Kojak

[OpenOffice.org 3*] LangSecRef=3021 Detect=HKCU\Software\OpenOffice.org Default=False FileKey1=%AppData%\OpenOffice.org\*\user\config\imagecache|*.* FileKey2=%AppData%\OpenOffice.org\*\user\registry\cache|*.* FileKey3=%AppData%\OpenOffice.org\*\user\registry\data\org\openoffice\Office|Common.xcu FileKey4=%AppData%\OpenOffice.org\*\user\registry\data\org\openoffice\Office|Views.xcu FileKey5=%AppData%\OpenOffice.org\*\user\registry\data\org\openoffice\Office|Writer.xcu FileKey6=%AppData%\OpenOffice.org\*\user\registry\data\org\openoffice\Office|Histories.xcu FileKey7=%AppData%\OpenOffice.org\*\user\registry\data\org\openoffice\ucb|Hierarchy.xcu FileKey8=%AppData%\OpenOffice.org\*\user\registry\data\org\openoffice\ucb|Store.xcu FileKey9=%AppData%\OpenOffice.org\*\user\store|.templdir.cache FileKey10=%AppData%\OpenOffice.org\*\user\template|*.* ^-- As it is in the new Winapp2.ini, part of this one - file key 10 - wipes out custom or downloaded Libre/OO templates without warning. :-\

Neither's the ZX32 ZX Spectrum Emulator v1.03; guess what the last item in Winapp2.ini is? "Most" workstations still don't have Firefox, Chrome or Libre/OpenOffice installed, either, to name just some top entries.

The link to TDSK's above, you can download it, run it a few times and see the looong-named logs it'll keep leaving in the main directory (TDSSKiller.2.7.22.0_27.03.2012_22.46.06_log.txt...) - even without scanning. 1. Because it should be creating a registry key that could be used to detect it ("Far Manager"), but it doesn't, at least when I try it. It's still in alpha though. 2. Because it's not the profile. The profile is in AppData/Profile. LocalAppData contains the history, cache and temporary stuff.

Here is a couple of new ones, tested: Scan logs for Kaspersky's TDSSKiller from http://support.kaspersky.com/faq/?qid=208283363 [Kaspersky TDSSKiller Logs*] LangSecRef=3024 Default=False FileKey1=%SystemDrive%|TDSSKiller*.txt Latest version 3 of Far Manager from farmanager.com, stores the logs in a new location: [FAR Manager 3*] LangSecRef=3021 DetectFile=%LocalAppData%\Far Manager\Profile Warning=Also clears the plugin name cache Default=False FileKey1=%LocalAppData%\Far Manager\Profile|*.*|RECURSE Temporary files for the Gadugadu IM tool, http://en.wikipedia.org/wiki/Gadu-Gadu (the program doesn't clean its temp files after itself, but they can't be deleted until it is shut down) [Gadu-Gadu Temporary Files*] LangSecRef=3022 Detect=HKCU\Software\Gadu-Gadu\ Default=False FileKey1=%WinDir%\|TEMP*.htm*