Jump to content

Winapp2.ini additions

Winapp2.ini

By Winapp2.ini
in CCleaner

 Share

Recommended Posts

SMalik

SMalik

Posted
Posted

I think [Adobe Acrobat Distiller *] and [Adobe Acrobat *] entries should be separated

[Adobe Acrobat Distiller *]
LangSecRef=3021
Detect=HKCU\Software\Adobe\Acrobat Distiller
FileKey1=%AppData%\Adobe\Acrobat\Distiller*\Cache|*
FileKey2=%LocalAppData%\Adobe\Acrobat\Distiller*\Cache|*
RegKey1=HKCU\Software\Adobe\Acrobat Distiller\PrinterJobControl

[Adobe Acrobat *]
LangSecRef=3021
Detect=HKCU\Software\Adobe\Adobe Acrobat
FileKey1=%AppData%\Adobe\Acrobat\DC\Security\CRLCache|*|RECURSE
FileKey2=%AppData%\Adobe\OOBE|dlcanalytics.db
FileKey3=%LocalAppData%|oobelibMkey.log
FileKey4=%LocalAppData%\Adobe\Acrobat|*.idx|RECURSE
FileKey5=%LocalAppData%\Adobe\Acrobat\*DC\Cache|*.lst
FileKey6=%LocalAppData%\Adobe\Acrobat\11.0|UserCache.bin
FileKey7=%LocalAppData%\Adobe\Acrobat\DC|*.lst;Exchange-ProMessages;IconCacheAcro*.dat;SharedDataEvents;UserCache*.bin
FileKey8=%LocalAppData%\Adobe\Acrobat\DC\ProtectedView|*.lst;UserCache*.bin
FileKey9=%LocalAppData%\Adobe\Acrobat\DC\ToolsSearchCacheAcro|*|RECURSE
FileKey10=%LocalAppData%\Adobe\AcroCef\DC\Acrobat\Cache|*|RECURSE
FileKey11=%LocalAppData%\Adobe\AcroCef\DC\Acrobat\Cookie|*
FileKey12=%LocalAppData%\Adobe\Color|*.lst
FileKey13=%LocalAppData%\Adobe\TypeSupport|*.lst
FileKey14=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC|*-journal;Exchange-ProMessages
FileKey15=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\NotificationsDB|notificationsDB
FileKey16=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Eureka\AcroCoreSync\Adobe\CoreSync\EntitySync|*.db-shm;*.db-wal
FileKey17=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Eureka\AcroCoreSync\CreativeCloud\CoreSync|*.log
FileKey18=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Synchronizer|*-log.txt
FileKey19=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons|*|RECURSE
FileKey20=%UserProfile%\AppData\LocalLow\Adobe\Acrobat\DC\Search|*|RECURSE
FileKey21=%UserProfile%\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache|*|RECURSE
FileKey22=%UserProfile%\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie|*-journal
RegKey1=HKCU\Software\Adobe\Adobe Acrobat\11.0\AVGeneral\cRecentFolders
RegKey2=HKCU\Software\Adobe\Adobe Acrobat\2015\AVGeneral\cRecentFiles
RegKey3=HKCU\Software\Adobe\Adobe Acrobat\2015\AVGeneral\cRecentFolders
RegKey4=HKCU\Software\Adobe\Adobe Acrobat\2017\AVGeneral\cRecentFiles
RegKey5=HKCU\Software\Adobe\Adobe Acrobat\2017\AVGeneral\cRecentFolders
RegKey6=HKCU\Software\Adobe\Adobe Acrobat\2020\AVGeneral\cRecentFiles
RegKey7=HKCU\Software\Adobe\Adobe Acrobat\2020\AVGeneral\cRecentFolders
RegKey8=HKCU\Software\Adobe\Adobe Acrobat\DC\AVConnector\cIconCache
RegKey9=HKCU\Software\Adobe\Adobe Acrobat\DC\AVConversionFromPDF\cSettings
RegKey10=HKCU\Software\Adobe\Adobe Acrobat\DC\AVConversionToPDF\cSettings
RegKey11=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral|iNumAcrobatLaunches
RegKey12=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral|iNumOfAVDocsOpened
RegKey13=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral|uLastAppLaunchTimeStamp
RegKey14=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cDockables
RegKey15=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles
RegKey16=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFolders
RegKey17=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentToolsList
RegKey18=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cToolbars
RegKey19=HKCU\Software\Adobe\Adobe Acrobat\DC\CompoundDocs\cStoredBinder
RegKey20=HKCU\Software\Adobe\Adobe Acrobat\DC\RememberedViews\cNoCategoryFiles
RegKey21=HKCU\Software\Adobe\Adobe Acrobat\DC\SessionManagement|uLastAppExitTimeStamp
RegKey22=HKCU\Software\Adobe\Adobe Acrobat\DC\ShareIdentity
RegKey23=HKCU\Software\Adobe\Adobe Synchronizer\DC

Link to comment
Share on other sites
SMalik

SMalik

Posted
Posted

Revised entry

Removed as it is already included into built-in entry
%LocalAppData%\Microsoft\OneDrive\Logs|*|RECURSE

[Microsoft OneDrive *]
LangSecRef=3021
Detect=HKCU\Software\Microsoft\OneDrive
DetectFile=%LocalAppData%\Packages\microsoft.microsoftskydrive_*
FileKey1=%LocalAppData%\Microsoft\OneDrive\Setup\Logs|*|RECURSE
FileKey2=%LocalAppData%\Microsoft\Windows\OneDrive\logs|*|RECURSE
FileKey3=%LocalAppData%\OneDrive\Cache|*|RECURSE
FileKey4=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\AC|*|RECURSE
FileKey5=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\LocalCache|*|RECURSE
FileKey6=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\LocalState\Logs|*.log
FileKey7=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\Settings|*.log*
FileKey8=%LocalAppData%\Packages\microsoft.microsoftskydrive_*\TempState|*|RECURSE
FileKey9=%ProgramFiles%\Microsoft OneDrive\Setup\Logs|*
FileKey10=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\OneDrive\Logs|*|RECURSE
FileKey11=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\OneDrive\Setup\Logs|*|RECURSE
FileKey12=%WinDir%\System32\LogFiles\CloudFiles|*|RECURSE
FileKey13=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\OneDrive\Logs|*|RECURSE
FileKey14=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\OneDrive\Setup\Logs|*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.microsoftskydrive_8wekyb3d8bbwe\PersistedPickerData\microsoft.microsoftskydrive_8wekyb3d8bbwe!Microsoft.MicrosoftSkyDrive\DefaultOpenFileMultiple|LastLocation
RegKey2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.microsoftskydrive_8wekyb3d8bbwe\SearchHistory

Link to comment
Share on other sites
SMalik

SMalik

Posted
Posted

Revised entry name from [Groove Media Player *] to [Media Player *]

[Media Player *]
LangSecRef=3023
DetectFile=%LocalAppData%\Packages\Microsoft.ZuneMusic_*
FileKey1=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC|*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalCache\Image|*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalCache\PlayReady|*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState|*.tmp;AppState.json*;*.db*
FileKey5=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\Database\*|*.log
FileKey6=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\ImageCache|*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\ImageRetrievalFailure|*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\ImageStore|*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\navigationHistory|*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\PlayReady|*|RECURSE
FileKey11=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\Settings|*.log*
FileKey12=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\TempState|*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneMusic_8wekyb3d8bbwe\SearchHistory

Link to comment
Share on other sites
  • Moderators
Nergal

Nergal

Posted
  • Moderators
Posted (edited)

I'll try and investigate further but i just updated to the latest ini and noticed two things

Onedrive*  duplicates some of the cleaning that latest ccleaner onedrive option cleans.

Microsoft Phone link*  when phone link is fully exited, so all files can be removed, this entry resets phonelink to default unpaired state. This looks to be due to the removal of all the .db files.

 

phonelink.txt

Edited by Nergal
updated phone link notice

 

ADVICE FOR USING CCleaner'S REGISTRY INTEGRITY SECTION

DON'T JUST CLEAN EVERYTHING THAT'S CHECKED OFF.

Do your Registry Cleaning in small bits (at the very least Check-mark by Check-mark)

ALWAYS BACKUP THE ENTRY, YOU NEVER KNOW WHAT YOU'LL BREAK IF YOU DON'T.

Support at https://support.ccleaner.com/s/?language=en_US

Pro users file a PRIORITY SUPPORT via email support@ccleaner.com

Link to comment
Share on other sites
SMalik

SMalik

Posted
Posted

Revised entry
FileKey3, 4, 5, 6, 11 changed from |*|RECURSE to |*.*|RECURSE

[Adobe *]
LangSecRef=3023
Detect=HKCU\Software\Adobe
FileKey1=%AppData%\Adobe|*.log|RECURSE
FileKey2=%AppData%\Adobe\Acrobat\Distiller*|*.log
FileKey3=%AppData%\Adobe\Common\* Cache*|*.*|RECURSE
FileKey4=%AppData%\Adobe\Common\Peak Files|*.*|RECURSE
FileKey5=%AppData%\Adobe\CRLogs|*.*|RECURSE
FileKey6=%AppData%\Adobe\LogTransport2\Logs|*.*|RECURSE
FileKey7=%CommonProgramFiles%\Adobe\Creative Cloud Libraries|*.log|RECURSE
FileKey8=%CommonProgramFiles%\Adobe\Installers|*.log*|RECURSE
FileKey9=%LocalAppData%\Adobe|*.Log|RECURSE
FileKey10=%LocalAppData%\Adobe\ARM|*.*|RECURSE
FileKey11=%ProgramData%\Adobe\ARM|*.*|RECURSE
FileKey12=%ProgramFiles%\Adobe\Adobe Creative Cloud Experience\js\node_modules\table-parser\test\output|*.log
FileKey13=%UserProfile%\Documents\Adobe|*.log|RECURSE
RegKey1=HKCU\Software\Adobe\Adobe ARM\1.0\ARM|tLastT_Reader
RegKey2=HKCU\Software\Adobe\Adobe Customization Wizard 8\Recent File List
RegKey3=HKCU\Software\Adobe\Adobe Customization Wizard 9\Recent File List
RegKey4=HKCU\Software\Adobe\Adobe Customization Wizard X\Recent File List
RegKey5=HKCU\Software\Adobe\Adobe Customization Wizard XI\Recent File List

Link to comment
Share on other sites
SMalik

SMalik

Posted
Posted

Revised entry

Added:
%ProgramData%\Wondershare\dr.fone\ThumbnailCache
%ProgramData%\Wondershare\dr.fone\iOSTemp|*.*|RECURSE
%ProgramData%\Wondershare\dr.fone\log|*.log
%ProgramData%\Wondershare\dr.fone\Sparrow|*.bak;*.log

[Wondershare Dr.Fone *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Wondershare\Wondershare Dr.Fone
FileKey1=%AppData%\DataEraser_Temp|*.*|RECURSE
FileKey2=%ProgramData%\Wondershare\dr.fone\ThumbnailCache
FileKey3=%ProgramData%\Wondershare\dr.fone\Wondershare_DataEraser_Clean|*.*|RECURSE
FileKey4=%ProgramData%\Wondershare\dr.fone\iOSTemp|*.*|RECURSE
FileKey5=%ProgramData%\Wondershare\dr.fone\log|*.log
FileKey6=%ProgramData%\Wondershare\dr.fone\Sparrow|*.bak;*.log
FileKey7=%ProgramData%\Wondershare\DriverInstall|*.log
FileKey8=%ProgramData%\Wondershare\WSRoot|*.tmp
FileKey9=%ProgramData%\WsAppHelper\Dr.Fone|*.log
FileKey10=%ProgramFiles%\Wondershare\dr.fone\ThumbnailCache|*.*|RECURSE
FileKey11=%ProgramFiles%\Wondershare\MirrorGo\Log|*.*|RECURSE

Link to comment
Share on other sites
  • 3 weeks later...
SMalik

SMalik

Posted
Posted

New entry

[Western Digital Dashboard *]
LangSecRef=3024
Detect=HKLM\SOFTWARE\Western Digital\SSD Dashboard
FileKey1=%LocalAppData%\Western Digital\Dashboard\cache\QtWebEngine\Default\Cache|*|RECURSE
FileKey2=%LocalAppData%\Western Digital\Dashboard\QtWebEngine\Default|*.old
FileKey3=%LocalAppData%\Western Digital\Dashboard\QtWebEngine\Default\GPUCache|*|RECURSE
FileKey4=%ProgramFiles%\Western Digital\SSD Dashboard|dashboard.log

Link to comment
Share on other sites
PICPro

PICPro

Posted
Posted

I don't know if Archived entries.ini or Winapp3.ini are being maintained anymore, but here is something of note.

I found it odd that these Winapp3.ini entries will no longer show up in CCleaner 6.16 when they are pasted into WinApp2.ini even though they are properly formatted:

[Chrome Indexed Database Extended *], [Chrome Installer *], and [Chrome Local Storage Extended *]

What I have found is that entries starting with "Chrome", or contain "Section=Dangerous Google Chrome" will not show up in CCleaner's list.

Changing these entries to: 

[Chromium Indexed Database Extended *]
Section=Dangerous Chromium
(... rest of entry etc.)

[Chromium Installer *]
Section=Dangerous Chromium

[Chromium Local Storage Extended *]
Section=Dangerous Chromium

[Chromium Software Reporter *]
Section=Dangerous Chromium

solves it and the entries then work correctly.  It is very strange, but seems to be a quirk in CCleaner.  WinApp3.ini and Archived Entries.ini are both affected.

Link to comment
Share on other sites
Winapp2.ini

Winapp2.ini

Posted
  • Author
Posted
4 hours ago, PICPro said:

I don't know if Archived entries.ini or Winapp3.ini are being maintained anymore, but here is something of note.

I found it odd that these Winapp3.ini entries will no longer show up in CCleaner 6.16 when they are pasted into WinApp2.ini even though they are properly formatted:

[Chrome Indexed Database Extended *], [Chrome Installer *], and [Chrome Local Storage Extended *]

What I have found is that entries starting with "Chrome", or contain "Section=Dangerous Google Chrome" will not show up in CCleaner's list.

Changing these entries to: 

[Chromium Indexed Database Extended *]
Section=Dangerous Chromium
(... rest of entry etc.)

[Chromium Installer *]
Section=Dangerous Chromium

[Chromium Local Storage Extended *]
Section=Dangerous Chromium

[Chromium Software Reporter *]
Section=Dangerous Chromium

solves it and the entries then work correctly.  It is very strange, but seems to be a quirk in CCleaner.  WinApp3.ini and Archived Entries.ini are both affected.

very odd, is this a recent development or just something you recently noticed

winapp2.ini additions thread
winapp2.ini github
 

Link to comment
Share on other sites
PICPro

PICPro

Posted
Posted
5 hours ago, Winapp2.ini said:

very odd, is this a recent development or just something you recently noticed

I'm don't know what version of CCleaner that this changed.  I'm pretty sure that those entries used to work as is.  I recently installed Thorium browser on my WIndows 7 x64 computer to have a more up to date Chromium based browser.  I added Thorium lines to  the [Chromium ... *] entries in Winapp2.ini and that all went well, but when I tried to use the additional entries from Winapp3.ini, I noticed that the [Chrome ... *] entries didn't show in CCleaner's list event though the detects were satisfied.  I found that both the entry name and the section name affected this and I am using CCleaner 6.16 at the moment.  It is very weird indeed.

Anyone else want to try it?

Link to comment
Share on other sites
  • 3 weeks later...
siliconman01

siliconman01

Posted
Posted
4 hours ago, SMalik said:

What happened to all of the Microsoft store apps entries?

I was wondering this too.  I'm showing no Windows Store entries from Winapp2.ini on Windows 10 or 11.

 

 

WindowsStore.jpg

Windows 10 x64 Pro on ASUS Maximus VIII Extreme motherboard, i7-6700k CPU,H220 X2 Liquid Cooler, 64 gbyte RipJaws DDR4 3200 RAM, Samsung 970 Pro NVMe M.2 500 gbyte SSD + Samsung 850 Pro 512 gbyte SSD, EVGA RTX 3060 Titan graphics card (Home Built System);  Windows 11x64 Pro on 512 gigabyte Dell XPS 15 2-in-1 Laptop/tablet and Dell XPS 8940 PC.  ASUS RT-AC88U router, 14 tbyte WD My Cloud PR2100 NAS Server, 200 Mbps cable Internet, MS Edge Chromium, MS Office 2021 (Local), Casper 11, DisplayFusion (3 Flat Panel Displays per system):   Latest Bitdefender Internet Security, Quicken, Weather Watcher Live, ThumbsPlus 10, Sticky Password 8, WD Smartware, CyberLink PowerDVD23, MSI AfterBurner, Rainmeter, 8GadgetPack, and many more.

Link to comment
Share on other sites
APMichael

APMichael

Posted
Posted
7 hours ago, SMalik said:

What happened to all of the Microsoft store apps entries?

2 hours ago, siliconman01 said:

I was wondering this too.  I'm showing no Windows Store entries from Winapp2.ini on Windows 10 or 11.

As far as I know, @Winapp2.ini has abandoned the "Microsoft Store" category and sorted the applications into their respective categories. (I guess it has already been questioned why the "Microsoft Store Apps" were given their own category, although they could have simply been sorted into the existing categories.)

The entries are still there, but @Winapp2.ini has merged some of them. The easiest way to find them is to search for "DetectFile=%LocalAppData%\Packages\".

 

 

 

Link to comment
Share on other sites
siliconman01

siliconman01

Posted
Posted

Thanks for the explanation APMichael🙃  Fully recognizing that WinApp2.ini has been and still is fully voluntary, I continue to wish that we would get more frequent updates again. 😉

Windows 10 x64 Pro on ASUS Maximus VIII Extreme motherboard, i7-6700k CPU,H220 X2 Liquid Cooler, 64 gbyte RipJaws DDR4 3200 RAM, Samsung 970 Pro NVMe M.2 500 gbyte SSD + Samsung 850 Pro 512 gbyte SSD, EVGA RTX 3060 Titan graphics card (Home Built System);  Windows 11x64 Pro on 512 gigabyte Dell XPS 15 2-in-1 Laptop/tablet and Dell XPS 8940 PC.  ASUS RT-AC88U router, 14 tbyte WD My Cloud PR2100 NAS Server, 200 Mbps cable Internet, MS Edge Chromium, MS Office 2021 (Local), Casper 11, DisplayFusion (3 Flat Panel Displays per system):   Latest Bitdefender Internet Security, Quicken, Weather Watcher Live, ThumbsPlus 10, Sticky Password 8, WD Smartware, CyberLink PowerDVD23, MSI AfterBurner, Rainmeter, 8GadgetPack, and many more.

Link to comment
Share on other sites
siliconman01

siliconman01

Posted
Posted
21 hours ago, Andavari said:

I found a new cache path that needs cleaned for Microsoft Edge Chromium: 

%LocalAppData%\Microsoft\Edge*\User Data\GraphiteDawnCache

When I run CCleaner and then immediately check the User Data folder, all the caches have been cleared.  This applies to Windows 10/11 x64.🙄  My only browser is MSEdge Chromium (latest version).

Windows 10 x64 Pro on ASUS Maximus VIII Extreme motherboard, i7-6700k CPU,H220 X2 Liquid Cooler, 64 gbyte RipJaws DDR4 3200 RAM, Samsung 970 Pro NVMe M.2 500 gbyte SSD + Samsung 850 Pro 512 gbyte SSD, EVGA RTX 3060 Titan graphics card (Home Built System);  Windows 11x64 Pro on 512 gigabyte Dell XPS 15 2-in-1 Laptop/tablet and Dell XPS 8940 PC.  ASUS RT-AC88U router, 14 tbyte WD My Cloud PR2100 NAS Server, 200 Mbps cable Internet, MS Edge Chromium, MS Office 2021 (Local), Casper 11, DisplayFusion (3 Flat Panel Displays per system):   Latest Bitdefender Internet Security, Quicken, Weather Watcher Live, ThumbsPlus 10, Sticky Password 8, WD Smartware, CyberLink PowerDVD23, MSI AfterBurner, Rainmeter, 8GadgetPack, and many more.

Link to comment
Share on other sites
  • Moderators
Andavari

Andavari

Posted
  • Moderators
Posted
On 20/11/2023 at 00:08, siliconman01 said:

When I run CCleaner and then immediately check the User Data folder, all the caches have been cleared.  This applies to Windows 10/11 x64.🙄  My only browser is MSEdge Chromium (latest version).

That folder had cached files in it on my system. When looking at winapp2.ini online (direct download version), it didn't clean that folder, there was no reference of it. I also have Microsoft Edge Chromium (latest version).

Edit:
That "GraphiteDawnCache" folder was a relatively new creation, the creation stamp date states "Tuesday, ‎August ‎22, ‎2023", and I know it was not in there for very long because once in a while I go about snooping in there to see what they've added.

Link to comment
Share on other sites
  • Moderators
Andavari

Andavari

Posted
  • Moderators
Posted

That explains why I couldn't find it, being it's a wildcard entry, and my winapp2.ini may have been outdated, don't know.

BUT (a big BUT), I don't like deleting "REMOVESELF" cache folders, instead I clean them out, due to past issues of deleting them outright.

How I clean that folder:
%LocalAppData%\Microsoft\Edge*\User Data\GraphiteDawnCache|*.*|RECURSE

Link to comment
Share on other sites
  • Moderators
Andavari

Andavari

Posted
  • Moderators
Posted

 

Two more. Don't know if it's from Microsoft Edge Chromium, or Windows Updates, or something else.

Both created on November 8, 2023 within 7 minutes of each other.

 

Contains telemetry data: 

C:\ProgramData\profile_count_updates.json

 

Was empty: 

C:\ProgramData\UpdateLock-updates

 

Link to comment
Share on other sites
  • 2 weeks later...
siliconman01

siliconman01

Posted
Posted
1 hour ago, Andavari said:

 

If anyone cleans Windows Update logs in their own personal winapp2.ini file there's another area to clean them from now also:
%CommonAppData%\PLUG\Logs|*.*|RECURSE

I had a ton of stuff in there.

 

Modified entry:  [Windows Update *]

Added FileKey9 

[Windows Update *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
FileKey1=%LocalAppData%\Microsoft\Windows\Windows Anytime Upgrade|Upgrade.log
FileKey2=%LocalAppData%\MigWiz|*|REMOVESELF
FileKey3=%LocalAppData%\Packages\MicrosoftWindows.Client*\AC|*|RECURSE
FileKey4=%LocalAppData%\Packages\MicrosoftWindows.Client*\LocalCache|*|RECURSE
FileKey5=%LocalAppData%\Packages\MicrosoftWindows.Client*\LocalState\EBWebview\*|LOG;LOG.old|RECURSE
FileKey6=%LocalAppData%\Packages\MicrosoftWindows.Client*\LocalState\EBWebview\Default\Service Worker\CacheStorage\*|*|RECURSE
FileKey7=%LocalAppData%\Packages\MicrosoftWindows.Client*\Settings|*.log*
FileKey8=%LocalAppData%\Packages\MicrosoftWindows.Client*\TempState|*|RECURSE
FileKey9=%ProgramData%\Plug\Logs|*.*
FileKey10=%ProgramData%\USOShared\Logs|*.etl|RECURSE
FileKey11=%ProgramFiles%\CUAssistant\Logs|*.etl
FileKey12=%ProgramFiles%\Microsoft Update Health Tools\Logs|*
FileKey13=%ProgramFiles%\rempl\Logs|*.etl
FileKey14=%ProgramFiles%\WindowsInstallationAssistant\Logs|*
FileKey15=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache|*|RECURSE
FileKey16=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs|*|RECURSE
FileKey17=%WinDir%\SoftwareDistribution\DataStore\Logs|*|RECURSE
FileKey18=%WinDir%\System32\MRT\*|*.log|REMOVESELF

 

Windows 10 x64 Pro on ASUS Maximus VIII Extreme motherboard, i7-6700k CPU,H220 X2 Liquid Cooler, 64 gbyte RipJaws DDR4 3200 RAM, Samsung 970 Pro NVMe M.2 500 gbyte SSD + Samsung 850 Pro 512 gbyte SSD, EVGA RTX 3060 Titan graphics card (Home Built System);  Windows 11x64 Pro on 512 gigabyte Dell XPS 15 2-in-1 Laptop/tablet and Dell XPS 8940 PC.  ASUS RT-AC88U router, 14 tbyte WD My Cloud PR2100 NAS Server, 200 Mbps cable Internet, MS Edge Chromium, MS Office 2021 (Local), Casper 11, DisplayFusion (3 Flat Panel Displays per system):   Latest Bitdefender Internet Security, Quicken, Weather Watcher Live, ThumbsPlus 10, Sticky Password 8, WD Smartware, CyberLink PowerDVD23, MSI AfterBurner, Rainmeter, 8GadgetPack, and many more.

Link to comment
Share on other sites
SMalik

SMalik

Posted
Posted
3 hours ago, SMalik said:

Revised entry

Added:
%WinDir%\Backup|*|RECURSE
%WinDir%\AppCompat\pca|*.txt

[Windows Logs *]

Revised entry

I made a mistake in the previous post. This is correct.

Added:
%WinDir%\AppCompat\Backup|*.json
%WinDir%\AppCompat\pca|*.txt

[Windows Logs *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
FileKey1=%LocalAppData%\ConnectedDevicesPlatform|*.log
FileKey2=%LocalAppData%\Diagnostics|*|RECURSE
FileKey3=%LocalAppData%\Microsoft\Dialer|*.log.txt
FileKey4=%LocalAppData%\Microsoft\msipc\Logs|*
FileKey5=%LocalAppData%\Microsoft\Portable Devices|wpdlog*.sqm
FileKey6=%LocalAppData%\Microsoft\Windows\Explorer|*.etl
FileKey7=%ProgramData%\Microsoft\Diagnosis\DownloadedSettings|*.json.bk
FileKey8=%ProgramData%\Microsoft\Diagnosis\ETLLogs|*|RECURSE
FileKey9=%ProgramData%\Microsoft\DiagnosticLogCSP|*|RECURSE
FileKey10=%ProgramData%\Microsoft\Network\Downloader|*|RECURSE
FileKey11=%ProgramData%\Microsoft\WDF|*|RECURSE
FileKey12=%ProgramData%\Microsoft\Windows Security Health\Logs|*|RECURSE
FileKey13=%ProgramData%\Microsoft\Windows\wfp|*.etl
FileKey14=%ProgramData%\USOShared\Logs|*|RECURSE
FileKey15=%ProgramFiles%\UNP\*Logs|*
FileKey16=%SystemDrive%|DumpStack.log
FileKey17=%SystemDrive%\PerfLogs\System\Diagnostics|*|RECURSE
FileKey18=%SystemDrive%\PerfLogs\System\Performance|*|RECURSE
FileKey19=%WinDir%|*.log
FileKey20=%WinDir%\AppCompat\Backup|*.json
FileKey21=%WinDir%\AppCompat\pca|*.txt
FileKey22=%WinDir%\AppCompat\Programs|*.txt;*.xml
FileKey23=%WinDir%\AppCompat\Programs\Install|*.txt;*.xml
FileKey24=%WinDir%\debug|*.log|RECURSE
FileKey25=%WinDir%\INF|*.etl;*.log*
FileKey26=%WinDir%\Logs|*.etl;*.log|RECURSE
FileKey27=%WinDir%\Logs\CBS|*.cab
FileKey28=%WinDir%\Panther|cbs.log;DDACLSys.log;miglog.xml;Migrep.html;*GatherPnPList.log;*.tmp
FileKey29=%WinDir%\Panther\FastCleanup|*.log
FileKey30=%WinDir%\Panther\Rollback|*.txt
FileKey31=%WinDir%\Panther\UnattendGC|diag*.xml;setup*.log
FileKey32=%WinDir%\repair|setup.log
FileKey33=%WinDir%\security\logs|*|RECURSE
FileKey34=%WinDir%\ServiceProfiles\NetworkService\debug|*.log
FileKey35=%WinDir%\System32\CatRoot|*.tmp
FileKey36=%WinDir%\System32\CatRoot_bak|*|REMOVESELF
FileKey37=%WinDir%\System32\catroot2|*.chk;*.log;*.jrs;*.txt
FileKey38=%WinDir%\System32\LogFiles|*|RECURSE
FileKey39=%WinDir%\System32\Logs|*.etl
FileKey40=%WinDir%\System32\NDF|*.etl
FileKey41=%WinDir%\System32\SleepStudy|*.etl|RECURSE
FileKey42=%WinDir%\System32\sysprep\Panther\IE|diagerr.xml;diagwrn.xml;*.log
FileKey43=%WinDir%\System32\WDI\*|*.etl*|REMOVESELF
FileKey44=%WinDir%\System32\WDI\LogFiles\StartupInfo|*|RECURSE
FileKey45=%WinDir%\Temp|*.log
RegKey1=HKLM\Software\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications
RegKey2=HKLM\Software\Microsoft\Tracing
RegKey3=HKLM\Software\Wow6432Node\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications
RegKey4=HKLM\Software\Wow6432Node\Microsoft\Tracing

Link to comment
Share on other sites
  • Moderators
Andavari

Andavari

Posted
  • Moderators
Posted

 

Updated.

Added: C:\Windows\%LOCALAPPDATA%\CrashDumps
Added With FileKey4: FileKey4=%WinDir%\*LOCALAPPDATA*\CrashDumps|*dmp*

Notes:
* Has to be written as *LOCALAPPDATA*, since using %LOCALAPPDATA% won't work with there already being a leading path with %WinDir% in it.
* Seems to only store Microsoft Defender Antivirus ("Windows Defender") crash dumps with names like these for example: MsMpEng.exe.4792.dmp, MsMpEng.exe.4804.dmp 

[Windows Error Reporting *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows\Windows Error Reporting
FileKey1=%LocalAppData%\CrashDumps|*dmp*
FileKey2=%LocalAppData%\PCHealth\ErrorRep\QSignoff|*
FileKey3=%WinDir%\LiveKernelReports|*.dmp|RECURSE
FileKey4=%WinDir%\*LOCALAPPDATA*\CrashDumps|*dmp*
FileKey5=%WinDir%\pchealth\ERRORREP|*|RECURSE
FileKey6=%WinDir%\pchealth\helpctr\DataColl|*.xml
FileKey7=%WinDir%\pchealth\helpctr\OfflineCache|*|RECURSE
FileKey8=%WinDir%\System32\config\systemprofile\AppData\Local\CrashDumps|*.dmp|RECURSE
FileKey9=%WinDir%\System32\config\systemprofile\AppData\Local\CrashDumps|*dmp*
FileKey10=%WinDir%\System32\config\systemprofile\Local Settings\Application Data\CrashDumps|*.dmp|RECURSE
FileKey11=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\CrashDumps|*.dmp|RECURSE
FileKey12=%WinDir%\SysWOW64\config\systemprofile\Local Settings\Application Data\CrashDumps|*.dmp|RECURSE
RegKey1=HKLM\Software\Microsoft\Windows\Windows Error Reporting\FullLiveKernelReports|LastFullLiveReport
RegKey2=HKLM\Software\Microsoft\Windows\Windows Error Reporting\FullLiveKernelReports\win32k.sys
RegKey3=HKLM\Software\Microsoft\Windows\Windows Error Reporting\LiveKernelReports\win32k.sys
RegKey4=HKLM\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps
RegKey5=HKU\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting\Debug|StoreLocation

 

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.

  I accept