MoscaDotTo / Winapp2

A database of extended cleaning routines for popular Windows PC based maintenance software.
Creative Commons Attribution Share Alike 4.0 International
770 stars 86 forks source link

New and updated entries for Winapp2.ini #828

Closed Shakil-Shahadat closed 2 years ago

Shakil-Shahadat commented 2 years ago

AIMP [ Updated ]

For reference, I am quoting the AIMP entry in winapp.ini.

[AIMP 3]
ID=2287
LangSecRef=3023
DetectFile=%AppData%\AIMP3
Default=True
FileKey1=%AppData%\AIMP3|AIMP3.bak
FileKey2=%AppData%\AIMP3|AIMP3ate.bak
FileKey3=%AppData%\AIMP3|AIMP3lib.bak
FileKey4=%AppData%\AIMP3|AIMP3ac.bak

There are several problems here,

Let me quote the AIMP entry in winapp2.ini for reference.

[AIMP *]
LangSecRef=3023
DetectFile=%ProgramFiles%\AIMP*
FileKey1=%AppData%\AIMP|*.bak
FileKey2=%ProgramFiles%\AIMP*\!Backup|*.*|REMOVESELF
FileKey3=%ProgramFiles%\AIMP*\Data|*.bak|RECURSE

The problems here,

So, the updated entry should be,

[AIMP *]
LangSecRef=3023
DetectFile=%AppData%\AIMP*
FileKey1=%AppData%\AIMP*|*.bak
FileKey2=%ProgramFiles%\AIMP*\!Backup|*.*|REMOVESELF
FileKey3=%ProgramFiles%\AIMP*\Data|*.bak|RECURSE

CareUEyes [ New Entry ]

[CareUEyes *]
LangSecRef=3021
DetectFile=%AppData%\careueyes
FileKey1=%AppData%\careueyes\log|*.*

DU Meter [ Updated ]

[DU Meter *]
LangSecRef=3022
Detect=HKCU\Software\Hagel\DU Meter
FileKey1=%CommonAppData%\Hagel Technologies\DU Meter|*.csv;error.elf

Change: error.elf is new here. It's just an error log. Also, I don't see any *.csv file there.

Foxit PDF Editor [ New Entry ]

[Foxit PDF Editor *]
LangSecRef=3021
Detect=HKCU\Software\Foxit Software\Foxit PDF Editor 11.0
FileKey1=%AppData%\Foxit Software\Foxit PDF Editor\Cache|*.db
FileKey2=%AppData%\Foxit Software\Foxit PDF Editor\cacheData|*.dat
FileKey3=%AppData%\Foxit Software\Foxit PDF Editor\FormFiller|AutoComplete.ds
RegKey1=HKCU\Software\Foxit Software\Foxit PDF Editor 11.0\CommentPanel\Filter
RegKey2=HKCU\Software\Foxit Software\Foxit PDF Editor 11.0\MRU\File MRU
RegKey3=HKCU\Software\Foxit Software\Foxit PDF Editor 11.0\MRU\Place MRU
RegKey4=HKCU\Software\Foxit Software\Foxit PDF Editor 11.0\Preferences\History

Note, Foxit PhantomPDF is renamed to Foxit PDF Editor. This version is somewhat different, that's why I made this new entry.

APMichael commented 2 years ago

The FileKeys can be merged:

[DU Meter *]
LangSecRef=3022
Detect=HKCU\Software\Hagel\DU Meter
FileKey1=%CommonAppData%\Hagel Technologies\DU Meter|*.csv;error.elf
Shakil-Shahadat commented 2 years ago

Updated.

APMichael commented 2 years ago

These changes are included in #824.