SMalik 0 Posted August 4, 2018 Share Posted August 4, 2018 New Entry This is a new program for both Android and iOS. [Wondershare dr.fone *] LangSecRef=3021 DetectFile=%ProgramFiles%\Wondershare\drfone Default=False FileKey1=%CommonAppData%\Wondershare\dr.fone\log|*.*|RECURSE FileKey2=%CommonAppData%\Wondershare\WAF\Log|*.*|RECURSE FileKey3=%CommonAppData%\Wondershare\WAF\ProductFeatures\*Logs|*.*|RECURSE FileKey4=%CommonAppData%\Wondershare\WSRoot|*.tmp FileKey5=%CommonAppData%\Wondershare\WSRoot\Logs|*.*|RECURSE Link to post Share on other sites
APMichael 0 Posted August 5, 2018 Share Posted August 5, 2018 Winapp2.ini updates:https://github.com/MoscaDotTo/Winapp2/commit/3a45cbf50d745037c45e4b4b96680722cd3475bdhttps://github.com/MoscaDotTo/Winapp2/commit/0a6ff0803b353539c44770bd7aaad5238bcb093a Link to post Share on other sites
siliconman01 0 Posted August 27, 2018 Share Posted August 27, 2018 Modified entry: [Dell Installation Files *] Deleted DetectFile and added Detect1 and Detect2 [Dell Installation Files *] LangSecRef=3024 Detect1=HKCU\Software\Dell Detect2=HKLM\Software\Dell Default=False Warning=This will delete your Dell installation files. FileKey1=%SystemDrive%\dell|*.*|REMOVESELF Link to post Share on other sites
APMichael 0 Posted August 28, 2018 Share Posted August 28, 2018 Winapp2.ini updates:https://github.com/MoscaDotTo/Winapp2/commit/043ba42e0fa0b94c3d1c772ad3f5a28a102833b6https://github.com/MoscaDotTo/Winapp2/commit/9dd627fc8ece26aabec47fd80c12d756a2f19ab2 Link to post Share on other sites
SMalik 0 Posted September 20, 2018 Share Posted September 20, 2018 Revised Entry Added: FileKey2=%AppData%\Microsoft\Office|*.tmp [MS Office *] LangSecRef=3021 Detect1=HKCU\Software\Microsoft\Office\12.0\Common Detect2=HKCU\Software\Microsoft\Office\14.0\Common Detect3=HKCU\Software\Microsoft\Office\15.0\Common Detect4=HKCU\Software\Microsoft\Office\16.0\Common Default=False FileKey1=%AppData%\Microsoft\Document Building Blocks|*.*|RECURSE FileKey2=%AppData%\Microsoft\Office|*.tmp FileKey3=%AppData%\Microsoft\OIS|Toolbars.dat FileKey4=%AppData%\Microsoft\UProof|*.bin;*.XML FileKey5=%CommonAppData%\Microsoft\ClickToRun\ProductReleases|*.*|RECURSE FileKey6=%Documents%|~*.ppt;~*.pptx;~*.doc;~*.docx|RECURSE FileKey7=%LocalAppData%\Microsoft Help|*.* FileKey8=%LocalAppData%\Microsoft\Office\*|OneNoteOfflineCache.onecache FileKey9=%LocalAppData%\Microsoft\Office\*\OfficeFileCache|*.*|RECURSE FileKey10=%LocalAppData%\Microsoft\OneNote\*|OneNoteOfflineCache.onecache FileKey11=%LocalAppData%\Microsoft\OneNote\*\OneNoteOfflineCache_Files|*.*|RECURSE FileKey12=%SystemDrive%|propfix.log RegKey1=HKCU\Software\Microsoft\Office\11.0\MSE|LastLoadedSolution RegKey2=HKCU\Software\Microsoft\Office\11.0\MSE\FileMRUList RegKey3=HKCU\Software\Microsoft\Office\11.0\MSE\ProjectMRUList RegKey4=HKCU\Software\Microsoft\Office\11.0\MSE\SolutionMRUList RegKey5=HKCU\Software\Microsoft\Office\12.0\Common\Internet|UseRWHlinkNavigation RegKey6=HKCU\Software\Microsoft\Office\12.0\Word\Reading Locations RegKey7=HKCU\Software\Microsoft\Office\14.0\Common\Internet|UseRWHlinkNavigation RegKey8=HKCU\Software\Microsoft\Office\14.0\Word\Reading Locations RegKey9=HKCU\Software\Microsoft\Office\15.0\Common\Internet|UseRWHlinkNavigation RegKey10=HKCU\Software\Microsoft\Office\15.0\Word\Reading Locations RegKey11=HKCU\Software\Microsoft\Office\16.0\Common\Internet|UseRWHlinkNavigation RegKey12=HKCU\Software\Microsoft\Office\16.0\Word\Reading Locations RegKey13=HKCU\Software\Microsoft\Office\Common|FontBmpCache RegKey14=HKCU\Software\Microsoft\OfficeCustomizeWizard\12.0\RecentFileList RegKey15=HKCU\Software\Microsoft\OfficeCustomizeWizard\14.0\RecentFileList RegKey16=HKCU\Software\Microsoft\OfficeCustomizeWizard\15.0\RecentFileList RegKey17=HKCU\Software\Microsoft\OfficeCustomizeWizard\16.0\RecentFileList Link to post Share on other sites
SMalik 0 Posted September 20, 2018 Share Posted September 20, 2018 Revised Entry Added: FileKey6=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\UrlBlock|*.tmp [Microsoft Edge *] LangSecRef=3022 Detect=HKCU\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe DetectFile=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe Default=False FileKey1=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!00*\INetCookies|*.*|RECURSE FileKey2=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!00*\Microsoft\Cryptnet*Cache|*.*|RECURSE FileKey3=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!00*\MicrosoftEdge\Cookies|*.*|RECURSE FileKey4=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\Microsoft\Cryptnet*Cache|*.*|RECURSE FileKey5=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\Cookies|*.*|RECURSE FileKey6=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\UrlBlock|*.tmp FileKey7=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\User\Default\Datastore\Data\nouser1\*\Favorites|*.ico FileKey8=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\User\Default\DataStore\Indexed\Data\nouser1\*|*.*|RECURSE FileKey9=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\User\Default\ImageStore|*.*|RECURSE FileKey10=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\Temp|*.*|RECURSE FileKey11=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AppData\User\Default\Indexed DB|*.*|RECURSE FileKey12=%UserProfile%\MicrosoftEdgeBackups\backups\*|*.*|REMOVESELF Link to post Share on other sites
SMalik 0 Posted September 20, 2018 Share Posted September 20, 2018 I think we should add the removing of Google Chrome .old files. Link to post Share on other sites
Moderators Nergal 0 Posted September 20, 2018 Moderators Share Posted September 20, 2018 59 minutes ago, SMalik said: FileKey6=%Documents%|~*.ppt;~*.pptx;~*.doc;~*.docx|RECURSE Am I reading this wrong, or does this delete documents? Link to post Share on other sites
SMalik 0 Posted September 20, 2018 Share Posted September 20, 2018 30 minutes ago, Nergal said: Am I reading this wrong, or does this delete documents? This looks dangerous. I didn't provide this. I provided FileKey2 Link to post Share on other sites
Moderators Nergal 0 Posted September 20, 2018 Moderators Share Posted September 20, 2018 11 minutes ago, SMalik said: This looks dangerous. I didn't provide this. I provided FileKey2 I agree, @APMichael can we have that line excised. Unless someone else can speak up for it. Link to post Share on other sites
CSGalloway 0 Posted September 20, 2018 Share Posted September 20, 2018 That line removes ~*.ppt; ~*.pptx; ~*.doc ;~*.docx from the documents folder - they are basiclaly temporary files left after MS Office / word or similar crashes.... Link to post Share on other sites
Moderators Nergal 0 Posted September 20, 2018 Moderators Share Posted September 20, 2018 11 minutes ago, CSGalloway said: That line removes ~*.ppt; ~*.pptx; ~*.doc ;~*.docx from the documents folder - they are basiclaly temporary files left after MS Office / word or similar crashes.... Oh I see I missed the ~ . Yeah ok I know those are temps @APMichael never mind Link to post Share on other sites
Moderators Andavari 1 Posted September 21, 2018 Moderators Share Posted September 21, 2018 12 hours ago, SMalik said: I think we should add the removing of Google Chrome .old files. I've been doing that for years with SRWare Iron Portable using this: FileKey3=%SystemDrive%\PortableApps\IronPortable|*.old|RECURSE Link to post Share on other sites
Moderators Andavari 1 Posted September 21, 2018 Moderators Share Posted September 21, 2018 13 hours ago, SMalik said: Revised Entry Added: FileKey6=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\UrlBlock|*.tmp [Microsoft Edge *] LangSecRef=3022 Note that for the LangSecRef Edge has a number for that now: 3005 = Microsoft Edge So that would be: LangSecRef=3005 And thank you for posting that cleaner, it removed allot of additional junk from Edge on my laptop! Link to post Share on other sites
APMichael 0 Posted September 21, 2018 Share Posted September 21, 2018 17 hours ago, SMalik said: I think we should add the removing of Google Chrome .old files. Thank you for your revised entries. The entry [Logs *] should remove those .old files already: FileKey23=%LocalAppData%\Google\Chrome*\User Data\*|*LOG.*;Log;*.log;*.old|RECURSE Link to post Share on other sites
SMalik 0 Posted September 21, 2018 Share Posted September 21, 2018 4 hours ago, APMichael said: Thank you for your revised entries. The entry [Logs *] should remove those .old files already: FileKey23=%LocalAppData%\Google\Chrome*\User Data\*|*LOG.*;Log;*.log;*.old|RECURSE It does not remove these files because of the ExcludeKey's. ExcludeKey45=PATH|%LocalAppData%\Google\Chrome*\User Data\*\*Settings\|*.* ExcludeKey46=PATH|%LocalAppData%\Google\Chrome*\User Data\*\Extensions\|*.* ExcludeKey47=PATH|%LocalAppData%\Google\Chrome*\User Data\*\File System\|*.* ExcludeKey48=PATH|%LocalAppData%\Google\Chrome*\User Data\*\Local Storage\leveldb\|*.* I remember removing *LOG.*;Log;*.log files from the exclude keys locations would break some Chrome extensions like Adblock Plus. Today, I removed all of the exclude keys and ran CCleaner. It deleted all of the *LOG.*;Log;*.log files from the exclude keys locations. All of the extensions are working fine. I recommend removing all of exclude keys from this entry. Link to post Share on other sites
SMalik 0 Posted September 21, 2018 Share Posted September 21, 2018 Revised Entry Added: %WinDir%\Logs\waasmedic|*.*|RECURSE https://www.thewindowsclub.com/windows-update-medic-service [Windows Update *] LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\WindowsUpdate Default=False FileKey1=%WinDir%\Logs\waasmedic|*.*|RECURSE FileKey2=%WinDir%\Logs\WindowsUpdate|*.*|RECURSE FileKey3=%WinDir%\SoftwareDistribution\DataStore\Logs|*.*|RECURSE Link to post Share on other sites
siliconman01 0 Posted September 22, 2018 Share Posted September 22, 2018 9 hours ago, SMalik said: Revised Entry Added: %WinDir%\Logs\waasmedic|*.*|RECURSE https://www.thewindowsclub.com/windows-update-medic-service [Windows Update *] LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\WindowsUpdate Default=False FileKey1=%WinDir%\Logs\waasmedic|*.*|RECURSE FileKey2=%WinDir%\Logs\WindowsUpdate|*.*|RECURSE FileKey3=%WinDir%\SoftwareDistribution\DataStore\Logs|*.*|RECURSE I do believe that the %WinDir%\Logs|waasmedic folder is typically a locked folder and CCleaner will not be able to clean it unless the user "Takes Ownership" of the folder. And as you know, that ownership will return to Windows when various Windows Updates are run. Link to post Share on other sites
APMichael 0 Posted September 22, 2018 Share Posted September 22, 2018 19 hours ago, SMalik said: It does not remove these files because of the ExcludeKey's... Thanks for the hint! 19 hours ago, SMalik said: I remember removing *LOG.*;Log;*.log files from the exclude keys locations would break some Chrome extensions like Adblock Plus. Today, I removed all of the exclude keys and ran CCleaner. It deleted all of the *LOG.*;Log;*.log files from the exclude keys locations. All of the extensions are working fine. I recommend removing all of exclude keys from this entry. I don't use Chrome, therefore I can't test it. I will wait 2-3 days before updating Winapp2.ini, because maybe someone will object. 7 hours ago, siliconman01 said: I do believe that the %WinDir%\Logs|waasmedic folder is typically a locked folder and CCleaner will not be able to clean it unless the user "Takes Ownership" of the folder. And as you know, that ownership will return to Windows when various Windows Updates are run. I can confirm this. CCleaner can't remove the files. Link to post Share on other sites
SMalik 0 Posted September 23, 2018 Share Posted September 23, 2018 Revised Entry Added: %CommonAppData%\Microsoft\Windows Defender\Definition Updates\Backup|*.*|RECURSE [Windows Defender *] LangSecRef=3024 Detect=HKLM\Software\Microsoft\Windows Defender Default=False FileKey1=%CommonAppData%\Microsoft\Windows Defender\Definition Updates\Backup|*.*|RECURSE FileKey2=%CommonAppData%\Microsoft\Windows Defender\Network Inspection System\Support|*.txt FileKey3=%CommonAppData%\Microsoft\Windows Defender\Scans|*.bin* FileKey4=%CommonAppData%\Microsoft\Windows Defender\Scans\History\CacheManager|*.*|RECURSE FileKey5=%CommonAppData%\Microsoft\Windows Defender\Scans\History\ReportLatency\Latency|*.*|RECURSE FileKey6=%CommonAppData%\Microsoft\Windows Defender\Scans\History\Service|*.log FileKey7=%CommonAppData%\Microsoft\Windows Defender\Scans\MetaStore|*.*|RECURSE FileKey8=%CommonAppData%\Microsoft\Windows Defender\Support|*.*|RECURSE Link to post Share on other sites
SMalik 0 Posted September 23, 2018 Share Posted September 23, 2018 Revised Entry Added: %WinDir%\System32\LogFiles\setupcln|*.*|RECURSE %WinDir%\System32\LogFiles\WMI|*.*|RECURSE [Windows Logs *] LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows Default=False FileKey1=%CommonAppData%\Microsoft\Network\Downloader|*.*|RECURSE FileKey2=%CommonAppData%\Microsoft\Windows Security Health\Logs|*.*|RECURSE FileKey3=%CommonAppData%\USOShared\Logs|*.*|RECURSE FileKey4=%LocalAppData%\ConnectedDevicesPlatform|*.log FileKey5=%LocalAppData%\Diagnostics|*.*|RECURSE FileKey6=%ProgramFiles%\UNP\Logs|*.* FileKey7=%SystemDrive%\PerfLogs\System\Diagnostics|*.*|RECURSE FileKey8=%SystemDrive%\PerfLogs\System\Performance|*.*|RECURSE FileKey9=%WinDir%\debug\WIA|*.log FileKey10=%WinDir%\inf|*.log* FileKey11=%WinDir%\Logs\CBS|*.cab FileKey12=%WinDir%\Logs\dosvc|*.*|RECURSE FileKey13=%WinDir%\Logs\NetSetup|*.*|RECURSE FileKey14=%WinDir%\Logs\SIH|*.*|RECURSE FileKey15=%WinDir%\Logs\WindowsBackup|*.etl FileKey16=%WinDir%\Panther|cbs.log;DDACLSys.log;miglog.xml;Migrep.html;PostGatherPnPList.log;PreGatherPnPList.log FileKey17=%WinDir%\Panther\FastCleanup|*.log FileKey18=%WinDir%\Panther\Rollback|*.txt FileKey19=%WinDir%\Panther\UnattendGC|diagerr.xml;diagwrn.xml FileKey20=%WinDir%\repair|setup.log FileKey21=%WinDir%\security\logs|*.*|RECURSE FileKey22=%WinDir%\System32\catroot2|*.chk;*.log;*.jrs;*.txt FileKey23=%WinDir%\System32\LogFiles\HTTPERR|*.log FileKey24=%WinDir%\System32\LogFiles\Scm|*.*|RECURSE FileKey25=%WinDir%\System32\LogFiles\setupcln|*.*|RECURSE FileKey26=%WinDir%\System32\LogFiles\Srt|*.*|RECURSE FileKey27=%WinDir%\System32\LogFiles\WMI|*.*|RECURSE FileKey28=%WinDir%\System32\sysprep\Panther\IE|diagerr.xml;diagwrn.xml;*.log FileKey29=%WinDir%\System32\WDI\*|snapshot.etl|REMOVESELF FileKey30=%WinDir%\System32\WDI\LogFiles\StartupInfo|*.*|RECURSE RegKey1=HKLM\Software\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications RegKey2=HKLM\Software\Microsoft\Tracing RegKey3=HKLM\Software\Wow6432Node\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications RegKey4=HKLM\Software\Wow6432Node\Microsoft\Tracing Link to post Share on other sites
SMalik 0 Posted September 23, 2018 Share Posted September 23, 2018 Please take a look at the screenshots. I tried another program and it found some more junk files in Microsoft IE and Microsoft Edge. I think we should add these into Internet Explorer and Microsoft Edge entries. Link to post Share on other sites
Moderators Nergal 0 Posted September 23, 2018 Moderators Share Posted September 23, 2018 3 hours ago, SMalik said: Please take a look at the screenshots. I tried another program and it found some more junk files in Microsoft IE and Microsoft Edge. I think we should add these into Internet Explorer and Microsoft Edge entries. Pretty sure the first picture are dom cookies and thus are handled by ccleaner already, and the second by sessions under edge. Link to post Share on other sites
SMalik 0 Posted September 23, 2018 Share Posted September 23, 2018 1 hour ago, Nergal said: Pretty sure the first picture are dom cookies and thus are handled by ccleaner already, and the second by sessions under edge. Not all traces are being wiped. Link to post Share on other sites
Winapp2.ini 0 Posted September 23, 2018 Author Share Posted September 23, 2018 8 hours ago, SMalik said: Not all traces are being wiped. Are the files process locked? Link to post Share on other sites
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now