Jump to content

Winapp2.ini additions


Winapp2.ini

Recommended Posts

Revised Entries

 

Adobe Acrobat DC shows up even though I don't have that program on my system, I just have Adobe Acrobat Reader DC. Adobe Acrobat Reader DC creates HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat. When I delete that key and open Adobe Acrobat Reader DC, it re-creates that path again. So let's change the Detect. CCleaner's winapp.ini also has HKLM\Software\Adobe\Acrobat Reader\DC

 

Changed Detect=HKCU\Software\Adobe\Adobe Acrobat\DC to Detect=HKLM\Software\Adobe\Adobe Acrobat\DC
 
[Adobe Acrobat DC*]
LangSecRef=3021
Detect=HKLM\Software\Adobe\Adobe Acrobat\DC
Default=False
FileKey1=%LocalAppData%\Adobe\Acrobat\DC\Cache|*.lst
FileKey2=%LocalAppData%\Adobe\Acrobat\DC\ToolsSearchCacheAcro|*.*|RECURSE
FileKey3=%LocalAppData%\Adobe\Acrobat\DC|*.lst
FileKey4=%LocalAppData%\Adobe\Acrobat\DC|UserCache.bin
FileKey5=%LocalLowAppData%\Adobe\Acrobat\DC\Search|*.*
RegKey1=HKCU\Software\Adobe\Adobe Acrobat\DC\AVConversionFromPDF\cSettings
RegKey2=HKCU\Software\Adobe\Adobe Acrobat\DC\AVConversionToPDF\cSettings
RegKey3=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cDockables
RegKey4=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles
RegKey5=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFolders
RegKey6=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentToolsList
RegKey7=HKCU\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cToolbars
RegKey8=HKCU\Software\Adobe\Adobe Acrobat\DC\RememberedViews\cNoCategoryFiles
RegKey9=HKCU\Software\Adobe\Adobe Acrobat\DC\ShareIdentity
RegKey10=HKCU\Software\Adobe\Adobe Synchronizer\DC
 
Changed Detect=HKCU\Software\Adobe\Acrobat Reader\DC to Detect=HKLM\Software\Adobe\Acrobat Reader\DC
 
[Adobe Reader DC More*]
LangSecRef=3021
Detect=HKLM\Software\Adobe\Acrobat Reader\DC
Default=False
FileKey1=%LocalAppData%\Adobe\Acrobat\DC|UserCache.bin
RegKey1=HKCU\Software\Adobe\Acrobat Reader\DC\AVConversionFromPDF
RegKey2=HKCU\Software\Adobe\Acrobat Reader\DC\AVConversionToPDF
RegKey3=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral\cDockables
RegKey4=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral\cRecentToolsList
RegKey5=HKCU\Software\Adobe\Acrobat Reader\DC\AVGeneral\cToolbars
RegKey6=HKCU\Software\Adobe\Acrobat Reader\DC\RememberedViews\cNoCategoryFiles
RegKey7=HKCU\Software\Adobe\Acrobat Reader\DC\ShareIdentity
RegKey8=HKCU\Software\Adobe\Adobe Synchronizer\DC
 
 
 
 
Link to comment
Share on other sites

Modified Entries:  [snagit 13*] and [snagit More*]

 

Incorporated the newly released Snagit 2018 

[Snagit 13/18*]
LangSecRef=3024
Detect1=HKCU\Software\TechSmith\Snagit\13
Detect2=HKCU\Software\TechSmith\Snagit\18
Default=False
RegKey1=HKCU\Software\TechSmith\Snagit\13\Recent Captures
RegKey2=HKCU\Software\TechSmith\Snagit\13\SnagitEditor\Recent File List
RegKey3=HKCU\Software\TechSmith\Snagit\18\Recent Captures
RegKey4=HKCU\Software\TechSmith\Snagit\18\SnagitEditor\Recent File List
FileKey1=%LocalAppData%\TechSmith\Snagit|Tray.bin
FileKey2=%LocalAppData%\TechSmith\Snagit\DataStore\AppIcons|*.ico
FileKey3=%LocalAppData%\TechSmith\Snagit\DataStore\WebSiteIcons|*.ico
FileKey4=%LocalAppData%\TechSmith\Snagit\Thumbnails|*.*

[Snagit More*]
LangSecRef=3024
Detect=HKCU\Software\TechSmith\Snagit
Default=False
Warning=This will delete the backups of the captures.
FileKey1=%Documents%|SnagitDebug.log
FileKey2=%LocalAppData%\TechSmith\Logs|*.log
FileKey3=%LocalAppData%\TechSmith\Snagit\DataStore|*.SNAG;*.SNAGundo;*.MP4
FileKey4=%LocalAppData%\TechSmith\Snagit\TrackerbirdFiles|*.log
RegKey1=HKCU\Software\TechSmith\Snagit\9|StampCustomFolder
RegKey2=HKCU\Software\TechSmith\Snagit\10|StampCustomFolder
RegKey3=HKCU\Software\TechSmith\Snagit\11|CaptureCount
RegKey4=HKCU\Software\TechSmith\Snagit\11|CaptureOpenCount
RegKey5=HKCU\Software\TechSmith\Snagit\12|CaptureCount
RegKey6=HKCU\Software\TechSmith\Snagit\12|CaptureOpenCount
RegKey7=HKCU\Software\TechSmith\Snagit\13|CaptureCount
RegKey8=HKCU\Software\TechSmith\Snagit\13|CaptureOpenCount
RegKey9=HKCU\Software\TechSmith\Snagit\18|CaptureCount
RegKey10=HKCU\Software\TechSmith\Snagit\18|CaptureOpenCount
RegKey11=HKCU\Software\TechSmith\Snagit\Stamps|StampCustomFolder

Windows 10 x64 Pro on ASUS Maximus VIII Extreme motherboard, i7-6700k CPU,H220 X2 Liquid Cooler, 64 gbyte RipJaws DDR4 3200 RAM, Samsung 970 Pro NVMe M.2 500 gbyte SSD + Samsung 850 Pro 512 gbyte SSD, EVGA RTX 3060 Titan graphics card (Home Built System);  Windows 11x64 Pro on 512 gigabyte Dell XPS 15 2-in-1 Laptop/tablet and Dell XPS 8940 PC.  ASUS RT-AC88U router, 14 tbyte WD My Cloud PR2100 NAS Server, 200 Mbps cable Internet, MS Edge Chromium, MS Office 2021 (Local), Casper 11, DisplayFusion (3 Flat Panel Displays per system):   Latest Bitdefender Internet Security, Quicken, Weather Watcher Live, ThumbsPlus 10, Sticky Password 8, WD Smartware, CyberLink PowerDVD23, MSI AfterBurner, Rainmeter, 8GadgetPack, and many more.

Link to comment
Share on other sites

Updated the file, but no change log this time as I removed and replaced the file so it didn't show any changes. Fixed all the trailing backslashes and updated with all the suggestions above.

 

Thanks for the update!

 

Missed post: #6485

 

I found some more entries with a wrong or inconsistent VirtualStore path. And fixed them:

[Multi-Edit 2008 11.04*]
LangSecRef=3021
Detect=HKCU\Software\Multi Edit Software\Multi-Edit\11.0
Default=False
FileKey1=%AppData%\Multi Edit Software\Multi-Edit\11\Config.04|*.bak
FileKey2=%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\Tmp|*.*
FileKey3=%LocalAppData%\VirtualStore\Program Files*\Multi-Edit 2008\Config|*.tmp
FileKey4=%ProgramFiles%\Multi-Edit 2008\Config|*.tmp

[My Horse and Me*]
Section=Games
Detect1=HKLM\SOFTWARE\My Horse and Me 2
Detect2=HKLM\SOFTWARE\Atari\Mein Pferd und ich Demo
Detect3=HKLM\SOFTWARE\Atari\Mein Pferd und ich
Detect4=HKLM\SOFTWARE\Wow6432Node\Atari\Mein Pferd und ich Demo
Detect5=HKLM\SOFTWARE\Wow6432Node\Atari\Mein Pferd und ich
Default=False
FileKey1=%LocalAppData%\VirtualStore\Program Files*\Atari\Mein Pferd und ich*\System|++ Finish log.txt;++ Start log.txt;*.log|RECURSE
FileKey2=%LocalAppData%\VirtualStore\Program Files*\Atari\My Horse and Me|++ Finish log.txt;++ Start log.txt;*.log|RECURSE
FileKey3=%LocalAppData%\VirtualStore\Program Files*\Atari\W!Games\My Horse and Me|++ Finish log.txt;++ Start log.txt;*.log|RECURSE
FileKey4=%ProgramFiles%\Atari\Mein Pferd und ich*\System|++ Finish log.txt;++ Start log.txt;*.log|RECURSE
FileKey5=%ProgramFiles%\Atari\My Horse and Me|++ Finish log.txt;++ Start log.txt;*.log|RECURSE
FileKey6=%ProgramFiles%\Atari\W!Games\My Horse and Me|++ Finish log.txt;++ Start log.txt;*.log|RECURSE

[Warcraft III*]
Section=Games
Detect=HKLM\Software\Blizzard Entertainment\Warcraft III
DetectFile=%ProgramFiles%\Warcraft III\Warcraft III.exe
Default=False
FileKey1=%LocalAppData%\VirtualStore\Program Files*\Warcraft III|*.log;*.html
FileKey2=%LocalAppData%\VirtualStore\Program Files*\Warcraft III\Errors|*.dmp;*.txt
FileKey3=%ProgramFiles%\Warcraft III|*.log;*.html
FileKey4=%ProgramFiles%\Warcraft III\Errors|*.dmp;*.txt
ExcludeKey1=FILE|%ProgramFiles%\Warcraft III|*CustomKeyInfo.txt;*CustomKeysSample.txt

[Yahoo Messenger Cache*]
LangSecRef=3022
Detect=HKCU\Software\Yahoo\pager
Default=False
FileKey1=%AppData%\Yahoo!\Messenger|*.*|RECURSE
FileKey2=%LocalAppData%\VirtualStore\Program Files*\Yahoo!\Messenger\Cache|*.*|RECURSE

[Yahoo Messenger Logs*]
LangSecRef=3022
Detect=HKCU\Software\Yahoo\pager
Default=False
FileKey1=%LocalAppData%\VirtualStore\Program Files*\Yahoo!\Messenger\Cache|*.log;*.tmp
FileKey2=%LocalAppData%\VirtualStore\Program Files*\Yahoo!\Messenger\logs|*.log|RECURSE
FileKey3=%ProgramFiles%\Yahoo!\Messenger|*.log
ExcludeKey1=FILE|%ProgramFiles%\Yahoo!\Messenger\INSTALL.LOG

[Yahoo Messenger Profiles*]
LangSecRef=3022
Detect=HKCU\Software\Yahoo\pager
Default=False
Warning=This will also delete your saved chat histories.
FileKey1=%LocalAppData%\VirtualStore\Program Files*\Yahoo!\Messenger\Profiles|*.*|RECURSE
FileKey2=%ProgramFiles%\Yahoo!\Messenger\Profiles|*.*|RECURSE
Link to comment
Share on other sites

Edited as the only TMP/BAK file would be in: "%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\Tmp"

 

[Multi-Edit 2008 11.04*]
LangSecRef=3021
Detect=HKCU\Software\Multi Edit Software\Multi-Edit\11.0
Default=False
FileKey1=%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\Tmp|*.TMP

 

1 - All the Yahoo Messenger ones in the above post can be removed.  All those are outdated and one must use the Yahoo Messenger App instead now. messenger.yahoo.com for more.

 

*New Entry

[Yahoo Messenger App Cache*]
LangSecRef=3022
Detect=HKCU\Software\Yahoo\pager
Default=False

Warning=You will need to reload the App next time its started. Select View, Reload from the menu.
FileKey1=%AppData%\Yahoo Messenger\Cache|*.*|RECURSE

 

*New entry

[Yahoo Messenger App Logs*]
LangSecRef=3022
Detect=HKCU\Software\Yahoo\pager
Default=False
FileKey1=%LocalAppData%\yahoomessenger|SquirrelSetup.log


 

Link to comment
Share on other sites

Revised Entry

 

Merged [McAfee SiteAdvisor*] into this entry

Added more rules

 

[McAfee*]
LangSecRef=3024
Detect=HKLM\Software\McAfee
Default=False
FileKey1=%CommonAppData%\McAfee\AMCore\datreputation\Logs|*.*|RECURSE
FileKey2=%CommonAppData%\McAfee\CSP\ETW|*.bak
FileKey3=%CommonAppData%\McAfee\Jcm|*.tmp
FileKey4=%CommonAppData%\McAfee\MCLOGS|*.bak;*.log|RECURSE
FileKey5=%CommonAppData%\McAfee\MHN|*.bak
FileKey6=%CommonAppData%\McAfee\modulecoreservice.exe|*.txt
FileKey7=%CommonAppData%\McAfee\MPF\data|*.*|RECURSE
FileKey8=%CommonAppData%\McAfee\MSC\Logs|*.log
FileKey9=%CommonAppData%\McAfee\SiteAdvisor|*.txt|RECURSE
FileKey10=%CommonAppData%\McAfee\Update|*.*|RECURSE

FileKey11=%CommonAppData%\McAfee\VirusScan\Data|*.log;*.old
FileKey12=%CommonAppData%\McAfee\VirusScan\Logs|*.*|RECURSE
FileKey13=%LocalAppData%\VirtualStore\ProgramData\McAfee\AMCore\datreputation\Logs|*.*|RECURSE
FileKey14=%LocalAppData%\VirtualStore\ProgramData\McAfee\CSP\ETW|*.bak
FileKey15=%LocalAppData%\VirtualStore\ProgramData\McAfee\Jcm|*.tmp
FileKey16=%LocalAppData%\VirtualStore\ProgramData\McAfee\MCLOGS|*.bak;*.log|RECURSE
FileKey17=%LocalAppData%\VirtualStore\ProgramData\McAfee\MHN|*.bak
FileKey18=%LocalAppData%\VirtualStore\ProgramData\McAfee\modulecoreservice.exe|*.txt
FileKey19=%LocalAppData%\VirtualStore\ProgramData\McAfee\MPF\data|*.*|RECURSE
FileKey20=%LocalAppData%\VirtualStore\ProgramData\McAfee\MSC\Logs|*.log
FileKey21=%LocalAppData%\VirtualStore\ProgramData\McAfee\SiteAdvisor|*.txt|RECURSE
FileKey22=%LocalAppData%\VirtualStore\ProgramData\McAfee\Update|*.*|RECURSE
FileKey23=%LocalAppData%\VirtualStore\ProgramData\McAfee\VirusScan\Data|*.log;*.old
FileKey24=%LocalAppData%\VirtualStore\ProgramData\McAfee\VirusScan\Logs|*.*|RECURSE

Link to comment
Share on other sites

[My Horse and Me*]
Section=Games
Detect1=HKLM\SOFTWARE\My Horse and Me 2
Detect2=HKLM\SOFTWARE\Atari\Mein Pferd und ich Demo
Detect3=HKLM\SOFTWARE\Atari\Mein Pferd und ich
Detect4=HKLM\SOFTWARE\Wow6432Node\Atari\Mein Pferd und ich Demo
Detect5=HKLM\SOFTWARE\Wow6432Node\Atari\Mein Pferd und ich
Default=False
FileKey1=%LocalAppData%\VirtualStore\Program Files*\Atari\Mein Pferd und ich*\System|++ Finish log.txt;++ Start log.txt;*.log|RECURSE
FileKey2=%LocalAppData%\VirtualStore\Program Files*\Atari\My Horse and Me|++ Finish log.txt;++ Start log.txt;*.log|RECURSE
FileKey3=%LocalAppData%\VirtualStore\Program Files*\Atari\W!Games\My Horse and Me|++ Finish log.txt;++ Start log.txt;*.log|RECURSE
FileKey4=%ProgramFiles%\Atari\Mein Pferd und ich*\System|++ Finish log.txt;++ Start log.txt;*.log|RECURSE
FileKey5=%ProgramFiles%\Atari\My Horse and Me|++ Finish log.txt;++ Start log.txt;*.log|RECURSE
FileKey6=%ProgramFiles%\Atari\W!Games\My Horse and Me|++ Finish log.txt;++ Start log.txt;*.log|RECURSE

 

Does anyone know what Detect 2-5 in this entry is suppose to be? I don't think these are suppose to be here. They seem like custom german entries to me.

I am a maintainer for Winapp2. I also have a open-source group on Steam.

http://steamcommunity.com/groups/opencommunity

Link to comment
Share on other sites

[My Horse and Me*]

...

Does anyone know what Detect 2-5 in this entry is suppose to be? I don't think these are suppose to be here. They seem like custom german entries to me.

I don't know the game. It looks like there's a special German version available.

 

But Detect4 and 5 are not necessary, because CC checks "Wow6432Node" automatically.

 

 

I found many entries with an unnecessary "Wow6432Node" Detect, using the following regular expression:

^Detect.+\\Wow6432Node\\.+
Link to comment
Share on other sites

Revised Entry

Added: %UserProfile%\MicrosoftEdgeBackups\backups\*|*.*|REMOVESELF

 

[Microsoft Edge More*]
LangSecRef=3022
Detect=HKCU\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!001\INetCookies|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!001\MicrosoftEdge\Cookies|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!002\INetCookies|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!002\MicrosoftEdge\Cookies|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!001\Microsoft\CryptnetUrlCache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\#!002\Microsoft\CryptnetUrlCache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\Microsoft\CryptnetUrlCache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\Cookies|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\User\Default\DataStore\Indexed\Data|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\User\Default\ImageStore|*.*|RECURSE
FileKey11=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\user\Default\datastore\Data\nouser1\*\DBStore|*.*|RECURSE
FileKey12=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\user\Default\datastore\Data\nouser1\*\Favorites|*.*|RECURSE
FileKey13=%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AppData\User\Default\Indexed DB|*.edb;*.jfm;*.jrs;*.log
FileKey14=%UserProfile%\MicrosoftEdgeBackups\backups\*|*.*|REMOVESELF
ExcludeKey1=FILE|%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\user\Default\datastore\Data\nouser1\*\DBStore|*.edb
ExcludeKey2=FILE|%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*\AC\MicrosoftEdge\user\Default\datastore\Data\nouser1\*\DBStore|*.jfm

 

 

Link to comment
Share on other sites

Correction to my post https://forum.piriform.com/index.php?showtopic=32310&page=326&do=findComment&comment=288022

 

Revised entries

 

*Revised Entry - changed Detect

[Yahoo Messenger App Cache*]
LangSecRef=3022
Detect=HKCU\Software\Yahoo\Messenger
Default=False

Warning=You will need to reload the App next time its started. Select View, Reload from the menu.
FileKey1=%AppData%\Yahoo Messenger\Cache|*.*|RECURSE

 

*Revised entry, changed Detect

[Yahoo Messenger App Logs*]
LangSecRef=3022
Detect=HKCU\Software\Yahoo\Messenger
Default=False
FileKey1=%LocalAppData%\yahoomessenger|SquirrelSetup.log

Link to comment
Share on other sites

Can remove as newer version is available

 

[Multi-Edit 9.0*]
LangSecRef=3021
Detect=HKCU\Software\American Cybernetics\Multi-Edit\9.0
Default=False
FileKey1=%LocalAppData%\VirtualStore\Program Files*\Multi-Edit 9\Config\Tmp|*.*
FileKey2=%ProgramFiles%\Multi-Edit 9\Config\Tmp|*.*
 

*Revised entry, added all ExcludeKeys...

[Multi-Edit 2008 Logs*]
LangSecRef=3024
DetectFile=%AppData%\Multi Edit Software
Default=False
FileKey1=%AppData%\Multi Edit Software|*.log|RECURSE
ExcludeKey1=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|EVOLVE.LOG
ExcludeKey2=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|FILEPANE.LOG
ExcludeKey3=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|INSTALL.LOG
ExcludeKey4=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|POLYSTYLE.LOG
ExcludeKey5=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|TMPLPANE.LOG
ExcludeKey6=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\|WINLIST.LOG
 

Link to comment
Share on other sites

Revised Entry

Added: %WinDir%\Panther\Rollback|*.txt

 

[Panther*]
LangSecRef=3025
DetectFile=%Windir%\Panther
Default=False
FileKey1=%WinDir%\Panther|cbs.log;DDACLSys.log;miglog.xml;Migrep.html;PostGatherPnPList.log;PreGatherPnPList.log
FileKey2=%WinDir%\Panther\FastCleanup|*.log
FileKey3=%WinDir%\Panther\Rollback|*.txt
FileKey4=%WinDir%\Panther\UnattendGC|diagerr.xml;diagwrn.xml
FileKey5=%WinDir%\System32\sysprep\Panther\IE|diagerr.xml;diagwrn.xml;*.log

Link to comment
Share on other sites

Please remove "CBS Logs" entry. It is included in CCleaner's "Windows Log Files".

 

attachicon.gifcbs_log.png

 

I wonder if the "Windows Log Files" in winapp.ini also removes the .cab files that are part of [CBS Logs*] ??

 

[CBS Logs*]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
Default=False
FileKey1=%WinDir%\Logs\CBS|cbs.log;*.cab

Windows 10 x64 Pro on ASUS Maximus VIII Extreme motherboard, i7-6700k CPU,H220 X2 Liquid Cooler, 64 gbyte RipJaws DDR4 3200 RAM, Samsung 970 Pro NVMe M.2 500 gbyte SSD + Samsung 850 Pro 512 gbyte SSD, EVGA RTX 3060 Titan graphics card (Home Built System);  Windows 11x64 Pro on 512 gigabyte Dell XPS 15 2-in-1 Laptop/tablet and Dell XPS 8940 PC.  ASUS RT-AC88U router, 14 tbyte WD My Cloud PR2100 NAS Server, 200 Mbps cable Internet, MS Edge Chromium, MS Office 2021 (Local), Casper 11, DisplayFusion (3 Flat Panel Displays per system):   Latest Bitdefender Internet Security, Quicken, Weather Watcher Live, ThumbsPlus 10, Sticky Password 8, WD Smartware, CyberLink PowerDVD23, MSI AfterBurner, Rainmeter, 8GadgetPack, and many more.

Link to comment
Share on other sites

I wonder if the "Windows Log Files" in winapp.ini also removes the .cab files that are part of [CBS Logs*] ??

 

No, CC doesn't remove the .cab files! (winsys.ini: FileKey15=%windir%\Logs|*.log|RECURSE)

 

Modified entry:

[CBS Logs*]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
Default=False
FileKey1=%WinDir%\Logs\CBS|*.cab
Link to comment
Share on other sites

I found many entries with an unnecessary "Wow6432Node" Detect, using the following regular expression:

^Detect.+\\Wow6432Node\\.+

 

Modified entries:

Revised those Detect lines.

[Active Setup Temp Folder*]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Active Setup Temp Folders

[Age of Empires*]
Section=Games
Detect1=HKLM\Software\Microsoft\Games\Age of Empires
Detect2=HKLM\Software\Microsoft\Microsoft Games\Age of Empires
Detect3=HKLM\Software\Microsoft\microsoft games\age of empires 3

[Auslogics Registry Cleaner*]
LangSecRef=3024
Detect1=HKCU\Software\Auslogics\Registry Cleaner
Detect2=HKLM\Software\Auslogics\Registry Cleaner\3.x
Detect3=HKLM\Software\Auslogics\Registry Cleaner\4.x
Detect4=HKLM\Software\Auslogics\Registry Cleaner\5.X

[Bitcoin*]
LangSecRef=3022
Detect1=HKCU\Software\Bitcoin
Detect2=HKCU\Software\Bitcoin Core
Detect3=HKLM\SOFTWARE\Bitcoin Core

[Copernic DesktopSearch4 Logs*]
LangSecRef=3024
Detect=HKLM\SOFTWARE\Copernic\DesktopSearch4

[Crysis 3*]
Section=Games
Detect=HKLM\Software\Crytek\Crysis 3

[CyberLink PhotoDirector*]
LangSecRef=3023
Detect1=HKCU\Software\CyberLink\PhotoDirector3
Detect2=HKLM\Software\CyberLink\PhotoDirector4
Detect3=HKLM\SOFTWARE\CyberLink\PhotoDirector6
Detect4=HKCU\Software\Cyberlink\PowerDirector7
Detect5=HKCU\Software\CyberLink\PowerDirector10
Detect6=HKCU\Software\CyberLink\PowerDirector11
Detect7=HKCU\Software\CyberLink\PowerDirector12
Detect8=HKCU\Software\CyberLink\PowerDirector13

[Dragon Age: Origins*]
Section=Games
Detect1=HKCU\Software\BioWare\Dragon Age
Detect2=HKLM\Software\BioWare\Dragon Age

[DVBDream*]
LangSecRef=3024
Detect=HKLM\SOFTWARE\DVBDream

[Forte Agent*]
LangSecRef=3025
Detect=HKLM\SOFTWARE\Forte

[FossaMail Corrupt SQLites*]
LangSecRef=3030
Detect=HKLM\SOFTWARE\Mozilla\FossaMail

[FossaMail Crash Reports*]
LangSecRef=3030
Detect=HKLM\SOFTWARE\Mozilla\FossaMail

[FossaMail Extensions Log*]
LangSecRef=3030
Detect=HKLM\SOFTWARE\Mozilla\FossaMail

[FossaMail Log*]
LangSecRef=3030
Detect=HKLM\SOFTWARE\Mozilla\FossaMail

[FossaMail Maintenance Service*]
LangSecRef=3030
Detect=HKLM\SOFTWARE\Mozilla\FossaMail

[FossaMail Minidumps*]
LangSecRef=3030
Detect=HKLM\SOFTWARE\Mozilla\FossaMail

[FossaMail Net Predictions*]
LangSecRef=3030
Detect=HKLM\SOFTWARE\Mozilla\FossaMail

[FossaMail Startup Cache*]
LangSecRef=3030
Detect=HKLM\SOFTWARE\Mozilla\FossaMail

[FossaMail TestPilot Error Logs*]
LangSecRef=3030
Detect=HKLM\SOFTWARE\Mozilla\FossaMail

[FossaMail Update Logs*]
LangSecRef=3030
Detect=HKLM\SOFTWARE\Mozilla\FossaMail

[FossaMail webappsstore.sqlite*]
LangSecRef=3030
Detect=HKLM\SOFTWARE\Mozilla\FossaMail

[Hedgewars VideoTemp*]
Section=Games
Detect=HKLM\SOFTWARE\Hedgewars

[HitmanPro*]
LangSecRef=3024
Detect1=HKCU\Software\HitMan Pro
Detect2=HKCU\Software\HitMan Pro 2
Detect3=HKCU\Software\HitMan Pro 3
Detect4=HKLM\SOFTWARE\HitmanPro

[League of Legends*]
Section=Games
Detect1=HKCU\Software\Bugsplat\lol_beta_riotgames_com
Detect2=HKCU\Software\Riot Games
Detect3=HKLM\Software\Riot Games

[Logitech Desktop Messenger*]
LangSecRef=3024
Detect1=HKCU\Software\Logitech\DesktopMessenger
Detect2=HKLM\SOFTWARE\Logitech\DesktopMessenger
Detect3=HKLM\SOFTWARE\Logitech\Logitech Desktop Messenger

[Microsoft XNA Game Studio*]
Section=Games
Detect=HKLM\Software\Microsoft\XNA

[Midori - Cache*]
LangSecRef=3022
Detect=HKLM\Software\Midori

[Midori - Cookies*]
LangSecRef=3022
Detect=HKLM\Software\Midori

[Midori - History*]
LangSecRef=3022
Detect=HKLM\Software\Midori

[Midori - Session*]
LangSecRef=3022
Detect=HKLM\Software\Midori

[Neostar CMS Station Client Logs*]
LangSecRef=3024
Detect=HKLM\SOFTWARE\company\Neostar CMS

[Nero*]
LangSecRef=3021
Detect1=HKLM\Software\Nero\Nero 11\Nero11Suite
Detect2=HKLM\Software\Nero\Nero 12\Nero12Suite

[OpenOffice.org Setup Files*]
LangSecRef=3021
Detect1=HKLM\Software\OpenOffice
Detect2=HKLM\Software\OpenOffice.org

[OpenOffice.org*]
LangSecRef=3021
Detect1=HKLM\Software\OpenOffice
Detect2=HKLM\Software\OpenOffice.org

[Samsung Magician Logs*]
LangSecRef=3021
Detect=HKLM\Software\Samsung Magician

[Seagate SeaTools for Windows Logs*]
LangSecRef=3024
Detect=HKLM\SOFTWARE\SeaToolsforWindows

[TrendMicro RUBotted Logs*]
LangSecRef=3024
Detect=HKLM\SOFTWARE\TrendMicro\RUBotted

[UltraDefrag Logs*]
LangSecRef=3024
Detect=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\UltraDefrag
DetectFile=%WinDir%\UltraDefrag\ultradefrag.exe

[Windows Live Writer Logs*]
LangSecRef=3024
Detect=HKLM\SOFTWARE\Microsoft\Windows Live Writer

[Wistron Corp Launch Manager Logs*]
LangSecRef=3024
Detect=HKLM\SOFTWARE\Wistron Corp\Launch Manager

[Wondershare PDF Editor*]
LangSecRef=3021
Detect=HKLM\Software\Wondershare\Wondershare PDF Editor

[Wondershare Video Converter Ultimate More*]
LangSecRef=3023
Detect=HKLM\SOFTWARE\Wondershare\Wondershare Video Converter Ultimate

[XnView More*]
LangSecRef=3023
Detect1=HKCU\Software\XnView
Detect2=HKLM\Software\XnView
Link to comment
Share on other sites

*Revised entry, added all ExcludeKeys...

[Multi-Edit 2008 Logs*]

...

 

Modified entry:

Changed Detect and removed unnecessary pipe symbols from ExcludeKeys.

[Multi-Edit 2008 Logs*]
LangSecRef=3024
Detect=HKCU\Software\Multi Edit Software\Multi-Edit\11.0
Default=False
FileKey1=%AppData%\Multi Edit Software|*.log|RECURSE
ExcludeKey1=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\EVOLVE.LOG
ExcludeKey2=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\FILEPANE.LOG
ExcludeKey3=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\INSTALL.LOG
ExcludeKey4=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\POLYSTYLE.LOG
ExcludeKey5=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\TMPLPANE.LOG
ExcludeKey6=FILE|%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\WINLIST.LOG
 

Modified entry:

Changed name from [Multi-Edit 2008 11.04*] to [Multi-Edit 2008 Temps*] and corrected LangSecRef.

[Multi-Edit 2008 Temps*]
LangSecRef=3024
Detect=HKCU\Software\Multi Edit Software\Multi-Edit\11.0
Default=False
FileKey1=%AppData%\Multi Edit Software\Multi-Edit\11\Config.04\Tmp|*.TMP
Edit: Fixed entry. Edited by APMichael
Link to comment
Share on other sites

Modified entry:

Removed unnecessary pipe symbols from ExcludeKeys.

[FlashPlayer SharedObjects*]
LangSecRef=3029
SpecialDetect=DET_CHROME
Detect1=HKCU\Software\Chromium
Detect2=HKCU\Software\SuperBird
Detect3=HKCU\Software\Torch
Detect4=HKCU\Software\Vivaldi
Default=False
FileKey1=%LocalAppData%\Amigo\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
FileKey2=%LocalAppData%\Chrome Plus\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
FileKey3=%LocalAppData%\Chromium\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
FileKey4=%LocalAppData%\Flock\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
FileKey5=%LocalAppData%\Google\Chrome*\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
FileKey6=%LocalAppData%\Rockmelt\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
FileKey7=%LocalAppData%\SRWare Iron\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
FileKey8=%LocalAppData%\SuperBird\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
FileKey9=%LocalAppData%\Torch\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
FileKey10=%LocalAppData%\Vivaldi\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Amigo\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol
ExcludeKey2=FILE|%LocalAppData%\Chrome Plus\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol
ExcludeKey3=FILE|%LocalAppData%\Chromium\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol
ExcludeKey4=FILE|%LocalAppData%\Flock\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol
ExcludeKey5=FILE|%LocalAppData%\Google\Chrome*\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol
ExcludeKey6=FILE|%LocalAppData%\Rockmelt\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol
ExcludeKey7=FILE|%LocalAppData%\SRWare Iron\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol
ExcludeKey8=FILE|%LocalAppData%\SuperBird\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol
ExcludeKey9=FILE|%LocalAppData%\Torch\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol
ExcludeKey10=FILE|%LocalAppData%\Vivaldi\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol
 

Modified entry:

Removed unnecessary pipe symbol from ExcludeKey.

[Jump Lists*]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
FileKey1=%AppData%\Microsoft\windows\recent\Automaticdestinations|*.*|RECURSE
FileKey2=%AppData%\Microsoft\windows\recent\CustomDestinations|*.*|RECURSE
ExcludeKey1=FILE|%AppData%\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
Link to comment
Share on other sites

 

I wonder if the "Windows Log Files" in winapp.ini also removes the .cab files that are part of [CBS Logs*] ??

 

[CBS Logs*]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
Default=False
FileKey1=%WinDir%\Logs\CBS|cbs.log;*.cab

 

 

CAB was not found in any of the 3 INI files once I exported them from the current CC version....

Link to comment
Share on other sites

 

No, CC doesn't remove the .cab files! (winsys.ini: FileKey15=%windir%\Logs|*.log|RECURSE)

 

Modified entry:

[CBS Logs*]
LangSecRef=3025
Detect=HKLM\Software\Microsoft\Windows
Default=False
FileKey1=%WinDir%\Logs\CBS|*.cab

 

I never saw files with the .cab extension in that location. I think this was added into this entry mistakenly.

Link to comment
Share on other sites

Modified entry:

Removed unnecessary pipe symbols from ExcludeKeys.

[FlashPlayer SharedObjects*]
LangSecRef=3029
SpecialDetect=DET_CHROME
Detect1=HKCU\Software\Chromium
Detect2=HKCU\Software\SuperBird
Detect3=HKCU\Software\Torch
Detect4=HKCU\Software\Vivaldi
Default=False
FileKey1=%LocalAppData%\Amigo\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
FileKey2=%LocalAppData%\Chrome Plus\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
FileKey3=%LocalAppData%\Chromium\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
FileKey4=%LocalAppData%\Flock\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
FileKey5=%LocalAppData%\Google\Chrome*\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
FileKey6=%LocalAppData%\Rockmelt\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
FileKey7=%LocalAppData%\SRWare Iron\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
FileKey8=%LocalAppData%\SuperBird\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
FileKey9=%LocalAppData%\Torch\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
FileKey10=%LocalAppData%\Vivaldi\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects|*.*|RECURSE
ExcludeKey1=FILE|%LocalAppData%\Amigo\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol
ExcludeKey2=FILE|%LocalAppData%\Chrome Plus\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol
ExcludeKey3=FILE|%LocalAppData%\Chromium\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol
ExcludeKey4=FILE|%LocalAppData%\Flock\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol
ExcludeKey5=FILE|%LocalAppData%\Google\Chrome*\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol
ExcludeKey6=FILE|%LocalAppData%\Rockmelt\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol
ExcludeKey7=FILE|%LocalAppData%\SRWare Iron\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol
ExcludeKey8=FILE|%LocalAppData%\SuperBird\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol
ExcludeKey9=FILE|%LocalAppData%\Torch\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol
ExcludeKey10=FILE|%LocalAppData%\Vivaldi\User Data\*\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\*\macromedia.com\support\flashplayer\sys\settings.sol
 

Modified entry:

Removed unnecessary pipe symbol from ExcludeKey.

[Jump Lists*]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
FileKey1=%AppData%\Microsoft\windows\recent\Automaticdestinations|*.*|RECURSE
FileKey2=%AppData%\Microsoft\windows\recent\CustomDestinations|*.*|RECURSE
ExcludeKey1=FILE|%AppData%\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

 

There are no extra pipe symbols in these entries. You must have an old Winapp2.ini.

Link to comment
Share on other sites

There are no extra pipe symbols in these entries. You must have an old Winapp2.ini.

 

I see it.

 

ExcludeKey1=FILE|%AppData%\Microsoft\Windows\Recent\AutomaticDestinations\|f01b4d95cf55d32a.automaticDestinations-ms

 

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.