Jump to content
CCleaner Community Forums
Winapp2.ini

Winapp2.ini additions

Recommended Posts

I have never heard of a subkey. do you mean a value ?

 

I for one would prefer that CCleaner maintain its reputation as being safer than the common herd of registry cleaners and boosters.

It would be harmful if Piriform developers incorporated a rudimentary REG.EXE so that Winapp2.ini users have enhanced unsupervised super-killer capabilities.

 

I normally run CCleaner from a BAT script launched from a desktop short-cut.

The script first wipes out all the foreign language subdirectories that come with every Xmarks update in Firefox profile.

This script could also easily cause the merge of a previously exported and edited REG file with chosen non-zero default values.

All under user control and user responsibility.

 

Definition: A key in the Windows Registry can be thought of like a file folder. A key that sits within another key is called a "subkey". Source: http://pcsupport.about.com/od/termss/g/registy_subkey.htm

 

Microsoft recognize the term 'Subkey'. http://support.microsoft.com/kb/310516

 

You deserve a promotion from Power Member to some other higher grades.

Share this post


Link to post
Share on other sites

You deserve a promotion from Power Member to some other higher grades.

Titles like that can be edited by members themselves in their profiles after so many posts, although I don't remember how many it takes.

Share this post


Link to post
Share on other sites

Haha, that thread was charming. I read quite a bit of it.

 

So silly :P!

Share this post


Link to post
Share on other sites

Definition: A key in the Windows Registry can be thought of like a file folder. A key that sits within another key is called a "subkey."

 

http://pcsupport.about.com/od/termss/g/registy_subkey.htm

http://support.microsoft.com/kb/310516

 

You deserve a promotion from Power Member to some other higher grades.

Yes, I am happy with the definition that a key is "like a file folder".

 

Not so happy about a subkey.

I prefer Child-key because all keys are descendent of a hive, and each key can have a parent and also its own set of children.

I believe I can do what I like to any key regardless of its position in a family tree, subject only to access restrictions.

 

I asked because I was confused by these two statements :-

"The paths listed above have diff. subkeys each time. I didn't want to delete the CpMRU, PageSetup, PropertyStore and Stats keys but, there is no option to delete subkeys."

and

"I didn't want to delete the Cached key itself I wanted to delete all the values on pane but, there was no option to do that."

 

I have not tried to get CCleaner to delete registry values and will accept that CCleaner cannot.

So far as I am concerned it is possible to delete any subkey.

Been there, Done that.

My experience is that CCleaner also has that capability where write/delete access is allowed,

hence I wondered if you were referring to the same thing when saying "there is no option to delete subkeys" and "wanted to delete all the values".

 

N.B.

I quite fancy the title "Registry Death Dealer"

 

When I needed to update Comodo Firewall with a clean install the initial uninstall left a family of 2000 registry keys behind.

Totally inaccessible and unremoveable, and blocking the intended upgrade.

RegEdit could not touch them.

They never saw me coming - zapped in 5 minutes (including making ERUNT backups just in-case).

 

I could tell you how I did that - but I fear a moderator would take me out ! !

Share this post


Link to post
Share on other sites

MODIFIED ENTRIES

 

[Cached WPF Fonts*]

LangSecRef=3025

DetectFile=%windir%\ServiceProfiles\LocalService\AppData\Local

Default=False

FileKey1=%windir%\ServiceProfiles\LocalService\AppData\Local|*.dat

 

[CleanMyPC Registry Cleaner (Backups)*]

LangSecRef=3024

DetectFile=%ProgramFiles%\CleanMyPC\Registry Cleaner\rcleaner.exe

Default=False

FileKey1=%AppData%\CleanMyPC Software\CleanMyPC Registry Cleaner\UndoCenter|*.*

FileKey2=%AppData%\CleanMyPC Software\CleanMyPC Registry Cleaner|fixlog.ini

FileKey3=%WinDir%\$regcmp$|*.*|REMOVESELF

 

[iTunes Logs*]

LangSecRef=3023

DetectFile=%AppData%\Apple Computer\iTunes

Default=False

FileKey1=%AppData%\Apple Computer\Logs|*.log

FileKey2=%WinDir%\system32\config\systemprofile\AppData\Roaming\Apple Computer\Logs|*.log

 

[skype More*]

LangSecRef=3022

DetectFile=%AppData%\Skype

Default=False

FileKey1=%AppData%\Skype|*.lck

FileKey2=%AppData%\Skype\*\chatsync|*.*|RECURSE

FileKey3=%AppData%\Skype\*|main.db

 

[snagit 9 More*]

LangSecRef=3024

Detect=HKCU\Software\TechSmith\SnagIt\9

Default=False

FileKey1=%LocalAppData%\TechSmith\Snagit\DataStore|*.*

FileKey2=%LocalAppData%\TechSmith\Snagit\DataStore\AppIcons|*.*

FileKey3=%LocalAppData%\TechSmith\Snagit\DataStore\WebSiteIcons|*.*

FileKey4=%LocalAppData%\TechSmith\SnagIt\Thumbnails|*.*

 

[snagit 10 More*]

LangSecRef=3024

Detect=HKCU\Software\TechSmith\SnagIt\10

Default=False

FileKey1=%LocalAppData%\TechSmith\Snagit\DataStore|*.*

FileKey2=%LocalAppData%\TechSmith\Snagit\DataStore\AppIcons|*.*

FileKey3=%LocalAppData%\TechSmith\Snagit\DataStore\WebSiteIcons|*.*

FileKey4=%LocalAppData%\TechSmith\SnagIt\Thumbnails|*.*

 

==============================

 

NEW ENTRIES

 

[Acrobat Distiller 10*]

LangSecRef=3021

DetectFile=%AppData%\Adobe\Acrobat\Distiller 10

Default=False

FileKey1=%AppData%\Adobe\Acrobat\Distiller 10|messages.log

 

[Diagnostics Logs*]

LangSecRef=3025

DetectFile=%WinDir%\debug

Default=False

FileKey1=%WinDir%\debug\WIA|wiatrace.log

FileKey2=%WinDir%\debug|PASSWD.log

 

[setup Logs*]

LangSecRef=3025

DetectFile=%WinDir%

Default=False

FileKey1=%WinDir%\inf|setupapi.app.log

FileKey2=%WinDir%\inf|setupapi.dev.log

FileKey3=%WinDir%\Panther\UnattendGC|setupact.log

FileKey4=%WinDir%\Panther\UnattendGC|setuperr.log

FileKey5=%WinDir%\Panther|setupact.log

FileKey6=%WinDir%\Panther|setuperr.log

 

==============================

 

Can we replace [eHome Logs*] and [eHome Playlist Cache*] entries with the entry listed here?

 

[Windows Media Center*]

LangSecRef=3023

DetectFile=%CommonAppData%\Microsoft\eHome

Default=False

FileKey1=%CommonAppData%\Microsoft\eHome\logs|*.*

FileKey2=%LocalAppData%\Microsoft\eHome|playlistcache.db

Share this post


Link to post
Share on other sites

I see [adobe flashplayer more*] was removed from Winapp2. Shouldn't these be removed anymore?:

 

 

C:\Documents and Settings\Kerry Kastelic\Application Data\Macromedia\Flash Player\#SharedObjects

C:\Documents and Settings\Kerry Kastelic\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys

 

 

Also right after [Opera More*] in Winapp2.ini, it gets out of order chronologically. Goes from O's back to C listings.

Share this post


Link to post
Share on other sites

[Cached Fonts*]
LangSecRef=3025
Default=False
FileKey1=%WinDir%\System32|FNTCACHE.DAT

[Cached GDI+ Fonts*]
LangSecRef=3025
Default=False
FileKey1=%LocalAppData%|GDIPFONTCACHEV1.DAT

[Cached WPF Fonts*]
LangSecRef=3025
DetectFile=%windir%\ServiceProfiles\LocalService\AppData\Local
Default=False
FileKey1=%windir%\ServiceProfiles\LocalService\AppData\Local|FontCache3.0.0.0.dat

 

ARE out of place, you're right!

 

 

[Crash Reports*]
LangSecRef=3026
DetectFile=%AppData%\Mozilla\FireFox\Crash Reports\
Default=False
FileKey1=%AppData%\Mozilla\FireFox\Crash Reports\pending|*.*
FileKey2=%AppData%\Mozilla\FireFox\Crash Reports\submitted|*.*
FileKey3=%AppData%\Mozilla\FireFox\Crash Reports|*.*

[Dump Files*]
LangSecRef=3026
DetectFile=%AppData%\Mozilla\Firefox
Default=False
FileKey1=%AppData%\Mozilla|*.dmp|RECURSE

[Firefox Updates*]
LangSecRef=3026
DetectFile=%LocalAppData%\Mozilla\Firefox
Default=False
FileKey1=%LocalAppData%\Mozilla\Firefox\updates|*.log

[Minefield Updates*]
LangSecRef=3026
DetectFile=%LocalAppData%\Mozilla\Firefox\minefield
Default=False
FileKey1=%LocalAppData%\Mozilla\Firefox\minefield\updates|*.log

[TestPilot Error Logs*]
LangSecRef=3026
DetectFile=%AppData%\Mozilla\FireFox\Profiles
Default=False
FileKey1=%AppData%\Mozilla\FireFox\Profiles|TestPilotErrorLog.*|RECURSE

 

are not out of place, they're all there with an imaginary "Mozilla" prefixed before each of them. No use actually putting it there since they're under LangSecRef 3026

Share this post


Link to post
Share on other sites
are not out of place, they're all there with an imaginary "Mozilla" prefixed before each of them. No use actually putting it there since they're under LangSecRef 3026

 

Oh, ok. I know they're under LangSecRef 3026, but for a better flow for all the entrys before and after, if Mozilla Firefox was added to the names? (i.e. Mozilla Firefox Crash Reports, Mozilla Firefox Dump Files)

 

Also, shouldn't Octoshape and Opera More* be with the O's?

 

 

[Octoshape*]
LangSecRef=3023
DetectFile=%LocalAppData%\Octoshape\Octoshape Streaming Services
Default=False
FileKey1=%LocalAppData%\Octoshape\Octoshape Streaming Services\temp|*.*

[Opera More*]
LangSecRef=3027
Detect=HKLM\SOFTWARE\Opera Software
Default=False
FileKey1=%LocalAppData%\Opera\Opera\icons|*.*|REMOVESELF
FileKey2=%LocalAppData%\Opera\Opera\thumbnails|*.*|REMOVESELF
FileKey3=%LocalAppData%\Opera\Opera\vps|*.*|REMOVESELF
FileKey4=%LocalAppData%\Opera\Opera\temporary_downloads|*.*|REMOVESELF

[Cached Fonts*]
LangSecRef=3025
Default=False
FileKey1=%WinDir%\System32|FNTCACHE.DAT

[Cached GDI+ Fonts*]
LangSecRef=3025
Default=False
FileKey1=%LocalAppData%|GDIPFONTCACHEV1.DAT

[Cached WPF Fonts*]
LangSecRef=3025
DetectFile=%windir%\ServiceProfiles\LocalService\AppData\Local
Default=False
FileKey1=%windir%\ServiceProfiles\LocalService\AppData\Local|FontCache3.0.0.0.dat

[Crash Reports*]
LangSecRef=3026
DetectFile=%AppData%\Mozilla\FireFox\Crash Reports\
Default=False
FileKey1=%AppData%\Mozilla\FireFox\Crash Reports\pending|*.*
FileKey2=%AppData%\Mozilla\FireFox\Crash Reports\submitted|*.*
FileKey3=%AppData%\Mozilla\FireFox\Crash Reports|*.*

[Dump Files*]
LangSecRef=3026
DetectFile=%AppData%\Mozilla\Firefox
Default=False
FileKey1=%AppData%\Mozilla|*.dmp|RECURSE

[Firefox Updates*]
LangSecRef=3026
DetectFile=%LocalAppData%\Mozilla\Firefox
Default=False
FileKey1=%LocalAppData%\Mozilla\Firefox\updates|*.log

[Minefield Updates*]
LangSecRef=3026
DetectFile=%LocalAppData%\Mozilla\Firefox\minefield
Default=False
FileKey1=%LocalAppData%\Mozilla\Firefox\minefield\updates|*.log

Share this post


Link to post
Share on other sites

Yep. Seems like over time, as the "M" section expanded, it ate the old O section :lol:

Share this post


Link to post
Share on other sites

re: [Windows Live Messenger More*]

 

FileKey8=%ProgramFiles%\Common Files\Windows Live\.cache|*.*|RECURSE

FileKey9=%LocalLowAppData%\Microsoft\Windows Live\Setup|*.*|RECURSE

 

These two lines cause Windows Live Messenger and WLMAil not to be able to be removed. At least for the WinXP version.

 

Is there a Windows XP user who has WL Mail installed who wouldn't mind uploading the contents of the two folders to a website so I can uninstall mine? There will be no privacy issues here.....

 

 

 

 

Share this post


Link to post
Share on other sites

re: [Windows Live Messenger More*]

 

FileKey8=%ProgramFiles%\Common Files\Windows Live\.cache|*.*|RECURSE

FileKey9=%LocalLowAppData%\Microsoft\Windows Live\Setup|*.*|RECURSE

 

These two lines cause Windows Live Messenger and WLMAil not to be able to be removed. At least for the WinXP version.

 

Is there a Windows XP user who has WL Mail installed who wouldn't mind uploading the contents of the two folders to a website so I can uninstall mine? There will be no privacy issues here.....

I have WLM installed on WinXP... what do you need? :)

 

AppData\LocalLow doesn't exist on WinXP. But I see it on my Win7 laptop - The Setup folder is empty and so is the tmp subfolder.

 

post-37617-0-86615100-1312850839_thumb.jpg

 

I've got the contents of the .cache folder zipped - a little over 23MB. The msi's don't compact much. Let me know if that is what you want.

Share this post


Link to post
Share on other sites
I see [adobe flashplayer more*] was removed from Winapp2. Shouldn't these be removed anymore?:

 

 

C:\Documents and Settings\Kerry Kastelic\Application Data\Macromedia\Flash Player\#SharedObjects

C:\Documents and Settings\Kerry Kastelic\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys

 

So whats the scoop guys?? Delete or not delete?

Share this post


Link to post
Share on other sites

I have WLM installed on WinXP... what do you need? :)

 

AppData\LocalLow doesn't exist on WinXP. But I see it on my Win7 laptop - The Setup folder is empty and so is the tmp subfolder.

 

post-37617-0-86615100-1312850839_thumb.jpg

 

I've got the contents of the .cache folder zipped - a little over 23MB. The msi's don't compact much. Let me know if that is what you want.

 

I found http://www.vistapcguy.net/?p=173 which says that locallowappdatya is valid for vista so it would be nice if %LocalLowAppData% was docuents in the first post of this thread.

 

I did find a zapmessenger.exe that removed WLMessenger so was hoping to find someone who could send me compressed copies of the follwing folders on their system:

 

FileKey8=%ProgramFiles%\Common Files\Windows Live\.cache|*.*|RECURSE

FileKey9=%LocalAppData%\Microsoft\Windows Live\Setup|*.*|RECURSE

 

call the first one PF.zip and the 2nd one LAD.zip - then tell me the web addresses of =where they are stored. I'll download them and go from there.

Share this post


Link to post
Share on other sites

I made some entry's for some AnvSoft Products.

 

[AnvSoft*]
LangSecRef=3023
Detect=HKCU\Software\AnvSoft
Default=False
FileKey1=%AppData%\AnvSoft\Any Audio Converter|*.*
FileKey2=%AppData%\AnvSoft\Any DVD Converter Professional|*.*
FileKey3=%AppData%\AnvSoft\Any Video Converter|*.*


[AnvSoft(Logs)*]
LangSecRef=3023
Detect=HKCU\Software\AnvSoft
Default=False
FileKey1=%AppData%\AnvSoft\Any Audio Converter|*.log
FileKey2=%AppData%\AnvSoft\Any DVD Converter Professional|*.log
FileKey3=%AppData%\AnvSoft\Any Video Converter|*.log

[AnvSoft(Database)*]
LangSecRef=3023
Detect=HKCU\Software\AnvSoft
Default=False
FileKey1=%AppData%\AnvSoft\Any Audio Converter|*.db
FileKey2=%AppData%\AnvSoft\Any DVD Converter Professional|*.db
FileKey3=%AppData%\AnvSoft\Any Video Converter|*.db

 

 

The first one deletes everything, the second one deletes just the logs, and the lasts gets rid of the database. ***Warning*** deleting the database slows the programs(adds a few seconds) load time, as it has to rebuild the database.

Share this post


Link to post
Share on other sites

I found http://www.vistapcguy.net/?p=173 which says that locallowappdatya is valid for vista so it would be nice if %LocalLowAppData% was docuents in the first post of this thread.

 

I did find a zapmessenger.exe that removed WLMessenger so was hoping to find someone who could send me compressed copies of the follwing folders on their system:

 

FileKey8=%ProgramFiles%\Common Files\Windows Live\.cache|*.*|RECURSE

FileKey9=%LocalAppData%\Microsoft\Windows Live\Setup|*.*|RECURSE

 

call the first one PF.zip and the 2nd one LAD.zip - then tell me the web addresses of =where they are stored. I'll download them and go from there.

 

Here's the link for the .cache PF.zip: http://www.sendspace.com/file/resisw

 

I couldn't find the Setup location on WinXP.

Share this post


Link to post
Share on other sites

Here's the link for the .cache PF.zip: http://www.sendspace.com/file/resisw

 

I couldn't find the Setup location on WinXP.

 

 

Do you have a:

 

%userprofile%\Local Settings\Application Data\Microsoft\Windows Live\Setup

 

folder? If so that is what I will also need. and a HUGE thank you for PF.ZIP too

Share this post


Link to post
Share on other sites

Do you have a:

 

%userprofile%\Local Settings\Application Data\Microsoft\Windows Live\Setup

 

folder? If so that is what I will also need. and a HUGE thank you for PF.ZIP too

No Setup subfolder. The only thing there is:

 

%userprofile%\Local Settings\Application Data\Microsoft\Windows Live\SqmApi

 

The SqmApi folder is empty.

Share this post


Link to post
Share on other sites

This code cleans up after a registry defrag via TuneUp Utilities 2011.

 

[TuneUp Utilities 2011 Reg Defrag Cleanup*]
LangSecRef=3024
Detect=HKCU\Software\TuneUp\Utilities\10.0
Default=False
FileKey1=%WinDir%\System32\config\|SECURITY_tureg_old
FileKey2=%WinDir%\System32\config\|SOFTWARE_tureg_old
FileKey3=%WinDir%\System32\config\|SYSTEM_tureg_old
FileKey4=%WinDir%\System32\config\|DEFAULT_tureg_new.LOG1
FileKey5=%WinDir%\System32\config\|DEFAULT_tureg_new.LOG2
FileKey6=%WinDir%\System32\config\|SAM_tureg_new.LOG1
FileKey7=%WinDir%\System32\config\|SAM_tureg_new.LOG2
FileKey8=%WinDir%\System32\config\|SECURITY_tureg_new.LOG1
FileKey9=%WinDir%\System32\config\|SECURITY_tureg_new.LOG2
FileKey10=%WinDir%\System32\config\|SOFTWARE_tureg_new.LOG1
FileKey11=%WinDir%\System32\config\|SOFTWARE_tureg_new.LOG2
FileKey12=%WinDir%\System32\config\|SYSTEM_tureg_new.LOG1
FileKey13=%WinDir%\System32\config\|SYSTEM_tureg_new.LOG2
FileKey14=%WinDir%\System32\config\|DEFAULT_tureg_old
FileKey15=%WinDir%\System32\config\|SAM_tureg_old
FileKey16=%WinDir%\ServiceProfiles\LocalService\|NTUSER.DAT_tureg_old
FileKey17=%WinDir%\ServiceProfiles\LocalService\|NTUSER.DAT_tureg_new.LOG1
FileKey18=%WinDir%\ServiceProfiles\LocalService\|NTUSER.DAT_tureg_new.LOG2
FileKey19=%WinDir%\ServiceProfiles\NetworkService\|NTUSER.DAT_tureg_old
FileKey20=%WinDir%\ServiceProfiles\NetworkService\|NTUSER.DAT_tureg_new.LOG1
FileKey21=%WinDir%\ServiceProfiles\NetworkService\|NTUSER.DAT_tureg_new.LOG2
FileKey22=%USERPROFILE%\AppData\Local\Microsoft\Windows|USRCLASS.DAT_tureg_old
FileKey23=%USERPROFILE%\|NTUSER.DAT_tureg_new.LOG1
FileKey24=%USERPROFILE%\|NTUSER.DAT_tureg_new.LOG2
FileKey25=%USERPROFILE%\|NTUSER.DAT_tureg_old
FileKey26=C:\Boot\|BCD_tureg_new.LOG1
FileKey27=C:\Boot\|BCD_tureg_new.LOG2
FileKey28=C:\Boot\|BCD_tureg_old

Share this post


Link to post
Share on other sites

NEW ENTRIES

 

[Adobe Acrobat Distiller Cache*]

LangSecRef=3021

DetectFile=%AppData%\Adobe\Acrobat\Distiller 10

Default=False

FileKey1=%AppData%\Adobe\Acrobat\Distiller 10\Cache|*.*|RECURSE

 

[Paltalk Messenger*]

LangSecRef=3022

DetectFile=%ProgramFiles%\Paltalk Messenger\paltalk.exe

Default=False

FileKey1=%AppData%\Paltalk|*.*|RECURSE

 

[unity Web Player Cache*]

LangSecRef=3023

DetectFile=%LocalLowAppData%\Unity

Default=False

FileKey1=%LocalLowAppData%\Unity\Web Player\Cache|*.*|RECURSE

FileKey2=%LocalLowAppData%\Unity\WebPlayer\Cache|*.*|RECURSE

 

MODIFIED ENTRY

 

Please replace the entry listed here with [Acrobat Distiller 10*] if possible. I have corrected the name.

 

[Adobe Acrobat Distiller 10*]

LangSecRef=3021

DetectFile=%AppData%\Adobe\Acrobat\Distiller 10

Default=False

FileKey1=%AppData%\Adobe\Acrobat\Distiller 10|messages.log

Share this post


Link to post
Share on other sites

Winapp2.ini Version: v1.0.110809

 

[skype More*]

...

FileKey3=%AppData%\Skype\*|main.db

this kills my contact list!? is/was this intended?

don't like; glad I had a recent backup ...

 

otherwise: great work, thanks!

Share this post


Link to post
Share on other sites

Winapp2.ini Version: v1.0.110809

 

 

this kills my contact list!? is/was this intended?

don't like; glad I had a recent backup ...

 

otherwise: great work, thanks!

 

FileKey3=%AppData%\Skype\*|main.db

 

By deleting/wiping main.db does not effect contact list. It wipes the things listed here ONLY:

 

Chat History

Call History

 

by deleting 'config.xml' from the location listed here will delete the contact list:

 

%AppData%\Skype\*

 

Where * is Skype user account.

 

In your case where your Skype contacts were gone. If you remove the whole Skype account folder from the location listed here: %AppData%\Skype\

 

And login back to Skype, you will get your contact list back.

Share this post


Link to post
Share on other sites

MODIFIED ENTRY

 

[Adobe Acrobat Distiller 10*]

LangSecRef=3021

DetectFile=%AppData%\Adobe\Acrobat\Distiller 10

Default=False

RegKey1=HKCU\Software\Adobe\Acrobat Distiller\10.0|InPath

FileKey1=%AppData%\Adobe\Acrobat\Distiller 10|messages.log

 

 

NEW ENTRY

 

[stored Application Descriptions*]

LangSecRef=3025

Detect=HKCU\Software\Classes\Local Settings

Default=False

RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Share this post


Link to post
Share on other sites

NEW ENTRIES

 

This is for Internet Explorer 9.

 

[inPrivate Filtering Saved Addresses*]

LangSecRef=3022

DetectFile=%AppData%\Microsoft\Windows\PrivacIE

Default=False

FileKey1=%AppData%\Microsoft\Windows\PrivacIE|*.*|RECURSE

 

Many webpages use content such as advertisements, maps, or web analysis tools from websites other than the one you are visiting. InPrivate Filtering helps prevent website content providers from collecting information about sites you visit. In this index.dat file you can see web address of such content stored in your system.

 

Go to the location listed here and open index.dat file with notepad to look at youself that how much sensitive data this .dat file holds.

 

AppData\Roaming\Microsoft\Windows\PrivacIE\Low

 

 

[Malicious Software Removal Tool*]

LangSecRef=3025

DetectFile=%WinDir%\debug

Default=False

FileKey1=%WinDir%\debug|mrt.log

 

 

MODIFIED ENTRY

 

[internet Explorer More*]

LangSecRef=3022

DetectFile=%ProgramFiles%\Internet Explorer\iexplore.exe

Default=False

RegKey1=HKCU\Software\Microsoft\Internet Explorer\International|CNum_CpCache

RegKey2=HKCU\Software\Microsoft\Internet Explorer\International|CpCache

RegKey3=HKCU\Software\Microsoft\Internet Explorer\International\CpMRU

RegKey4=HKCU\Software\Microsoft\Internet Explorer\PageSetup

RegKey5=HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore

RegKey6=HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats

RegKey7=HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached

FileKey1=%LocalLowAppData%\Microsoft\CryptnetUrlCache\Content|*.*

FileKey2=%LocalLowAppData%\Microsoft\CryptnetUrlCache\MetaData|*.*

FileKey3=%AppData%\Microsoft\Internet Explorer\UserData|*.*|RECURSE

FileKey4=%AppData%\Microsoft\Windows\IECompatCache|*.*|RECURSE

FileKey5=%AppData%\Microsoft\Windows\IETldCache|*.*|RECURSE

FileKey6=%LocalAppData%\Microsoft\Internet Explorer|brndlog.*

FileKey7=%LocalAppData%\Microsoft\Internet Explorer|*iconcache.dat

FileKey8=%LocalAppData%\Microsoft\Internet Explorer\iconcache|*.*|REMOVESELF

 

In this entry I have added 2 more sensitive areas.

 

FileKey4=%AppData%\Microsoft\Windows\IECompatCache|*.*|RECURSE

FileKey5=%AppData%\Microsoft\Windows\IETldCache|*.*|RECURSE

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...

×
×
  • Create New...