Winapp2.ini additions

[nodles]

NEW ENTRY:

[Tweaking.com Windows Repair*]
LangSecRef=3024
DetectFile=%SystemDrive%\Tweaking.com_Windows_Repair_Logs
Default=False
FileKey1=%SystemDrive%\Tweaking.com_Windows_Repair_Logs|*.*

[nodles]

NEW ENTRY:

[installShield Installation Information*]
LangSecRef=3024
DetectFile=%ProgramFiles%\InstallShield Installation Information
Default=False
FileKey1=%ProgramFiles%\InstallShield Installation Information|*.log|RECURSE

[Hav0c]

NEW ENTRY:

[ESET NOD32 Antivirus*]
LangSecRef=3021
Detect=HKLM\SOFTWARE\ESET\ESET Security
Default=False
FileKey1=%CommonAppData%\ESET\ESET NOD32 Antivirus\updfiles|*.*|RECURSE
FileKey2=%CommonAppData%\ESET\ESET NOD32 Antivirus\Logs|*.*|RECURSE
FileKey3=%CommonAppData%\ESET\ESET NOD32 Antivirus\Oldfiles|*.*|RECURSE

 

NOTE: don't know if this should come with a warning as ESET stated

 

You should be able to delete the folder updfiles but I would recommend to do this in safe mode for the antivirus package alternatively if you wish to delete the updfiles folder for ESET Remote Administrator then remeber to stop the ERA service.

[siliconman01]

New Entry:

 

[spywareBlaster Update File*]
LangSecRef=3024
DetectFile=%ProgramFiles%\SpywareBlaster\sbautoupdate.exe
Default=False
Warning=This deletes SWB program updater file spywareblasterupgrade_latest.exe which is no longer needed once a SWB program version update occurs.
FileKey1=%ProgramFiles%\SpywareBlaster\|spywareblasterupgrade_latest.exe

 

This is for security program SpywareBlaster, licensed version with automatic updates. File spywareblasterupgrade_latest.exe is generated when a new SWB version is automatically downloaded and installed. Once the upgrade occurs the file is no longer needed. (See the forum discussion at the link below.) Although it is supposed to be automatically removed on the next reboot, the file is left hanging on my Windows 7 SP1 x64 and x86 Professional systems. So I assume that others have a similar unneccessary file.

 

http://www.wildersse...ad.php?t=323061

[2nd base]

[Windows Live Movie Maker Recent List*]
LangSecRef=3022
Detect=HKCU\Software\Microsoft\Windows Live\Movie Maker
Default=False
RegKey1=HKCU\Software\Microsoft\Windows Live\Movie Maker\Recent

 

should be tested more to make sure it rebuilds the recent key after clearing.

 

via www.windowsmoviemakers.net/Forums/ShowPost.aspx?PostID=251089 and http://answers.micro...5e-39c413188ed0

 

Program has rebuilt the list. Thanks again.

[Berntsson]

I hope I'm in the right section...

 

I'd like to request an addition, or instructions on how to add the following registry key(s). These keys list all the network adapters that have been installed on a machine. On XP they also list the connection information of the access points connected to. On Win7 those connections are in a folder that can be wiped using CCleaner's custom folder/file option. It is:

 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WZCSVC\Parameters\Interfaces\[interface Guid]

 

The folder is:

 

C:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\[interface Guid]

 

The registry key appears in several other places, but I'm not a registry expert...but it is always the same (WZCSVC\Parameters, etc...)

 

Just looking at deleting the Guid's, leaving the main key. Deleting these does no permanent harm, the adapter gets re-created on boot, but I think it's a good privacy measure to delete them.

 

http://www.iccyber.o...P_Eric_Rowe.pdf

 

This is another key:

 

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces

 

I haven't tested if deleting these Guid's causes a problem or not.

 

Thanks

[siliconman01]

Non-functioning Belarc* needs to be modified to the following code:

 

[belarc*]
LangSecRef=3024
Detect=HKCU\Software\Belarc
Default=False
FileKey1=%ProgramFiles%\Belarc\Advisor\|INSTALL.Log
FileKey2=%ProgramFiles%\Belarc\Advisor\System\|Progress.Log
FileKey3=%ProgramFiles%\Belarc\Advisor\System\Tmp\|*.*

[Winapp2.ini]

thanks

[Andavari]

This is another key:

 

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces

 

I haven't tested if deleting these Guid's causes a problem or not.

 

That's where your default Gateway, etc., reside to use the Internet, and I'd think wiping out the whole thing would possibly cause issues.

[Nergal]

I haven't tested if deleting these Guid's causes a problem or not.

 

Quick Reminder to EVERYBODY, please do not submit untested entries.

Thanks

MGMT

[Winapp2.ini]

Thanks, MGMT!

[Nergal]

Actually as I left out the comma I believe I may have been thanking http://en.wikipedia....thyltransferase LOL

 

MGMT has also been shown to be a useful tool increasing gene therapy efficiency. By using a two component vector consisting of a transgene of interest and MGMT, in vivo drug selection can be utilized to select for successfully transduced cells

[APMichael]

I'm back from my vacation. Thanks for the update. Following two suggestions are missed:

 

Please change the following entry, because RegKey2 and 3 are included in winapp.ini of CCleaner now:

[Windows Media Player (MediaGuide)*]

LangSecRef=3023

Detect=HKCU\Software\Microsoft\MediaPlayer

Default=True

RegKey1=HKCU\Software\Microsoft\MediaPlayer\Preferences|CurrentBackgroundScanFolder

RegKey2=HKCU\Software\Microsoft\MediaPlayer\Services\MediaGuide|CachedIconPath

RegKey3=HKCU\Software\Microsoft\MediaPlayer\Services\MediaGuide|CachedLargeLogoPath

 

I think you can remove the following entry, because RegKey and FileKey are included in winapp.ini of CCleaner (for Office 2003, 2007 and 2010):

[MS Office Temp Files*]

LangSecRef=3021

Detect=HKCU\Software\Microsoft\Office

Default=False

RegKey1=HKCU\Software\Microsoft\Office\Common|FontBmpCache

FileKey1=%AppData%\Microsoft\Office|*.tmp|RECURSE

 

 

And between the entries [Windows Log Files More*] and [Windows Mail*] is no blank line.

[nodles]

NEW ENTRY:

[TomTom*]
LangSecRef=3021
Detect=HKCU\Software\TomTom
Default=False
FileKey1=%AppData%\TomTom\HOME\Profiles\*|Log.txt

[nodles]

MODIFIED ENTRIES:

[batman: Arkham City*]
LangSecRef=3021
Detect=HKLM\SOFTWARE\Warner Bros\Batman Arkham City
Default=False
FileKey1=%Documents%\WB Games\Batman Arkham City\BmGame\Logs|*.*

<-Changed DetectFile to Detect.

[battlefield 3*]
LangSecRef=3021
Detect=HKLM\SOFTWARE\EA Games\Battlefield 3
Default=False
FileKey1=%ProgramFiles%\Origin Games\Battlefield 3\__Installer|InstallLog.txt

<-Changed DetectFile to Detect.

[League of Legends*]
LangSecRef=3021
Detect=HKLM\SOFTWARE\Riot Games\League of Legends
Default=False
FileKey1=%HomeDrive%\Riot Games\League of Legends\rads|*.log*
FileKey2=%HomeDrive%\Riot Games\League of Legends\rads\solutions\lol_game_client_sln\releases\0*\deploy|*.log
FileKey3=%HomeDrive%\Riot Games\League of Legends\rads\solutions\lol_game_client_sln\releases\0*\deploy|*.txt
FileKey4=%HomeDrive%\Riot Games\League of Legends\rads\projects\lol_air_client\releases\0*\deploy\logs|*.log
FileKey5=%HomeDrive%\Riot Games\League of Legends\rads\projects\lol_launcher\releases\0*\deploy|*.log
FileKey6=%HomeDrive%\Riot Games\League of Legends\rads\projects\lol_launcher\releases\0*\deploy\temp|*.tmp
FileKey7=%HomeDrive%\Riot Games\League of Legends\Logs|*.txt|RECURSE
FileKey8=%UserProfile%\riotsGamesLogs|*.log

<-Changed entry name & changed DetectFile to Detect. Merged with entry [Riot Games Logs*] which can be removed.

[Origin*]
LangSecRef=3021
Detect=HKLM\SOFTWARE\Origin
Default=False
FileKey1=%CommonAppData%\Origin\Logs|*.*
FileKey2=%CommonAppData%\Origin\DownloadCache|*.*|RECURSE
FileKey3=%CommonAppData%\Origin\AvatarsCache|*.*|RECURSE
FileKey4=%LocalAppData%\Origin\Web Cache|*.*|RECURSE
FileKey5=%SystemDrive%|shared.log

<-Changed DetectFile to Detect.

[star Wars: The Old Republic*]
LangSecRef=3021
Detect=HKLM\SOFTWARE\BioWare\Star Wars-The Old Republic
Default=False
FileKey1=%Documents%|Install STAR WARS The Old Republic.log
FileKey2=%LocalAppData%\SWTOR\CrashDump\swtor|*.*
FileKey3=%ProgramFiles%\Electronic Arts\BioWare\Star Wars-The Old Republic\betatest\retailclient\Temp|*.log
FileKey4=%ProgramFiles%\Electronic Arts\BioWare\Star Wars-The Old Republic\logs|*.log
FileKey5=%ProgramFiles%\Electronic Arts\BioWare\Star Wars-The Old Republic\swtor\retailclient\swtor\logs|*.log
FileKey6=%Documents%|Uninstall STAR WARS The Old Republic.log
FileKey7=%ProgramFiles%\Origin Games\Star Wars - The Old Republic\swtor\retailclient\swtor\logs|*.*
FileKey8=%ProgramFiles%\Origin Games\Star Wars - The Old Republic\logs|*.*
FileKey9=%ProgramFiles%\Origin Games\Star Wars - The Old Republic\__Installer|InstallLog.txt

<-Changed DetectFile to Detect.

[Windows Live Messenger Chat History*]
LangSecRef=3022
Detect=HKLM\SOFTWARE\Microsoft\Windows Live\Messenger
Warning=Removes Windows Live Messenger chat history!
Default=False
FileKey1=%Documents%\My Received Files\*\History|*.*

<-Changed DetectFile to Detect.

[Windows Live Messenger More*]
LangSecRef=3022
Detect=HKLM\SOFTWARE\Microsoft\Windows Live\Messenger
Warning=After running this, you will not be able to uninstall Windows Live Essentials components without downloading the installer again.
Default=False
FileKey1=%LocalAppData%\Microsoft\Messenger|*.uccapilog|RECURSE
FileKey2=%LocalAppData%\Microsoft\Messenger|*.bak|RECURSE
FileKey3=%LocalAppData%\Microsoft\Messenger|*.txt|RECURSE
FileKey4=%LocalAppData%\Microsoft\Windows Live Contacts|*.log|RECURSE
FileKey5=%LocalAppData%\Microsoft\Windows Live Contacts|*.jrs|RECURSE
FileKey6=%LocalAppData%\Microsoft\Windows Live|*.log|RECURSE
FileKey7=%LocalAppData%\Microsoft\Windows Live|*.jrs|RECURSE
FileKey8=%CommonProgramFiles%\Windows Live\.cache|*.*|RECURSE
FileKey9=%LocalLowAppData%\Microsoft\Windows Live\Setup|*.*|REMOVESELF
FileKey10=%LocalAppData%\Microsoft\Windows Live|*.sqm|RECURSE
FileKey11=%LocalAppData%\Microsoft\Windows Live Contacts\*\*\*\Backup|*.*|RECURSE
FileKey12=%ProgramFiles%\Windows Live\Messenger|*.bak|RECURSE
FileKey13=%WinDir%\System32\config\systemprofile\Documents|wlidsvctrace*.txt

<-Changed DetectFile to Detect.

[Winapp2.ini]

Thanks!

[Coffee4Joe]

Modified

Added FileKey2

after snapshot 12w18a, single player will run as a local server

[Minecraft*]
LangSecRef=3021
DetectFile=%AppData%\.minecraft
Default=False
FileKey1=%AppData%\.minecraft\stats|*.old
FileKey2=%AppData%\.minecraft\server|server.log

[Hav0c]

MODIFIED ENTRIES:

 

<-Changed DetectFile to Detect.

[Tracks Eraser Pro Log*]
LangSecRef=3024
Detect=HKLM\Software\Acesoft\tracks eraser pro
Default=False
FileKey1=%ProgramFiles%\Acesoft\Tracks Eraser Pro|te.log

 

<-Changed DetectFile to Detect.

[K-Lite Codec Pack Install Log*]
LangSecRef=3023
Detect=HKLM\Software\KLCodecPack
Default=False
FileKey1=%ProgramFiles%\K-Lite Codec Pack|install.log

 

 

<-Changed DetectFile to Detect.

[WinASO Registry Optimizer (Backups)*]
LangSecRef=3024
Detect=HKLM\Software\WinASO\Registry Optimizer
Default=False
FileKey1=%ProgramFiles%\WinASO\Registry Optimizer\backup|*.*|RECURSE

 

 

<-Changed DetectFile to Detect.

[spybot Search and Destroy Hosts Backups*]
LangSecRef=3024
Detect=HKLM\Software\Safer Networking Limited\SpybotSnD
Default=False
FileKey1=%WinDir%\System32\drivers\etc|hosts.*.backup

 

 

<-Changed DetectFile to Detect.

[spybot Search And Destroy Updates*]
LangSecRef=3024
Detect=HKLM\Software\Safer Networking Limited\SpybotSnD
Default=False
FileKey1=%ProgramFiles%\Spybot - Search & Destroy\Updates|*.zip

 

Question:

Does changing DetectFile to Detect make such a huge difference that all has to be Detect ?

[nodles]

Question:

Does changing DetectFile to Detect make such a huge difference that all has to be Detect ?

Thanks again, Joe!

 

Sidenote: I did some actual testing today and although the difference is extremely small, there is a small difference in running a blank clean with Registry detections.

 

(Using Alan_B's script to time a CCleaner.exe /AUTO run, which counts running time as well, there was about a 30ms difference on my machine. Slower machines may see better/worse speeds.)

CCleaner/Winapp2.ini loads a bit faster with Detect (using registry).

[nodles]

Should we merge all Comodo entries into one?

[Comodo Crash Dumps*]
LangSecRef=3024
DetectFile=%CommonAppData%\Comodo
Default=False
FileKey1=%CommonAppData%\Comodo\CisDumps|*.*

[Comodo Temps*]
LangSecRef=3024
DetectFile=%CommonAppData%\Comodo
Default=False
FileKey1=%CommonAppData%\Comodo\Installer|*.*
FileKey2=%CommonAppData%\Comodo Downloader|*.*

[Comodo Update Temps*]
LangSecRef=3024
DetectFile1=%ProgramFiles%\COMODO\COMODO Internet Security
DetectFile2=%LocalAppData%\Temp\Comodo\Firewall Pro\Data\TempFiles
Default=False
FileKey1=%ProgramFiles%\COMODO\COMODO Internet Security|*.tmp
FileKey2=%LocalAppData%\Temp\Comodo\Firewall Pro\Data\TempFiles|*.*

[CSC Cache*]
LangSecRef=3023
DetectFile=%AppData%\ComodoGroup\CSC
Default=False
FileKey1=%AppData%\ComodoGroup\CSC\Cache|*.*

Here's the merged entry with Detect instead of DetectFile:

[Comodo*]
LangSecRef=3024
Detect=HKCU\Software\ComodoGroup
Default=False
FileKey1=%AppData%\ComodoGroup\CSC\Cache|*.*
FileKey2=%CommonAppData%\Comodo Downloader|*.*
FileKey3=%CommonAppData%\Comodo\CisDumps|*.*
FileKey4=%CommonAppData%\Comodo\Installer|*.*
FileKey5=%LocalAppData%\Temp\Comodo\Firewall Pro\Data\TempFiles|*.*
FileKey6=%ProgramFiles%\COMODO\COMODO Internet Security|*.tmp

[nodles]

Same with Avira products (with other changes):

[Avira More*]
LangSecRef=3024
Detect=HKLM\SOFTWARE\Avira
Default=False
FileKey1=%CommonAppData%\Avira|*.tmp|RECURSE
FileKey2=%CommonAppData%\Avira|*.log|RECURSE
FileKey3=%ProgramFiles%\Avira|*.tmp|RECURSE
FileKey4=%ProgramFiles%\Avira|*.log|RECURSE
FileKey5=%ProgramFiles%\Avira GmbH|*.log|RECURSE

From:

[AntiVir Personal 8*]
LangSecRef=3024
Detect=HKLM\SOFTWARE\Avira\AntiVir PersonalEdition Classic
Default=False
FileKey1=%CommonAppData%\Avira\AntiVir PersonalEdition Classic\BACKUP\FAILSAFE|*.tmp
FileKey2=%CommonAppData%\Avira\AntiVir PersonalEdition Classic\LOGFILES|*.log
FileKey3=%ProgramFiles%\Avira\AntiVir PersonalEdition Classic|*.tmp
FileKey4=%ProgramFiles%\Avira\AntiVir PersonalEdition Classic\FAILSAFE|*.tmp

[Avira AntiVir Logs*]
LangSecRef=3024
Detect=HKLM\SOFTWARE\Avira
Default=False
FileKey1=%ProgramFiles%\Avira\AntiVir Desktop\APPDATA\LOGFILES|*.*

[Avira RootKit Detection*]
LangSecRef=3024
DetectFile=%ProgramFiles%\Avira GmbH\Avira RootKit Detection\avirarkd.exe
Default=False
FileKey1=%ProgramFiles%\Avira GmbH\Avira RootKit Detection|*.log|RECURSE

What do you think?

[nodles]

How about AMD/ATI?

[AMD/ATI*]
LangSecRef=3024
Detect=HKLM\Software\AMD
Detect2=HKLM\Software\ATI
Detect3=HKLM\Software\ATI Technologies
Default=False
FileKey1=%CommonAppData%\AMD\Fuel|*.txt
FileKey2=%LocalAppData%\AMD\Fuel|ClientProxyLog*.*
FileKey3=%LocalAppData%\ATI\ACE|*.txt
FileKey4=%ProgramFiles%\AMD\OverDrive|*.log
FileKey5=%ProgramFiles%\ATI\CIM\Reports|*.xml
FileKey6=%ProgramFiles%\ATI Technologies|cccutil64.txt
FileKey7=%SystemDrive%\ATI|*.*|REMOVESELF
FileKey8=%SystemDrive%\AMD|*.*|REMOVESELF

 

From:

[ATI Technologies Log*]
LangSecRef=3024
Detect=HKLM\Software\ATI Technologies\
Default=False
FileKey1=%ProgramFiles%\ATI Technologies|cccutil64.txt

[ATI/AMD Graphics Card Driver Install Logs*]
LangSecRef=3024
Detect=HKLM\Software\Ati Technologies\Install\ATI Catalyst Install Manager
Default=False
FileKey1=%ProgramFiles%\ATI\CIM\Reports|*.xml

[ATI/AMD Graphics Driver Install Files*]
LangSecRef=3024
Detect=HKLM\Software\Ati Technologies\Install\ATI Catalyst Install Manager
Default=False
FileKey1=%SystemDrive%\ATI|*.*|REMOVESELF
FileKey2=%SystemDrive%\AMD|*.*|REMOVESELF

[AMD OverDrive*]
LangSecRef=3024
DetectFile=%ProgramFiles%\AMD\OverDrive
Default=False
FileKey1=%ProgramFiles%\AMD\OverDrive|*.log

[AMD ACE*]
LangSecRef=3024
Detect=HKLM\Software\ATI\ACE
Default=False
FileKey1=%LocalAppData%\ATI\ACE|*.txt

[AMD Fuel Logs*]
LangSecRef=3024
Detect=HKLM\Software\AMD\Fuel
Default=False
FileKey1=%LocalAppData%\AMD\Fuel|ClientProxyLog*.*
FileKey2=%CommonAppData%\AMD\Fuel|*.txt

[nodles]

MODIFIED / MERGED ENTRIES:

 

Merged Adobe Flash entries to:

[Adobe Flash More*]
LangSecRef=3023
Detect=HKCU\Software\Macromedia\FlashPlayer
Default=False
FileKey1=%AppData%\Adobe\Flash Player\AssetCache|*.*|RECURSE
FileKey2=%WinDir%\System32\Macromed\Flash|FlashInstall.log
FileKey3=%WinDir%\SysWOW64\Macromed\Flash|FlashInstall.log

From:

[Adobe Flash Install Logs*]
LangSecRef=3023
Detect=HKCU\Software\Macromedia\FlashPlayer
Default=False
FileKey1=%WinDir%\System32\Macromed\Flash|FlashInstall.log
FileKey2=%WinDir%\SysWOW64\Macromed\Flash|FlashInstall.log

[Adobe Flash Player Asset Cache*]
LangSecRef=3023
Detect=HKCU\Software\Macromedia\FlashPlayer
Default=False
FileKey1=%AppData%\Adobe\Flash Player\AssetCache|*.*|RECURSE

 

[Foxit Reader 5.0 More*]
LangSecRef=3021
Detect=HKCU\Software\Foxit Software\Foxit Reader 5.0
Default=False
RegKey1=HKCU\Software\Foxit Software\Foxit Reader 5.0\RecentFiles
RegKey2=HKCU\Software\Foxit Software\Foxit Reader 5.0\Preferences\Others|csInitialOpenDir
RegKey3=HKCU\Software\Foxit Software\Foxit Reader 5.0\Recent File List

<-Added RegKey3. Apparently wildcards don't work with regkeys?

 

Merged MBAM entries:

[MalwareBytes Anti Malware More*]
LangSecRef=3024
Detect=HKCU\Software\Malwarebytes' Anti-Malware
Default=False
FileKey1=%AppData%\Malwarebytes\Malwarebytes' Anti-Malware\Logs|*.*
FileKey2=%CommonAppData%\Malwarebytes\Malwarebytes' Anti-Malware\Logs|*.*
FileKey3=%CommonAppData%\Malwarebytes\Malwarebytes' Anti-Malware|mbam-setup.exe

From:

[MalwareBytes Anti Malware Logs*]
LangSecRef=3024
Detect=HKCU\Software\Malwarebytes' Anti-Malware
Default=False
FileKey1=%CommonAppData%\Malwarebytes\Malwarebytes' Anti-Malware\Logs|*.*
FileKey2=%AppData%\Malwarebytes\Malwarebytes' Anti-Malware\Logs|*.*

[Malwarebytes Anti Malware Setup File*]
LangSecRef=3024
Detect=HKCU\Software\Malwarebytes' Anti-Malware
Default=False
FileKey1=%CommonAppData%\Malwarebytes\Malwarebytes' Anti-Malware|mbam-setup.exe

 

[Microsoft Standalone System Sweeper Tool*]
LangSecRef=3024
Detect=HKCU\Software\Microsoft\Microsoft Standalone System Sweeper Tool
DetectFile=%WinDir%\Windows Defender Offline\Support
Default=False
FileKey1=%CommonAppData%\Microsoft\Microsoft Standalone System Sweeper Tool\Support|*.log
FileKey2=%WinDir%\Windows Defender Offline\Support|*.txt

<-Changed DetectFile to Detect.

 

[secunia PSI*]
LangSecRef=3021
Detect=HKLM\SOFTWARE\Secunia\PSI
Detect2=HKCU\Software\Secunia\PSI
Default=False
FileKey1=%ProgramFiles%\secunia\PSI|sualog.txt
FileKey2=%ProgramFiles%\Secunia\PSI|psialog.txt*

<-Changed DetectFile to Detect. Removed FileKey3, added * to FileKey2.

 

[search Everything*]
LangSecRef=3024
DetectFile=%ProgramFiles%\Everything
Default=False
FileKey1=%ProgramFiles%\Everything|Errorlog.txt

<-Changed entry title/name.

[siliconman01]

You can change [Thumbsplus 8*] to [Thumbsplus 8/9*]. Thumbsplus 9 is almost out of beta and the cleanup is the same as Thumbsplus 8.

[pook1y7985]

The only comments I have about combing entries are that I know some would prefer to keep the Malwarebytes Separate so they don't have to clean the Quarantine area(which is what the default CCleaner entry does) I think combining them makes sense to me as the list is growing ever longer. Perhaps use the Warning tag to list out what is being cleaned the combined entries so its more apparent what they will be removing. Just my two cents.