Jump to content
CCleaner Community Forums
Winapp2.ini

Winapp2.ini additions

Recommended Posts

It deletes much more for bad guys, not normal people... This is the same file hazelnut added months ago (directly after Neverblooms ban) as it was supporting advanced entries for not everybody's use..

Share this post


Link to post
Share on other sites

updated

 

What's new in winapp2.ini 5.10.150925

 

I'll update the hash etc in a few days

 

Web site still has Version: v5.09.150825

Share this post


Link to post
Share on other sites

I think he (Trader5858) was trying to tell us he made a file called winsys2.ini and wanted to combine it with Winapp2 entries. I was looking through them and he has some listed websites that I don't understand what they were for. He also had some more agressive entries in there. I don't know, maybe some of them are ok to add, if anyone wanted to go through them.

 

I wonder if that was Neverbloom on a alt account? He did mention Neverbloom's ban. Makes you wonder...

 

Anyways, anyone know when he will be able to update the Winapp2 file. Also, I would suggest throwing it on GitHub. It would help in situations like this.

Share this post


Link to post
Share on other sites

Forks of chrome are already cleaned by cclean

Share this post


Link to post
Share on other sites

I wonder if that was Neverbloom on a alt account? He did mention Neverbloom's ban.

 

I can only presume that's why he/she was banned, didn't see anything remotely spammy about his/her postings, seemed to be trying to help (in a rather hard to understand way)

Share this post


Link to post
Share on other sites

It has been almost three days since someone uploaded the wrong Winapp2.ini file. It is still not corrected.

 

Sorry, Winapp2.INI was uploaded, but the link points to Winapp2.ini. Case sensitivity problems. Link should work properly now :)

Share this post


Link to post
Share on other sites

Silly linux servers lol

Share this post


Link to post
Share on other sites

New Entry:  [AccuWeather*]

[AccuWeather*]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\AccuWeather.AccuWeatherforWindows8_8zz2pj9h1h1d8
DetectFile=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_8zz2pj9h1h1d8
Default=False
FileKey1=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\AC\INetCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\AC\INetCookies|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\AC\INetHistory|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.log|RECURSE
FileKey5=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\AC\Temp|*.*
FileKey6=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\LocalState|*.tmp
FileKey7=%LocalAppData%\Packages\AccuWeather.AccuWeatherforWindows8_*\TempState\Bing.Maps\Cache|*.*|RECURSE

Share this post


Link to post
Share on other sites

Sorry, I don`t know English.

I think it is a mistake.

 

3c66d3b90b0dcd0535c11b0914cb290d.png

 

Also GPUCache Chrome.

 

Chrome SXS is Chrome Canary, a developer build of Chrome.

Share this post


Link to post
Share on other sites

I searched my HDD for both *.BAK and *.TMP and came up with:

          8,192 2011-02-11 13:00:42 C:\BOOTSECT.BAK
     33,554,625 2015-10-14 13:04:16 C:\ProgramData\Microsoft\Microsoft Antimalware\Network Inspection System\Support\NisLog.txt.bak
          8,200 2002-10-17 21:23:16 C:\ProgramData\Microsoft\OFFICE\DATA\OPA11.BAK
      1,048,576 2015-06-23 20:47:47 C:\Users\Administrator\AppData\Local\Microsoft\Windows\Explorer\ThumbCacheToDelete\thmEF9C.tmp
      1,048,576 2015-06-23 20:47:47 C:\Users\Administrator\AppData\Local\Microsoft\Windows\Explorer\ThumbCacheToDelete\thmEF9D.tmp
      1,048,576 2015-06-23 20:47:47 C:\Users\Administrator\AppData\Local\Microsoft\Windows\Explorer\ThumbCacheToDelete\thmEF9E.tmp
             24 2015-06-23 20:47:47 C:\Users\Administrator\AppData\Local\Microsoft\Windows\Explorer\ThumbCacheToDelete\thmEF9F.tmp
             24 2015-06-23 20:47:47 C:\Users\Administrator\AppData\Local\Microsoft\Windows\Explorer\ThumbCacheToDelete\thmEFA0.tmp
          3,256 2015-06-23 20:47:47 C:\Users\Administrator\AppData\Local\Microsoft\Windows\Explorer\ThumbCacheToDelete\thmEFA1.tmp
         59,285 2015-04-16 20:45:44 C:\Users\Galloway\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences.bak
        524,288 2015-10-22 22:36:30 C:\Users\Galloway\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.tmp
             58 2015-10-23 16:11:08 C:\Users\Galloway\AppData\Local\Mozilla\Firefox\Profiles\y73yivh7.default-1408590376909\ShutdownDuration.json.tmp
         47,416 2015-10-22 22:36:15 C:\Users\Galloway\AppData\Local\Temp\DIO9E14.tmp
         47,416 2015-10-21 20:43:45 C:\Users\Galloway\AppData\Local\Temp\DIOA6D.tmp
          1,313 2015-10-22 22:36:09 C:\Users\Galloway\AppData\Local\Temp\MAR848A.tmp
          1,285 2015-10-22 22:36:09 C:\Users\Galloway\AppData\Local\Temp\MAR87C6.tmp
          1,313 2015-10-21 20:43:39 C:\Users\Galloway\AppData\Local\Temp\MARF343.tmp
          1,285 2015-10-21 20:43:39 C:\Users\Galloway\AppData\Local\Temp\MARF3D1.tmp
         45,128 2015-10-21 19:15:07 C:\Users\Galloway\AppData\Local\Temp\acrord32_sbx\Z@R9A27.tmp
         44,268 2015-10-21 19:15:07 C:\Users\Galloway\AppData\Local\Temp\acrord32_sbx\Z@R9A87.tmp
         42,592 2015-10-21 19:15:07 C:\Users\Galloway\AppData\Local\Temp\acrord32_sbx\Z@R9AF6.tmp
         44,268 2015-10-21 19:13:16 C:\Users\Galloway\AppData\Local\Temp\acrord32_sbx\Z@RE95F.tmp
         42,592 2015-10-21 19:13:16 C:\Users\Galloway\AppData\Local\Temp\acrord32_sbx\Z@REA1D.tmp
         45,128 2015-10-21 19:13:16 C:\Users\Galloway\AppData\Local\Temp\acrord32_sbx\Z@REA4D.tmp
         16,384 2015-10-23 16:42:21 C:\Users\Galloway\AppData\Local\Temp\~DF0E658E1C49D51764.TMP
            512 2015-10-23 16:42:21 C:\Users\Galloway\AppData\Local\Temp\~DF57E44A66E904D226.TMP
              0 2015-10-22 22:37:06 C:\Users\Galloway\AppData\Local\VirtualStore\Program Files (x86)\Yahoo!\Messenger\Cache\9G0IMTf7KSnOtr1pRkveNQ--.ProfileMap.dat.tmp
         24,327 2015-09-18 12:29:41 C:\Users\Galloway\AppData\Roaming\Mozilla\Firefox\Profiles\y73yivh7.default-1408590376909\extensions.json.bak
         57,344 2015-10-02 15:32:31 C:\Users\Galloway\Tracing\WPPMedia\Skype_MediaStack-6.0.8943.312-lcsmedia_vnext_release3(rtbldlab)-x86fre-U.etl.bak
         65,536 2015-10-22 22:22:12 C:\Users\Galloway\Tracing\WPPMedia\Skype_MediaStack-6.0.8943.314-lcsmedia_vnext_release3(rtbldlab)-x86fre-U.etl.bak
         16,384 2015-10-02 15:32:31 C:\Users\Galloway\Tracing\WPPMedia\Skype_MediaStackETW-6.0.8943.312-lcsmedia_vnext_release3(rtbldlab)-x86fre-U.etl.bak
         16,384 2015-10-22 22:22:12 C:\Users\Galloway\Tracing\WPPMedia\Skype_MediaStackETW-6.0.8943.314-lcsmedia_vnext_release3(rtbldlab)-x86fre-U.etl.bak
     27,194,449 2015-10-04 12:27:05 C:\Windows\Logs\DISM\dism.log.bak
        576,683 2014-11-22 14:49:47 C:\Windows\System32\drivers\etc\hosts_PTBackup.bak
            837 2015-01-09 01:00:21 C:\Windows\System32\drivers\etc\hosts_PTbackup2.bak
          4,204 2005-07-02 18:57:28 C:\Z_UserFiles\Unknown\BAK_001\settings.bak
     65,640,728 / 36

Does anyone know if ALL files are safe to delete ?  I guess the C:\BOOTSECT.BAK is not?

Share this post


Link to post
Share on other sites

C:\Users\Galloway\AppData\Local\Temp\*.*

 

this is safe to delete

 

you can take this in your include-list in ccleaner. --> with "files and subfolders"

Share this post


Link to post
Share on other sites

\Microsoft\OFFICE\DATA\OPA11.BAK is certainly NOT safe to delete. (been caught out with that one myself) :)

 

deleting it breaks Office, requiring it to be reinstalled the next time one of the Office suite of programs is used.

Share this post


Link to post
Share on other sites

\Microsoft\OFFICE\DATA\OPA11.BAK is certainly NOT safe to delete. (been got out with that one myself) :)

 

deleting it breaks Office, requiring it to be reinstalled the next time one of the Office suite of programs is used.

 

I wonder why so many "so-called cleaning tools" still target that file after over 12 years of causing users grief upon its removal.

Share this post


Link to post
Share on other sites

I wonder why so many "so-called cleaning tools" still target that file after over 12 years of causing users grief upon its removal.

I wonder why so many USERS still think that anything with a .bak or .tmp is immediately safe to delete.

Share this post


Link to post
Share on other sites

I wonder why so many USERS still think that anything with a .bak or .tmp is immediately safe to delete.

I would argue that was a safe assumption. but no longer.

Historically, by the very name of the extension, they should be safe to delete.

BAK for backup and TMP for temporary.

 

The user shouldn't be held at blame on being caught out by some stupid MS programmer using BAK for an important file.

Almost any other extension would have been better.

 

But the user is certainly to blame for not learning the lesson the hard way. ^_^

It just demonstrates that any file cleaning, no matter how seemingly innocent, has cause and effect.

Share this post


Link to post
Share on other sites

I would argue that was a safe assumption. but no longer.

I would argue it's NEVER been a safe assumption, I can remember it causing issues as long as I've been using computers. Admittedly not a LOT of issues, but certainly enough issues for long enough for the message to have sunk in that you can't judge a file's value by it's extension.

Share this post


Link to post
Share on other sites

Revised Entries

 

[MS Office Unsaved Files*]
LangSecRef=3021
Detect1=HKCU\Software\Microsoft\Office\12.0
Detect2=HKCU\Software\Microsoft\Office\14.0
Detect3=HKCU\Software\Microsoft\Office\15.0
Detect4=HKCU\Software\Microsoft\Office\16.0
Default=False
FileKey1=%LocalAppData%\Microsoft\Office\UnsavedFiles|*.*|RECURSE
FileKey2=%AppData%\Microsoft\Excel|*.*|RECURSE
FileKey3=%AppData%\Microsoft\PowerPoint|*.*|RECURSE
FileKey4=%AppData%\Microsoft\Word|*.*|RECURSE

Added: FileKey2, FileKey3 & FileKey4

[MS Office Word More*]
LangSecRef=3021
Detect1=HKCU\Software\Microsoft\Office\12.0
Detect2=HKCU\Software\Microsoft\Office\14.0
Detect3=HKCU\Software\Microsoft\Office\15.0
Detect4=HKCU\Software\Microsoft\Office\16.0
Default=False
RegKey1=HKCU\Software\Microsoft\Office\15.0\Word\Reading Locations
RegKey2=HKCU\Software\Microsoft\Office\16.0\Word\Reading Locations
FileKey1=%Documents%|~*.doc|RECURSE
ExcludeKey1=FILE|%AppData%\Microsoft\Word\listgal.dat
ExcludeKey2=PATH|%AppData%\Microsoft\Word\STARTUP

Removed %AppData%\Microsoft\Word|*.*|RECURSE from this entry and added into [MS Office Unsaved Files*].

Share this post


Link to post
Share on other sites

New Entry

 

[MS Office Recent Templates*]
LangSecRef=3021
Detect1=HKCU\Software\Microsoft\Office\12.0
Detect2=HKCU\Software\Microsoft\Office\14.0
Detect3=HKCU\Software\Microsoft\Office\15.0
Detect4=HKCU\Software\Microsoft\Office\16.0
Default=False
FileKey1=%AppData%\Microsoft\Templates|*.xlt;*.xltx;*.pot;*.potx;*.dot;*.dotx
RegKey1=HKCU\SOFTWARE\Microsoft\Office\12.0\Common\OfficeStart\Web\Templates
RegKey2=HKCU\SOFTWARE\Microsoft\Office\12.0\Excel\Recent Templates
RegKey3=HKCU\SOFTWARE\Microsoft\Office\12.0\PowerPoint\Recent Templates
RegKey4=HKCU\SOFTWARE\Microsoft\Office\12.0\Word\Recent Templates
RegKey5=HKCU\SOFTWARE\Microsoft\Office\14.0\Common\OfficeStart\Web\Templates
RegKey6=HKCU\SOFTWARE\Microsoft\Office\14.0\Excel\Recent Templates
RegKey7=HKCU\SOFTWARE\Microsoft\Office\14.0\PowerPoint\Recent Templates
RegKey8=HKCU\SOFTWARE\Microsoft\Office\14.0\Word\Recent Templates
RegKey9=HKCU\SOFTWARE\Microsoft\Office\15.0\Common\OfficeStart\Web\Templates
RegKey10=HKCU\SOFTWARE\Microsoft\Office\15.0\Excel\Recent Templates
RegKey11=HKCU\SOFTWARE\Microsoft\Office\15.0\PowerPoint\Recent Templates
RegKey12=HKCU\SOFTWARE\Microsoft\Office\15.0\Word\Recent Templates
RegKey13=HKCU\SOFTWARE\Microsoft\Office\16.0\Common\OfficeStart\Web\Templates
RegKey14=HKCU\SOFTWARE\Microsoft\Office\16.0\Excel\Recent Templates
RegKey15=HKCU\SOFTWARE\Microsoft\Office\16.0\PowerPoint\Recent Templates
RegKey16=HKCU\SOFTWARE\Microsoft\Office\16.0\Word\Recent Templates

Share this post


Link to post
Share on other sites

Revised Entry

Changed: DetectFile to Detect

 

[Apple MobileSync Backup*]
LangSecRef=3023
Detect=HKLM\Software\Apple Computer, Inc.
Warning=This will delete all your iPhone backups.
Default=False
FileKey1=%AppData%\Apple Computer\MobileSync\Backup|*.*|RECURSE

Share this post


Link to post
Share on other sites

Revised Entries

Changed the Detect=HKLM\Software\Apple Computer, Inc.\ to Detect=HKLM\Software\Apple Computer, Inc.

 

[Apple iDevices Software Updates*]
LangSecRef=3023
Detect=HKLM\Software\Apple Computer, Inc.
Default=False
FileKey1=%AppData%\Apple Computer\iTunes|*.ipsw|RECURSE

[Apple iDevices Updater Logs*]
LangSecRef=3023
Detect=HKLM\Software\Apple Computer, Inc.
Default=False
FileKey1=%AppData%\Apple Computer\iTunes|*.log|RECURSE

Share this post


Link to post
Share on other sites

Revised Entries

 

[MS Office Unsaved Files*]

Added: FileKey2, FileKey3 & FileKey4

 

[MS Office Word More*]

Removed %AppData%\Microsoft\Word|*.*|RECURSE from this entry and added into [MS Office Unsaved Files*].

you forgot to bring ExcludeKey1 and ExcludeKey2 with FileKey1 to [MS Office Unsaved Files*]

 

 

Revised Entries

 

[MS Office Unsaved Files*]

LangSecRef=3021

Detect1=HKCU\Software\Microsoft\Office\12.0

Detect2=HKCU\Software\Microsoft\Office\14.0

Detect3=HKCU\Software\Microsoft\Office\15.0

Detect4=HKCU\Software\Microsoft\Office\16.0

Default=False

FileKey1=%LocalAppData%\Microsoft\Office\UnsavedFiles|*.*|RECURSE

FileKey2=%AppData%\Microsoft\Excel|*.*|RECURSE

FileKey3=%AppData%\Microsoft\PowerPoint|*.*|RECURSE

FileKey4=%AppData%\Microsoft\Word|*.*|RECURSE

ExcludeKey1=FILE|%AppData%\Microsoft\Word\listgal.dat

ExcludeKey2=PATH|%AppData%\Microsoft\Word\STARTUP

ExcludeKey3=PATH|%AppData%\Microsoft\Excel\XLSTART

 - add ExcludeKey 1,2,3

 

[MS Office Word More*]

LangSecRef=3021

Detect1=HKCU\Software\Microsoft\Office\12.0

Detect2=HKCU\Software\Microsoft\Office\14.0

Detect3=HKCU\Software\Microsoft\Office\15.0

Detect4=HKCU\Software\Microsoft\Office\16.0

Default=False

RegKey1=HKCU\Software\Microsoft\Office\15.0\Word\Reading Locations

RegKey2=HKCU\Software\Microsoft\Office\16.0\Word\Reading Locations

FileKey1=%Documents%|~*.doc;~*.docx|RECURSE

 - remove ExcludeKey 1,2

 - modify FileKey1

 

 

[MS Office PowerPoint More*]

LangSecRef=3021

Detect1=HKCU\Software\Microsoft\Office\12.0

Detect2=HKCU\Software\Microsoft\Office\14.0

Detect3=HKCU\Software\Microsoft\Office\15.0

Detect4=HKCU\Software\Microsoft\Office\16.0

Default=False

RegKey1=HKCU\Software\Microsoft\Office\12.0\Common\Internet|UseRWHlinkNavigation

RegKey2=HKCU\Software\Microsoft\Office\14.0\Common\Internet|UseRWHlinkNavigation

RegKey3=HKCU\Software\Microsoft\Office\15.0\Common\Internet|UseRWHlinkNavigation

RegKey4=HKCU\Software\Microsoft\Office\16.0\Common\Internet|UseRWHlinkNavigation

FileKey1=%Documents%|~*.ppt;~*.pptx|RECURSE

 - add FileKey1

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...

×
×
  • Create New...