APMichael Posted February 26, 2022 Share Posted February 26, 2022 Thank you for the new and revised entries and the replies. Winapp2.ini update:https://github.com/MoscaDotTo/Winapp2/commit/6431ffa146e2b25263360692068d17848e6bcd69 Winapp3.ini update:https://github.com/MoscaDotTo/Winapp2/commit/4b2777e5889fc0cb3284c74935e9c4ad367abea0 Link to comment Share on other sites More sharing options...
siliconman01 Posted February 26, 2022 Share Posted February 26, 2022 Thanks for the Update APM ! Modified entry: [Malwarebytes *] Changed the name from Malwarebytes Anti-Malware. Malwarebytes no longer refers to Malwarebytes as Malwarebytes Anti-Malware. Changed Detects to Detect1 and Detect2 Added FileKey12 to remove Malwarebytes folder left hanging after a Malwarebytes auto update. I did not remove FileKeys that are not use in most recent versions of Malwarebytes. [Malwarebytes *] LangSecRef=3024 Detect1=HKCU\Software\Malwarebytes Detect2=HKLM\Software\Malwarebytes Warning=You must manually and temporarily turn off Malwarebytes "self-protection" to remove the logs. FileKey1=%AppData%\Malwarebytes\Malwarebytes*Anti-Malware\Logs|*.* FileKey2=%CommonAppData%\Malwarebytes\Malwarebytes*Anti-Malware|mbam-setup.exe FileKey3=%CommonAppData%\Malwarebytes\Malwarebytes*Anti-Malware\Logs|*.* FileKey4=%CommonAppData%\Malwarebytes\MBAMService|*.log;*.bak;*.regtrans-ms;*.TM.blf;*-ntuser.dat;*.LOG1;*.LOG2;*-UsrClass.dat FileKey5=%CommonAppData%\Malwarebytes\MBAMService\config|*.bak FileKey6=%CommonAppData%\Malwarebytes\MBAMService\logs|*.* FileKey7=%CommonAppData%\Malwarebytes\MBAMService\ScanResults|*.* FileKey8=%CommonAppData%\Malwarebytes\MBAMService\tmp|*.* FileKey9=%LocalAppData%\Crashdumps\Malwarebytes|*.*|REMOVESELF FileKey10=%LocalAppData%\MBAM*\Cache\qmlcache|*.* FileKey11=%LocalLowAppData%\IGDump|*.*|REMOVESELF FileKey12=%SystemDrive%\Malwarebytes|*.*|REMOVESELF Windows 10 x64 Pro on ASUS Maximus VIII Extreme motherboard, i7-6700k CPU,H220 X2 Liquid Cooler, 64 gbyte RipJaws DDR4 3200 RAM, Samsung 970 Pro NVMe M.2 500 gbyte SSD + Samsung 850 Pro 512 gbyte SSD, EVGA RTX 3060 Titan graphics card (Home Built System); Windows 11x64 Pro on 512 gigabyte Dell XPS 15 2-in-1 Laptop/tablet and Dell XPS 8940 PC. ASUS RT-AC88U router, 14 tbyte WD My Cloud PR2100 NAS Server, 200 Mbps cable Internet, MS Edge Chromium, MS Office 2021 (Local), Casper 11, DisplayFusion (3 Flat Panel Displays per system): Bitdefender Internet Security 2022, Quicken, Weather Watcher Live, ThumbsPlus 10, Sticky Password 8, WD Smartware, CyberLink PowerDVD22, MSI AfterBurner, Rainmeter, Windows Sidebar, and many more. Link to comment Share on other sites More sharing options...
SMalik Posted February 27, 2022 Share Posted February 27, 2022 Snagit creates the MSI*.tmp- folders. [Windows Installer *] LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Installer FileKey1=%SystemDrive%\Config.msi|*.*|REMOVESELF FileKey2=%WinDir%\Installer|*.tmp|RECURSE FileKey3=%WinDir%\Installer|SourceHash{*};wix{*}.SchedServiceConfig.rmi FileKey4=%WinDir%\Installer\Config.Msi|*.*|REMOVESELF FileKey5=%WinDir%\Installer\MSI*.tmp-|*.*|REMOVESELF Link to comment Share on other sites More sharing options...
siliconman01 Posted February 27, 2022 Share Posted February 27, 2022 Modified entry: [DisplayFusion *] Added FileKey3 [DisplayFusion *] LangSecRef=3024 Detect=HKCU\Software\Binary Fortress Software\DisplayFusion FileKey1=%AppData%\DisplayFusion|DisplayFusionSetup.exe;DisplayFusion*.log;DebugInfo.* FileKey2=%CommonAppData%\Binary Fortress Software\DisplayFusion|DisplayFusionSetup.exe;*.log FileKey3=%LocalAppData%\DisplayFusion|*.log Windows 10 x64 Pro on ASUS Maximus VIII Extreme motherboard, i7-6700k CPU,H220 X2 Liquid Cooler, 64 gbyte RipJaws DDR4 3200 RAM, Samsung 970 Pro NVMe M.2 500 gbyte SSD + Samsung 850 Pro 512 gbyte SSD, EVGA RTX 3060 Titan graphics card (Home Built System); Windows 11x64 Pro on 512 gigabyte Dell XPS 15 2-in-1 Laptop/tablet and Dell XPS 8940 PC. ASUS RT-AC88U router, 14 tbyte WD My Cloud PR2100 NAS Server, 200 Mbps cable Internet, MS Edge Chromium, MS Office 2021 (Local), Casper 11, DisplayFusion (3 Flat Panel Displays per system): Bitdefender Internet Security 2022, Quicken, Weather Watcher Live, ThumbsPlus 10, Sticky Password 8, WD Smartware, CyberLink PowerDVD22, MSI AfterBurner, Rainmeter, Windows Sidebar, and many more. Link to comment Share on other sites More sharing options...
siliconman01 Posted February 27, 2022 Share Posted February 27, 2022 Modified entry: [DVDFab *] Added FileKey15 [DVDFab *] LangSecRef=3023 Detect1=HKCU\Software\DVDFab Detect2=HKCU\Software\DVDFab Passkey Detect3=HKCU\Software\FabPlayer FileKey1=%AppData%\DVDFab Player*\Advertis*|*.*|RECURSE FileKey2=%AppData%\DVDFab\DVDFab*\SceneData|*.*|RECURSE FileKey3=%AppData%\LiveUpdate|*.log FileKey4=%AppData%\Microsoft\Windows\Templates\Videos\Temp|*.*|RECURSE FileKey5=%Documents%\DVDFab*|*.log FileKey6=%Documents%\DVDFab*\Log|*.*|RECURSE FileKey7=%Documents%\DVDFab*\SceneData|*.*|RECURSE FileKey8=%Documents%\DVDFab*\Temp|*.*|RECURSE FileKey9=%Documents%\DVDFab\DVDFab*\Cinavia|*.*|RECURSE FileKey10=%Documents%\DVDFab\DVDFab*\Log|*.*|RECURSE FileKey11=%Documents%\DVDFab\DVDFab*\Temp|*.*|RECURSE FileKey12=%Documents%\DVDFab\updateLog|*.*|REMOVESELF FileKey13=%Documents%\LiveUpdate|*.*|REMOVESELF FileKey14=%Documents%\PcSetup|*.*|RECURSE FileKey15=%LocalAppData%\DVDFab*\cache\QtWebEngine\Default\Cache|*.* RegKey1=HKCU\Software\FabPlayer|DefaultDir RegKey2=HKCU\Software\FabPlayer|DefaultFile Windows 10 x64 Pro on ASUS Maximus VIII Extreme motherboard, i7-6700k CPU,H220 X2 Liquid Cooler, 64 gbyte RipJaws DDR4 3200 RAM, Samsung 970 Pro NVMe M.2 500 gbyte SSD + Samsung 850 Pro 512 gbyte SSD, EVGA RTX 3060 Titan graphics card (Home Built System); Windows 11x64 Pro on 512 gigabyte Dell XPS 15 2-in-1 Laptop/tablet and Dell XPS 8940 PC. ASUS RT-AC88U router, 14 tbyte WD My Cloud PR2100 NAS Server, 200 Mbps cable Internet, MS Edge Chromium, MS Office 2021 (Local), Casper 11, DisplayFusion (3 Flat Panel Displays per system): Bitdefender Internet Security 2022, Quicken, Weather Watcher Live, ThumbsPlus 10, Sticky Password 8, WD Smartware, CyberLink PowerDVD22, MSI AfterBurner, Rainmeter, Windows Sidebar, and many more. Link to comment Share on other sites More sharing options...
siliconman01 Posted February 27, 2022 Share Posted February 27, 2022 Modified entry: [DriverMax *] Added FileKey3 [DriverMax *] LangSecRef=3024 Detect=HKCU\Software\Innovative Solutions\DriverMax FileKey1=%LocalAppData%\Innovative Solutions\DriverMax\Agent|*.tmp;dmxlog.txt;lastscan*.xml;logScan.txt FileKey2=%LocalAppData%\Innovative Solutions\DriverMax\Agent\Downloded Drivers|*.* FileKey3=%LocalAppData%\Innovative Solutions\DriverMax\Agent\Dump|*.* FileKey4=%LocalAppData%\Innovative Solutions\DriverMax\Agent\Uploads|*.*|RECURSE FileKey5=%LocalAppData%\Innovative Solutions\DriverMax\Backup|*.* FileKey6=%LocalAppData%\Innovative Solutions\DriverMax\LastScan|*.* FileKey7=%LocalAppData%\Innovative Solutions\DriverMax\Temp*|*.* FileKey8=%ProgramFiles%\Innovative Solutions\DriverMax|*.log Windows 10 x64 Pro on ASUS Maximus VIII Extreme motherboard, i7-6700k CPU,H220 X2 Liquid Cooler, 64 gbyte RipJaws DDR4 3200 RAM, Samsung 970 Pro NVMe M.2 500 gbyte SSD + Samsung 850 Pro 512 gbyte SSD, EVGA RTX 3060 Titan graphics card (Home Built System); Windows 11x64 Pro on 512 gigabyte Dell XPS 15 2-in-1 Laptop/tablet and Dell XPS 8940 PC. ASUS RT-AC88U router, 14 tbyte WD My Cloud PR2100 NAS Server, 200 Mbps cable Internet, MS Edge Chromium, MS Office 2021 (Local), Casper 11, DisplayFusion (3 Flat Panel Displays per system): Bitdefender Internet Security 2022, Quicken, Weather Watcher Live, ThumbsPlus 10, Sticky Password 8, WD Smartware, CyberLink PowerDVD22, MSI AfterBurner, Rainmeter, Windows Sidebar, and many more. Link to comment Share on other sites More sharing options...
siliconman01 Posted February 27, 2022 Share Posted February 27, 2022 Modified entry: [Movavi Video Converter *] Added FileKey1, FileKey5, FileKey6. Changed FileKey7, FileKey8, FileKey9 [Movavi Video Converter *] LangSecRef=3023 Detect=HKCU\Software\MOVAVI FileKey1=%LocalAppData%\Movavi\Logs\IPCRouterApplication|*.* FileKey2=%LocalAppData%\Movavi\Logs\MovaviStatistics|*.* FileKey3=%LocalAppData%\Movavi\Logs\VideoConverter*|*.* FileKey4=%LocalAppData%\Movavi\Movavi Video Converter * Premium\Cache|*.*|RECURSE FileKey5=%LocalAppData%\Movavi\Video Converter *\cache\NagsCache|*.*|RECURSE FileKey6=%LocalAppData%\Movavi\Video Converter *\cache\qmlcache|*.*|RECURSE FileKey7=%LocalAppData%\Movavi\Video Converter *\cache\videoconverter*\MSparkle|*.*|RECURSE FileKey8=%LocalAppData%\Movavi\Video Converter *\TranscoderTemp|*.*|RECURSE FileKey9=%LocalAppData%\Movavi\Video Converter|Log.txt ExcludeKey1=PATH|%LocalAppData%\Movavi\Video Converter *\cache\videoconverter*\MSparkle\*\|MovaviVideoConverterSetup*.exe Windows 10 x64 Pro on ASUS Maximus VIII Extreme motherboard, i7-6700k CPU,H220 X2 Liquid Cooler, 64 gbyte RipJaws DDR4 3200 RAM, Samsung 970 Pro NVMe M.2 500 gbyte SSD + Samsung 850 Pro 512 gbyte SSD, EVGA RTX 3060 Titan graphics card (Home Built System); Windows 11x64 Pro on 512 gigabyte Dell XPS 15 2-in-1 Laptop/tablet and Dell XPS 8940 PC. ASUS RT-AC88U router, 14 tbyte WD My Cloud PR2100 NAS Server, 200 Mbps cable Internet, MS Edge Chromium, MS Office 2021 (Local), Casper 11, DisplayFusion (3 Flat Panel Displays per system): Bitdefender Internet Security 2022, Quicken, Weather Watcher Live, ThumbsPlus 10, Sticky Password 8, WD Smartware, CyberLink PowerDVD22, MSI AfterBurner, Rainmeter, Windows Sidebar, and many more. Link to comment Share on other sites More sharing options...
APMichael Posted February 27, 2022 Share Posted February 27, 2022 1 hour ago, siliconman01 said: Modified entry: [Movavi Video Converter *] ... Just a question: is there a reason for the separate FileKeys or couldn't they be merged as well? [Movavi Video Converter *] LangSecRef=3023 Detect=HKCU\Software\MOVAVI FileKey1=%LocalAppData%\Movavi\Logs|*.*|RECURSE FileKey2=%LocalAppData%\Movavi\*Video Converter*\Cache|*.*|RECURSE FileKey3=%LocalAppData%\Movavi\*Video Converter*\TranscoderTemp|*.*|RECURSE FileKey4=%LocalAppData%\Movavi\*Video Converter*|Log.txt ExcludeKey1=PATH|%LocalAppData%\Movavi\*Video Converter*\Cache\videoconverter*\MSparkle\*\|MovaviVideoConverterSetup*.exe Link to comment Share on other sites More sharing options...
siliconman01 Posted February 27, 2022 Share Posted February 27, 2022 New entry: [Rainmeter Updates Cleanup *] [Rainmeter Updates Cleanup *] LangSecRef=3024 Detect=HKLM\Software\Rainmeter FileKey1=%AppData%\Rainmeter\Updates|*.* Windows 10 x64 Pro on ASUS Maximus VIII Extreme motherboard, i7-6700k CPU,H220 X2 Liquid Cooler, 64 gbyte RipJaws DDR4 3200 RAM, Samsung 970 Pro NVMe M.2 500 gbyte SSD + Samsung 850 Pro 512 gbyte SSD, EVGA RTX 3060 Titan graphics card (Home Built System); Windows 11x64 Pro on 512 gigabyte Dell XPS 15 2-in-1 Laptop/tablet and Dell XPS 8940 PC. ASUS RT-AC88U router, 14 tbyte WD My Cloud PR2100 NAS Server, 200 Mbps cable Internet, MS Edge Chromium, MS Office 2021 (Local), Casper 11, DisplayFusion (3 Flat Panel Displays per system): Bitdefender Internet Security 2022, Quicken, Weather Watcher Live, ThumbsPlus 10, Sticky Password 8, WD Smartware, CyberLink PowerDVD22, MSI AfterBurner, Rainmeter, Windows Sidebar, and many more. Link to comment Share on other sites More sharing options...
siliconman01 Posted February 27, 2022 Share Posted February 27, 2022 33 minutes ago, APMichael said: Just a question: is there a reason for the separate FileKeys or couldn't they be merged as well? [Movavi Video Converter *] LangSecRef=3023 Detect=HKCU\Software\MOVAVI FileKey1=%LocalAppData%\Movavi\Logs|*.*|RECURSE FileKey2=%LocalAppData%\Movavi\*Video Converter*\Cache|*.*|RECURSE FileKey3=%LocalAppData%\Movavi\*Video Converter*\TranscoderTemp|*.*|RECURSE FileKey4=%LocalAppData%\Movavi\*Video Converter*|Log.txt ExcludeKey1=PATH|%LocalAppData%\Movavi\*Video Converter*\Cache\videoconverter*\MSparkle\*\|MovaviVideoConverterSetup*.exe They can be merged per your code. Windows 10 x64 Pro on ASUS Maximus VIII Extreme motherboard, i7-6700k CPU,H220 X2 Liquid Cooler, 64 gbyte RipJaws DDR4 3200 RAM, Samsung 970 Pro NVMe M.2 500 gbyte SSD + Samsung 850 Pro 512 gbyte SSD, EVGA RTX 3060 Titan graphics card (Home Built System); Windows 11x64 Pro on 512 gigabyte Dell XPS 15 2-in-1 Laptop/tablet and Dell XPS 8940 PC. ASUS RT-AC88U router, 14 tbyte WD My Cloud PR2100 NAS Server, 200 Mbps cable Internet, MS Edge Chromium, MS Office 2021 (Local), Casper 11, DisplayFusion (3 Flat Panel Displays per system): Bitdefender Internet Security 2022, Quicken, Weather Watcher Live, ThumbsPlus 10, Sticky Password 8, WD Smartware, CyberLink PowerDVD22, MSI AfterBurner, Rainmeter, Windows Sidebar, and many more. Link to comment Share on other sites More sharing options...
siliconman01 Posted February 28, 2022 Share Posted February 28, 2022 Modified entry: [MSI Afterburner Hardware Monitoring *] Added FileKey1 [MSI Afterburner Hardware Monitoring *] LangSecRef=3024 Detect=HKCU\Software\MSI FileKey1=%ProgramFiles%\Geeks3D\MSI Kombustor * *\logs|*.* FileKey2=%ProgramFiles%\MSI Afterburner|HardwareMonitoring.hml Modified entry: [Movavi Video Converter *] Rearranged FileKeys [Movavi Video Converter *] LangSecRef=3023 Detect=HKCU\Software\MOVAVI FileKey1=%LocalAppData%\Movavi\*Video Converter*|Log.txt FileKey2=%LocalAppData%\Movavi\*Video Converter*\Cache|*.*|RECURSE FileKey3=%LocalAppData%\Movavi\*Video Converter*\TranscoderTemp|*.*|RECURSE FileKey4=%LocalAppData%\Movavi\Logs|*.*|RECURSE ExcludeKey1=PATH|%LocalAppData%\Movavi\*Video Converter*\Cache\videoconverter*\MSparkle\*\|MovaviVideoConverterSetup*.exe Windows 10 x64 Pro on ASUS Maximus VIII Extreme motherboard, i7-6700k CPU,H220 X2 Liquid Cooler, 64 gbyte RipJaws DDR4 3200 RAM, Samsung 970 Pro NVMe M.2 500 gbyte SSD + Samsung 850 Pro 512 gbyte SSD, EVGA RTX 3060 Titan graphics card (Home Built System); Windows 11x64 Pro on 512 gigabyte Dell XPS 15 2-in-1 Laptop/tablet and Dell XPS 8940 PC. ASUS RT-AC88U router, 14 tbyte WD My Cloud PR2100 NAS Server, 200 Mbps cable Internet, MS Edge Chromium, MS Office 2021 (Local), Casper 11, DisplayFusion (3 Flat Panel Displays per system): Bitdefender Internet Security 2022, Quicken, Weather Watcher Live, ThumbsPlus 10, Sticky Password 8, WD Smartware, CyberLink PowerDVD22, MSI AfterBurner, Rainmeter, Windows Sidebar, and many more. Link to comment Share on other sites More sharing options...
siliconman01 Posted February 28, 2022 Share Posted February 28, 2022 Modified entry: [Dell Logs *] Added FileKey9 [Dell Logs *] LangSecRef=3024 Detect1=HKLM\Software\Dell\MUP Detect2=HKLM\Software\Dell\UpdateService Detect3=HKLM\Software\PC-Doctor DetectFile1=%AppData%\Creative\DELL Webcam Center DetectFile2=%CommonAppData%\Dell DetectFile3=%LocalAppData%\Dell DetectFile4=%LocalAppData%\SupportSoft\DellSupportCenter DetectFile5=%ProgramFiles%\Dell* FileKey1=%AppData%\Creative\DELL Webcam Center|MO_Log.txt FileKey2=%AppData%\PCDr\*\Logs|*.* FileKey3=%CommonAppData%\Dell\*\Log|*.*|RECURSE FileKey4=%CommonAppData%\Dell\*\Logs|*.*|RECURSE FileKey5=%CommonAppData%\Dell\BiosVerification|*.log FileKey6=%CommonAppData%\Dell\D3\pla\*\*|*.log;*.txt|REMOVESELF FileKey7=%CommonAppData%\Dell\D3\Resources\Logs\serilog|*.* FileKey8=%CommonAppData%\Dell\Drivers\*|*.log;*.tmp|RECURSE FileKey9=%CommonAppData%\Dell\SupportAssist|*.*|RECURSE FileKey10=%CommonAppData%\Dell\TrustedDevice|*.log FileKey11=%CommonAppData%\Dell\Update|*.txt FileKey12=%CommonAppData%\Dell\UpdateService\Clients\Update|*.log FileKey13=%CommonAppData%\Dell\UpdateService\DataStore\*\*|*.log FileKey14=%CommonAppData%\Dell\UpdateService\UpdatePackage\Log|*.log;*.txt FileKey15=%CommonAppData%\PCDr\*\Cache|*.xml FileKey16=%CommonAppData%\PCDr\*\Cache\archives|*.*|RECURSE FileKey17=%CommonAppData%\PCDr\*\Cache\BUMA|*.* FileKey18=%CommonAppData%\PCDr\*\Cache\DriverScan|*.* FileKey19=%CommonAppData%\PCDr\*\Logs|*.* FileKey20=%LocalAppData%\Dell\*\Log|*.* FileKey21=%LocalAppData%\Dell\DellMobileConnect|*.log FileKey22=%LocalAppData%\SupportSoft\DellSupportCenter\*\state\logs|*.* FileKey23=%ProgramFiles%\Dell*|*.log|RECURSE Windows 10 x64 Pro on ASUS Maximus VIII Extreme motherboard, i7-6700k CPU,H220 X2 Liquid Cooler, 64 gbyte RipJaws DDR4 3200 RAM, Samsung 970 Pro NVMe M.2 500 gbyte SSD + Samsung 850 Pro 512 gbyte SSD, EVGA RTX 3060 Titan graphics card (Home Built System); Windows 11x64 Pro on 512 gigabyte Dell XPS 15 2-in-1 Laptop/tablet and Dell XPS 8940 PC. ASUS RT-AC88U router, 14 tbyte WD My Cloud PR2100 NAS Server, 200 Mbps cable Internet, MS Edge Chromium, MS Office 2021 (Local), Casper 11, DisplayFusion (3 Flat Panel Displays per system): Bitdefender Internet Security 2022, Quicken, Weather Watcher Live, ThumbsPlus 10, Sticky Password 8, WD Smartware, CyberLink PowerDVD22, MSI AfterBurner, Rainmeter, Windows Sidebar, and many more. Link to comment Share on other sites More sharing options...
SMalik Posted March 2, 2022 Share Posted March 2, 2022 Revised entry Added .cache files FileKey13=%Public%\TechSmith\Snagit\License|*.cache;*.log [Snagit *] LangSecRef=3021 Detect=HKCU\Software\TechSmith\Snagit FileKey1=%CommonAppData%\TechSmith\Uploader|*.log FileKey2=%Documents%|SnagitDebug.log FileKey3=%Documents%\Snagit|*.snagx FileKey4=%Documents%\Snagit\.metadata|*.*|RECURSE FileKey5=%LocalAppData%\TechSmith\Logs|*.log FileKey6=%LocalAppData%\TechSmith\Snagit|Tray.bin FileKey7=%LocalAppData%\TechSmith\Snagit\*\NativeCrashReporting\Reports|*.dmp|RECURSE FileKey8=%LocalAppData%\TechSmith\Snagit\CrashDumps|*.*|RECURSE FileKey9=%LocalAppData%\TechSmith\Snagit\DataStore\AppIcons|*.ico FileKey10=%LocalAppData%\TechSmith\Snagit\DataStore\WebSiteIcons|*.ico FileKey11=%LocalAppData%\TechSmith\Snagit\Thumbnails|*.*|RECURSE FileKey12=%LocalAppData%\TechSmith\Snagit\TrackerbirdFiles|*.log;*.logtmp FileKey13=%Public%\TechSmith\Snagit\License|*.cache;*.log RegKey1=HKCU\Software\TechSmith\Snagit\9|StampCustomFolder RegKey2=HKCU\Software\TechSmith\Snagit\10|StampCustomFolder RegKey3=HKCU\Software\TechSmith\Snagit\11|CaptureCount RegKey4=HKCU\Software\TechSmith\Snagit\11|CaptureOpenCount RegKey5=HKCU\Software\TechSmith\Snagit\11|OutputDirLastUsed RegKey6=HKCU\Software\TechSmith\Snagit\11|VidOutputDirLastUsed RegKey7=HKCU\Software\TechSmith\Snagit\11\SnagItEditor\Tray|Thumbnailsize RegKey8=HKCU\Software\TechSmith\Snagit\12|CaptureCount RegKey9=HKCU\Software\TechSmith\Snagit\12|CaptureOpenCount RegKey10=HKCU\Software\TechSmith\Snagit\12|OutputDirLastUsed RegKey11=HKCU\Software\TechSmith\Snagit\12|VidOutputDirLastUsed RegKey12=HKCU\Software\TechSmith\Snagit\12\SnagItEditor\Tray|Thumbnailsize RegKey13=HKCU\Software\TechSmith\Snagit\13|CaptureCount RegKey14=HKCU\Software\TechSmith\Snagit\13|CaptureOpenCount RegKey15=HKCU\Software\TechSmith\Snagit\13|OutputDirLastUsed RegKey16=HKCU\Software\TechSmith\Snagit\13|VidOutputDirLastUsed RegKey17=HKCU\Software\TechSmith\Snagit\13\Recent Captures RegKey18=HKCU\Software\TechSmith\Snagit\13\SnagitEditor\Recent File List RegKey19=HKCU\Software\TechSmith\Snagit\13\SnagItEditor\Tray|Thumbnailsize RegKey20=HKCU\Software\TechSmith\Snagit\18|CaptureCount RegKey21=HKCU\Software\TechSmith\Snagit\18|CaptureOpenCount RegKey22=HKCU\Software\TechSmith\Snagit\18|OutputDirLastUsed RegKey23=HKCU\Software\TechSmith\Snagit\18|VidOutputDirLastUsed RegKey24=HKCU\Software\TechSmith\Snagit\18\Recent Captures RegKey25=HKCU\Software\TechSmith\Snagit\18\SnagitEditor\Recent File List RegKey26=HKCU\Software\TechSmith\Snagit\18\SnagItEditor\Tray|Thumbnailsize RegKey27=HKCU\Software\TechSmith\Snagit\19|CaptureCount RegKey28=HKCU\Software\TechSmith\Snagit\19|CaptureOpenCount RegKey29=HKCU\Software\TechSmith\Snagit\19|OutputDirLastUsed RegKey30=HKCU\Software\TechSmith\Snagit\19|VidOutputDirLastUsed RegKey31=HKCU\Software\TechSmith\Snagit\19\Recent Captures RegKey32=HKCU\Software\TechSmith\Snagit\19\SnagitEditor\Recent File List RegKey33=HKCU\Software\TechSmith\Snagit\19\SnagItEditor\Tray|Thumbnailsize RegKey34=HKCU\Software\TechSmith\Snagit\20|CaptureCount RegKey35=HKCU\Software\TechSmith\Snagit\20|CaptureOpenCount RegKey36=HKCU\Software\TechSmith\Snagit\20|OutputDirLastUsed RegKey37=HKCU\Software\TechSmith\Snagit\20|VidOutputDirLastUsed RegKey38=HKCU\Software\TechSmith\Snagit\20\Recent Captures RegKey39=HKCU\Software\TechSmith\Snagit\20\SnagitEditor\Recent File List RegKey40=HKCU\Software\TechSmith\Snagit\20\SnagItEditor\Tray|Thumbnailsize RegKey41=HKCU\Software\TechSmith\Snagit\21|CaptureCount RegKey42=HKCU\Software\TechSmith\Snagit\21|CaptureOpenCount RegKey43=HKCU\Software\TechSmith\Snagit\21|OutputDirLastUsed RegKey44=HKCU\Software\TechSmith\Snagit\21|VidOutputDirLastUsed RegKey45=HKCU\Software\TechSmith\Snagit\21\Recent Captures RegKey46=HKCU\Software\TechSmith\Snagit\21\SnagitEditor\Recent File List RegKey47=HKCU\Software\TechSmith\Snagit\21\SnagItEditor\Tray|Thumbnailsize RegKey48=HKCU\Software\TechSmith\Snagit\22|CaptureCount RegKey49=HKCU\Software\TechSmith\Snagit\22|CaptureOpenCount RegKey50=HKCU\Software\TechSmith\Snagit\22|OutputDirLastUsed RegKey51=HKCU\Software\TechSmith\Snagit\22|VidOutputDirLastUsed RegKey52=HKCU\Software\TechSmith\Snagit\22\Recent Captures RegKey53=HKCU\Software\TechSmith\Snagit\22\SnagitEditor\Recent File List RegKey54=HKCU\Software\TechSmith\Snagit\22\SnagItEditor\Tray|Thumbnailsize Link to comment Share on other sites More sharing options...
Moderators Andavari Posted March 15, 2022 Moderators Share Posted March 15, 2022 (edited) What's anyone else's take on cleaning out this folder? C:\Users\YourUserName\AppData\Roaming\Microsoft\Windows\Recent There's already a winapp2.ini cleaner called [Jump Lists *] but it doesn't deal with the hidden .URL items. I've got allot of .URL items from years ago (all junk at this point, and a privacy concern) that can't be seen by the user even when changing Windows 'Folder Options'. I was shocked at the amount of .URL accumulation in that path when viewing it inside 7-Zip File Manager which has no issues revealing the contents. ------------------------- Edit: This worked for me. [Recent Items (URL) *] LangSecRef=3025 Detect=HKCU\Software\Microsoft\Windows FileKey1=%AppData%\Microsoft\Windows\Recent|*.URL|RECURSE Edited March 15, 2022 by Andavari Link to comment Share on other sites More sharing options...
SMalik Posted March 26, 2022 Share Posted March 26, 2022 Revised entry Added .tmp in FileKey23 [Windows Logs *] LangSecRef=3025 Detect=HKLM\Software\Microsoft\Windows FileKey1=%CommonAppData%\Microsoft\Diagnosis\DownloadedSettings|*.json.bk FileKey2=%CommonAppData%\Microsoft\Diagnosis\ETLLogs|*.*|RECURSE FileKey3=%CommonAppData%\Microsoft\DiagnosticLogCSP|*.*|RECURSE FileKey4=%CommonAppData%\Microsoft\Network\Downloader|*.*|RECURSE FileKey5=%CommonAppData%\Microsoft\WDF|*.*|RECURSE FileKey6=%CommonAppData%\Microsoft\Windows Security Health\Logs|*.*|RECURSE FileKey7=%CommonAppData%\Microsoft\Windows\wfp|*.etl FileKey8=%CommonAppData%\USOShared\Logs|*.*|RECURSE FileKey9=%LocalAppData%\ConnectedDevicesPlatform|*.log FileKey10=%LocalAppData%\Diagnostics|*.*|RECURSE FileKey11=%LocalAppData%\Microsoft\Dialer|*.log.txt FileKey12=%LocalAppData%\Microsoft\msipc\Logs|*.* FileKey13=%LocalAppData%\Microsoft\Windows\Explorer|*.etl FileKey14=%ProgramFiles%\UNP\*Logs|*.* FileKey15=%SystemDrive%|DumpStack.log FileKey16=%SystemDrive%\PerfLogs\System\Diagnostics|*.*|RECURSE FileKey17=%SystemDrive%\PerfLogs\System\Performance|*.*|RECURSE FileKey18=%WinDir%\AppCompat\Programs|*.txt;*.xml FileKey19=%WinDir%\AppCompat\Programs\Install|*.txt;*.xml FileKey20=%WinDir%\debug\WIA|*.log FileKey21=%WinDir%\INF|*.etl;*.log* FileKey22=%WinDir%\Logs\CBS|*.cab FileKey23=%WinDir%\Panther|cbs.log;DDACLSys.log;miglog.xml;Migrep.html;PostGatherPnPList.log;PreGatherPnPList.log;*.tmp FileKey24=%WinDir%\Panther\FastCleanup|*.log FileKey25=%WinDir%\Panther\Rollback|*.txt FileKey26=%WinDir%\Panther\UnattendGC|diagerr.xml;diagwrn.xml FileKey27=%WinDir%\repair|setup.log FileKey28=%WinDir%\security\logs|*.*|RECURSE FileKey29=%WinDir%\ServiceProfiles\NetworkService\debug|*.log FileKey30=%WinDir%\System32\CatRoot|*.tmp FileKey31=%WinDir%\System32\CatRoot_bak|*.*|REMOVESELF FileKey32=%WinDir%\System32\catroot2|*.chk;*.log;*.jrs;*.txt FileKey33=%WinDir%\System32\LogFiles\HTTPERR|*.log FileKey34=%WinDir%\System32\LogFiles\Scm|*.*|RECURSE FileKey35=%WinDir%\System32\LogFiles\setupcln|*.*|RECURSE FileKey36=%WinDir%\System32\LogFiles\Srt|*.*|RECURSE FileKey37=%WinDir%\System32\LogFiles\WMI|*.*|RECURSE FileKey38=%WinDir%\System32\LogFiles\WUDF|*.* FileKey39=%WinDir%\System32\SleepStudy|*.etl FileKey40=%WinDir%\System32\SleepStudy\ScreenOn|*.etl FileKey41=%WinDir%\System32\sysprep\Panther\IE|diagerr.xml;diagwrn.xml;*.log FileKey42=%WinDir%\System32\WDI\*|snapshot.etl|REMOVESELF FileKey43=%WinDir%\System32\WDI\LogFiles\StartupInfo|*.*|RECURSE RegKey1=HKLM\Software\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications RegKey2=HKLM\Software\Microsoft\Tracing RegKey3=HKLM\Software\Wow6432Node\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications RegKey4=HKLM\Software\Wow6432Node\Microsoft\Tracing Link to comment Share on other sites More sharing options...
Winapp2.ini Posted March 28, 2022 Author Share Posted March 28, 2022 Good news! At long last, I've been able to update my Photo ID and will be renewing the code signing certificate soon, after which I'll be able to publish new builds of winapp2ool without antivirus vendors considering it malicious. I'll post here as that situation develops winapp2.ini additions thread winapp2.ini github Link to comment Share on other sites More sharing options...
siliconman01 Posted March 29, 2022 Share Posted March 29, 2022 Great .... hopefully we wiil get back to routine updates shortly. APM has been a big help in recent months. :) Windows 10 x64 Pro on ASUS Maximus VIII Extreme motherboard, i7-6700k CPU,H220 X2 Liquid Cooler, 64 gbyte RipJaws DDR4 3200 RAM, Samsung 970 Pro NVMe M.2 500 gbyte SSD + Samsung 850 Pro 512 gbyte SSD, EVGA RTX 3060 Titan graphics card (Home Built System); Windows 11x64 Pro on 512 gigabyte Dell XPS 15 2-in-1 Laptop/tablet and Dell XPS 8940 PC. ASUS RT-AC88U router, 14 tbyte WD My Cloud PR2100 NAS Server, 200 Mbps cable Internet, MS Edge Chromium, MS Office 2021 (Local), Casper 11, DisplayFusion (3 Flat Panel Displays per system): Bitdefender Internet Security 2022, Quicken, Weather Watcher Live, ThumbsPlus 10, Sticky Password 8, WD Smartware, CyberLink PowerDVD22, MSI AfterBurner, Rainmeter, Windows Sidebar, and many more. Link to comment Share on other sites More sharing options...
PICPro Posted March 30, 2022 Share Posted March 30, 2022 Quote What's anyone else's take on cleaning out this folder? C:\Users\YourUserName\AppData\Roaming\Microsoft\Windows\Recent There's already a winapp2.ini cleaner called [Jump Lists *] but it doesn't deal with the hidden .URL items. I think it is a good idea to remove the .url files to be thorough, but so far I haven't found a computer with url files here. Is it something that started in Windows 10 or what are the conditions that cause the creation of a .url file in this location? Link to comment Share on other sites More sharing options...
PICPro Posted March 30, 2022 Share Posted March 30, 2022 With the increasing popularity of LibreWolf browser which is based on the current Firefox release, it might be good to add it to the Firefox cleaning. Even though Librewolf doesn't make quite as many junk files due to the lack of telemetry and such, I think that it still makes sense to give it the full Firefox treament in case there is ever a mistake in LibreWolf's customized setting file, or if a user accidentally reenables a disabled feature. Since LibreWolf is unsupported in CC, then a ccleaner.ini CustomLocation entry is needed to get the built in cleaning. For Winapp2, the detect would be: LangSecRef=3026 Detect1=HKCU\Software\LibreWolf An example entry to show the profile path: [Profile Lock File *] LangSecRef=3026 Detect1=HKCU\Software\ArtistScope\ArtisBrowser Detect2=HKLM\Software\ComodoGroup\IceDragon Detect3=HKLM\Software\FlashPeak\SlimBrowser Detect4=HKCU\Software\LibreWolf Detect5=HKLM\Software\Mozilla\Basilisk Detect6=HKLM\Software\Mozilla\Pale Moon Detect7=HKLM\Software\Mozilla\SeaMonkey Detect8=HKLM\Software\Mozilla\Waterfox DetectFile=%AppData%\Mozilla\Firefox FileKey1=%AppData%\ArtistScope\ArtisBrowser\Profiles\*|parent.lock FileKey2=%AppData%\Comodo\IceDragon\Profiles\*|parent.lock FileKey3=%AppData%\FlashPeak\SlimBrowser\Profiles\*|parent.lock FileKey4=%AppData%\LibreWolf\Profiles\*|parent.lock FileKey5=%AppData%\Moonchild Productions\Basilisk\Profiles\*|parent.lock FileKey6=%AppData%\Moonchild Productions\Pale Moon\Profiles\*|parent.lock FileKey7=%AppData%\Mozilla\Firefox\Profiles\*|parent.lock FileKey8=%AppData%\Mozilla\SeaMonkey\Profiles\*|parent.lock FileKey9=%AppData%\Waterfox\Profiles\*|parent.lock The file paths used are similar to Firefox: =%AppData%\LibreWolf\Profiles\* =%LocalAppData%\LibreWolf\Profiles\* =%ProgramFiles%\LibreWolf Where \LibreWolf\ replaces \Mozilla\Firefox\ in the profile folders. Thank you. Link to comment Share on other sites More sharing options...
Moderators Andavari Posted March 30, 2022 Moderators Share Posted March 30, 2022 7 hours ago, PICPro said: I think it is a good idea to remove the .url files to be thorough, but so far I haven't found a computer with url files here. Is it something that started in Windows 10 or what are the conditions that cause the creation of a .url file in this location? That happened on my Acer OEM Win10 Home install. I suspect without any proof whatsoever that it may have been generated either by Internet Explorer or the original Edge browser. I can't imagine Firefox or SRWare Iron doing that. Everything in there was old though from 2018 and 2019, but nothing newer. Some of it I recognized such as old software readme's in HTML I used to make and it had .URL links to those documents, and some where to actual websites I had visited, which was weird. It was over 500kb of those small bytes sized .URL files, so there was allot of them. Link to comment Share on other sites More sharing options...
SMalik Posted March 31, 2022 Share Posted March 31, 2022 Revised entry Added: HKCU\Software\Microsoft\Internet Explorer\DOMStorage [Internet Explorer *] LangSecRef=3001 Detect=HKCU\Software\Microsoft\Internet Explorer FileKey1=%AppData%\Microsoft\Internet Explorer\UserData|*.*|RECURSE FileKey2=%LocalAppData%\Microsoft\Internet Explorer|*.log;*.txt|RECURSE FileKey3=%LocalAppData%\Microsoft\Internet Explorer\CacheStorage|*.*|RECURSE FileKey4=%LocalAppData%\Microsoft\Windows\AppCache|*.*|RECURSE FileKey5=%LocalAppData%\Microsoft\Windows\IECompat*Cache|*.*|RECURSE FileKey6=%LocalAppData%\Microsoft\Windows\INetCache|*.*|RECURSE FileKey7=%LocalAppData%\Microsoft\Windows\INetCookies|*.*|RECURSE FileKey8=%LocalAppData%\Microsoft\Windows\WebCache|*.*|RECURSE FileKey9=%LocalAppData%\Microsoft\Windows\WebCache.old|*.*|REMOVESELF FileKey10=%LocalAppData%\Packages\windows_ie_ac_*\AC\AppCache|*.*|RECURSE FileKey11=%LocalAppData%\Packages\windows_ie_ac_*\AC\IECompat*Cache|*.*|RECURSE FileKey12=%LocalAppData%\Packages\windows_ie_ac_*\AC\IEDownloadHistory|*.*|RECURSE FileKey13=%LocalAppData%\Packages\windows_ie_ac_*\AC\INet*|*.*|RECURSE FileKey14=%LocalAppData%\Packages\windows_ie_ac_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE FileKey15=%LocalAppData%\Packages\windows_ie_ac_*\AC\Microsoft\CryptnetUrlCache\*|*.* FileKey16=%LocalAppData%\Packages\windows_ie_ac_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE FileKey17=%LocalAppData%\Packages\windows_ie_ac_*\AC\Microsoft\Internet Explorer\Emie*List|*.*|RECURSE FileKey18=%LocalAppData%\Packages\windows_ie_ac_*\AC\PRICache|*.*|RECURSE FileKey19=%LocalAppData%\Packages\windows_ie_ac_*\AC\Temp|*.*|RECURSE FileKey20=%LocalAppData%\Packages\windows_ie_ac_*\LocalState\Cache|*.*|RECURSE FileKey21=%LocalAppData%\Packages\windows_ie_ac_*\LocalState\navigationHistory|*.*|RECURSE FileKey22=%LocalAppData%\Packages\windows_ie_ac_*\TempState|*.*|RECURSE FileKey23=%SystemDrive%\Documents and Settings\LocalService*\Cookies|*.*|RECURSE FileKey24=%SystemDrive%\Documents and Settings\LocalService*\Local Settings\History|*.*|RECURSE FileKey25=%SystemDrive%\Documents and Settings\LocalService*\Local Settings\Temporary Internet Files|*.*|RECURSE FileKey26=%SystemDrive%\Documents and Settings\NetworkService*\Cookies|*.*|RECURSE FileKey27=%SystemDrive%\Documents and Settings\NetworkService*\Local Settings\History|*.*|RECURSE FileKey28=%SystemDrive%\Documents and Settings\NetworkService*\Local Settings\Temporary Internet Files|*.*|RECURSE FileKey29=%WinDir%\ServiceProfiles\*\AppData\Local\Microsoft\Windows\History|*.*|RECURSE FileKey30=%WinDir%\ServiceProfiles\*\AppData\Local\Microsoft\Windows\INetCache|*.*|RECURSE FileKey31=%WinDir%\ServiceProfiles\*\AppData\Local\Microsoft\Windows\INetCookies|*.*|RECURSE FileKey32=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History|*.*|RECURSE FileKey33=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache|*.*|RECURSE FileKey34=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies|*.*|RECURSE FileKey35=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache|*.*|RECURSE FileKey36=%WinDir%\System32\config\systemprofile\Cookies|*.*|RECURSE FileKey37=%WinDir%\System32\config\systemprofile\History|*.*|RECURSE FileKey38=%WinDir%\System32\config\systemprofile\Local Settings\Temporary Internet Files|*.*|RECURSE FileKey39=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History|*.*|RECURSE FileKey40=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache|*.*|RECURSE FileKey41=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies|*.*|RECURSE FileKey42=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache|*.*|RECURSE RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Explorer\DOMStorage RegKey2=HKCU\Software\Microsoft\Internet Explorer\DOMStorage RegKey3=HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage RegKey4=HKCU\Software\Microsoft\Internet Explorer\Recovery\PendingDelete RegKey5=HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats RegKey6=HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\ContainingTextMRU RegKey7=HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU RegKey8=HKU\.DEFAULT\Software\Microsoft\Internet Explorer\TypedURLs Link to comment Share on other sites More sharing options...
APMichael Posted April 2, 2022 Share Posted April 2, 2022 Thank you for the new and modified/revised entries. Winapp2.ini update:https://github.com/MoscaDotTo/Winapp2/commit/c30828be1e9710a20de8620f7b43225720d50c72 @siliconman01 Thank you for the kind words. On 07/10/2021 at 14:03, siliconman01 said: BTW is there a DetectOS=11 for Windows 11? The following line works for Windows 11: DetectOS=10.0.22000| Link to comment Share on other sites More sharing options...
Moderators Andavari Posted April 8, 2022 Moderators Share Posted April 8, 2022 (edited) Does anyone know where the memory/settings are stored in Microsoft Edge Chromium for it to display a popup when looking at a previously opened PDF document "start where you left off", or something similarly worded along those lines. I don't know if it's the browser or Windows that stores the settings for it to remember where I left off in a PDF, however I don't remember it ever happening before with the original Edge or in earlier versions of Edge Chromium. I'd personally like to be able to make it forget, i.e.; clean that location via winapp2.ini. -------------- Edit: I found this, but it doesn't make it forget the page, etc., in a PDF document so it's storing the setting for that elsewhere. It however does list the PDF document file name in the "Session_#################" file, so it's possibly a privacy risk. [Edge Sessions *] LangSecRef=3006 DetectFile=%LocalAppData%\Microsoft\Edge* FileKey1=%LocalAppData%\Microsoft\Edge\User Data\Default\Sessions\|Session_* Edited April 8, 2022 by Andavari Referenced a winapp2.ini entry that either doesn't exist anymore or never existed. Link to comment Share on other sites More sharing options...
APMichael Posted April 8, 2022 Share Posted April 8, 2022 11 hours ago, Andavari said: Does anyone know where the memory/settings are stored in Microsoft Edge Chromium for it to display a popup when looking at a previously opened PDF document "start where you left off", or something similarly worded along those lines. ... ... FileKey1=%LocalAppData%\Microsoft\Edge\User Data\Default\Sessions\|Session_* Edge stores this information in its own database. The following entry deletes this database: [Edge PDF Database *] LangSecRef=3006 DetectFile=%LocalAppData%\Microsoft\Edge* FileKey1=%LocalAppData%\Microsoft\Edge*\User Data\*\Pdf|pdfSQLite I tested it with a locally saved PDF. After deleting the database, the PDF opens again with page 1. The "Session_*" files are already deleted by CCleaner's built-in [Edge Chromium - Session] entry: Link to comment Share on other sites More sharing options...
Moderators Andavari Posted April 8, 2022 Moderators Share Posted April 8, 2022 Thank you for finding that! Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now