Local\Microsoft\Windows\Explorer\ThumbCacheToDelete\thmEF9F.tmp
             24 2015-06-23 20:47:47 C:\Users\Administrator\AppData\Local\Microsoft\Windows\Explorer\ThumbCacheToDelete\thmEFA0.tmp
          3,256 2015-06-23 20:47:47 C:\Users\Administrator\AppData\Local\Microsoft\Windows\Explorer\ThumbCacheToDelete\thmEFA1.tmp
         59,285 2015-04-16 20:45:44 C:\Users\Galloway\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences.bak
        524,288 2015-10-22 22:36:30 C:\Users\Galloway\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.tmp
             58 2015-10-23 16:11:08 C:\Users\Galloway\AppData\Local\Mozilla\Firefox\Profiles\y73yivh7.default-1408590376909\ShutdownDuration.json.tmp
         47,416 2015-10-22 22:36:15 C:\Users\Galloway\AppData\Local\Temp\DIO9E14.tmp
         47,416 2015-10-21 20:43:45 C:\Users\Galloway\AppData\Local\Temp\DIOA6D.tmp
          1,313 2015-10-22 22:36:09 C:\Users\Galloway\AppData\Local\Temp\MAR848A.tmp
          1,285 2015-10-22 22:36:09 C:\Users\Galloway\AppData\Local\Temp\MAR87C6.tmp
          1,313 2015-10-21 20:43:39 C:\Users\Galloway\AppData\Local\Temp\MARF343.tmp
          1,285 2015-10-21 20:43:39 C:\Users\Galloway\AppData\Local\Temp\MARF3D1.tmp
         45,128 2015-10-21 19:15:07 C:\Users\Galloway\AppData\Local\Temp\acrord32_sbx\Z@R9A27.tmp
         44,268 2015-10-21 19:15:07 C:\Users\Galloway\AppData\Local\Temp\acrord32_sbx\Z@R9A87.tmp
         42,592 2015-10-21 19:15:07 C:\Users\Galloway\AppData\Local\Temp\acrord32_sbx\Z@R9AF6.tmp
         44,268 2015-10-21 19:13:16 C:\Users\Galloway\AppData\Local\Temp\acrord32_sbx\Z@RE95F.tmp
         42,592 2015-10-21 19:13:16 C:\Users\Galloway\AppData\Local\Temp\acrord32_sbx\Z@REA1D.tmp
         45,128 2015-10-21 19:13:16 C:\Users\Galloway\AppData\Local\Temp\acrord32_sbx\Z@REA4D.tmp
         16,384 2015-10-23 16:42:21 C:\Users\Galloway\AppData\Local\Temp\~DF0E658E1C49D51764.TMP
            512 2015-10-23 16:42:21 C:\Users\Galloway\AppData\Local\Temp\~DF57E44A66E904D226.TMP
              0 2015-10-22 22:37:06 C:\Users\Galloway\AppData\Local\VirtualStore\Program Files (x86)\Yahoo!\Messenger\Cache\9G0IMTf7KSnOtr1pRkveNQ--.ProfileMap.dat.tmp
         24,327 2015-09-18 12:29:41 C:\Users\Galloway\AppData\Roaming\Mozilla\Firefox\Profiles\y73yivh7.default-1408590376909\extensions.json.bak
         57,344 2015-10-02 15:32:31 C:\Users\Galloway\Tracing\WPPMedia\Skype_MediaStack-6.0.8943.312-lcsmedia_vnext_release3(rtbldlab)-x86fre-U.etl.bak
         65,536 2015-10-22 22:22:12 C:\Users\Galloway\Tracing\WPPMedia\Skype_MediaStack-6.0.8943.314-lcsmedia_vnext_release3(rtbldlab)-x86fre-U.etl.bak
         16,384 2015-10-02 15:32:31 C:\Users\Galloway\Tracing\WPPMedia\Skype_MediaStackETW-6.0.8943.312-lcsmedia_vnext_release3(rtbldlab)-x86fre-U.etl.bak
         16,384 2015-10-22 22:22:12 C:\Users\Galloway\Tracing\WPPMedia\Skype_MediaStackETW-6.0.8943.314-lcsmedia_vnext_release3(rtbldlab)-x86fre-U.etl.bak
     27,194,449 2015-10-04 12:27:05 C:\Windows\Logs\DISM\dism.log.bak
        576,683 2014-11-22 14:49:47 C:\Windows\System32\drivers\etc\hosts_PTBackup.bak
            837 2015-01-09 01:00:21 C:\Windows\System32\drivers\etc\hosts_PTbackup2.bak
          4,204 2005-07-02 18:57:28 C:\Z_UserFiles\Unknown\BAK_001\settings.bak
     65,640,728 / 36

Does anyone know if ALL files are safe to delete ? I guess the C:\BOOTSECT.BAK is not?

October 23, 2015

C:\Users\Galloway\AppData\Local\Temp\*.*

this is safe to delete

you can take this in your include-list in ccleaner. --> with "files and subfolders"

October 23, 2015

\Microsoft\OFFICE\DATA\OPA11.BAK is certainly NOT safe to delete. (been caught out with that one myself)

deleting it breaks Office, requiring it to be reinstalled the next time one of the Office suite of programs is used.

October 23, 2015

\Microsoft\OFFICE\DATA\OPA11.BAK is certainly NOT safe to delete. (been got out with that one myself)

deleting it breaks Office, requiring it to be reinstalled the next time one of the Office suite of programs is used.

I wonder why so many "so-called cleaning tools" still target that file after over 12 years of causing users grief upon its removal.

October 23, 2015

I wonder why so many "so-called cleaning tools" still target that file after over 12 years of causing users grief upon its removal.

I wonder why so many USERS still think that anything with a .bak or .tmp is immediately safe to delete.

October 23, 2015

I wonder why so many USERS still think that anything with a .bak or .tmp is immediately safe to delete.

I would argue that was a safe assumption. but no longer.

Historically, by the very name of the extension, they should be safe to delete.

BAK for backup and TMP for temporary.

The user shouldn't be held at blame on being caught out by some stupid MS programmer using BAK for an important file.

Almost any other extension would have been better.

But the user is certainly to blame for not learning the lesson the hard way.

It just demonstrates that any file cleaning, no matter how seemingly innocent, has cause and effect.

October 23, 2015

I would argue that was a safe assumption. but no longer.

I would argue it's NEVER been a safe assumption, I can remember it causing issues as long as I've been using computers. Admittedly not a LOT of issues, but certainly enough issues for long enough for the message to have sunk in that you can't judge a file's value by it's extension.

October 24, 2015

Revised Entries

[MS Office Unsaved Files*]
LangSecRef=3021
Detect1=HKCU\Software\Microsoft\Office\12.0
Detect2=HKCU\Software\Microsoft\Office\14.0
Detect3=HKCU\Software\Microsoft\Office\15.0
Detect4=HKCU\Software\Microsoft\Office\16.0
Default=False
FileKey1=%LocalAppData%\Microsoft\Office\UnsavedFiles|*.*|RECURSE
FileKey2=%AppData%\Microsoft\Excel|*.*|RECURSE
FileKey3=%AppData%\Microsoft\PowerPoint|*.*|RECURSE
FileKey4=%AppData%\Microsoft\Word|*.*|RECURSE

Added: FileKey2, FileKey3 & FileKey4

[MS Office Word More*]
LangSecRef=3021
Detect1=HKCU\Software\Microsoft\Office\12.0
Detect2=HKCU\Software\Microsoft\Office\14.0
Detect3=HKCU\Software\Microsoft\Office\15.0
Detect4=HKCU\Software\Microsoft\Office\16.0
Default=False
RegKey1=HKCU\Software\Microsoft\Office\15.0\Word\Reading Locations
RegKey2=HKCU\Software\Microsoft\Office\16.0\Word\Reading Locations
FileKey1=%Documents%|~*.doc|RECURSE
ExcludeKey1=FILE|%AppData%\Microsoft\Word\listgal.dat
ExcludeKey2=PATH|%AppData%\Microsoft\Word\STARTUP

Removed %AppData%\Microsoft\Word|*.*|RECURSE from this entry and added into [MS Office Unsaved Files*].

October 24, 2015

New Entry

[MS Office Recent Templates*]
LangSecRef=3021
Detect1=HKCU\Software\Microsoft\Office\12.0
Detect2=HKCU\Software\Microsoft\Office\14.0
Detect3=HKCU\Software\Microsoft\Office\15.0
Detect4=HKCU\Software\Microsoft\Office\16.0
Default=False
FileKey1=%AppData%\Microsoft\Templates|*.xlt;*.xltx;*.pot;*.potx;*.dot;*.dotx
RegKey1=HKCU\SOFTWARE\Microsoft\Office\12.0\Common\OfficeStart\Web\Templates
RegKey2=HKCU\SOFTWARE\Microsoft\Office\12.0\Excel\Recent Templates
RegKey3=HKCU\SOFTWARE\Microsoft\Office\12.0\PowerPoint\Recent Templates
RegKey4=HKCU\SOFTWARE\Microsoft\Office\12.0\Word\Recent Templates
RegKey5=HKCU\SOFTWARE\Microsoft\Office\14.0\Common\OfficeStart\Web\Templates
RegKey6=HKCU\SOFTWARE\Microsoft\Office\14.0\Excel\Recent Templates
RegKey7=HKCU\SOFTWARE\Microsoft\Office\14.0\PowerPoint\Recent Templates
RegKey8=HKCU\SOFTWARE\Microsoft\Office\14.0\Word\Recent Templates
RegKey9=HKCU\SOFTWARE\Microsoft\Office\15.0\Common\OfficeStart\Web\Templates
RegKey10=HKCU\SOFTWARE\Microsoft\Office\15.0\Excel\Recent Templates
RegKey11=HKCU\SOFTWARE\Microsoft\Office\15.0\PowerPoint\Recent Templates
RegKey12=HKCU\SOFTWARE\Microsoft\Office\15.0\Word\Recent Templates
RegKey13=HKCU\SOFTWARE\Microsoft\Office\16.0\Common\OfficeStart\Web\Templates
RegKey14=HKCU\SOFTWARE\Microsoft\Office\16.0\Excel\Recent Templates
RegKey15=HKCU\SOFTWARE\Microsoft\Office\16.0\PowerPoint\Recent Templates
RegKey16=HKCU\SOFTWARE\Microsoft\Office\16.0\Word\Recent Templates

October 25, 2015

Revised Entry

Changed: DetectFile to Detect

[Apple MobileSync Backup*]
LangSecRef=3023
Detect=HKLM\Software\Apple Computer, Inc.
Warning=This will delete all your iPhone backups.
Default=False
FileKey1=%AppData%\Apple Computer\MobileSync\Backup|*.*|RECURSE

October 25, 2015

Revised Entries

Changed the Detect=HKLM\Software\Apple Computer, Inc.\ to Detect=HKLM\Software\Apple Computer, Inc.

[Apple iDevices Software Updates*]
LangSecRef=3023
Detect=HKLM\Software\Apple Computer, Inc.
Default=False
FileKey1=%AppData%\Apple Computer\iTunes|*.ipsw|RECURSE

[Apple iDevices Updater Logs*]
LangSecRef=3023
Detect=HKLM\Software\Apple Computer, Inc.
Default=False
FileKey1=%AppData%\Apple Computer\iTunes|*.log|RECURSE

October 25, 2015

Revised Entries

[MS Office Unsaved Files*]

Added: FileKey2, FileKey3 & FileKey4

[MS Office Word More*]

Removed %AppData%\Microsoft\Word|*.*|RECURSE from this entry and added into [MS Office Unsaved Files*].

you forgot to bring ExcludeKey1 and ExcludeKey2 with FileKey1 to [MS Office Unsaved Files*]

Revised Entries

[MS Office Unsaved Files*]

LangSecRef=3021

Detect1=HKCU\Software\Microsoft\Office\12.0

Detect2=HKCU\Software\Microsoft\Office\14.0

Detect3=HKCU\Software\Microsoft\Office\15.0

Detect4=HKCU\Software\Microsoft\Office\16.0

Default=False

FileKey1=%LocalAppData%\Microsoft\Office\UnsavedFiles|*.*|RECURSE

FileKey2=%AppData%\Microsoft\Excel|*.*|RECURSE

FileKey3=%AppData%\Microsoft\PowerPoint|*.*|RECURSE

FileKey4=%AppData%\Microsoft\Word|*.*|RECURSE

ExcludeKey1=FILE|%AppData%\Microsoft\Word\listgal.dat

ExcludeKey2=PATH|%AppData%\Microsoft\Word\STARTUP

ExcludeKey3=PATH|%AppData%\Microsoft\Excel\XLSTART

- add ExcludeKey 1,2,3

[MS Office Word More*]

LangSecRef=3021

Detect1=HKCU\Software\Microsoft\Office\12.0

Detect2=HKCU\Software\Microsoft\Office\14.0

Detect3=HKCU\Software\Microsoft\Office\15.0

Detect4=HKCU\Software\Microsoft\Office\16.0

Default=False

RegKey1=HKCU\Software\Microsoft\Office\15.0\Word\Reading Locations

RegKey2=HKCU\Software\Microsoft\Office\16.0\Word\Reading Locations

FileKey1=%Documents%|~*.doc;~*.docx|RECURSE

- remove ExcludeKey 1,2

- modify FileKey1

[MS Office PowerPoint More*]

LangSecRef=3021

Detect1=HKCU\Software\Microsoft\Office\12.0

Detect2=HKCU\Software\Microsoft\Office\14.0

Detect3=HKCU\Software\Microsoft\Office\15.0

Detect4=HKCU\Software\Microsoft\Office\16.0

Default=False

RegKey1=HKCU\Software\Microsoft\Office\12.0\Common\Internet|UseRWHlinkNavigation

RegKey2=HKCU\Software\Microsoft\Office\14.0\Common\Internet|UseRWHlinkNavigation

RegKey3=HKCU\Software\Microsoft\Office\15.0\Common\Internet|UseRWHlinkNavigation

RegKey4=HKCU\Software\Microsoft\Office\16.0\Common\Internet|UseRWHlinkNavigation

FileKey1=%Documents%|~*.ppt;~*.pptx|RECURSE

- add FileKey1

Winapp2.ini additions

Recommended Posts

trader5858

Link to comment

Share on other sites

hazelnut

Link to comment

Share on other sites

Tr3bg0D

Link to comment

Share on other sites

ROCKNROLL

Link to comment

Share on other sites

hazelnut

Link to comment

Share on other sites

ROCKNROLL

Link to comment

Share on other sites

Nergal

Link to comment

Share on other sites

JDPower

Link to comment

Share on other sites

Winapp2.ini

Link to comment

Share on other sites

Nergal

Link to comment

Share on other sites

embos

Link to comment

Share on other sites

siliconman01

Link to comment

Share on other sites

Winapp2.ini

Link to comment

Share on other sites

CSGalloway

Link to comment

Share on other sites

trium

Link to comment

Share on other sites

mta

Link to comment

Share on other sites

Andavari

Link to comment

Share on other sites

JDPower

Link to comment

Share on other sites

mta

Link to comment

Share on other sites

JDPower

Link to comment

Share on other sites

SMalik

Link to comment

Share on other sites

SMalik

Link to comment

Share on other sites

SMalik

Link to comment

Share on other sites

SMalik

Link to comment

Share on other sites

dvdbane

Link to comment

Share on other sites

Browse

Activity

Home