Jump to content
Piriform Community Forums
Winapp2.ini

Winapp2.ini additions

Recommended Posts

New Entry

This is a new program for both Android and iOS.

[Wondershare dr.fone *]
LangSecRef=3021
DetectFile=%ProgramFiles%\Wondershare\drfone
Default=False
FileKey1=%CommonAppData%\Wondershare\dr.fone\log|*.*|RECURSE
FileKey2=%CommonAppData%\Wondershare\WAF\Log|*.*|RECURSE
FileKey3=%CommonAppData%\Wondershare\WAF\ProductFeatures\*Logs|*.*|RECURSE
FileKey4=%CommonAppData%\Wondershare\WSRoot|*.tmp
FileKey5=%CommonAppData%\Wondershare\WSRoot\Logs|*.*|RECURSE

Share this post


Link to post
Share on other sites

Modified entry:   [Dell Installation Files *]
Deleted DetectFile and added Detect1 and Detect2

[Dell Installation Files *]
LangSecRef=3024
Detect1=HKCU\Software\Dell
Detect2=HKLM\Software\Dell
Default=False
Warning=This will delete your Dell installation files.
FileKey1=%SystemDrive%\dell|*.*|REMOVESELF

 

Share this post


Link to post
Share on other sites

Revised Entry

Added: FileKey2=%AppData%\Microsoft\Office|*.tmp

[MS Office *]
LangSecRef=3021
Detect1=HKCU\Software\Microsoft\Office\12.0\Common
Detect2=HKCU\Software\Microsoft\Office\14.0\Common
Detect3=HKCU\Software\Microsoft\Office\15.0\Common
Detect4=HKCU\Software\Microsoft\Office\16.0\Common
Default=False
FileKey1=%AppData%\Microsoft\Document Building Blocks|*.*|RECURSE
FileKey2=%AppData%\Microsoft\Office|*.tmp
FileKey3=%AppData%\Microsoft\OIS|Toolbars.dat
FileKey4=%AppData%\Microsoft\UProof|*.bin;*.XML
FileKey5=%CommonAppData%\Microsoft\ClickToRun\ProductReleases|*.*|RECURSE
FileKey6=%Documents%|~*.ppt;~*.pptx;~*.doc;~*.docx|RECURSE
FileKey7=%LocalAppData%\Microsoft Help|*.*
FileKey8=%LocalAppData%\Microsoft\Office\*|OneNoteOfflineCache.onecache
FileKey9=%LocalAppData%\Microsoft\Office\*\OfficeFileCache|*.*|RECURSE
FileKey10=%LocalAppData%\Microsoft\OneNote\*|OneNoteOfflineCache.onecache
FileKey11=%LocalAppData%\Microsoft\OneNote\*\OneNoteOfflineCache_Files|*.*|RECURSE
FileKey12=%SystemDrive%|propfix.log
RegKey1=HKCU\Software\Microsoft\Office\11.0\MSE|LastLoadedSolution
RegKey2=HKCU\Software\Microsoft\Office\11.0\MSE\FileMRUList
RegKey3=HKCU\Software\Microsoft\Office\11.0\MSE\ProjectMRUList
RegKey4=HKCU\Software\Microsoft\Office\11.0\MSE\SolutionMRUList
RegKey5=HKCU\Software\Microsoft\Office\12.0\Common\Internet|UseRWHlinkNavigation
RegKey6=HKCU\Software\Microsoft\Office\12.0\Word\Reading Locations
RegKey7=HKCU\Software\Microsoft\Office\14.0\Common\Internet|UseRWHlinkNavigation
RegKey8=HKCU\Software\Microsoft\Office\14.0\Word\Reading Locations
RegKey9=HKCU\Software\Microsoft\Office\15.0\Common\Internet|UseRWHlinkNavigation
RegKey10=HKCU\Software\Microsoft\Office\15.0\Word\Reading Locations
RegKey11=HKCU\Software\Microsoft\Office\16.0\Common\Internet|UseRWHlinkNavigation
RegKey12=HKCU\Software\Microsoft\Office\16.0\Word\Reading Locations
RegKey13=HKCU\Software\Microsoft\Office\Common|FontBmpCache
RegKey14=HKCU\Software\Microsoft\OfficeCustomizeWizard\12.0\RecentFileList
RegKey15=HKCU\Software\Microsoft\OfficeCustomizeWizard\14.0\RecentFileList
RegKey16=HKCU\Software\Microsoft\OfficeCustomizeWizard\15.0\RecentFileList
RegKey17=HKCU\Software\Microsoft\OfficeCustomizeWizard\16.0\RecentFileList

Share this post


Link to post
Share on other sites

Revised Entry

Added: FileKey6=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\UrlBlock|*.tmp

[Microsoft Edge *]
LangSecRef=3022
Detect=HKCU\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!00*\INetCookies|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!00*\Microsoft\Cryptnet*Cache|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!00*\MicrosoftEdge\Cookies|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\Microsoft\Cryptnet*Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\Cookies|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\UrlBlock|*.tmp
FileKey7=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\User\Default\Datastore\Data\nouser1\*\Favorites|*.ico
FileKey8=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\User\Default\DataStore\Indexed\Data\nouser1\*|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\User\Default\ImageStore|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\Temp|*.*|RECURSE
FileKey11=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AppData\User\Default\Indexed DB|*.*|RECURSE
FileKey12=%UserProfile%\MicrosoftEdgeBackups\backups\*|*.*|REMOVESELF

Share this post


Link to post
Share on other sites
59 minutes ago, SMalik said:

FileKey6=%Documents%|~*.ppt;~*.pptx;~*.doc;~*.docx|RECURSE

Am I reading this wrong, or does this delete documents?

Share this post


Link to post
Share on other sites
30 minutes ago, Nergal said:

Am I reading this wrong, or does this delete documents?

This looks dangerous. I didn't provide this. I provided FileKey2

Share this post


Link to post
Share on other sites
11 minutes ago, SMalik said:

This looks dangerous. I didn't provide this. I provided FileKey2

I agree, @APMichael can we have that line excised.  Unless someone else can speak up for it.

Share this post


Link to post
Share on other sites

That line removes

~*.ppt;

~*.pptx;

~*.doc

;~*.docx

 

from the documents folder - they are basiclaly temporary files left after MS Office / word or similar crashes....

Share this post


Link to post
Share on other sites
11 minutes ago, CSGalloway said:

That line removes

~*.ppt;

~*.pptx;

~*.doc

;~*.docx

 

from the documents folder - they are basiclaly temporary files left after MS Office / word or similar crashes....

Oh I see I missed the ~ . Yeah ok I know those are temps @APMichael never mind

Share this post


Link to post
Share on other sites
12 hours ago, SMalik said:

I think we should add the removing of Google Chrome .old files.

I've been doing that for years with SRWare Iron Portable using this:
FileKey3=%SystemDrive%\PortableApps\IronPortable|*.old|RECURSE

Share this post


Link to post
Share on other sites
13 hours ago, SMalik said:

Revised Entry

Added: FileKey6=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\UrlBlock|*.tmp

[Microsoft Edge *]
LangSecRef=3022

Note that for the LangSecRef Edge has a number for that now:
3005 = Microsoft Edge

So that would be:
LangSecRef=3005

And thank you for posting that cleaner, it removed allot of additional junk from Edge on my laptop!:)

Share this post


Link to post
Share on other sites
17 hours ago, SMalik said:

I think we should add the removing of Google Chrome .old files.

Chrome_LOG.old_files.png

Thank you for your revised entries.

The entry [Logs *] should remove those .old files already:
FileKey23=%LocalAppData%\Google\Chrome*\User Data\*|*LOG.*;Log;*.log;*.old|RECURSE

Share this post


Link to post
Share on other sites
4 hours ago, APMichael said:

Thank you for your revised entries.

The entry [Logs *] should remove those .old files already:
FileKey23=%LocalAppData%\Google\Chrome*\User Data\*|*LOG.*;Log;*.log;*.old|RECURSE

It does not remove these files because of the ExcludeKey's.

ExcludeKey45=PATH|%LocalAppData%\Google\Chrome*\User Data\*\*Settings\|*.*
ExcludeKey46=PATH|%LocalAppData%\Google\Chrome*\User Data\*\Extensions\|*.*
ExcludeKey47=PATH|%LocalAppData%\Google\Chrome*\User Data\*\File System\|*.*
ExcludeKey48=PATH|%LocalAppData%\Google\Chrome*\User Data\*\Local Storage\leveldb\|*.*

I remember removing *LOG.*;Log;*.log files from the exclude keys locations would break some Chrome extensions like Adblock Plus. Today, I removed all of the exclude keys and ran CCleaner. It deleted all of the *LOG.*;Log;*.log files from the exclude keys locations. All of the extensions are working fine. I recommend removing all of exclude keys from this entry.

Share this post


Link to post
Share on other sites

Revised Entry

Added: %WinDir%\Logs\waasmedic|*.*|RECURSE

https://www.thewindowsclub.com/windows-update-medic-service

[Windows Update *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\WindowsUpdate
Default=False
FileKey1=%WinDir%\Logs\waasmedic|*.*|RECURSE
FileKey2=%WinDir%\Logs\WindowsUpdate|*.*|RECURSE
FileKey3=%WinDir%\SoftwareDistribution\DataStore\Logs|*.*|RECURSE

Share this post


Link to post
Share on other sites
9 hours ago, SMalik said:

Revised Entry

Added: %WinDir%\Logs\waasmedic|*.*|RECURSE

https://www.thewindowsclub.com/windows-update-medic-service

[Windows Update *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\WindowsUpdate
Default=False
FileKey1=%WinDir%\Logs\waasmedic|*.*|RECURSE
FileKey2=%WinDir%\Logs\WindowsUpdate|*.*|RECURSE
FileKey3=%WinDir%\SoftwareDistribution\DataStore\Logs|*.*|RECURSE

I do believe that the %WinDir%\Logs|waasmedic folder is typically a locked folder and CCleaner will not be able to clean it unless the user "Takes Ownership" of the folder.  And as you know, that ownership will return to Windows when various Windows Updates are run.

Share this post


Link to post
Share on other sites
19 hours ago, SMalik said:

It does not remove these files because of the ExcludeKey's...

Thanks for the hint!

19 hours ago, SMalik said:

I remember removing *LOG.*;Log;*.log files from the exclude keys locations would break some Chrome extensions like Adblock Plus. Today, I removed all of the exclude keys and ran CCleaner. It deleted all of the *LOG.*;Log;*.log files from the exclude keys locations. All of the extensions are working fine. I recommend removing all of exclude keys from this entry.

I don't use Chrome, therefore I can't test it. I will wait 2-3 days before updating Winapp2.ini, because maybe someone will object.

7 hours ago, siliconman01 said:

I do believe that the %WinDir%\Logs|waasmedic folder is typically a locked folder and CCleaner will not be able to clean it unless the user "Takes Ownership" of the folder.  And as you know, that ownership will return to Windows when various Windows Updates are run.

I can confirm this. CCleaner can't remove the files.

Share this post


Link to post
Share on other sites

Revised Entry

Added: %CommonAppData%\Microsoft\Windows Defender\Definition Updates\Backup|*.*|RECURSE

[Windows Defender *]
LangSecRef=3024
Detect=HKLM\Software\Microsoft\Windows Defender
Default=False
FileKey1=%CommonAppData%\Microsoft\Windows Defender\Definition Updates\Backup|*.*|RECURSE
FileKey2=%CommonAppData%\Microsoft\Windows Defender\Network Inspection System\Support|*.txt
FileKey3=%CommonAppData%\Microsoft\Windows Defender\Scans|*.bin*
FileKey4=%CommonAppData%\Microsoft\Windows Defender\Scans\History\CacheManager|*.*|RECURSE
FileKey5=%CommonAppData%\Microsoft\Windows Defender\Scans\History\ReportLatency\Latency|*.*|RECURSE
FileKey6=%CommonAppData%\Microsoft\Windows Defender\Scans\History\Service|*.log
FileKey7=%CommonAppData%\Microsoft\Windows Defender\Scans\MetaStore|*.*|RECURSE
FileKey8=%CommonAppData%\Microsoft\Windows Defender\Support|*.*|RECURSE

Share this post


Link to post
Share on other sites

Revised Entry

Added:
%WinDir%\System32\LogFiles\setupcln|*.*|RECURSE
%WinDir%\System32\LogFiles\WMI|*.*|RECURSE

[Windows Logs *]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
Default=False
FileKey1=%CommonAppData%\Microsoft\Network\Downloader|*.*|RECURSE
FileKey2=%CommonAppData%\Microsoft\Windows Security Health\Logs|*.*|RECURSE
FileKey3=%CommonAppData%\USOShared\Logs|*.*|RECURSE
FileKey4=%LocalAppData%\ConnectedDevicesPlatform|*.log
FileKey5=%LocalAppData%\Diagnostics|*.*|RECURSE
FileKey6=%ProgramFiles%\UNP\Logs|*.*
FileKey7=%SystemDrive%\PerfLogs\System\Diagnostics|*.*|RECURSE
FileKey8=%SystemDrive%\PerfLogs\System\Performance|*.*|RECURSE
FileKey9=%WinDir%\debug\WIA|*.log
FileKey10=%WinDir%\inf|*.log*
FileKey11=%WinDir%\Logs\CBS|*.cab
FileKey12=%WinDir%\Logs\dosvc|*.*|RECURSE
FileKey13=%WinDir%\Logs\NetSetup|*.*|RECURSE
FileKey14=%WinDir%\Logs\SIH|*.*|RECURSE
FileKey15=%WinDir%\Logs\WindowsBackup|*.etl
FileKey16=%WinDir%\Panther|cbs.log;DDACLSys.log;miglog.xml;Migrep.html;PostGatherPnPList.log;PreGatherPnPList.log
FileKey17=%WinDir%\Panther\FastCleanup|*.log
FileKey18=%WinDir%\Panther\Rollback|*.txt
FileKey19=%WinDir%\Panther\UnattendGC|diagerr.xml;diagwrn.xml
FileKey20=%WinDir%\repair|setup.log
FileKey21=%WinDir%\security\logs|*.*|RECURSE
FileKey22=%WinDir%\System32\catroot2|*.chk;*.log;*.jrs;*.txt
FileKey23=%WinDir%\System32\LogFiles\HTTPERR|*.log
FileKey24=%WinDir%\System32\LogFiles\Scm|*.*|RECURSE
FileKey25=%WinDir%\System32\LogFiles\setupcln|*.*|RECURSE
FileKey26=%WinDir%\System32\LogFiles\Srt|*.*|RECURSE
FileKey27=%WinDir%\System32\LogFiles\WMI|*.*|RECURSE
FileKey28=%WinDir%\System32\sysprep\Panther\IE|diagerr.xml;diagwrn.xml;*.log
FileKey29=%WinDir%\System32\WDI\*|snapshot.etl|REMOVESELF
FileKey30=%WinDir%\System32\WDI\LogFiles\StartupInfo|*.*|RECURSE
RegKey1=HKLM\Software\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications
RegKey2=HKLM\Software\Microsoft\Tracing
RegKey3=HKLM\Software\Wow6432Node\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications
RegKey4=HKLM\Software\Wow6432Node\Microsoft\Tracing

Share this post


Link to post
Share on other sites

Please take a look at the screenshots. I tried another program and it found some more junk files in Microsoft IE and Microsoft Edge. I think we should add these into Internet Explorer and Microsoft Edge entries.

Microsoft IE DOMStore Cookies.png

Microsoft_Edge_Session.png

Share this post


Link to post
Share on other sites
3 hours ago, SMalik said:

Please take a look at the screenshots. I tried another program and it found some more junk files in Microsoft IE and Microsoft Edge. I think we should add these into Internet Explorer and Microsoft Edge entries.

Microsoft IE DOMStore Cookies.png

Microsoft_Edge_Session.png

Pretty sure the first picture are dom cookies and thus are handled by ccleaner already, and the second by sessions under edge.

Share this post


Link to post
Share on other sites
1 hour ago, Nergal said:

Pretty sure the first picture are dom cookies and thus are handled by ccleaner already, and the second by sessions under edge.

Not all traces are being wiped.

Share this post


Link to post
Share on other sites
8 hours ago, SMalik said:

Not all traces are being wiped.

Are the files process locked?

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×