4208 lines
127 KiB
INI
4208 lines
127 KiB
INI
#
|
|
# Sandboxie Official Configuration Templates
|
|
#
|
|
# PLEASE DO NOT EDIT
|
|
#
|
|
# You may place local (custom) templates in your Sandboxie.ini
|
|
# file. Use the examples here to create your own templates, but
|
|
# do not copy the [TemplateSettings] section.
|
|
#
|
|
# Please name your own local templates in such a way that
|
|
# it will not introduce conflicts with the official templates.
|
|
#
|
|
# For example, if you design a local template to resolve
|
|
# a conflict with the utility ExampleSoft:
|
|
#
|
|
# [Template_Local_ExampleSoft]
|
|
# Tmpl.Title=ExampleSoft
|
|
# Tmpl.Class=Local
|
|
# OpenWinClass=ExampleSoft_WindowClass
|
|
# OpenIpcPath=*\BaseNamedObjects*\ExampleSoft_*
|
|
#
|
|
# Note the use of the word "local" to prevent a conflict,
|
|
# should this official template file later be revised to
|
|
# include a template for ExampleSoft.
|
|
#
|
|
# Local templates that appear in your Sandboxie.ini are
|
|
# treated the same way as any official template in this file,
|
|
# and can be activated in the Sandboxie user interface.
|
|
#
|
|
|
|
[DefaultTemplates]
|
|
Template=RpcPortBindings
|
|
Template=SpecialImages
|
|
Template=COM
|
|
Template=WindowsExplorer
|
|
Template=ThirdPartyIsolation
|
|
Template=BlockSoftwareUpdaters
|
|
Template=BlockWinRM
|
|
Template=OpenWinInetCache
|
|
|
|
|
|
[TemplateSettings]
|
|
Tmpl.Version=1
|
|
|
|
# Firefox-based profile paths
|
|
Tmpl.Firefox=%AppData%\Mozilla\Firefox\Profiles\*
|
|
Tmpl.Waterfox=%AppData%\Waterfox\Profiles\*
|
|
Tmpl.PaleMoon=%AppData%\Moonchild Productions\Pale Moon\Profiles\*
|
|
Tmpl.SeaMonkey=%AppData%\Mozilla\SeaMonkey\Profiles\*
|
|
Tmpl.LibreWolf=%AppData%\LibreWolf\Profiles\*
|
|
|
|
# Firefox-based addon path
|
|
Tmpl.Zotero=%Tmpl.Firefox%\zotero
|
|
|
|
# Chromium-based profile paths
|
|
Tmpl.Chrome=%Local AppData%\Google\Chrome\User Data\Default
|
|
Tmpl.Edge=%Local AppData%\Microsoft\Edge\User Data\Default
|
|
Tmpl.Vivaldi=%Local AppData%\Vivaldi\User Data\Default
|
|
Tmpl.Brave=%Local AppData%\BraveSoftware\Brave-Browser\User Data\Default
|
|
Tmpl.Opera=%AppData%\Opera Software\Opera Stable\Default
|
|
Tmpl.Yandex=%Local AppData%\Yandex\YandexBrowser\User Data\Default
|
|
Tmpl.Ungoogled=%Local AppData%\Chromium\User Data\Default
|
|
Tmpl.Iron=%Local AppData%\Chromium\User Data\Default
|
|
Tmpl.Maxthon_6=%Local AppData%\Maxthon\Application\User Data\Default
|
|
Tmpl.Dragon=%Local AppData%\Comodo\Dragon\User Data\Default
|
|
Tmpl.Osiris=%Local AppData%\Osiris\Osiris-Browser\User Data\Default
|
|
Tmpl.Slimjet=%Local AppData%\Slimjet\User Data\Default
|
|
|
|
# Email Readers profile paths
|
|
Tmpl.Office_Outlook=%Local AppData%\Microsoft\Outlook
|
|
Tmpl.Windows_Vista_Mail=%Local AppData%\Microsoft\Windows Mail
|
|
Tmpl.Windows_Live_Mail=%Local AppData%\Microsoft\Windows Live Mail
|
|
Tmpl.Thunderbird=%Local AppData%\Thunderbird
|
|
Tmpl.Thunderbird:ExpectFile=xulstore.json
|
|
Tmpl.Opera_Mail=%Local AppData%\Opera\*\mail
|
|
Tmpl.Opera_Mail:ExpectFile=accounts.ini
|
|
Tmpl.Incredimail=%Local AppData%\IM
|
|
Tmpl.TheBat=%AppData%\The Bat!
|
|
Tmpl.eM_Client=%AppData%\eM Client
|
|
|
|
# Miscellaneous paths
|
|
Tmpl.eDocPrinter=%ProgramFiles%\ITEKSOFT\eDocPrinter*
|
|
Tmpl.FinePrint=%Personal%\FinePrint files
|
|
Tmpl.RoboForm=%Personal%\My RoboForm Data
|
|
Tmpl.KasperskyDataRoot=%AllUsersProfile%\Kaspersky Lab
|
|
|
|
|
|
#
|
|
# Default access rules
|
|
#
|
|
|
|
[TemplateDefaultPaths]
|
|
|
|
# Key
|
|
# Application Hives
|
|
OpenKeyPath=\REGISTRY\A\*
|
|
|
|
# File
|
|
# named pipe root
|
|
OpenFilePath=\Device\NamedPipe\
|
|
# mail slot root
|
|
OpenFilePath=\Device\MailSlot\
|
|
# Windows 7 fault-tolerant heap
|
|
OpenFilePath=\Device\NamedPipe\ProtectedPrefix\LocalService\FTHPIPE
|
|
# printer
|
|
OpenFilePath=\Device\NamedPipe\spoolss
|
|
OpenFilePath=\Device\NamedPipe\spooler*
|
|
OpenFilePath=%DefaultSpoolDirectory%\*
|
|
OpenFilePath=%DefaultSpoolDirectory2%\*
|
|
# doPDF
|
|
OpenFilePath=\Device\NamedPipe\*_doPDF*
|
|
# multimedia
|
|
OpenFilePath=\Device\NamedPipe\AudioSrv
|
|
# third-party software
|
|
OpenFilePath=\Device\NamedPipe\Adobe LM Service*
|
|
# Novell NetIdentity
|
|
OpenFilePath=\Device\NamedPipe\XTIERRPCPIPE
|
|
#
|
|
# the LanmanRedirector/Mup devices (when accessed without extra paths)
|
|
# is a security attack, and must be closed
|
|
ClosedFilePath=\Device\LanmanRedirector
|
|
ClosedFilePath=\Device\Mup
|
|
#
|
|
# Block access to imdisk, force terminated proxy processes can result in a BSOD
|
|
ClosedFilePath=\Device\ImDiskCtl
|
|
|
|
# IPC
|
|
OpenIpcPath=\Windows\ApiPort
|
|
OpenIpcPath=\Sessions\*\Windows\ApiPort
|
|
OpenIpcPath=\Sessions\*\Windows\SharedSection
|
|
# bSession0
|
|
OpenIpcPath=\Windows\SharedSection
|
|
# now required by Chromium browsers
|
|
OpenIpcPath=\Sessions\*\BaseNamedObjects\CrSharedMem_*
|
|
OpenIpcPath=\ThemeApiPort
|
|
OpenIpcPath=\KnownDlls\*
|
|
# _WIN64
|
|
OpenIpcPath=\KnownDlls32\*
|
|
# _M_ARM64
|
|
OpenIpcPath=\KnownDllsChpe32\*
|
|
OpenIpcPath=\NLS\*
|
|
OpenIpcPath=*\BaseNamedObjects*\ShimCacheMutex
|
|
OpenIpcPath=*\BaseNamedObjects*\ShimSharedMemory
|
|
OpenIpcPath=*\BaseNamedObjects*\SHIMLIB_LOG_MUTEX
|
|
OpenIpcPath=*\BaseNamedObjects*\msgina: ReturnToWelcome
|
|
OpenIpcPath=\Security\LSA_AUTHENTICATION_INITIALIZED
|
|
OpenIpcPath=\LsaAuthenticationPort
|
|
OpenIpcPath=\NlsCacheMutant
|
|
OpenIpcPath=\KernelObjects\*
|
|
# miscellaneous services
|
|
OpenIpcPath=\NLAPublicPort
|
|
OpenIpcPath=\RPC Control\nlaapi
|
|
OpenIpcPath=\RPC Control\tapsrvlpc
|
|
OpenIpcPath=\RPC Control\senssvc
|
|
OpenIpcPath=\RPC Control\samss lpc
|
|
OpenIpcPath=*\BaseNamedObjects*\SENS Information Cache
|
|
OpenIpcPath=*\BaseNamedObjects*\TabletHardwarePresent
|
|
OpenIpcPath=*\BaseNamedObjects*\userenv: * Group Policy has been applied
|
|
OpenIpcPath=*\BaseNamedObjects*\TermSrvReadyEvent
|
|
# network
|
|
OpenIpcPath=\RPC Control\dhcpcsvc
|
|
OpenIpcPath=\RPC Control\dhcpcsvc6
|
|
OpenIpcPath=\RPC Control\DNSResolver
|
|
OpenIpcPath=\RPC Control\RasmanRpc
|
|
OpenIpcPath=*\BaseNamedObjects*\WininetStartupMutex
|
|
OpenIpcPath=*\BaseNamedObjects*\WininetConnectionMutex
|
|
OpenIpcPath=*\BaseNamedObjects*\WininetProxyRegistryMutex
|
|
OpenIpcPath=*\BaseNamedObjects*\RasPbFile
|
|
# cicero multi-language subsystem
|
|
OpenIpcPath=*\BaseNamedObjects*\CTF.*
|
|
OpenIpcPath=*\BaseNamedObjects*\MSCTF.*
|
|
OpenIpcPath=*\BaseNamedObjects*\MSUIM.*
|
|
OpenIpcPath=*\BaseNamedObjects*\CtfmonInstMutex*
|
|
OpenIpcPath=*\BaseNamedObjects*\CiceroSharedMemDefault*
|
|
OpenIpcPath=*\BaseNamedObjects*\CicLoadWinStaWinSta*
|
|
# Sysinternals DebugView (dbgview)
|
|
OpenIpcPath=*\BaseNamedObjects*\DBWinMutex
|
|
OpenIpcPath=*\BaseNamedObjects*\DBWIN_BUFFER
|
|
OpenIpcPath=*\BaseNamedObjects*\DBWIN_BUFFER_READY
|
|
OpenIpcPath=*\BaseNamedObjects*\DBWIN_DATA_READY
|
|
# multimedia
|
|
OpenIpcPath=\RPC Control\AudioSrv
|
|
OpenIpcPath=*\BaseNamedObjects*\mmGlobalPnpInfo
|
|
OpenIpcPath=*\BaseNamedObjects*\Guard*mmGlobalPnpInfoGuard
|
|
OpenIpcPath=*\BaseNamedObjects*\MidiMapper_modLongMessage_RefCnt
|
|
OpenIpcPath=*\BaseNamedObjects*\MidiMapper_Configure
|
|
OpenIpcPath=*\BaseNamedObjects*\SsiMidiDllCs
|
|
OpenIpcPath=*\BaseNamedObjects*\StaccatoSynthCore11Mutex
|
|
OpenIpcPath=*\BaseNamedObjects*\WDMAUD_Callbacks
|
|
OpenIpcPath=*\BaseNamedObjects*\DirectSound*
|
|
OpenIpcPath=*\BaseNamedObjects*\AMResourceMutex*
|
|
OpenIpcPath=*\BaseNamedObjects*\AMResourceMapping*
|
|
OpenIpcPath=*\BaseNamedObjects*\VideoRenderer
|
|
OpenIpcPath=*\BaseNamedObjects*\VIDEOMEMORY
|
|
OpenIpcPath=*\BaseNamedObjects*\mxrapi
|
|
OpenIpcPath=*\BaseNamedObjects*\mixercallback
|
|
OpenIpcPath=*\BaseNamedObjects*\hardwaremixercallback
|
|
OpenIpcPath=*\BaseNamedObjects*\DINPUTWINMM
|
|
OpenIpcPath=*\BaseNamedObjects*\DDrawDriverObjectListMutex
|
|
OpenIpcPath=*\BaseNamedObjects*\__DDrawExclMode__
|
|
OpenIpcPath=*\BaseNamedObjects*\__DDrawCheckExclMode__
|
|
OpenIpcPath=*\BaseNamedObjects*\DDrawWindowListMutex
|
|
OpenIpcPath=*\BaseNamedObjects*\DDrawCheckFullscreenSemaphore
|
|
OpenIpcPath=*\BaseNamedObjects*\D3D9CheckFullscreenSemaphore
|
|
OpenIpcPath=*\BaseNamedObjects*\WinMMConsoleAudioEvent
|
|
# multimedia (Vista)
|
|
OpenIpcPath=\MmcssApiPort
|
|
OpenIpcPath=\RPC Control\AudioClientRpc
|
|
# AudioDg
|
|
OpenIpcPath=*\BaseNamedObjects*\SYSTEM_AUDIO_STREAM_*
|
|
# Windows Aero
|
|
OpenIpcPath=\UxSmsApiPort
|
|
OpenIpcPath=*\BaseNamedObjects*\Dwm-*-ApiPort-*
|
|
OpenIpcPath=*\BaseNamedObjects*\DwmDxBltEvent*
|
|
# following resource is needed on Windows Vista and later,
|
|
# but also provided by the SRS Audio Sandbox program
|
|
OpenIpcPath=*\BaseNamedObjects*\AudioEngineDuplicateHandleApiPort*
|
|
# NComputing audio server/driver ?
|
|
OpenIpcPath=\RPC Control\NCWTSAudioServer
|
|
# printer
|
|
OpenIpcPath=\RPC Control\spoolss
|
|
OpenIpcPath=*\BaseNamedObjects*\EPSON-PrgMtr-*
|
|
OpenIpcPath=*\BaseNamedObjects*\RouterPreInitEvent
|
|
# Sandboxie service
|
|
OpenIpcPath=\RPC Control\SbieSvcPort
|
|
OpenIpcPath=*\BaseNamedObjects*\Sandboxie_StartMenu_WorkArea_*
|
|
# objects in an unnamed directory
|
|
OpenIpcPath=\...\*
|
|
# miscellaneous services (Vista)
|
|
# licensing
|
|
OpenIpcPath=\RPC Control\SLCTransportEndpoint-*
|
|
# parental controls
|
|
OpenIpcPath=\RPC Control\wpcsvc
|
|
# Windows Firewall
|
|
OpenIpcPath=*\BaseNamedObjects*\BFE_Notify_Event_*
|
|
# _WIN64
|
|
# 64-bit spooler for 32-bit programs
|
|
OpenIpcPath=*\BaseNamedObjects*\WinSpl64To32Mutex*_0
|
|
OpenIpcPath=\RPC Control\splwow64_*_0
|
|
OpenIpcPath=\RPC Control\umpdproxy_*_0
|
|
#
|
|
OpenIpcPath=\ConsoleEvent-0x*
|
|
OpenIpcPath=*\BaseNamedObjects*\ConsoleEvent-0x*
|
|
OpenIpcPath=\RPC Control\console-0x*-lpc-handle
|
|
OpenIpcPath=\RPC Control\ConsoleEvent-0x*
|
|
OpenIpcPath=\RPC Control\ConsoleLPC-0x*
|
|
OpenIpcPath=\RPC Control\lsapolicylookup
|
|
OpenIpcPath=\RPC Control\lsasspirpc
|
|
OpenIpcPath=\RPC Control\LSARPC_ENDPOINT
|
|
OpenIpcPath=\RPC Control\umpo
|
|
OpenIpcPath=*\BaseNamedObjects*\FlipEx*
|
|
OpenIpcPath=*\BaseNamedObjects*\FontCachePort
|
|
OpenIpcPath=*\BaseNamedObjects*\FntCache-*
|
|
# Windows 8
|
|
OpenIpcPath=\Windows\Theme*
|
|
OpenIpcPath=\Sessions\*\Windows\Theme*
|
|
OpenIpcPath=\Sessions\*\Windows\DwmApiPort
|
|
OpenIpcPath=*\BaseNamedObjects*\DWM_DX_FULLSCREEN_TRANSITION_EVENT
|
|
# _WIN64
|
|
# 64-bit spooler for 32-bit programs
|
|
OpenIpcPath=*\BaseNamedObjects*\WinSpl64To32Mutex*_2000
|
|
OpenIpcPath=\RPC Control\splwow64_*_2000
|
|
OpenIpcPath=\RPC Control\umpdproxy_*_2000
|
|
#
|
|
# Windows 10
|
|
OpenIpcPath=*\BaseNamedObjects*\CoreMessagingRegistrar
|
|
OpenIpcPath=*\BaseNamedObjects\[CoreUI]-*
|
|
# open paths Windows 11
|
|
# 22449.1000 accesses this before sbiedll load
|
|
OpenIpcPath=*\BaseNamedObjects\SM*:WilStaging_*
|
|
# _M_ARM64 22621.819 used by emulated processes
|
|
OpenIpcPath=\{BEC19D6F-D7B2-41A8-860C-8787BB964F2D}
|
|
#
|
|
ReadIpcPath=\??\pipe\*
|
|
ReadIpcPath=$:explorer.exe
|
|
|
|
OpenWinClass=Shell_TrayWnd
|
|
OpenWinClass=TrayNotifyWnd
|
|
# Power Meter dialog box:
|
|
OpenWinClass=SystemTray_Main
|
|
OpenWinClass=Connections Tray
|
|
OpenWinClass=MS_WebcheckMonitor
|
|
OpenWinClass=PrintTray_Notify_WndClass
|
|
OpenWinClass=CicLoaderWndClass
|
|
OpenWinClass=CicMarshalWndClass
|
|
OpenWinClass=Credential Dialog Xaml Host
|
|
# Windows 7
|
|
OpenWinClass=Sandbox:*:ConsoleWindowClass
|
|
OpenWinClass=MSTaskSwWClass
|
|
|
|
#
|
|
# third party
|
|
#
|
|
OpenIpcPath=*\BaseNamedObjects*\ATITRAY_SMEM
|
|
OpenIpcPath=*\BaseNamedObjects*\ATITRAY_OSDM
|
|
OpenIpcPath=*\BaseNamedObjects*\AMCreateListenSock*
|
|
# Ad Muncher
|
|
OpenIpcPath=*\BaseNamedObjects*\AMIPC_*
|
|
# DevLdr32 sound card driver
|
|
OpenIpcPath=*\BaseNamedObjects*\devldr32
|
|
# ThreatFire
|
|
OpenIpcPath=*\BaseNamedObjects*\ThreatfireApiHookIpc2Map
|
|
# third party - key-logger-related
|
|
OpenIpcPath=*\BaseNamedObjects*\00MemoryShareKeyloggerHunter
|
|
# hardware - wacom tablet
|
|
OpenIpcPath=*\BaseNamedObjects*\WacomNewFrontAppEventName
|
|
OpenIpcPath=*\BaseNamedObjects*\WacomTouchingAppNameMutexName
|
|
|
|
OpenWinClass=CTouchPadSynchronizer
|
|
OpenWinClass=Type32_Main_Window
|
|
OpenWinClass=TForm_AshampooFirewall
|
|
# Tight VNC
|
|
OpenWinClass=WinVNC desktop sink
|
|
# Download Accelerator Plus
|
|
OpenWinClass=Afx:400000:0
|
|
# nVidia nView
|
|
OpenWinClass=NVIDIA TwinView Window
|
|
OpenWinClass=SWFlash_PlaceHolderX
|
|
# PowerPoint
|
|
OpenWinClass=MdiClass
|
|
# joystick
|
|
OpenWinClass=Logitech Wingman Internal Message Router
|
|
# devldr32 sound card driver
|
|
OpenWinClass=devldr
|
|
|
|
|
|
#
|
|
# Network access rules
|
|
# depending on the preset, either the "Open" or the "Close" directives are applied
|
|
#
|
|
|
|
[TemplateNetworkPaths]
|
|
OpenFilePath=\Device\NamedPipe\ROUTER
|
|
OpenFilePath=\Device\NamedPipe\ShimViewer
|
|
OpenFilePath=\Device\Afd
|
|
OpenFilePath=\Device\Afd\Endpoint
|
|
OpenFilePath=\Device\Afd\AsyncConnectHlp
|
|
OpenFilePath=\Device\Afd\AsyncSelectHlp
|
|
OpenFilePath=\Device\Afd\ROUTER
|
|
OpenFilePath=\Device\Afd\Mio
|
|
OpenFilePath=\Device\WS2IFSL
|
|
OpenFilePath=\Device\WS2IFSL\NifsPvd
|
|
OpenFilePath=\Device\WS2IFSL\NifsSct
|
|
OpenFilePath=\Device\Tcp
|
|
OpenFilePath=\Device\Tcp6
|
|
OpenFilePath=\Device\Ip
|
|
OpenFilePath=\Device\Ip6
|
|
OpenFilePath=\Device\Udp
|
|
OpenFilePath=\Device\Udp6
|
|
OpenFilePath=\Device\RawIp
|
|
OpenFilePath=\Device\RawIp6
|
|
OpenFilePath=\Device\NetBT_Tcpip_*
|
|
OpenFilePath=\Device\Http\*
|
|
OpenFilePath=\Device\Nsi
|
|
ClosedFilePath=\Device\afd*
|
|
ClosedFilePath=\Device\ip
|
|
ClosedFilePath=\Device\ip6
|
|
ClosedFilePath=\Device\udp
|
|
ClosedFilePath=\Device\udp6
|
|
ClosedFilePath=\Device\tcp
|
|
ClosedFilePath=\Device\tcp6
|
|
ClosedFilePath=\Device\http\*
|
|
ClosedFilePath=\Device\rawip
|
|
ClosedFilePath=\Device\rawip6
|
|
ClosedFilePath=\Device\nsi
|
|
|
|
|
|
#
|
|
# Access rules for device restricted boxes
|
|
#
|
|
|
|
[TemplateSModPaths]
|
|
ClosedFilePath=\Device\*
|
|
NormalFilePath=\Device\NamedPipe\*
|
|
NormalFilePath=\Device\CNG
|
|
NormalFilePath=\Device\ConDrv\*
|
|
NormalFilePath=\Device\DeviceApi*
|
|
NormalFilePath=\Device\DfsClient
|
|
NormalFilePath=\Device\KsecDD
|
|
NormalFilePath=\Device\MountPointManager
|
|
NormalFilePath=\Device\Ndis
|
|
NormalFilePath=\Device\PcwDrv
|
|
NormalFilePath=\Device\Null
|
|
NormalFilePath=\Device\BootDevice\Windows\*
|
|
NormalFilePath=\Device\BootPartition\Windows\*
|
|
# Smart App Control
|
|
NormalFilePath=\Device\SrpDevice
|
|
|
|
#
|
|
# Access rules for privacy enhanced boxes
|
|
#
|
|
|
|
[TemplatePModPaths]
|
|
#NormalKeyPath=HKEY_LOCAL_MACHINE\*
|
|
#NormalKeyPath=HKEY_CURRENT_USER\software\Microsoft\*
|
|
#NormalKeyPath=HKEY_CURRENT_USER\software\WOW6432Node\Microsoft\*
|
|
#NormalKeyPath=\REGISTRY\USER\*_Classes\*
|
|
WriteKeyPath=\REGISTRY\USER\*
|
|
#
|
|
NormalFilePath=%SystemRoot%\*
|
|
NormalFilePath=%SbieHome%\*
|
|
NormalFilePath=%ProgramFiles%\*
|
|
NormalFilePath=%ProgramFiles% (x86)\*
|
|
NormalFilePath=%ProgramData%\Microsoft\*
|
|
# recycle bin
|
|
NormalFilePath=?:\$Recycle.Bin\*
|
|
WriteFilePath=?:\$Recycle.Bin\**\*
|
|
# shell & ui
|
|
NormalKeyPath=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\*
|
|
NormalKeyPath=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\*
|
|
NormalKeyPath=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\*
|
|
NormalKeyPath=HKEY_CURRENT_USER\SOFTWARE\Classes\*
|
|
NormalKeyPath=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\*
|
|
NormalKeyPath=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\*
|
|
NormalKeyPath=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\*
|
|
NormalKeyPath=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\FileAssociations\*
|
|
NormalKeyPath=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Associations\*
|
|
NormalKeyPath=HKEY_CURRENT_USER\AppEvents\*
|
|
NormalKeyPath=HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX\UserGpuPreferences\*
|
|
NormalKeyPath=HKEY_CURRENT_USER\Environment\*
|
|
|
|
#
|
|
# Access rules for app compartment boxes
|
|
#
|
|
|
|
[TemplateAppCPaths]
|
|
# open those in compartment mode as do not use the de-administrator-ize proxy in File_NtCreateFilePipe
|
|
OpenFilePath=\device\*pipe\lsarpc
|
|
OpenFilePath=\device\*pipe\srvsvc
|
|
OpenFilePath=\device\*pipe\wkssvc
|
|
OpenFilePath=\device\*pipe\samr
|
|
OpenFilePath=\device\*pipe\netlogon
|
|
# enable AppContainer isolation support
|
|
OpenIpcPath=\Sessions\*\AppContainerNamedObjects\*
|
|
OpenFilePath=\Device\NamedPipe\Sessions\*\AppContainerNamedObjects\*
|
|
|
|
|
|
#
|
|
# Sbie builds after 5.27-1 opens this (it breaks IE's source view and cache though)
|
|
#
|
|
|
|
[Template_OpenWinInetCache]
|
|
OpenClsid={0358B920-0AC7-461F-98F4-58E32CD89148}
|
|
OpenIpcPath=\RPC Control\webcache_*
|
|
OpenIpcPath=*\BaseNamedObjects\windows_webcache_counters_*
|
|
|
|
|
|
#
|
|
# Windows Remote Management (WinRM) is a large security hole.
|
|
# A sandboxed app running in an elevated cmd shell can send any admin command to the host.
|
|
# Block the WinRS.exe and the automation dlls to make it very difficult for someone to use.
|
|
# See ICD-10136 "Sandboxie security hole allows guest to run any command in host as admin"
|
|
#
|
|
|
|
[Template_BlockWinRM]
|
|
ClosedFilePath=|%SystemRoot%\Sys*\wsmsvc.dll
|
|
ClosedFilePath=|%SystemRoot%\Sys*\wsmauto.dll
|
|
ClosedFilePath=|%SystemRoot%\Sys*\winrs.exe
|
|
|
|
|
|
#
|
|
# this template replaces OpenProtectedStorage=y
|
|
#
|
|
|
|
[Template_OpenProtectedStorage]
|
|
Tmpl.Title=Open Protected Storage
|
|
Tmpl.Class=Misc
|
|
#FuncSkipHook=PStoreCreateInstance
|
|
OpenFilePath=|\Device\NamedPipe\protected_storage
|
|
OpenIpcPath=*\BaseNamedObjects*\PS_SERVICE_STARTED
|
|
OpenIpcPath=\RPC Control\protected_storage
|
|
|
|
|
|
#
|
|
# useful exceptions for confidential boxes
|
|
#
|
|
|
|
[Template_LessConfidentialBox]
|
|
Tmpl.Title=Allow some Windows processes to access processes in a confidential box
|
|
Tmpl.Class=Misc
|
|
DenyHostAccess=audiodg.exe,n
|
|
|
|
|
|
#
|
|
# Custom handling for special images
|
|
#
|
|
|
|
[Template_SpecialImages]
|
|
#Tmpl.Title=#xxxx
|
|
#Tmpl.Class=Misc
|
|
|
|
SpecialImage=chrome,chrome.exe
|
|
SpecialImage=chrome,msedge.exe
|
|
SpecialImage=chrome,msedgewebview2.exe
|
|
SpecialImage=chrome,iron.exe
|
|
SpecialImage=chrome,dragon.exe
|
|
SpecialImage=chrome,opera.exe
|
|
SpecialImage=chrome,neon.exe
|
|
SpecialImage=chrome,maxthon.exe
|
|
SpecialImage=chrome,vivaldi.exe
|
|
SpecialImage=chrome,brave.exe
|
|
SpecialImage=chrome,browser.exe
|
|
SpecialImage=chrome,osiris.exe
|
|
SpecialImage=chrome,slimjet.exe
|
|
|
|
SpecialImage=firefox,firefox.exe
|
|
SpecialImage=firefox,waterfox.exe
|
|
SpecialImage=firefox,palemoon.exe
|
|
SpecialImage=firefox,basilisk.exe
|
|
SpecialImage=firefox,seamonkey.exe
|
|
SpecialImage=firefox,k-meleon.exe
|
|
SpecialImage=firefox,librewolf.exe
|
|
|
|
SpecialImage=thunderbird,thunderbird.exe
|
|
|
|
SpecialImage=mail,winmail.exe
|
|
SpecialImage=mail,IncMail.exe
|
|
SpecialImage=mail,eudora.exe
|
|
SpecialImage=mail,thebat32.exe
|
|
SpecialImage=mail,thebat64.exe
|
|
SpecialImage=mail,Foxmail.exe
|
|
SpecialImage=mail,Mailbird.exe
|
|
SpecialImage=mail,MailClient.exe
|
|
SpecialImage=mail,postbox.exe
|
|
SpecialImage=mail,Inky.exe
|
|
|
|
SpecialImage=browser,PuffinSecureBrowser.exe
|
|
|
|
SpecialImage=chrome,wechat.exe
|
|
SpecialImage=chrome,slack.exe
|
|
SpecialImage=chrome,spotify.exe
|
|
SpecialImage=chrome,Amazon Music.exe
|
|
|
|
#
|
|
# other image specific presets
|
|
#
|
|
|
|
PreferExternalManifest=spotify.exe,y
|
|
|
|
|
|
|
|
#
|
|
# updater blockage, usage:
|
|
# SoftwareUpdater=starting_image.exe,updater_path\updater_image.exe
|
|
#
|
|
|
|
[Template_BlockSoftwareUpdaters]
|
|
#Tmpl.Title=#xxxx
|
|
#Tmpl.Class=Misc
|
|
#BlockSoftwareUpdaters=y
|
|
|
|
SoftwareUpdater=firefox.exe,*\mozilla firefox\updater.exe
|
|
SoftwareUpdater=firefox.exe,*\mozilla*\updates\*updater.exe
|
|
SoftwareUpdater=waterfox.exe,*\Waterfox\updater.exe
|
|
SoftwareUpdater=palemoon.exe,*\Pale Moon\updater.exe
|
|
SoftwareUpdater=seamonkey.exe,*\SeaMonkey\updater.exe
|
|
|
|
SoftwareUpdater=GoogleUpdate.exe,*\google\update\*chrome_installer.exe
|
|
SoftwareUpdater=msedge.exe,*\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
|
|
SoftwareUpdater=msedge.exe,*\Microsoft\EdgeUpdate\*MicrosoftEdgeUpdateBroker.exe
|
|
SoftwareUpdater=vivaldi.exe,*\Vivaldi\Application\update_notifier.exe
|
|
SoftwareUpdater=brave.exe,*\BraveSoftware\Update\BraveUpdate.exe
|
|
SoftwareUpdater=brave.exe,*\BraveSoftware\Update\*BraveUpdateBroker.exe
|
|
SoftwareUpdater=opera.exe,*\Opera\*opera_autoupdate.exe
|
|
SoftwareUpdater=launcher.exe,*\Opera\*opera_autoupdate.exe
|
|
SoftwareUpdater=yandex.exe,*\Yandex\YandexBrowser\Application\*service_update.exe
|
|
SoftwareUpdater=maxthon.exe,*\Maxthon\Application\*mxupdater.exe
|
|
SoftwareUpdater=dragon.exe,*\Comodo\Dragon\dragon_updater.exe
|
|
SoftwareUpdater=osiris.exe,*\Osiris\update.exe
|
|
SoftwareUpdater=app_launcher.exe,*\Osiris\update.exe
|
|
SoftwareUpdater=slimjet.exe,*\Slimjet\updater.exe
|
|
|
|
SoftwareUpdater=thunderbird.exe,*\mozilla*\updates\*updater.exe
|
|
|
|
|
|
|
|
[Template_COM]
|
|
# block BITS service (issue 1081)
|
|
ClosedClsid={4991D34B-80A1-4291-83B6-3328366B9097}
|
|
|
|
[Template_WindowsExplorer]
|
|
# make search box wait (issue 1002)
|
|
ClosedClsid={C2F03A33-21F5-47FA-B4BB-156362A2F239}
|
|
# prevent context menu hang
|
|
ClosedClsid={470C0EBD-5D73-4D58-9CED-E91E22E23282}
|
|
# never fake admin rights for explorer.exe (issue 3516)
|
|
FakeAdminRights=explorer.exe,n
|
|
|
|
[Template_ThirdPartyIsolation]
|
|
# block VMNet0 virtual network configuration (issue 1102)
|
|
ClosedFilePath=vmnetcfg.exe,\Device\VMnetUserif
|
|
|
|
|
|
#
|
|
# Internet Explorer
|
|
#
|
|
|
|
[Template_IExplore_Force]
|
|
Tmpl.Title=#4323,Internet Explorer
|
|
Tmpl.Class=WebBrowser
|
|
ForceProcess=iexplore.exe
|
|
|
|
[Template_IExplore_Favorites_DirectAccess]
|
|
Tmpl.Title=#4326,Internet Explorer
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=iexplore.exe,%Favorites%
|
|
#OpenFilePath=firefox.exe,%Favorites%
|
|
|
|
[Template_IExplore_Favorites_RecoverFolder]
|
|
Tmpl.Title=#4327
|
|
Tmpl.Class=WebBrowser
|
|
RecoverFolder=%Favorites%
|
|
|
|
[Template_IExplore_History_DirectAccess]
|
|
Tmpl.Title=#4336,Internet Explorer
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=iexplore.exe,%Favorites%
|
|
OpenFilePath=iexplore.exe,%History%\History.IE5\*
|
|
OpenKeyPath=iexplore.exe,HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs
|
|
# Windows Search features needed for address bar in IE 8
|
|
OpenClsid={7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
|
|
OpenClsid={9E175B6D-F52A-11D8-B9A5-505054503030}
|
|
OpenPipePath=\Device\NamedPipe\MsFteWds
|
|
# Internet Explorer 10 history pane
|
|
OpenFilePath=|%Local AppData%\Microsoft\Windows\
|
|
|
|
[Template_IExplore_Cookies_DirectAccess]
|
|
Tmpl.Title=#4328,Internet Explorer
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=iexplore.exe,%Cookies%
|
|
# Internet Explorer 10 cookies
|
|
OpenClsid={0358b920-0ac7-461f-98f4-58e32cd89148}
|
|
OpenIpcPath=\RPC Control\webcache_*
|
|
OpenIpcPath=*\BaseNamedObjects*\windows_webcache_*
|
|
OpenFilePath=%Local AppData%\Microsoft\Internet Explorer\DOMStore\*
|
|
|
|
[Template_IExplore_Feeds_DirectAccess]
|
|
Tmpl.Title=#4325,Internet Explorer
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=iexplore.exe,%Local AppData%\Microsoft\Feeds\
|
|
OpenFilePath=iexplore.exe,%Local AppData%\Microsoft\Feeds Cache\
|
|
|
|
[Template_IExplore_ProtectedStorage]
|
|
Tmpl.Title=#4329
|
|
Tmpl.Class=WebBrowser
|
|
OpenProtectedStorage=y
|
|
OpenKeyPath=iexplore.exe,HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms
|
|
OpenKeyPath=iexplore.exe,HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs
|
|
|
|
# [Template_IExplore_Credentials]
|
|
# Tmpl.Title=#4330
|
|
# Tmpl.Class=WebBrowser
|
|
# OpenCredentials=y
|
|
|
|
#
|
|
# Firefox / Waterfox / PaleMoon / SeaMonkey / LibreWolf
|
|
#
|
|
|
|
#
|
|
# Firefox
|
|
#
|
|
|
|
[Template_Firefox_Force]
|
|
Tmpl.Title=#4323,Mozilla Firefox
|
|
Tmpl.Class=WebBrowser
|
|
ForceProcess=firefox.exe
|
|
|
|
[Template_Firefox_Bookmarks_DirectAccess]
|
|
Tmpl.Title=#4336,Mozilla Firefox
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=firefox.exe,%Tmpl.Firefox%\bookmark*
|
|
OpenFilePath=firefox.exe,%Tmpl.Firefox%\places*
|
|
OpenFilePath=firefox.exe,%Tmpl.Firefox%\favicons.sqlite
|
|
|
|
[Template_Firefox_Cookies_DirectAccess]
|
|
Tmpl.Title=#4328,Mozilla Firefox
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=firefox.exe,%Tmpl.Firefox%\cookies*
|
|
|
|
[Template_Firefox_Passwords_DirectAccess]
|
|
Tmpl.Title=#4331,Mozilla Firefox
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=firefox.exe,%Tmpl.Firefox%\logins.json
|
|
OpenFilePath=firefox.exe,%Tmpl.Firefox%\key*.db
|
|
|
|
[Template_Firefox_Session_DirectAccess]
|
|
Tmpl.Title=#4340,Mozilla Firefox
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=firefox.exe,%Tmpl.Firefox%\sessionstore.js*
|
|
|
|
[Template_Firefox_Phishing_DirectAccess]
|
|
Tmpl.Title=#4337,Mozilla Firefox
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=firefox.exe,%Tmpl.Firefox%\cert9.db
|
|
OpenFilePath=firefox.exe,%Local AppData%\Mozilla\Firefox\Profiles\*\safebrowsing*
|
|
|
|
[Template_Firefox_Profile_DirectAccess]
|
|
Tmpl.Title=#4338,Mozilla Firefox
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=firefox.exe,%Tmpl.Firefox%\*
|
|
|
|
[Template_Firefox_Separator]
|
|
Tmpl.Title=-
|
|
Tmpl.Class=WebBrowser
|
|
|
|
#
|
|
# Waterfox
|
|
#
|
|
|
|
[Template_Waterfox_Force]
|
|
Tmpl.Title=#4323,Waterfox
|
|
Tmpl.Class=WebBrowser
|
|
ForceProcess=waterfox.exe
|
|
|
|
[Template_Waterfox_Bookmarks_DirectAccess]
|
|
Tmpl.Title=#4336,Waterfox
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=waterfox.exe,%Tmpl.Waterfox%\bookmark*
|
|
OpenFilePath=waterfox.exe,%Tmpl.Waterfox%\places*
|
|
|
|
[Template_Waterfox_Cookies_DirectAccess]
|
|
Tmpl.Title=#4328,Waterfox
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=waterfox.exe,%Tmpl.Waterfox%\cookies*
|
|
|
|
[Template_Waterfox_Passwords_DirectAccess]
|
|
Tmpl.Title=#4331,Waterfox
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=waterfox.exe,%Tmpl.Waterfox%\logins.json
|
|
OpenFilePath=waterfox.exe,%Tmpl.Waterfox%\key*.db
|
|
|
|
[Template_Waterfox_Session_DirectAccess]
|
|
Tmpl.Title=#4340,Waterfox
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=waterfox.exe,%Tmpl.Waterfox%\sessionstore.js*
|
|
|
|
[Template_Waterfox_Phishing_DirectAccess]
|
|
Tmpl.Title=#4337,Waterfox
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=waterfox.exe,%Tmpl.Waterfox%\blocklist.xml
|
|
OpenFilePath=waterfox.exe,%Tmpl.Waterfox%\cert9.db
|
|
OpenFilePath=waterfox.exe,%Local AppData%\Waterfox\Profiles\*\safebrowsing*
|
|
|
|
[Template_Waterfox_Profile_DirectAccess]
|
|
Tmpl.Title=#4338,Waterfox
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=waterfox.exe,%Tmpl.Waterfox%\*
|
|
|
|
[Template_Waterfox_Separator]
|
|
Tmpl.Title=-
|
|
Tmpl.Class=WebBrowser
|
|
|
|
#
|
|
# Pale Moon
|
|
#
|
|
|
|
[Template_PaleMoon_Force]
|
|
Tmpl.Title=#4323,Pale Moon
|
|
Tmpl.Class=WebBrowser
|
|
ForceProcess=palemoon.exe
|
|
|
|
[Template_PaleMoon_Bookmarks_DirectAccess]
|
|
Tmpl.Title=#4336,Pale Moon
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=palemoon.exe,%Tmpl.PaleMoon%\bookmark*
|
|
OpenFilePath=palemoon.exe,%Tmpl.PaleMoon%\places*
|
|
|
|
[Template_PaleMoon_Cookies_DirectAccess]
|
|
Tmpl.Title=#4328,Pale Moon
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=palemoon.exe,%Tmpl.PaleMoon%\cookies*
|
|
|
|
[Template_PaleMoon_Passwords_DirectAccess]
|
|
Tmpl.Title=#4331,Pale Moon
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=palemoon.exe,%Tmpl.PaleMoon%\logins.json
|
|
OpenFilePath=palemoon.exe,%Tmpl.PaleMoon%\key*.db
|
|
|
|
[Template_PaleMoon_Session_DirectAccess]
|
|
Tmpl.Title=#4340,Pale Moon
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=palemoon.exe,%Tmpl.PaleMoon%\sessionstore.js
|
|
|
|
[Template_PaleMoon_Phishing_DirectAccess]
|
|
Tmpl.Title=#4337,Pale Moon
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=palemoon.exe,%Tmpl.PaleMoon%\blocklist.xml
|
|
OpenFilePath=palemoon.exe,%Tmpl.PaleMoon%\cert9.db
|
|
|
|
[Template_PaleMoon_Profile_DirectAccess]
|
|
Tmpl.Title=#4338,Pale Moon
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=palemoon.exe,%Tmpl.PaleMoon%\*
|
|
|
|
[Template_PaleMoon_Separator]
|
|
Tmpl.Title=-
|
|
Tmpl.Class=WebBrowser
|
|
|
|
#
|
|
# SeaMonkey Browser
|
|
#
|
|
|
|
[Template_SeaMonkey_Force]
|
|
Tmpl.Title=#4323,SeaMonkey
|
|
Tmpl.Class=WebBrowser
|
|
ForceProcess=seamonkey.exe
|
|
|
|
[Template_SeaMonkey_Bookmarks_DirectAccess]
|
|
Tmpl.Title=#4336,SeaMonkey
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=seamonkey.exe,%Tmpl.SeaMonkey%\bookmark*
|
|
OpenFilePath=seamonkey.exe,%Tmpl.SeaMonkey%\places*
|
|
|
|
[Template_SeaMonkey_Cookies_DirectAccess]
|
|
Tmpl.Title=#4328,SeaMonkey
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=seamonkey.exe,%Tmpl.SeaMonkey%\cookies*
|
|
|
|
[Template_SeaMonkey_Passwords_DirectAccess]
|
|
Tmpl.Title=#4331,SeaMonkey
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=seamonkey.exe,%Tmpl.SeaMonkey%\logins.json
|
|
OpenFilePath=seamonkey.exe,%Tmpl.SeaMonkey%\key*.db
|
|
|
|
[Template_SeaMonkey_Session_DirectAccess]
|
|
Tmpl.Title=#4340,SeaMonkey
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=seamonkey.exe,%Tmpl.SeaMonkey%\sessionstore.js
|
|
|
|
[Template_SeaMonkey_Phishing_DirectAccess]
|
|
Tmpl.Title=#4337,SeaMonkey
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=seamonkey.exe,%Tmpl.SeaMonkey%\blocklist.xml
|
|
OpenFilePath=seamonkey.exe,%Tmpl.SeaMonkey%\cert9.db
|
|
OpenFilePath=seamonkey.exe,%Local AppData%\Mozilla\SeaMonkey\Profiles\*\safebrowsing*
|
|
|
|
[Template_SeaMonkey_Profile_DirectAccess]
|
|
Tmpl.Title=#4338,SeaMonkey
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=seamonkey.exe,%Tmpl.SeaMonkey%\*
|
|
|
|
[Template_SeaMonkey_Separator]
|
|
Tmpl.Title=-
|
|
Tmpl.Class=WebBrowser
|
|
|
|
#
|
|
# LibreWolf
|
|
#
|
|
|
|
[Template_LibreWolf_Force]
|
|
Tmpl.Title=#4323,LibreWolf
|
|
Tmpl.Class=WebBrowser
|
|
ForceProcess=librewolf.exe
|
|
|
|
[Template_LibreWolf_Bookmarks_DirectAccess]
|
|
Tmpl.Title=#4336,LibreWolf
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=librewolf.exe,%Tmpl.LibreWolf%\bookmark*
|
|
OpenFilePath=librewolf.exe,%Tmpl.LibreWolf%\places*
|
|
OpenFilePath=librewolf.exe,%Tmpl.LibreWolf%\favicons.sqlite
|
|
|
|
[Template_LibreWolf_Cookies_DirectAccess]
|
|
Tmpl.Title=#4328,LibreWolf
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=librewolf.exe,%Tmpl.LibreWolf%\cookies*
|
|
|
|
[Template_LibreWolf_Passwords_DirectAccess]
|
|
Tmpl.Title=#4331,LibreWolf
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=librewolf.exe,%Tmpl.LibreWolf%\logins.json
|
|
OpenFilePath=librewolf.exe,%Tmpl.LibreWolf%\key*.db
|
|
|
|
[Template_LibreWolf_Session_DirectAccess]
|
|
Tmpl.Title=#4340,LibreWolf
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=librewolf.exe,%Tmpl.LibreWolf%\sessionstore.js*
|
|
|
|
[Template_LibreWolf_Phishing_DirectAccess]
|
|
Tmpl.Title=#4337,LibreWolf
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=librewolf.exe,%Tmpl.LibreWolf%\cert9.db
|
|
OpenFilePath=librewolf.exe,%Local AppData%\LibreWolf\Profiles\*\safebrowsing*
|
|
|
|
[Template_LibreWolf_Profile_DirectAccess]
|
|
Tmpl.Title=#4338,LibreWolf
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=librewolf.exe,%Tmpl.LibreWolf%\*
|
|
|
|
#
|
|
# Firefox Add-ons
|
|
#
|
|
|
|
[Template_Firefox_Addon_Zotero]
|
|
Tmpl.Title=Zotero (with XPDF)
|
|
Tmpl.Class=WebBrowser
|
|
Tmpl.Url=http://www.zotero.org/
|
|
OpenFilePath=<Zotero>,%Tmpl.Zotero%\*
|
|
ProcessGroup=<Zotero>,firefox.exe,pdfinfo-Win32.exe,pdftotext-Win32.exe
|
|
|
|
#
|
|
# Google Chrome / Microsoft Edge (Chromium) / Vivaldi / Brave Browser / Opera / Yandex / Ungoogled Chromium /
|
|
# SRWare Iron / Maxthon 6 (Chromium) / Comodo Dragon / Osiris Browser / FlashPeak Slimjet /
|
|
#
|
|
|
|
#
|
|
# Google Chrome
|
|
#
|
|
|
|
[Template_Chrome_Force]
|
|
Tmpl.Title=#4323,Google Chrome
|
|
Tmpl.Class=WebBrowser
|
|
ForceProcess=chrome.exe
|
|
|
|
[Template_Chrome_Bookmarks_DirectAccess]
|
|
Tmpl.Title=#4356,Google Chrome
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Tmpl.Chrome%\Bookmarks*
|
|
OpenFilePath=chrome.exe,%Tmpl.Chrome%\Favicons*
|
|
|
|
[Template_Chrome_History_DirectAccess]
|
|
Tmpl.Title=#4336,Google Chrome
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Tmpl.Chrome%\Bookmarks*
|
|
OpenFilePath=chrome.exe,%Tmpl.Chrome%\Favicons*
|
|
OpenFilePath=chrome.exe,%Tmpl.Chrome%\*History*
|
|
OpenFilePath=chrome.exe,%Tmpl.Chrome%\Current *
|
|
OpenFilePath=chrome.exe,%Tmpl.Chrome%\Last *
|
|
OpenFilePath=chrome.exe,%Tmpl.Chrome%\Visited Links*
|
|
|
|
[Template_Chrome_Cookies_DirectAccess]
|
|
Tmpl.Title=#4328,Google Chrome
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Tmpl.Chrome%\Network\Cookies*
|
|
|
|
[Template_Chrome_Passwords_DirectAccess]
|
|
Tmpl.Title=#4331,Google Chrome
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Tmpl.Chrome%\Login Data*
|
|
|
|
[Template_Chrome_Preferences_DirectAccess]
|
|
Tmpl.Title=#4339,Google Chrome
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Tmpl.Chrome%\Preferences*
|
|
|
|
[Template_Chrome_Sync_DirectAccess]
|
|
Tmpl.Title=#4324,Google Chrome
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Tmpl.Chrome%\Sync Data\*
|
|
OpenFilePath=chrome.exe,%Tmpl.Chrome%\Sync Extension Settings\*
|
|
|
|
[Template_Chrome_Phishing_DirectAccess]
|
|
Tmpl.Title=#4337,Google Chrome
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Local AppData%\Google\Chrome\User Data\Safe Browsing*
|
|
OpenFilePath=chrome.exe,%Local AppData%\Google\Chrome\User Data\CertificateRevocation
|
|
|
|
[Template_Chrome_Profile_DirectAccess]
|
|
Tmpl.Title=#4338,Google Chrome
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Tmpl.Chrome%\*
|
|
|
|
#
|
|
# Microsoft Edge (Chromium)
|
|
#
|
|
|
|
[Template_Edge_Force]
|
|
Tmpl.Title=#4323,Microsoft Edge
|
|
Tmpl.Class=WebBrowser
|
|
ForceProcess=msedge.exe
|
|
|
|
[Template_Edge_Bookmarks_DirectAccess]
|
|
Tmpl.Title=#4356,Microsoft Edge
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=msedge.exe,%Tmpl.Edge%\Bookmarks*
|
|
OpenFilePath=msedge.exe,%Tmpl.Edge%\Favicons*
|
|
|
|
[Template_Edge_History_DirectAccess]
|
|
Tmpl.Title=#4336,Microsoft Edge
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=msedge.exe,%Tmpl.Edge%\Bookmarks*
|
|
OpenFilePath=msedge.exe,%Tmpl.Edge%\Favicons*
|
|
OpenFilePath=msedge.exe,%Tmpl.Edge%\*History*
|
|
OpenFilePath=msedge.exe,%Tmpl.Edge%\Current *
|
|
OpenFilePath=msedge.exe,%Tmpl.Edge%\Last *
|
|
OpenFilePath=msedge.exe,%Tmpl.Edge%\Visited Links*
|
|
|
|
[Template_Edge_Cookies_DirectAccess]
|
|
Tmpl.Title=#4328,Microsoft Edge
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=msedge.exe,%Tmpl.Edge%\Network\Cookies*
|
|
|
|
[Template_Edge_Passwords_DirectAccess]
|
|
Tmpl.Title=#4331,Microsoft Edge
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=msedge.exe,%Tmpl.Edge%\Login Data*
|
|
|
|
[Template_Edge_Preferences_DirectAccess]
|
|
Tmpl.Title=#4339,Microsoft Edge
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=msedge.exe,%Tmpl.Edge%\Preferences*
|
|
|
|
[Template_Edge_Sync_DirectAccess]
|
|
Tmpl.Title=#4324,Microsoft Edge
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=msedge.exe,%Tmpl.Edge%\Sync Data\*
|
|
OpenFilePath=msedge.exe,%Tmpl.Edge%\Sync Extension Settings\*
|
|
|
|
[Template_Edge_Phishing_DirectAccess]
|
|
Tmpl.Title=#4337,Microsoft Edge
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=msedge.exe,%Local AppData%\Microsoft\Edge\User Data\Safe Browsing*
|
|
OpenFilePath=msedge.exe,%Local AppData%\Microsoft\Edge\User Data\CertificateRevocation
|
|
OpenFilePath=msedge.exe,%Local AppData%\Microsoft\Edge\User Data\SmartScreen
|
|
OpenFilePath=msedge.exe,%Local AppData%\Microsoft\Edge\User Data\Ad Blocking
|
|
|
|
[Template_Edge_Profile_DirectAccess]
|
|
Tmpl.Title=#4338,Microsoft Edge
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=msedge.exe,%Tmpl.Edge%\*
|
|
|
|
[Template_Edge_Fix]
|
|
Tmpl.Title=#4342,Microsoft Edge
|
|
Tmpl.Class=WebBrowser
|
|
Tmpl.Url=https://www.microsoft.com/en-us/edge
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct=Microsoft Edge
|
|
Tmpl.ScanService=edgeupdate
|
|
# SBIE fix for Windows 11 KB5014019 update (May 2022)
|
|
# ExternalManifest breaks MSEdge 111.0.1633.0
|
|
#ExternalManifestHack=msedge.exe,y
|
|
# SBIE fix for MS Edge 106.x also for Windows 10
|
|
#OpenIpcPath=msedge.exe,\Sessions\*\AppContainerNamedObjects\*
|
|
#OpenFilePath=msedge.exe,\Device\NamedPipe\Sessions\*\AppContainerNamedObjects\*
|
|
# SBIE fix for MS Edge WebView2
|
|
#ExternalManifestHack=msedgewebview2.exe,y
|
|
NormalFilePath=msedge.exe,%LocalAppData%\Microsoft\Edge\User Data\Default\Secure Preferences
|
|
|
|
#
|
|
# Vivaldi
|
|
#
|
|
|
|
[Template_Vivaldi_Force]
|
|
Tmpl.Title=#4323,Vivaldi
|
|
Tmpl.Class=WebBrowser
|
|
ForceProcess=vivaldi.exe
|
|
|
|
[Template_Vivaldi_Bookmarks_DirectAccess]
|
|
Tmpl.Title=#4356,Vivaldi
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Bookmarks*
|
|
OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Favicons*
|
|
|
|
[Template_Vivaldi_History_DirectAccess]
|
|
Tmpl.Title=#4336,Vivaldi
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Bookmarks*
|
|
OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Favicons*
|
|
OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\*History*
|
|
OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Current *
|
|
OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Last *
|
|
OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Visited Links*
|
|
|
|
[Template_Vivaldi_Cookies_DirectAccess]
|
|
Tmpl.Title=#4328,Vivaldi
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Network\Cookies*
|
|
|
|
[Template_Vivaldi_Notes_DirectAccess]
|
|
Tmpl.Title=#4341,Vivaldi
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Notes*
|
|
|
|
[Template_Vivaldi_Passwords_DirectAccess]
|
|
Tmpl.Title=#4331,Vivaldi
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Login Data*
|
|
|
|
[Template_Vivaldi_Preferences_DirectAccess]
|
|
Tmpl.Title=#4339,Vivaldi
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Preferences*
|
|
|
|
[Template_Vivaldi_Sync_DirectAccess]
|
|
Tmpl.Title=#4324,Vivaldi
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Sync Data\*
|
|
OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\Sync Extension Settings\*
|
|
|
|
[Template_Vivaldi_Phishing_DirectAccess]
|
|
Tmpl.Title=#4337,Vivaldi
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=vivaldi.exe,%Local AppData%\Vivaldi\User Data\Safe Browsing*
|
|
OpenFilePath=vivaldi.exe,%Local AppData%\Vivaldi\User Data\CertificateRevocation
|
|
|
|
[Template_Vivaldi_Profile_DirectAccess]
|
|
Tmpl.Title=#4338,Vivaldi
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=vivaldi.exe,%Tmpl.Vivaldi%\*
|
|
|
|
[Template_Vivaldi_Separator]
|
|
Tmpl.Title=-
|
|
Tmpl.Class=WebBrowser
|
|
|
|
#
|
|
# Brave Browser
|
|
#
|
|
|
|
[Template_Brave_Force]
|
|
Tmpl.Title=#4323,Brave Browser
|
|
Tmpl.Class=WebBrowser
|
|
ForceProcess=brave.exe
|
|
|
|
[Template_Brave_Bookmarks_DirectAccess]
|
|
Tmpl.Title=#4356,Brave Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=brave.exe,%Tmpl.Brave%\Bookmarks*
|
|
OpenFilePath=brave.exe,%Tmpl.Brave%\Favicons*
|
|
|
|
[Template_Brave_History_DirectAccess]
|
|
Tmpl.Title=#4336,Brave Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=brave.exe,%Tmpl.Brave%\Bookmarks*
|
|
OpenFilePath=brave.exe,%Tmpl.Brave%\Favicons*
|
|
OpenFilePath=brave.exe,%Tmpl.Brave%\*History*
|
|
OpenFilePath=brave.exe,%Tmpl.Brave%\Current *
|
|
OpenFilePath=brave.exe,%Tmpl.Brave%\Last *
|
|
OpenFilePath=brave.exe,%Tmpl.Brave%\Visited Links*
|
|
|
|
[Template_Brave_Cookies_DirectAccess]
|
|
Tmpl.Title=#4328,Brave Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=brave.exe,%Tmpl.Brave%\Network\Cookies*
|
|
|
|
[Template_Brave_Passwords_DirectAccess]
|
|
Tmpl.Title=#4331,Brave Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=brave.exe,%Tmpl.Brave%\Login Data*
|
|
|
|
[Template_Brave_Preferences_DirectAccess]
|
|
Tmpl.Title=#4339,Brave Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=brave.exe,%Tmpl.Brave%\Preferences*
|
|
|
|
[Template_Brave_Sync_DirectAccess]
|
|
Tmpl.Title=#4324,Brave Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=brave.exe,%Tmpl.Brave%\Sync Data\*
|
|
|
|
[Template_Brave_Phishing_DirectAccess]
|
|
Tmpl.Title=#4337,Brave Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=brave.exe,%Local AppData%\BraveSoftware\Brave-Browser\User Data\Safe Browsing*
|
|
OpenFilePath=brave.exe,%Local AppData%\BraveSoftware\Brave-Browser\User Data\CertificateRevocation
|
|
|
|
[Template_Brave_Profile_DirectAccess]
|
|
Tmpl.Title=#4338,Brave Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=brave.exe,%Tmpl.Brave%\*
|
|
|
|
[Template_Brave_Separator]
|
|
Tmpl.Title=-
|
|
Tmpl.Class=WebBrowser
|
|
|
|
#
|
|
# Opera
|
|
#
|
|
|
|
[Template_Opera_Force]
|
|
Tmpl.Title=#4323,Opera
|
|
Tmpl.Class=WebBrowser
|
|
ForceProcess=opera.exe
|
|
|
|
[Template_Opera_Bookmarks_DirectAccess]
|
|
Tmpl.Title=#4356,Opera
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=opera.exe,%Tmpl.Opera%\Bookmarks*
|
|
OpenFilePath=opera.exe,%Tmpl.Opera%\Favicons*
|
|
|
|
[Template_Opera_History_DirectAccess]
|
|
Tmpl.Title=#4336,Opera
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=opera.exe,%Tmpl.Opera%\Bookmarks*
|
|
OpenFilePath=opera.exe,%Tmpl.Opera%\Favicons*
|
|
OpenFilePath=opera.exe,%Tmpl.Opera%\*History*
|
|
OpenFilePath=opera.exe,%Tmpl.Opera%\Current *
|
|
OpenFilePath=opera.exe,%Tmpl.Opera%\Last *
|
|
OpenFilePath=opera.exe,%Tmpl.Opera%\Visited Links*
|
|
|
|
[Template_Opera_Cookies_DirectAccess]
|
|
Tmpl.Title=#4328,Opera
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=opera.exe,%Tmpl.Opera%\Network\Cookies*
|
|
|
|
[Template_Opera_Passwords_DirectAccess]
|
|
Tmpl.Title=#4331,Opera
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=opera.exe,%Tmpl.Opera%\Login Data*
|
|
|
|
[Template_Opera_Preferences_DirectAccess]
|
|
Tmpl.Title=#4339,Opera
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=opera.exe,%Tmpl.Opera%\Preferences*
|
|
|
|
[Template_Opera_Sync_DirectAccess]
|
|
Tmpl.Title=#4324,Opera
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=opera.exe,%Tmpl.Opera%\Sync Data\*
|
|
|
|
[Template_Opera_Phishing_DirectAccess]
|
|
Tmpl.Title=#4337,Opera
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=opera.exe,%Tmpl.Opera%\CertificateRevocation
|
|
|
|
[Template_Opera_Profile_DirectAccess]
|
|
Tmpl.Title=#4338,Opera
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=opera.exe,%Tmpl.Opera%\*
|
|
OpenFilePath=launcher.exe,%Local AppData%\*\Opera\*
|
|
OpenFilePath=opera.exe,%Local AppData%\*\Opera\*\*
|
|
|
|
[Template_Opera_Separator]
|
|
Tmpl.Title=-
|
|
Tmpl.Class=WebBrowser
|
|
|
|
#
|
|
# Yandex
|
|
#
|
|
|
|
[Template_Yandex_Force]
|
|
Tmpl.Title=#4323,Yandex Browser
|
|
Tmpl.Class=WebBrowser
|
|
ForceProcess=browser.exe
|
|
|
|
[Template_Yandex_Bookmarks_DirectAccess]
|
|
Tmpl.Title=#4356,Yandex Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=browser.exe,%Tmpl.Yandex%\Bookmarks*
|
|
OpenFilePath=browser.exe,%Tmpl.Yandex%\Favicons*
|
|
|
|
[Template_Yandex_History_DirectAccess]
|
|
Tmpl.Title=#4336,Yandex Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=browser.exe,%Tmpl.Yandex%\Bookmarks*
|
|
OpenFilePath=browser.exe,%Tmpl.Yandex%\Favicons*
|
|
OpenFilePath=browser.exe,%Tmpl.Yandex%\*History*
|
|
OpenFilePath=browser.exe,%Tmpl.Yandex%\Current *
|
|
OpenFilePath=browser.exe,%Tmpl.Yandex%\Last *
|
|
OpenFilePath=browser.exe,%Tmpl.Yandex%\Visited Links*
|
|
|
|
[Template_Yandex_Cookies_DirectAccess]
|
|
Tmpl.Title=#4328,Yandex Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=browser.exe,%Tmpl.Yandex%\Network\Cookies*
|
|
|
|
[Template_Yandex_Passwords_DirectAccess]
|
|
Tmpl.Title=#4331,Yandex Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=browser.exe,%Tmpl.Yandex%\Ya Passman Data*
|
|
|
|
[Template_Yandex_Preferences_DirectAccess]
|
|
Tmpl.Title=#4339,Yandex Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=browser.exe,%Tmpl.Yandex%\Preferences*
|
|
|
|
[Template_Yandex_Sync_DirectAccess]
|
|
Tmpl.Title=#4324,Yandex Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=browser.exe,%Tmpl.Yandex%\Sync Data\*
|
|
|
|
[Template_Yandex_Phishing_DirectAccess]
|
|
Tmpl.Title=#4337,Yandex Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=browser.exe,%Local AppData%\Yandex\YandexBrowser\User Data\Safe Browsing*
|
|
OpenFilePath=browser.exe,%Local AppData%\Yandex\YandexBrowser\User Data\CertificateRevocation
|
|
|
|
[Template_Yandex_Profile_DirectAccess]
|
|
Tmpl.Title=#4338,Yandex Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=browser.exe,%Tmpl.Yandex%\*
|
|
|
|
[Template_Yandex_Separator]
|
|
Tmpl.Title=-
|
|
Tmpl.Class=WebBrowser
|
|
|
|
#
|
|
# Ungoogled Chromium
|
|
#
|
|
|
|
[Template_Ungoogled_Force]
|
|
Tmpl.Title=#4323,Ungoogled Chromium
|
|
Tmpl.Class=WebBrowser
|
|
ForceProcess=chrome.exe
|
|
|
|
[Template_Ungoogled_Bookmarks_DirectAccess]
|
|
Tmpl.Title=#4356,Ungoogled Chromium
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\Bookmarks*
|
|
OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\Favicons*
|
|
|
|
[Template_Ungoogled_History_DirectAccess]
|
|
Tmpl.Title=#4336,Ungoogled Chromium
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\Bookmarks*
|
|
OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\Favicons*
|
|
OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\*History*
|
|
OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\Current *
|
|
OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\Last *
|
|
OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\Visited Links*
|
|
|
|
[Template_Ungoogled_Cookies_DirectAccess]
|
|
Tmpl.Title=#4328,Ungoogled Chromium
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\Network\Cookies*
|
|
|
|
[Template_Ungoogled_Passwords_DirectAccess]
|
|
Tmpl.Title=#4331,Ungoogled Chromium
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\Login Data*
|
|
|
|
[Template_Ungoogled_Preferences_DirectAccess]
|
|
Tmpl.Title=#4339,Ungoogled Chromium
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\Preferences*
|
|
|
|
[Template_Ungoogled_Sync_DirectAccess]
|
|
Tmpl.Title=#4324,Ungoogled Chromium
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\Sync Data\*
|
|
|
|
[Template_Ungoogled_Profile_DirectAccess]
|
|
Tmpl.Title=#4338,Ungoogled Chromium
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Tmpl.Ungoogled%\*
|
|
|
|
[Template_Ungoogled_Separator]
|
|
Tmpl.Title=-
|
|
Tmpl.Class=WebBrowser
|
|
|
|
#
|
|
# SRWare Iron
|
|
#
|
|
|
|
[Template_Iron_Force]
|
|
Tmpl.Title=#4323,SRWare Iron
|
|
Tmpl.Class=WebBrowser
|
|
ForceFolder=C:\Program Files\SRWare Iron (64-Bit)
|
|
|
|
[Template_Iron_Bookmarks_DirectAccess]
|
|
Tmpl.Title=#4356,SRWare Iron
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Tmpl.Iron%\Bookmarks*
|
|
OpenFilePath=chrome.exe,%Tmpl.Iron%\Favicons*
|
|
|
|
[Template_Iron_History_DirectAccess]
|
|
Tmpl.Title=#4336,SRWare Iron
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Tmpl.Iron%\Bookmarks*
|
|
OpenFilePath=chrome.exe,%Tmpl.Iron%\Favicons*
|
|
OpenFilePath=chrome.exe,%Tmpl.Iron%\*History*
|
|
OpenFilePath=chrome.exe,%Tmpl.Iron%\Current *
|
|
OpenFilePath=chrome.exe,%Tmpl.Iron%\Last *
|
|
OpenFilePath=chrome.exe,%Tmpl.Iron%\Visited Links*
|
|
|
|
[Template_Iron_Cookies_DirectAccess]
|
|
Tmpl.Title=#4328,SRWare Iron
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Tmpl.Iron%\Network\Cookies*
|
|
|
|
[Template_Iron_Passwords_DirectAccess]
|
|
Tmpl.Title=#4331,SRWare Iron
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Tmpl.Iron%\Login Data*
|
|
|
|
[Template_Iron_Preferences_DirectAccess]
|
|
Tmpl.Title=#4339,SRWare Iron
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Tmpl.Iron%\Preferences*
|
|
|
|
[Template_Iron_Sync_DirectAccess]
|
|
Tmpl.Title=#4324,SRWare Iron
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Tmpl.Iron%\Sync Data\*
|
|
|
|
[Template_Iron_Phishing_DirectAccess]
|
|
Tmpl.Title=#4337,SRWare Iron
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Local AppData%\Chromium\User Data\Safe Browsing*
|
|
OpenFilePath=chrome.exe,%Local AppData%\Chromium\User Data\CertificateRevocation
|
|
|
|
[Template_Iron_Profile_DirectAccess]
|
|
Tmpl.Title=#4338,SRWare Iron
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=chrome.exe,%Tmpl.Iron%\*
|
|
|
|
[Template_Iron_Separator]
|
|
Tmpl.Title=-
|
|
Tmpl.Class=WebBrowser
|
|
|
|
#
|
|
# Maxthon 6 (Chromium)
|
|
#
|
|
|
|
[Template_Maxthon6_Force]
|
|
Tmpl.Title=#4323,Maxthon 6
|
|
Tmpl.Class=WebBrowser
|
|
ForceProcess=Maxthon.exe
|
|
|
|
[Template_Maxthon6_Bookmarks_DirectAccess]
|
|
Tmpl.Title=#4356,Maxthon 6
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\Bookmarks*
|
|
OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\Favicons*
|
|
|
|
[Template_Maxthon6_History_DirectAccess]
|
|
Tmpl.Title=#4336,Maxthon 6
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\Bookmarks*
|
|
OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\Favicons*
|
|
OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\*History*
|
|
OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\Current *
|
|
OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\Last *
|
|
OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\Visited Links*
|
|
|
|
[Template_Maxthon6_Cookies_DirectAccess]
|
|
Tmpl.Title=#4328,Maxthon 6
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\Network\Cookies*
|
|
|
|
[Template_Maxthon6_Passwords_DirectAccess]
|
|
Tmpl.Title=#4331,Maxthon 6
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\Login Data*
|
|
|
|
[Template_Maxthon6_Preferences_DirectAccess]
|
|
Tmpl.Title=#4339,Maxthon 6
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\Preferences*
|
|
|
|
[Template_Maxthon6_Phishing_DirectAccess]
|
|
Tmpl.Title=#4337,Maxthon 6
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=Maxthon.exe,%Local AppData%\Maxthon\Application\User Data\Safe Browsing*
|
|
OpenFilePath=Maxthon.exe,%Local AppData%\Maxthon\Application\User Data\CertificateRevocation
|
|
|
|
[Template_Maxthon6_Profile_DirectAccess]
|
|
Tmpl.Title=#4338,Maxthon 6
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=Maxthon.exe,%Tmpl.Maxthon_6%\*
|
|
|
|
[Template_Maxthon6_Separator]
|
|
Tmpl.Title=-
|
|
Tmpl.Class=WebBrowser
|
|
|
|
#
|
|
# Comodo Dragon
|
|
#
|
|
|
|
[Template_Dragon_Force]
|
|
Tmpl.Title=#4323,Comodo Dragon
|
|
Tmpl.Class=WebBrowser
|
|
ForceProcess=dragon.exe
|
|
|
|
[Template_Dragon_Bookmarks_DirectAccess]
|
|
Tmpl.Title=#4356,Comodo Dragon
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=dragon.exe,%Tmpl.Dragon%\Bookmarks*
|
|
OpenFilePath=dragon.exe,%Tmpl.Dragon%\Favicons*
|
|
|
|
[Template_Dragon_History_DirectAccess]
|
|
Tmpl.Title=#4336,Comodo Dragon
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=dragon.exe,%Tmpl.Dragon%\Bookmarks*
|
|
OpenFilePath=dragon.exe,%Tmpl.Dragon%\Favicons*
|
|
OpenFilePath=dragon.exe,%Tmpl.Dragon%\*History*
|
|
OpenFilePath=dragon.exe,%Tmpl.Dragon%\Current *
|
|
OpenFilePath=dragon.exe,%Tmpl.Dragon%\Last *
|
|
OpenFilePath=dragon.exe,%Tmpl.Dragon%\Visited Links*
|
|
|
|
[Template_Dragon_Cookies_DirectAccess]
|
|
Tmpl.Title=#4328,Comodo Dragon
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=dragon.exe,%Tmpl.Dragon%\Network\Cookies*
|
|
|
|
[Template_Dragon_Passwords_DirectAccess]
|
|
Tmpl.Title=#4331,Comodo Dragon
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=dragon.exe,%Tmpl.Dragon%\Login Data*
|
|
|
|
[Template_Dragon_Preferences_DirectAccess]
|
|
Tmpl.Title=#4339,Comodo Dragon
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=dragon.exe,%Tmpl.Dragon%\Preferences*
|
|
|
|
[Template_Dragon_Phishing_DirectAccess]
|
|
Tmpl.Title=#4337,Comodo Dragon
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=dragon.exe,%Local AppData%\Comodo\Dragon\User Data\Safe Browsing*
|
|
OpenFilePath=dragon.exe,%Local AppData%\Comodo\Dragon\User Data\CertificateRevocation
|
|
|
|
[Template_Dragon_Profile_DirectAccess]
|
|
Tmpl.Title=#4338,Comodo Dragon
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=dragon.exe,%Tmpl.Dragon%\*
|
|
|
|
[Template_Dragon_Separator]
|
|
Tmpl.Title=-
|
|
Tmpl.Class=WebBrowser
|
|
|
|
#
|
|
# Osiris Browser
|
|
#
|
|
|
|
[Template_Osiris_Force]
|
|
Tmpl.Title=#4323,Osiris Browser
|
|
Tmpl.Class=WebBrowser
|
|
ForceProcess=osiris.exe
|
|
|
|
[Template_Osiris_Bookmarks_DirectAccess]
|
|
Tmpl.Title=#4356,Osiris Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=osiris.exe,%Tmpl.Osiris%\Bookmarks*
|
|
OpenFilePath=osiris.exe,%Tmpl.Osiris%\Favicons*
|
|
|
|
[Template_Osiris_History_DirectAccess]
|
|
Tmpl.Title=#4336,Osiris Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=osiris.exe,%Tmpl.Osiris%\Bookmarks*
|
|
OpenFilePath=osiris.exe,%Tmpl.Osiris%\Favicons*
|
|
OpenFilePath=osiris.exe,%Tmpl.Osiris%\*History*
|
|
OpenFilePath=osiris.exe,%Tmpl.Osiris%\Current *
|
|
OpenFilePath=osiris.exe,%Tmpl.Osiris%\Last *
|
|
OpenFilePath=osiris.exe,%Tmpl.Osiris%\Visited Links*
|
|
|
|
[Template_Osiris_Cookies_DirectAccess]
|
|
Tmpl.Title=#4328,Osiris Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=osiris.exe,%Tmpl.Osiris%\Cookies*
|
|
|
|
[Template_Osiris_Passwords_DirectAccess]
|
|
Tmpl.Title=#4331,Osiris Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=osiris.exe,%Tmpl.Osiris%\Login Data*
|
|
|
|
[Template_Osiris_Preferences_DirectAccess]
|
|
Tmpl.Title=#4339,Osiris Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=osiris.exe,%Tmpl.Osiris%\Preferences*
|
|
|
|
[Template_Osiris_Sync_DirectAccess]
|
|
Tmpl.Title=#4324,Osiris Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=osiris.exe,%Tmpl.Osiris%\Sync Data\*
|
|
|
|
[Template_Osiris_Phishing_DirectAccess]
|
|
Tmpl.Title=#4337,Osiris Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=osiris.exe,%Tmpl.Osiris%\User Data\Safe Browsing*
|
|
OpenFilePath=osiris.exe,%Tmpl.Osiris%\User Data\CertificateRevocation
|
|
|
|
[Template_Osiris_Profile_DirectAccess]
|
|
Tmpl.Title=#4338,Osiris Browser
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=osiris.exe,%Tmpl.Osiris%\*
|
|
|
|
[Template_Osiris_Separator]
|
|
Tmpl.Title=-
|
|
Tmpl.Class=WebBrowser
|
|
|
|
#
|
|
# FlashPeak Slimjet
|
|
#
|
|
|
|
[Template_Slimjet_Force]
|
|
Tmpl.Title=#4323,Slimjet
|
|
Tmpl.Class=WebBrowser
|
|
ForceProcess=slimjet.exe
|
|
|
|
[Template_Slimjet_Bookmarks_DirectAccess]
|
|
Tmpl.Title=#4356,Slimjet
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Bookmarks*
|
|
OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Favicons*
|
|
|
|
[Template_Slimjet_History_DirectAccess]
|
|
Tmpl.Title=#4336,Slimjet
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Bookmarks*
|
|
OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Favicons*
|
|
OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\*History*
|
|
OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Current *
|
|
OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Last *
|
|
OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Visited Links*
|
|
|
|
[Template_Slimjet_Cookies_DirectAccess]
|
|
Tmpl.Title=#4328,Slimjet
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Network\Cookies*
|
|
|
|
[Template_Slimjet_Passwords_DirectAccess]
|
|
Tmpl.Title=#4331,Slimjet
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Login Data*
|
|
|
|
[Template_Slimjet_Preferences_DirectAccess]
|
|
Tmpl.Title=#4339,Slimjet
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Preferences*
|
|
|
|
[Template_Slimjet_Sync_DirectAccess]
|
|
Tmpl.Title=#4324,Slimjet
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Sync Data\*
|
|
OpenFilePath=slimjet.exe,%Tmpl.Slimjet%\Sync Extension Settings\*
|
|
|
|
[Template_Slimjet_Phishing_DirectAccess]
|
|
Tmpl.Title=#4337,Slimjet
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=slimjet.exe,%Local AppData%\Slimjet\User Data\Safe Browsing*
|
|
OpenFilePath=slimjet.exe,%Local AppData%\Slimjet\User Data\CertificateRevocation
|
|
|
|
[Template_Slimjet_Profile_DirectAccess]
|
|
Tmpl.Title=#4338,Slimjet
|
|
Tmpl.Class=WebBrowser
|
|
OpenFilePath=slimjet.exe,%Local AppData%\Slimjet*
|
|
|
|
#
|
|
# Email Readers
|
|
#
|
|
|
|
[Template_Office_Outlook]
|
|
Tmpl.Title=Office Outlook
|
|
Tmpl.Class=EmailReader
|
|
ProcessGroup=<Office_Outlook>,outlook.exe
|
|
OpenFilePath=<Office_Outlook>,%Tmpl.Office_Outlook%
|
|
OpenFilePath=<Office_Outlook>,%AppData%\Microsoft\Outlook
|
|
OpenFilePath=<Office_Outlook>,%Local AppData%\Microsoft\Outlook
|
|
OpenFilePath=outlook.exe,*.eml
|
|
OpenKeyPath=<Office_Outlook>,HKEY_CURRENT_USER\Software\Microsoft\Office
|
|
OpenKeyPath=<Office_Outlook>,HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager
|
|
OpenKeyPath=<Office_Outlook>,HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
|
|
# Outlook pst locks
|
|
OpenIpcPath=<Office_Outlook>,*\BaseNamedObjects*\OLKCRPC.OBJ=*
|
|
OpenIpcPath=<Office_Outlook>,*\BaseNamedObjects*\MAPI-HP*
|
|
OpenIpcPath=<Office_Outlook>,*\BaseNamedObjects*\*_WCIDXPACKED
|
|
OpenIpcPath=<Office_Outlook>,*\BaseNamedObjects*\*_WCEMPTY
|
|
OpenIpcPath=<Office_Outlook>,*\BaseNamedObjects*\*_WCWRITE
|
|
OpenIpcPath=<Office_Outlook>,*\BaseNamedObjects*\*_WCINFO
|
|
OpenIpcPath=<Office_Outlook>,*\BaseNamedObjects*\*_CACHEMUTEX
|
|
OpenIpcPath=<Office_Outlook>,*\BaseNamedObjects*\*_NDB_ZOMBIE
|
|
OpenIpcPath=<Office_Outlook>,*\BaseNamedObjects*\NDB_ROOT_MUTEX
|
|
OpenIpcPath=<Office_Outlook>,*\BaseNamedObjects*\Shared-NDB-FE
|
|
OpenIpcPath=<Office_Outlook>,*\BaseNamedObjects*\Optex_*_LogOptex
|
|
OpenIpcPath=<Office_Outlook>,*\BaseNamedObjects*\OfficeSharedLocks_*
|
|
OpenIpcPath=<Office_Outlook>,*\BaseNamedObjects\WMS Notif Engine*
|
|
OpenWinClass=<Office_Outlook>,WMS ST Notif Class
|
|
# Integration with Windows Desktop Search
|
|
OpenClsid={7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
|
|
OpenClsid={9E175B6D-F52A-11D8-B9A5-505054503030}
|
|
OpenPipePath=\Device\NamedPipe\MsFteWds
|
|
|
|
[Template_Office_Outlook_NEO_Pro]
|
|
Tmpl.Title=Office Outlook + NEO Pro
|
|
Tmpl.Class=EmailReader
|
|
Tmpl.Url=http://www.caelo.com/
|
|
ProcessGroup=<Office_Outlook>,neopro.exe
|
|
OpenFilePath=<Office_Outlook>,%Local AppData%\Caelo\NEO Pro\*
|
|
OpenKeyPath=<Office_Outlook>,HKEY_CURRENT_USER\Software\Caelo Software\
|
|
LingerProcess=w32mkde.exe
|
|
|
|
[Template_Office_Outlook_Copernic_Desktop_Search]
|
|
Tmpl.Title=Office Outlook + Copernic Desktop Search
|
|
Tmpl.Class=EmailReader
|
|
Tmpl.Url=http://www.copernic.com/index.html
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{728F7B17-0053-4543-B232-EC3F19A97985}
|
|
OpenIpcPath=<Office_Outlook>,$:DesktopSearchService.exe
|
|
OpenIpcPath=<Office_Outlook>,*\BaseNamedObjects*\*DDCS
|
|
|
|
[Template_Office_Outlook_Avast_Mail_Scanner]
|
|
Tmpl.Title=Office Outlook + avast! Mail Scanner
|
|
Tmpl.Class=EmailReader
|
|
Tmpl.Url=http://www.avast.com
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=avast! Mail Scanner
|
|
OpenIpcPath=<Office_Outlook>,\RPC Control\[Aavm]
|
|
OpenIpcPath=<Office_Outlook>,*\BaseNamedObjects*\*Aavm*
|
|
OpenIpcPath=<Office_Outlook>,*\BaseNamedObjects*\AvOut*
|
|
OpenIpcPath=<Office_Outlook>,*\BaseNamedObjects*\AvSPM*
|
|
OpenIpcPath=<Office_Outlook>,*\BaseNamedObjects*\AvRes*
|
|
ProcessGroup=<Office_Outlook>,outlook.exe
|
|
|
|
[Template_Office_Outlook_Rainlendar]
|
|
Tmpl.Title=Office Outlook + Rainlendar
|
|
Tmpl.Class=EmailReader
|
|
Tmpl.Url=http://www.rainlendar.net
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct=Rainlendar2
|
|
OpenIpcPath=<Office_Outlook>,*\BaseNamedObjects*\Mutex_MSOSharedMem
|
|
OpenIpcPath=<Office_Outlook>,*\BaseNamedObjects*\MSOutlook97_ANCTinuse
|
|
OpenIpcPath=<Office_Outlook>,$:Rainlendar2.exe
|
|
ProcessGroup=<Office_Outlook>,outlook.exe
|
|
|
|
[Template_Windows_Vista_Mail]
|
|
Tmpl.Title=Windows Vista Mail
|
|
Tmpl.Class=EmailReader
|
|
OpenFilePath=winmail.exe,%Tmpl.Windows_Vista_Mail%
|
|
OpenFilePath=winmail.exe,%AppData%\Microsoft\Windows Mail
|
|
OpenFilePath=winmail.exe,%Local AppData%\Microsoft\Windows Mail
|
|
OpenFilePath=winmail.exe,*.eml
|
|
OpenKeyPath=winmail.exe,HKEY_CURRENT_USER\Software\Microsoft\Windows Mail
|
|
OpenKeyPath=winmail.exe,HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager
|
|
|
|
[Template_Windows_Live_Mail]
|
|
Tmpl.Title=Windows Live Mail
|
|
Tmpl.Class=EmailReader
|
|
ProcessGroup=<Windows_Live_Mail>,wlmail.exe,wlcomm.exe
|
|
OpenFilePath=<Windows_Live_Mail>,%Tmpl.Windows_Live_Mail%
|
|
OpenFilePath=<Windows_Live_Mail>,%AppData%\Microsoft\Windows Live Mail
|
|
OpenFilePath=<Windows_Live_Mail>,%AppData%\Microsoft\Windows Live Contacts
|
|
OpenFilePath=<Windows_Live_Mail>,%Local AppData%\Microsoft\Windows Live Mail
|
|
OpenFilePath=<Windows_Live_Mail>,%Local AppData%\Microsoft\Windows Live Contacts
|
|
OpenFilePath=<Windows_Live_Mail>,%Local AppData%\Microsoft\Windows Live\Contacts
|
|
OpenFilePath=wlmail.exe,*.eml
|
|
OpenKeyPath=<Windows_Live_Mail>,HKEY_CURRENT_USER\Software\Microsoft\Windows Live
|
|
OpenKeyPath=<Windows_Live_Mail>,HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
|
|
OpenIpcPath=<Windows_Live_Mail>,\RPC Control\LiveIdSvc
|
|
|
|
[Template_Thunderbird]
|
|
Tmpl.Title=Thunderbird
|
|
Tmpl.Class=EmailReader
|
|
OpenFilePath=thunderbird.exe,%Tmpl.Thunderbird%
|
|
OpenFilePath=thunderbird.exe,%AppData%\Thunderbird
|
|
OpenFilePath=thunderbird.exe,%Local AppData%\Thunderbird
|
|
OpenKeyPath=thunderbird.exe,HKEY_LOCAL_MACHINE\SOFTWARE\Clients\*\Mozilla Thunderbird*
|
|
OpenKeyPath=thunderbird.exe,HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird*
|
|
|
|
[Template_Thunderbird_PGP]
|
|
Tmpl.Title=OpenPGP for Thunderbird
|
|
Tmpl.Class=EmailReader
|
|
OpenFilePath=thunderbird.exe,%AppData%\gnupg
|
|
ProcessGroup=<gpg_programs>,gpg.exe,gpg2.exe,gpg-agent.exe
|
|
OpenFilePath=<gpg_programs>,%Tmpl.Thunderbird%
|
|
OpenFilePath=<gpg_programs>,%AppData%\Thunderbird
|
|
OpenFilePath=<gpg_programs>,%Local AppData%\Thunderbird
|
|
OpenFilePath=<gpg_programs>,%AppData%\gnupg\
|
|
LingerProcess=gpg-agent.exe
|
|
|
|
[Template_SeaMonkey]
|
|
Tmpl.Title=SeaMonkey
|
|
Tmpl.Class=EmailReader
|
|
OpenFilePath=seamonkey.exe,%Tmpl.SeaMonkey%\Mail*
|
|
#OpenFilePath=seamonkey.exe,%AppData%\Mozilla\Profiles\*\Mail*
|
|
#OpenFilePath=seamonkey.exe,%Local AppData%\Mozilla\Profiles\*\Mail*
|
|
OpenKeyPath=seamonkey.exe,HKEY_CURRENT_USER\Software\Mozilla*\SeaMonkey*
|
|
OpenKeyPath=seamonkey.exe,HKEY_LOCAL_MACHINE\Software\Mozilla\SeaMonkey*
|
|
|
|
[Template_Opera_Mail]
|
|
Tmpl.Title=Opera Mail
|
|
Tmpl.Class=EmailReader
|
|
OpenFilePath=opera.exe,%Tmpl.Opera_Mail%\*
|
|
OpenFilePath=opera.exe,%AppData%\Opera\*\mail\*
|
|
OpenFilePath=opera.exe,%Local AppData%\Opera\*\mail\*
|
|
|
|
[Template_IncrediMail]
|
|
Tmpl.Title=IncrediMail
|
|
Tmpl.Class=EmailReader
|
|
OpenFilePath=IncMail.exe,*\IncrediMail\Data\*
|
|
OpenFilePath=IncMail.exe,%Tmpl.Incredimail%\
|
|
OpenFilePath=IncMail.exe,%Local AppData%\IM\
|
|
OpenFilePath=IncMail.exe,%AppData%\IM\
|
|
OpenFilePath=ImApp.exe,*\IncrediMail\Data\*
|
|
OpenFilePath=ImApp.exe,%Tmpl.Incredimail%\
|
|
OpenFilePath=ImApp.exe,%Local AppData%\IM\
|
|
OpenFilePath=ImApp.exe,%AppData%\IM\
|
|
LingerProcess=ImApp.exe
|
|
|
|
[Template_Eudora]
|
|
Tmpl.Title=Eudora
|
|
Tmpl.Class=EmailReader
|
|
OpenFilePath=eudora.exe,%Tmpl.Eudora%
|
|
OpenKeyPath=eudora.exe,HKEY_CURRENT_USER\Software\Qualcomm\Eudora
|
|
|
|
[Template_TheBat]
|
|
Tmpl.Title=The Bat!
|
|
Tmpl.Class=EmailReader
|
|
ProcessGroup=<TheBat>,thebat32.exe,thebat64.exe
|
|
OpenFilePath=<TheBat>,%Tmpl.TheBat%
|
|
OpenKeyPath=<TheBat>,HKEY_CURRENT_USER\Software\RIT\The Bat!
|
|
|
|
[Template_eM_Client]
|
|
Tmpl.Title=eM Client
|
|
Tmpl.Class=EmailReader
|
|
Tmpl.Url=http://www.emclient.com
|
|
OpenFilePath=MailClient.exe,%Tmpl.em_Client%\
|
|
|
|
[Template_SpamFighter]
|
|
Tmpl.Title=SPAMfighter
|
|
Tmpl.Class=EmailReader
|
|
Tmpl.Url=http://www.spamfighter.com/
|
|
OpenIpcPath=*\BaseNamedObjects*\SPAMfighter.*
|
|
OpenIpcPath=*\BaseNamedObjects*\sfsg.update_*
|
|
OpenIpcPath=*\BaseNamedObjects*\log-*_SPAMfighter_Logs_*
|
|
OpenIpcPath=*\BaseNamedObjects*\*?SPAMCFG.EXE
|
|
OpenKeyPath=HKEY_CURRENT_USER\Software\SPAMfighter\
|
|
|
|
[Template_GreatNews]
|
|
Tmpl.Title=Great News RSS Reader
|
|
Tmpl.Class=EmailReader
|
|
Tmpl.Url=http://www.curiostudio.com/download.html
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct={AA381A22-834B-4b21-AB78-CAFF2B05A4C3}}_is1
|
|
OpenFilePath=GreatNews.exe,*\greatnews.ini
|
|
OpenFilePath=GreatNews.exe,*\newsfeed.db
|
|
|
|
#
|
|
# PDF and Printing
|
|
#
|
|
|
|
[Template_AdobeAcrobat]
|
|
Tmpl.Title=Adobe Acrobat
|
|
Tmpl.Class=Print
|
|
Tmpl.Url=http://www.adobe.com/
|
|
OpenPipePath=\Device\NamedPipe\FLEXnet Licensing Service*
|
|
OpenIpcPath=*\BaseNamedObjects*\FLEXnet Licensing Service*
|
|
OpenWinClass=AcrobatTrayIcon
|
|
|
|
[Template_AdobeAcrobatReader]
|
|
Tmpl.Title=Adobe Acrobat Reader
|
|
Tmpl.Class=Print
|
|
Tmpl.Url=http://www.adobe.com/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F9DB5320-233E-11D1-9F84-707F02C10627}
|
|
Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{F9DB5320-233E-11D1-9F84-707F02C10627}
|
|
OpenPipePath=\Device\NamedPipe\AIPC_SRV\pdfshell_*
|
|
OpenPipePath=\Device\NamedPipe\AIPC_SRV\AcroSBL_*
|
|
NoRenameWinClass=AcrobatSDIWindow
|
|
|
|
[Template_AdobeDistiller]
|
|
Tmpl.Title=Adobe Acrobat (version 8 or 9) with Distiller
|
|
Tmpl.Class=Print
|
|
Tmpl.Url=http://www.adobe.com/
|
|
Tmpl.Scan=w
|
|
OpenPipePath=\Device\NamedPipe\PMtoDistiller
|
|
OpenWinClass=Distiller
|
|
|
|
[Template_AdobeLicensing]
|
|
Tmpl.Title=FlexNet Licensing for Adobe and Autodesk
|
|
Tmpl.Class=Print
|
|
Tmpl.Url=http://www.adobe.com/
|
|
Tmpl.Scan=i
|
|
OpenPipePath=\Device\NamedPipe\FLEXnet Licensing Service*
|
|
OpenIpcPath=*\BaseNamedObjects*\FLEXnet Licensing Service*
|
|
|
|
[Template_eDocPrinter]
|
|
Tmpl.Title=ITEKSOFT eDocPrinter PDF
|
|
Tmpl.Class=Print
|
|
Tmpl.Url=http://uk.iteksoft.com/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{E6718EF2-2B9F-4FFE-B783-35E2CDC6F12E}
|
|
Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{621483E9-77B0-4E2E-A737-2DB9D5CD02E0}
|
|
OpenIpcPath=*\BaseNamedObjects*\eDocPDF*
|
|
OpenIpcPath=*\BaseNamedObjects*\Global\eDocPDF*
|
|
OpenIpcPath=*\BaseNamedObjects*\EPDFEVTREGPIPE*
|
|
OpenPipePath=%Tmpl.eDocPrinter%\
|
|
OpenKeyPath=HKEY_CURRENT_USER\Software\ITEKSOFT\eDocPrinter\PDF\
|
|
OpenPipePath=%Temp%\ep*\
|
|
|
|
[Template_FinePrint]
|
|
Tmpl.Title=FinePrint (PDF)
|
|
Tmpl.Class=Print
|
|
Tmpl.Url=http://www.fineprint.com/products/fineprint/index.html
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanKey=\REGISTRY\MACHINE\Software\FinePrint Software\FinePrint5
|
|
Tmpl.ScanKey=\REGISTRY\MACHINE\Software\FinePrint Software\FinePrint6
|
|
OpenIpcPath=*\BaseNamedObjects*\FP5*
|
|
OpenIpcPath=*\BaseNamedObjects*\FP6*
|
|
OpenPipePath=\Device\NamedPipe\FP5_Dispatcher_*
|
|
OpenPipePath=\Device\NamedPipe\FP6_Dispatcher_*
|
|
OpenWinClass=FP5_DispWndClass
|
|
OpenWinClass=FP6_DispWndClass
|
|
OpenKeyPath=\REGISTRY\MACHINE\Software\FinePrint Software\FinePrint5
|
|
OpenKeyPath=\REGISTRY\MACHINE\Software\FinePrint Software\FinePrint6
|
|
OpenFilePath=%Tmpl.FinePrint%\fp5.ini
|
|
OpenFilePath=%Tmpl.FinePrint%\fp6.ini
|
|
RecoverFolder=%Tmpl.FinePrint%
|
|
|
|
[Template_HP_UniversalPrintDriver]
|
|
Tmpl.Title=HP Universal Print Driver
|
|
Tmpl.Class=Print
|
|
Tmpl.Url=http://www.hp.com/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{877A5D52-5F6F-4175-907D-A6AC4E8F1171}
|
|
OpenClsid={877A5D52-5F6F-4175-907D-A6AC4E8F1171}
|
|
#OpenPipePath=\Device\NamedPipe\wkssvc
|
|
|
|
[Template_NitroPDF5]
|
|
Tmpl.Title=Nitro PDF 5
|
|
Tmpl.Class=Print
|
|
Tmpl.Url=http://www.nitropdf.com/index.asp
|
|
Tmpl.Scan=w
|
|
OpenWinClass={FAF5BE9E-BAFF-47BF-BA47-1A4B15185066}
|
|
OpenWinClass={03576772-AD02-4630-BC5F-3648526FDF87}
|
|
OpenWinClass={AD744029-AC6A-4C0C-A597-D0B02CDB4DE4}
|
|
OpenPipePath=%Temp%\BCL Technologies
|
|
|
|
[Template_NitroPDF6]
|
|
Tmpl.Title=Nitro PDF 6/7
|
|
Tmpl.Class=Print
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=NitroDriverReadSpool
|
|
Tmpl.ScanService=NitroDriverReadSpool2
|
|
OpenPipePath=\Device\Mailslot\nlsX86ccMailslot
|
|
OpenPipePath=\Device\Mailslot\nlsX86ccCtlSlot
|
|
OpenPipePath=\Device\NamedPipe\nitropdfdriverspool
|
|
OpenPipePath=\Device\NamedPipe\nitropdfreaderdriverspool
|
|
OpenPipePath=\Device\Mailslot\AstccMailslot*
|
|
OpenIpcPath=*\BaseNamedObjects*\Nitro PDF Professional*
|
|
|
|
[Template_SumatraPDF]
|
|
Tmpl.Title=#4323,SumatraPDF
|
|
Tmpl.Class=Print
|
|
ForceProcess=SumatraPDF.exe
|
|
|
|
[Template_SumatraPDF_Folder]
|
|
Tmpl.Title=#4338,SumatraPDF
|
|
Tmpl.Class=Print
|
|
OpenFilePath=%Local AppData%\SumatraPDF
|
|
|
|
[Template_Evernote]
|
|
Tmpl.Title=Evernote
|
|
Tmpl.Class=Print
|
|
Tmpl.Url=http://evernote.com/
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=*\BaseNamedObjects*\Evernote*
|
|
OpenIpcPath=*\BaseNamedObjects*\ENClipperInstanceMutex
|
|
OpenIpcPath=*\BaseNamedObjects*\ENSyncServiceAuthMutex
|
|
OpenWinClass=TENTrayMainWindow
|
|
OpenWinClass=ENMainFrame
|
|
OpenWinClass=ENMainFrame3
|
|
OpenWinClass=HwndWrapper[Evernote.exe;*
|
|
OpenWinClass=$:EvernoteClipper.exe/IgnoreUIPI
|
|
LingerProcess=EvernoteClipper.exe
|
|
|
|
[Template_MetaProducts_Inquiry]
|
|
Tmpl.Title=MetaProducts Inquiry
|
|
Tmpl.Class=Print
|
|
Tmpl.Url=http://www.metaproducts.com/mp/Inquiry_Standard_Edition.htm
|
|
ProcessGroup=<InquiryPrograms>,iqls.exe,iqserv.exe,inquiry.exe,iexplore.exe
|
|
OpenFilePath=<InquiryPrograms>,%AppData%\MetaProducts\Inquiry\
|
|
OpenFilePath=<InquiryPrograms>,%Personal%\
|
|
LingerProcess=iqserv.exe
|
|
|
|
[Template_Pdf995]
|
|
Tmpl.Title=Pdf995
|
|
Tmpl.Class=Print
|
|
Tmpl.Url=http://www.pdf995.com/index.html
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\PDF995
|
|
OpenPipePath=%Common AppData%\pdf995\
|
|
OpenPipePath=%AppData%\pdf995\
|
|
OpenPipePath=%Local AppData%\pdf995\
|
|
|
|
[Template_PretonSaver]
|
|
Tmpl.Title=PretonSaver
|
|
Tmpl.Class=Print
|
|
Tmpl.Url=http://www.preton.com/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=PretonClientService
|
|
OpenPipePath=\Device\NamedPipe\PT32_IpcSessionQueue*
|
|
|
|
[Template_SolidConverter]
|
|
Tmpl.Title=Solid Converter
|
|
Tmpl.Class=Print
|
|
Tmpl.Url=http://www.soliddocuments.com/features.htm?product=SolidConverterPDF
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=SPDFCreatorReadSpool
|
|
OpenPipePath=\Device\NamedPipe\sdspool
|
|
OpenIpcPath=*\BaseNamedObjects*\*.spl*
|
|
OpenIpcPath=*\BaseNamedObjects*\Solid*
|
|
LingerProcess=SolidConverterPDFv8.exe
|
|
LingerProcess=SolidScanServiceX86.exe
|
|
ClosedFilePath=SolidConverterPDFV8.exe,*
|
|
|
|
[Template_UltraRecall]
|
|
Tmpl.Title=UltraRecall
|
|
Tmpl.Class=Print
|
|
Tmpl.Url=http://www.kinook.com/UltraRecall/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct=Ultra Recall_is1
|
|
OpenWinClass=Afx:00400000:0
|
|
OpenWinClass=$:UltraRecall.exe/IgnoreUIPI
|
|
OpenIpcPath=*\BaseNamedObjects*\UltraRecall
|
|
|
|
#
|
|
# Security/Privacy
|
|
#
|
|
|
|
[Template_a2AntiMalware]
|
|
Tmpl.Title=Emsisoft A-Squared Anti-Malware
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.emsisoft.com/en/software/free/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=a2AntiMalware
|
|
# version 5.0
|
|
OpenPipePath=\Device\NamedPipe\{A2IPC}a2_ipc
|
|
OpenIpcPath=*\BaseNamedObjects*\{A2IPCMUTEX}a2_ipc
|
|
# earlier versions
|
|
OpenIpcPath=*\BaseNamedObjects*\mc2SWDIJ*
|
|
OpenIpcPath=*\BaseNamedObjects*\Mutex*Process*API*
|
|
OpenIpcPath=*\BaseNamedObjects*\NamedBuffer*Process*API*
|
|
OpenIpcPath=*\BaseNamedObjects*\AutoUnhookMap*
|
|
OpenIpcPath=*\BaseNamedObjects*\mchLLEW2*
|
|
OpenIpcPath=*\BaseNamedObjects*\mchMixCache*
|
|
OpenIpcPath=*\BaseNamedObjects*\TestQueue*
|
|
OpenIpcPath=\RPC Control\mchIpcTestQueue
|
|
OpenIpcPath=$:a2service.exe
|
|
|
|
[Template_Anonymizer]
|
|
Tmpl.Title=Anonymizer Anonymous Surfing
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.anonymizer.com/consumer/products/anonymous_surfing/
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=*\BaseNamedObjects*\AnonFrmWrk*
|
|
OpenIpcPath=*\BaseNamedObjects*\AnonTCPMutex
|
|
|
|
[Template_Avast_Antivirus]
|
|
Tmpl.Title=avast! Antivirus
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.avast.com
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=avast! Antivirus
|
|
OpenWinClass=asw_av_tray_icon_wndclass
|
|
OpenIpcPath=*\BaseNamedObjects*\asw.script_blocking.conf_data*
|
|
OpenIpcPath=*\BaseNamedObjects*\aavmGlob.*
|
|
OpenIpcPath=*\BaseNamedObjects*\aavmSema.*
|
|
OpenIpcPath=*\BaseNamedObjects*\*aavmRq.map
|
|
OpenIpcPath=*\BaseNamedObjects*\*aavmSync.evt
|
|
OpenIpcPath=*\BaseNamedObjects*\*avscr*.map
|
|
ClosedFilePath=*\snxhk.dll
|
|
ClosedFilePath=*\snxhk64.dll
|
|
|
|
[Template_AVG_Anti_Virus]
|
|
Tmpl.Title=AVG Anti-Virus / LinkScanner
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.avg.com
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=AvgLdx86
|
|
Tmpl.ScanService=AvgMfx86
|
|
Tmpl.ScanService=avgwd
|
|
Tmpl.ScanService=avgsvc
|
|
ProcessGroup=<AVG_AV_1>,avgscana.exe,avgscanx.exe,avgcsrvx.exe,avgui.exe
|
|
ProcessGroup=<AVG_AV_2>,avgscana.exe,avgscanx.exe,avgcsrvx.exe,avgui.exe,firefox.exe,iexplore.exe
|
|
ProcessGroup=<AVG_AV_3>,avgscana.exe
|
|
OpenPipePath=<AVG_AV_1>,\Device\NamedPipe\*-*-*-*-*::*
|
|
OpenPipePath=<AVG_AV_1>,\Device\NamedPipe\AVG-CHJW-*
|
|
OpenPipePath=<AVG_AV_1>,\Device\NamedPipe\AvgScanPipeName*
|
|
OpenPipePath=<AVG_AV_1>,\Device\NamedPipe\AvgUIPipeName*
|
|
OpenPipePath=<AVG_AV_2>,\Device\NamedPipe\__hex8__-__hex4__-__hex4__-__hex4__-__hex12__
|
|
OpenIpcPath=<AVG_AV_2>,*\BaseNamedObjects*\bce5ad8b-264e-024b-81d6-f289aa672301*
|
|
OpenIpcPath=*\BaseNamedObjects*\__AVG_FW_*__
|
|
OpenIpcPath=*\BaseNamedObjects*\CE6383A0-EB13-428c-A97E-92FE645B06E3
|
|
OpenFilePath=<AVG_AV_3>,%AllUsersProfile%\AVG*\*
|
|
OpenPipePath=\Device\NamedPipe\avg-*
|
|
ClosedFilePath=*avg*snxhk*.dll
|
|
|
|
[Template_Avira_Antivirus]
|
|
Tmpl.Title=Avira Antivirus / Internet Security
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.avira.com
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=AntiVirService
|
|
OpenIpcPath=*\BaseNamedObjects*\AVSDA_KERNELOBJECT_*
|
|
OpenIpcPath=*\BaseNamedObjects*\WEBGUARD_KERNEL_OBJECT_*
|
|
OpenIpcPath=*\BaseNamedObjects*\AVMAILC_ISPOP3ACTIVE_*
|
|
OpenIpcPath=*\BaseNamedObjects*\AVMAILC_KERNELOBJECT_*
|
|
OpenIpcPath=*\BaseNamedObjects*\AVMAILC_KERNEL_OBJECT_*
|
|
OpenIpcPath=*\BaseNamedObjects*\KERNELOBJECTNAME_*
|
|
OpenIpcPath=*\BaseNamedObjects*\KERNELOBJECT_*
|
|
OpenIpcPath=*\BaseNamedObjects*\{506A71E2-D744-4717-8689-649A16CBBA0F}
|
|
|
|
[Template_BitDefenderInternetSecurity]
|
|
Tmpl.Title=BitDefender Internet Security
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.bitdefender.com
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct=BitDefender
|
|
Tmpl.ScanService=vsserv
|
|
Tmpl.ScanService=ProductAgentService
|
|
OpenPipePath=\Device\NamedPipe\DEFAULT_BD_COMM_PIPE
|
|
ClosedFilePath=*BitDefender*atcuf*.dll
|
|
|
|
[Template_BitVise]
|
|
Tmpl.Title=Bitvise SSH Client
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.bitvise.com/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct=BvSshClient
|
|
OpenIpcPath=\Device\NamedPipe\TLINETLOCKPIPE
|
|
|
|
[Template_TrendMicroBrowserGuard]
|
|
Tmpl.Title=Trend Micro Browser Guard
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://free.antivirus.com/browser-guard/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct={D4ADDB2A-EE3C-41A7-88DF-99333DAE18E3}
|
|
OpenPipePath=\Device\NamedPipe\bgpipe
|
|
|
|
[Template_BullGuard]
|
|
Tmpl.Title=BullGuard Antivirus / Internet Security
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.bullguard.com/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct=BullGuard
|
|
OpenIpcPath=*\BaseNamedObjects*\BullGuard*
|
|
|
|
[Template_Bsecure]
|
|
Tmpl.Title=Bsecure CloudCare
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.bsecure.com/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=Bsecure
|
|
Tmpl.ScanService=BsecureAV
|
|
Tmpl.ScanService=BsecureFilter
|
|
Tmpl.ScanService=BSecACFltr
|
|
OpenIpcPath=*\BaseNamedObjects*\Bsecure*
|
|
OpenIpcPath=*\BaseNamedObjects*\IsBsecureServiceRunning
|
|
|
|
[Template_CA_InternetSecuritySuite]
|
|
Tmpl.Title=CA Internet Security Suite
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://shop.ca.com/ca/products/internetsecurity/internetsecurity_suite.asp
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=CAISafe
|
|
OpenIpcPath=*\BaseNamedObjects*\820EEE67-B517-405d-A775-8BE1879BD279
|
|
OpenIpcPath=*\BaseNamedObjects*\0F727B36-E18C-47fa-B5A4-30C2B84E2EAA
|
|
OpenIpcPath=*\BaseNamedObjects*\672AF2F3-FCBE-4870-A103-E78DDCFC051C*
|
|
OpenIpcPath=*\BaseNamedObjects*\2212AC6F-01F9-4107-9DD6-C75DA65A7A1F*
|
|
OpenIpcPath=*\BaseNamedObjects*\CallingID.*
|
|
OpenIpcPath=*\BaseNamedObjects*\*UmxSbx_*
|
|
OpenClsid={1791C1B5-FFD0-4D4B-ABCD-7A7DF6EAA89C}
|
|
OpenClsid={5F36DC27-B076-4D0C-BD8C-7AEE14022193}
|
|
OpenClsid={E82070F7-4174-4F49-8DCF-C87F8DDF0BAA}
|
|
|
|
[Template_ChildControl2011]
|
|
Tmpl.Title=Salfeld.com Child Control 2011
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.salfeld.com/software/parentalcontrol/index.html
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanIpc=*\BaseNamedObjects*\ChicoTaskCaller*
|
|
OpenIpcPath=*\BaseNamedObjects*\AutoUnhookMap*
|
|
OpenIpcPath=*\BaseNamedObjects*\mchLLEW*
|
|
OpenIpcPath=*\BaseNamedObjects*\mchMixCache*
|
|
OpenIpcPath=*\BaseNamedObjects*\Mutex*Process*API*
|
|
OpenIpcPath=*\BaseNamedObjects*\NamedBuffer*Process*API*
|
|
OpenIpcPath=*\BaseNamedObjects*\ChicoTaskCaller*
|
|
OpenIpcPath=*\BaseNamedObjects*\IPCMyLogIpc*
|
|
OpenIpcPath=*\BaseNamedObjects*\IPCWebCheck*
|
|
OpenIpcPath=*\BaseNamedObjects*\Salfeld-*
|
|
OpenIpcPath=$:webtmr.exe
|
|
|
|
[Template_CovenantEyes]
|
|
Tmpl.Title=Covenant Eyes
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.covenanteyes.com/
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=*\BaseNamedObjects*\CE_*Obj
|
|
OpenWinClass=$:nmSvc.exe/IgnoreUIPI
|
|
|
|
[Template_ComodoInternetSecurity]
|
|
Tmpl.Title=Comodo Internet Security / Antivirus / Firewall
|
|
Tmpl.Class=Security
|
|
Tmp.Url=http://www.comodo.com/home/internet-security/free-internet-security.php
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=cmdGuard
|
|
DelayLoadDll=guard32.dll
|
|
DelayLoadDll=guard64.dll
|
|
ClosedFilePath=*\Guard32.dll
|
|
ClosedFilePath=*\Guard64.dll
|
|
|
|
[Template_ComodoVerificationEngine]
|
|
Tmpl.Title=Comodo Verification Engine
|
|
Tmpl.Class=Security
|
|
Tmp.Url=http://www.vengine.com/
|
|
Tmpl.Scan=w
|
|
OpenWinClass=Comodo_TTB_Shadow_Class
|
|
OpenIpcPath=*\BaseNamedObjects*\Verification Engine Registry Mutex Object
|
|
OpenIpcPath=*\BaseNamedObjects*\EE855D62-517A-420e-ADEA-9813658B0442
|
|
OpenIpcPath=*\BaseNamedObjects*\ESigilTaskTrayLoadMutex
|
|
OpenIpcPath=*\BaseNamedObjects*\ESigilBho::ValidateOnEvent
|
|
OpenIpcPath=*\BaseNamedObjects*\ESigilBho::ValidateOffEvent
|
|
|
|
[Template_CyberPatrol]
|
|
Tmpl.Title=CyberPatrol
|
|
Tmpl.Class=Security
|
|
Tmp.Url=http://www.cyberpatrol.com/index.htm
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6EE6F203-0E4B-4D35-AA06-2B6FBA833D14}
|
|
OpenClsid={09ECA3F9-F977-4FD1-84ED-68C89D435D75}
|
|
OpenClsid={24E83BB6-80E1-4A1D-BE63-82BF306F3CFA}
|
|
OpenClsid={280B4C50-B42E-47E1-8D8D-39F4CD41CDE3}
|
|
OpenClsid={37AFD09F-D0D0-47DF-91FE-67F952482929}
|
|
OpenClsid={3AA786BD-E3DB-472C-81E3-F38FF100B6BF}
|
|
OpenClsid={3D5B796D-8364-4D81-83CE-E5B32FF345AD}
|
|
OpenClsid={4C4D3C2E-A908-4F0B-90EB-0E736564CA96}
|
|
OpenClsid={4E386DFE-659D-4428-B9FC-B7B1865E8FCE}
|
|
OpenClsid={575E825A-91AB-485E-A450-351449256BEA}
|
|
OpenClsid={5D40EC06-89EC-447D-A5E1-EFEAF7FBD3B5}
|
|
OpenClsid={6164DE26-D577-4323-B588-F11105C6D30A}
|
|
OpenClsid={6792F97B-A3C1-4E89-A1C7-C7DFDA70DBE9}
|
|
OpenClsid={6DCE346B-1205-4D49-9E52-6670CF1844AB}
|
|
OpenClsid={7714CE7E-F32F-4739-9BCB-3CB442DFA724}
|
|
OpenClsid={7B5CCBA7-38B5-4B9C-A0EC-4E5ADFD7BA3A}
|
|
OpenClsid={7E9B677A-A155-4B12-A17B-9DBD4F359BCB}
|
|
OpenClsid={8ABBB2C6-FF5B-4B01-8250-673EC5155561}
|
|
OpenClsid={8C62E4AD-C390-48FD-8311-7C3E764EAD70}
|
|
OpenClsid={9B4B7F18-D1EA-43BC-93F4-EDF14E0AA703}
|
|
OpenClsid={A747A75D-D03D-48F9-9AC6-50D9B610FAC5}
|
|
OpenClsid={AA9AD697-20E3-4ECC-A746-0ABAD875C548}
|
|
OpenClsid={BB930754-5C0E-4708-B2AC-8567B9753ADE}
|
|
OpenClsid={C42F10D8-967A-4F5C-B78C-F0291C0F7FAA}
|
|
OpenClsid={D529E5B4-B49D-4D88-B04D-2FA598D76BEA}
|
|
OpenClsid={D57CF01D-10C8-46CA-B7AC-D6969D5433B8}
|
|
OpenClsid={DDC8AA23-8016-4E16-B567-8F9FBF153010}
|
|
OpenClsid={F51CD102-642B-4381-A549-CFEAF9E1EA53}
|
|
OpenClsid={FCAA2E8F-EA4E-44F6-97F5-4418E84073CA}
|
|
OpenIpcPath=*\BaseNamedObjects*\CYBERPATROLLLC_CYBERPATROL_*
|
|
OpenIpcPath=*\BaseNamedObjects*\CP_LSP_MEM_FILE_EVENT
|
|
OpenIpcPath=*\BaseNamedObjects*\CPLSP_CONTENT_MEM_MAPPED_FILE_*
|
|
|
|
[Template_DigitalPersona]
|
|
Tmpl.Title=Digital Persona Fingerprint Reader
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.digitalpersona.com/index.php?id=dev_hdw_uareu_reader
|
|
Tmpl.Scan=iw
|
|
OpenIpcPath=*\BaseNamedObjects*\__DP_TRACE_MUTEX__
|
|
OpenIpcPath=*\BaseNamedObjects*\DP_OTS_IPC_MUTEX
|
|
OpenIpcPath=*\BaseNamedObjects*\U.are.U_VerifyCriptoprovider
|
|
OpenIpcPath=*\BaseNamedObjects*\DP_OTS_IPC_BUFFER
|
|
OpenIpcPath=*\BaseNamedObjects*\DP_OTS_LOOKUP_CACHE
|
|
OpenIpcPath=\RPC Control\DPHOST
|
|
OpenWinClass=DigitalPersona Pro Agent
|
|
OpenWinClass=DP_GlobalAvatarClass
|
|
|
|
[Template_DrWeb_SecuritySpace]
|
|
Tmpl.Title=Dr.Web Security Space
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://products.drweb.com/win/security_space/?lng=en
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=DrWebEngine
|
|
Tmpl.ScanService=DrWebAVService
|
|
OpenPipePath=\Device\SpiderG3
|
|
OpenPipePath=\Device\NamedPipe\Dr.Web
|
|
OpenPipePath=\??\SPIDER
|
|
OpenIpcPath=*\BaseNamedObjects*\DrWebOutlookRunningEvent
|
|
OpenWinClass=SpiderAgent GUI Class
|
|
|
|
[Template_EasyHideIp]
|
|
Tmpl.Title=Easy Hide IP
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.easy-hide-ip.com/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=EasyRedirect
|
|
OpenIpcPath=*\BaseNamedObjects*\Redirector_event2
|
|
OpenClsid={E8B2A82A-2B16-4DBE-BCF0-70CB49FF5022}
|
|
|
|
[Template_FastAccessAnywhere]
|
|
Tmpl.Title=FastAccess Anywhere
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.sensiblevision.com/en-us/fastaccessanywhere/overview.aspx
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanIpc=*\BaseNamedObjects*\E84B01BF-FA91-48e4-A4B3-EECD7E4DB810
|
|
OpenIpcPath=*\BaseNamedObjects*\E84B01BF-FA91-48e4-A4B3-EECD7E4DB810
|
|
OpenIpcPath=\RPC Control\Callbacks*
|
|
OpenWinClass=FATrayAlert
|
|
|
|
[Template_FSecure]
|
|
Tmpl.Title=F-Secure Internet Protection
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.f-secure.com/en_US/products/home-office/internet-security/index.html
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=F-Secure Filter
|
|
Tmpl.ScanService=F-Secure Gatekeeper Handler Starter
|
|
Tmpl.ScanService=F-Secure Gatekeeper
|
|
OpenIpcPath=\RPC Control\__hex12__*.*.*.*.*.*.*.*
|
|
OpenIpcPath=\RPC Control\F-Secure ORSP V1
|
|
OpenIpcPath=*\BaseNamedObjects*\FSMB *
|
|
OpenIpcPath=*\BaseNamedObjects*\dxk390x-*
|
|
OpenIpcPath=*\BaseNamedObjects*\pipeserverhere*
|
|
OpenIpcPath=*\BaseNamedObjects*\pipeserversync*
|
|
OpenIpcPath=*\BaseNamedObjects*\pipeservertaken*
|
|
OpenPipePath=\Device\NamedPipe\__fs*__
|
|
OpenPipePath=\Device\NamedPipe\*.*.*.*.*.*.*.*.*.*
|
|
OpenPipePath=\Device\NamedPipe\rcn_*
|
|
LingerProcess=fsavaui.exe
|
|
# F-Secure 2012
|
|
OpenPipePath=\Device\NamedPipe\ccf_cuif*
|
|
OpenPipePath=\Device\NamedPipe\fsccfSettingsServer*
|
|
OpenPipePath=\Device\NamedPipe\CCFSettingsChangeNotif_*
|
|
OpenPipePath=\Device\NamedPipe\PipeServerTaken*
|
|
# F-Secure 2013
|
|
OpenIpcPath=*\BaseNamedObjects*\FsCcfLogging_*.log
|
|
OpenIpcPath=*\BaseNamedObjects*\PipeServerTaken*
|
|
OpenPipePath=\Device\NamedPipe\FS_CCF_NI_DAEMON*
|
|
# change line below to OpenPipePath=\Device\NamedPipe\%EXENAME%-%PID%
|
|
OpenPipePath=\Device\NamedPipe\*.exe-*
|
|
|
|
[Template_GDataInternetSecurity]
|
|
Tmpl.Title=G Data Anti-Virus/Internet Security
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.gdata-software.com/home-security/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=GDScan
|
|
OpenClsid={1E0D02B2-989A-45FF-9318-F43CC56C515A}
|
|
|
|
[Template_HomeGuard]
|
|
Tmpl.Title=HomeGuard Activity Monitor
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://veridium.net/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=HomeGuard AMC
|
|
OpenIpcPath=*\BaseNamedObjects*\*Ipc2Map*
|
|
OpenIpcPath=*\BaseNamedObjects*\*Ipc2Mutex*
|
|
OpenIpcPath=*\BaseNamedObjects*\mc2SWDIJ*
|
|
OpenIpcPath=*\BaseNamedObjects*\NamedBuffer*Process*API*
|
|
OpenIpcPath=*\BaseNamedObjects*\Mutex*Process*API*
|
|
OpenIpcPath=*\BaseNamedObjects*\AutoUnhookMap*
|
|
OpenIpcPath=*\BaseNamedObjects*\mchLLEW2*
|
|
OpenIpcPath=*\BaseNamedObjects*\mchMixCache*
|
|
OpenIpcPath=*\BaseNamedObjects*\*AnswerBuf*Event*
|
|
OpenIpcPath=*\BaseNamedObjects*\*AnswerBuf*Map*
|
|
OpenIpcPath=$:vglset.exe
|
|
|
|
[Template_IoloSystemMechanic]
|
|
Tmpl.Title=iolo System Mechanic
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.iolo.com/system-mechanic/standard/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=ioloSystemService
|
|
OpenIpcPath=*\BaseNamedObjects*\AutoUnhookMap*
|
|
OpenIpcPath=*\BaseNamedObjects*\Mutex*mAH*Process*API*
|
|
OpenIpcPath=*\BaseNamedObjects*\NamedBuffer*mAH*Process*API*
|
|
OpenIpcPath=*\BaseNamedObjects*\NamedBuffer*mix*Process*API*
|
|
OpenIpcPath=*\BaseNamedObjects*\mchLLEW2*
|
|
OpenIpcPath=*\BaseNamedObjects*\mchMixCache*
|
|
OpenIpcPath=*\BaseNamedObjects*\mhicce*
|
|
|
|
[Template_Microsoft_EMET]
|
|
Tmpl.Title=Enhanced Mitigation Experience Toolkit (Microsoft EMET)
|
|
Tmpl.Class=Security
|
|
# old EMET homepage
|
|
# Tmpl.Url=http://www.microsoft.com/downloads/en/confirmation.aspx?FamilyID=c6f0a6ee-05ac-4eb6-acd0-362559fd2f04
|
|
Tmpl.Url=http://technet.microsoft.com/en-us/security/jj653751
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Microsoft\EMET
|
|
OpenIpcPath=*\BaseNamedObjects*\emet_pid_*
|
|
OpenWinClass=$:EMET_notifier.exe/IgnoreUIPI
|
|
# EMET 4
|
|
OpenPipePath=\Device\Mailslot\EMET_Agent_*
|
|
OpenPipePath=\Device\Mailslot\EMET_Recipient_*
|
|
|
|
[Template_Kaspersky]
|
|
Tmpl.Title=Kaspersky Anti-Virus/Internet Security
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.kaspersky.com/kaspersky_internet_security
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=klim5
|
|
Tmpl.ScanService=klim6
|
|
OpenIpcPath=\RPC Control\PRRemote:*
|
|
OpenIpcPath=*\BaseNamedObjects*\PRCustomProps*
|
|
OpenIpcPath=*\BaseNamedObjects*\PREvent*
|
|
OpenIpcPath=*\BaseNamedObjects*\PRObjects*
|
|
OpenIpcPath=*\BaseNamedObjects*\KLObj_mt_KLSCRIPTCHECKER_PR_*
|
|
OpenIpcPath=*\BaseNamedObjects*\__hex30-90__
|
|
OpenPipePath=\Device\NamedPipe\sa_hlp_srv
|
|
LingerProcess=klwtblfs.exe
|
|
# following setting comes from value DataRoot of the following key
|
|
# HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KasperskyLab\protected\AVP9\environment
|
|
OpenPipePath=%Tmpl.KasperskyDataRoot%\~PR*.dat
|
|
|
|
[Template_Kaspersky_Pure_Password_Manager]
|
|
Tmpl.Title=Kaspersky Pure Password Manager
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.kaspersky.com/kaspersky_internet_security
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct={1A59064A-12A9-469F-99F6-04BF118DBCFF}
|
|
OpenIpcPath=*\BaseNamedObjects*\Mutex*Process*API*
|
|
OpenIpcPath=*\BaseNamedObjects*\NamedBuffer*Process*API*
|
|
OpenIpcPath=*\BaseNamedObjects*\AutoUnhookMap*
|
|
OpenIpcPath=*\BaseNamedObjects*\mchLLEW2*
|
|
OpenIpcPath=*\BaseNamedObjects*\mchMixCache*
|
|
OpenIpcPath=*\BaseNamedObjects*\TtsMappedObject_Tts*
|
|
# settings specific to Kaspersky Pure
|
|
OpenIpcPath=*\BaseNamedObjects*\kpmPasswordAssistantClosedEvent:*
|
|
OpenIpcPath=*\BaseNamedObjects*\kpmAutofillInfo:*
|
|
|
|
[Template_KeyScrambler]
|
|
Tmpl.Title=KeyScrambler
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.qfxsoftware.com/
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=\Device\KeyScrambler
|
|
OpenIpcPath=\RPC Control\KSControlEp.Default*
|
|
OpenIpcPath=*\BaseNamedObjects*\KeyScrambler*
|
|
OpenIpcPath=*\BaseNamedObjects*\KSEncryptionEvent*
|
|
OpenIpcPath=*\BaseNamedObjects*\KSProcEvent*
|
|
OpenIpcPath=*\BaseNamedObjects*\KSEncStatusEvent
|
|
OpenIpcPath=*\BaseNamedObjects*\KSSettingsEvent*
|
|
OpenPipePath=\Device\NamedPipe\KSTIPipe*
|
|
OpenPipePath=\Device\NamedPipe\KSSettingsPipe*
|
|
|
|
[Template_HideMyIp]
|
|
Tmpl.Title=Hide My IP
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.hide-my-ip.com/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=HideMyIpSRV
|
|
OpenIpcPath=*\BaseNamedObjects*\Redirector_event
|
|
OpenClsid={B1A429DB-FB06-4645-B7C0-0CC405EAD3CD}
|
|
OpenClsid={6EEBC7FF-67DA-4B90-9251-C2C5696E4B48}
|
|
|
|
[Template_HitmanProAlert]
|
|
Tmpl.Title=Hitman Pro Alert
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=https://www.hitmanpro.com/en-us/alert.aspx
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct=HitmanPro.Alert
|
|
Tmpl.ScanService=hmpalertsvc
|
|
OpenPipePath=\Device\NamedPipe\hmpalert
|
|
|
|
[Template_HmaProVpn]
|
|
Tmpl.Title=HMA! Pro VPN
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.hidemyass.com/vpn/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct=HMA! Pro VPN
|
|
OpenIpcPath=*\BaseNamedObjects*\{3A4BE5AC-E783-4939-A746-05920ACDE790}
|
|
OpenIpcPath=*\BaseNamedObjects*\{73B2E84B-B7D9-464d-8376-68D43DE31E1D}
|
|
|
|
[Template_LastPass]
|
|
Tmpl.Title=LastPass
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=https://lastpass.com/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Classes\lpgetr
|
|
Tmpl.ScanFile=%{A520A1A4-1780-4FF6-BD18-167343C5AF16}%\LastPass
|
|
OpenFilePath=<Template_LastPass>,%UserProfile%\*\LastPass\*
|
|
ProcessGroup=<Template_LastPass>,iexplore.exe,firefox.exe,opera.exe,chrome.exe
|
|
|
|
[Template_McAfee_Guardian_Firewall]
|
|
Tmpl.Title=McAfee Guardian Firewall
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.mcafee.com/us/index.html
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=\RPC Control\McAfee_FW_RPC
|
|
|
|
[Template_Microsoft_Security_Essentials]
|
|
Tmpl.Title=Microsoft Security Essentials
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://windows.microsoft.com/en-US/windows/products/security-essentials
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=MsMpSvc
|
|
OpenWinClass=msseces_class
|
|
OpenWinClass=$:msseces.exe/IgnoreUIPI
|
|
IContextMenuClsid={09A47860-11B0-4DA5-AFA5-26D86198A780}
|
|
|
|
[Template_Mirekusoft_Install_Monitor]
|
|
Tmpl.Title=Mirekusoft Install Monitor
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.mirekusoft.com/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=MSpyData
|
|
Tmpl.ScanService=MSpyMon
|
|
#Tmpl.ScanProduct={E4ED1ADE-60A6-4660-811E-6E4096EBCA36}
|
|
SkipHook=//start.exe,createproc,cocreate
|
|
ClosedFilePath=*\MSpyDll.dll
|
|
|
|
[Template_NetNanny]
|
|
Tmpl.Title=NetNanny
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.netnanny.com/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=CwAltaService20
|
|
OpenPipePath=\Device\NamedPipe\CWIPCServer_ContentWatch*
|
|
OpenIpcPath=*\BaseNamedObjects*\*STRulesSTRules*
|
|
OpenIpcPath=*\BaseNamedObjects*\*SearchTree_*
|
|
OpenIpcPath=*\BaseNamedObjects*\Alta::*
|
|
OpenIpcPath=*\BaseNamedObjects*\SM::*
|
|
OpenIpcPath=*\BaseNamedObjects*\CW::*
|
|
OpenIpcPath=*\BaseNamedObjects*\CW_*
|
|
OpenIpcPath=*\BaseNamedObjects*\CP_SHARED_*
|
|
OpenIpcPath=*\BaseNamedObjects*\WORD_PARSER_*
|
|
OpenIpcPath=*\BaseNamedObjects*\CwAlta*
|
|
OpenFilePath=%AllUsersProfile%\*\ContentWatch\Internet Protection\*
|
|
OpenFilePath=%AppData%\ContentWatch\Internet Protection\*
|
|
# NetNanny 5
|
|
OpenIpcPath=*\BaseNamedObjects*\*/NETNANNY5/*
|
|
OpenClsid={056CDF58-CD7A-41D2-AF75-7CA1F44B84E9}
|
|
|
|
[Template_NOD32]
|
|
Tmpl.Title=ESET NOD32 Antivirus
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.eset.com/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=eamon
|
|
Tmpl.ScanService=ehdrv
|
|
Tmpl.ScanService=ekrn
|
|
OpenIpcPath=*\BaseNamedObjects*\NOD32*
|
|
OpenIpcPath=*\BaseNamedObjects*\NODCOMM*
|
|
|
|
[Template_NormanSecuritySuite]
|
|
Tmpl.Title=Norman Security Suite with Parental Controls
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://norman.com/Product/Home_Home_office/49887/en-us
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=NPROSECSVC
|
|
OpenIpcPath=*\BaseNamedObjects*\SEM32_COM_MUTEX
|
|
OpenIpcPath=*\BaseNamedObjects*\SEM32_EVENT_*
|
|
OpenIpcPath=*\BaseNamedObjects*\SHAREMEM_*_MEM*
|
|
|
|
[Template_NortonInternetSecurity]
|
|
Tmpl.Title=Norton Internet Security / AntiVirus / Norton 360
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=https://www.norton.com
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=NortonSecurity
|
|
Tmpl.ScanService=NIS
|
|
Tmpl.ScanService=NAV
|
|
Tmpl.ScanService=N360
|
|
OpenIpcPath=\RPC Control\{__hex8__-__hex4__-__hex4__-__hex4__-__hex12__}
|
|
OpenIpcPath=*\BaseNamedObjects*\ccSetMgr_Running*
|
|
OpenIpcPath=*\BaseNamedObjects*\NewWCIDConfig*
|
|
OpenIpcPath=*\BaseNamedObjects*\LockWCIDConfig*
|
|
OpenIpcPath=*\BaseNamedObjects*\IDS_STORAGE_MUTEX
|
|
OpenIpcPath=*\BaseNamedObjects*\CGSCE
|
|
OpenIpcPath=*\BaseNamedObjects*\CSECE
|
|
OpenIpcPath=*\BaseNamedObjects*\CNDIE
|
|
|
|
[Template_NortonSafeWebLite]
|
|
Tmpl.Title=Norton Safe Web Lite
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://safeweb.norton.com/lite
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=NSL
|
|
ProcessGroup=<NortonSafeWeb>,firefox.exe,iexplore.exe
|
|
OpenIpcPath=<NortonSafeWeb>,\RPC Control\{__hex8__-__hex4__-__hex4__-__hex4__-__hex12__}
|
|
OpenIpcPath=<NortonSafeWeb>,*\BaseNamedObjects*\ccSetMgr_Running*
|
|
|
|
[Template_PandaCloudAntivirus]
|
|
Tmpl.Title=Panda Cloud Antivirus
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.cloudantivirus.com/en/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{39655A7E-1CCB-4BC7-8686-342A4581CA94}
|
|
OpenIpcPath=*\BaseNamedObjects*\76529309-F679-41df-8CAD-383D589867CF
|
|
OpenIpcPath=*\BaseNamedObjects*\psanmsrvcppal_*
|
|
OpenIpcPath=*\BaseNamedObjects*\_sbf_*panda2*
|
|
|
|
[Template_PandaInternetSecurity]
|
|
Tmpl.Title=Panda Internet Security
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.pandasecurity.com/usa/homeusers/solutions/internet-security/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=Panda Software Controller
|
|
Tmpl.ScanService=pavboot
|
|
Tmpl.ScanService=PAVDRV
|
|
Tmpl.ScanService=PAVFNSVR
|
|
Tmpl.ScanService=PavProc
|
|
Tmpl.ScanService=PavPrSrv
|
|
Tmpl.ScanService=PAVSRV
|
|
OpenIpcPath=*\BaseNamedObjects*\*PAVPROT_*
|
|
OpenIpcPath=*\BaseNamedObjects*\PAVKRE_*
|
|
OpenIpcPath=*\BaseNamedObjects*\PAV_icl_proxy_evento_fin
|
|
OpenIpcPath=*\BaseNamedObjects*\pavwp_*
|
|
OpenIpcPath=*\BaseNamedObjects*\TPSRV_*
|
|
OpenIpcPath=*\BaseNamedObjects*\TP_MINIDUMPER_*
|
|
OpenIpcPath=*\BaseNamedObjects*\Mutex_Lect_Escri_Memoria_Compartida_*
|
|
OpenIpcPath=*\BaseNamedObjects*_ACTIVATION_SHARED_OBJECT_EVENT
|
|
OpenIpcPath=*\BaseNamedObjects*_IPC_COMMAND
|
|
OpenIpcPath=*\BaseNamedObjects*_IPC_COMMAND_ANSWER
|
|
OpenIpcPath=*\BaseNamedObjects*_IPC_CONTROL
|
|
OpenIpcPath=*\BaseNamedObjects*_IPC_CONTROL_MUTEX
|
|
OpenIpcPath=*\BaseNamedObjects*_IPC_IS_OPEN
|
|
OpenIpcPath=*\BaseNamedObjects*_IPC_MUTEX
|
|
OpenIpcPath=*\BaseNamedObjects*_IPC_NEW_MESSAGE
|
|
OpenIpcPath=*\BaseNamedObjects*_RULES_CHANGE_SHARED_OBJECT_EVENT
|
|
|
|
[Template_PasswordDoor]
|
|
Tmpl.Title=Password Door
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://toplang.com/passworddoor.htm
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct=Password Door
|
|
OpenPipePath=\Device\NamedPipe\PasswordDoor*
|
|
|
|
[Template_PC_Tools_Security]
|
|
Tmpl.Title=PC Tools Security
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.pctools.com/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=ThreatFire
|
|
OpenIpcPath=\RPC Control\mchIpcThreatfireApiHook
|
|
OpenIpcPath=*\BaseNamedObjects*\ThreatfireApiHookAnswerBuf*
|
|
OpenIpcPath=*\BaseNamedObjects*\Mutex*mAH*Process*API*
|
|
OpenIpcPath=*\BaseNamedObjects*\NamedBuffer*mAH*Process*API*
|
|
OpenIpcPath=*\BaseNamedObjects*\NamedBuffer*mix*Process*API*
|
|
OpenIpcPath=*\BaseNamedObjects*\Ipc2Cnt*
|
|
OpenIpcPath=*\BaseNamedObjects*\mchMixCache*
|
|
OpenIpcPath=*\BaseNamedObjects*\mchLLEW2*
|
|
OpenIpcPath=*\BaseNamedObjects*\AutoUnhookMap*
|
|
OpenIpcPath=*\BaseNamedObjects*\{1E57CBD2-232C-4f17-867C-7F9B4052D89C}
|
|
OpenIpcPath=*\BaseNamedObjects*\{CB98E8A0-6E8B-4a24-9953-41D8F2FED3FC}
|
|
OpenIpcPath=*\BaseNamedObjects*\{0C84A7BB-7D57-4b00-A418-1448159824DA}
|
|
DelayLoadDll=TfWah.dll
|
|
|
|
[Template_PGP]
|
|
Tmpl.Title=PGP (Pretty Good Privacy)
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.pgp.com/products/desktop_home/index.html
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=*\BaseNamedObjects*\PGPhkSharedMemory
|
|
OpenIpcPath=*\BaseNamedObjects*\PGPocTrayInstSem
|
|
OpenIpcPath=*\BaseNamedObjects*\PGPocTrayListenSem
|
|
OpenIpcPath=*\BaseNamedObjects*\PGPtray_Hidden_Window
|
|
OpenIpcPath=*\BaseNamedObjects*\PGPlsp Debug Print Mutex
|
|
OpenPipePath=\Device\NamedPipe\pgpserv
|
|
OpenPipePath=\Device\NamedPipe\pgpsdkserv
|
|
|
|
[Template_Proxifier]
|
|
Tmpl.Title=Proxifier
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.proxifier.com/
|
|
Tmpl.Scan=w
|
|
OpenWinClass=Proxifier32Cls
|
|
OpenWinClass=$:proxifier.exe/IgnoreUIPI
|
|
OpenIpcPath=*\BaseNamedObjects*\Proxifier*
|
|
OpenPipePath=\Device\NamedPipe\proxifier
|
|
DllSkipHook=ws2_32.dll
|
|
|
|
[Template_ProxyCap]
|
|
Tmpl.Title=ProxyCap
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.proxycap.com/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=pcapsvc
|
|
OpenIpcPath=*\BaseNamedObjects*\proxycap_*_event*
|
|
OpenPipePath=\Device\NamedPipe\proxycap_s_pipe
|
|
|
|
[Template_ReHIPS]
|
|
Tmpl.Title=ReHIPS
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=https://rehips.com/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=ReHIPSService
|
|
DenyHostAccess=HIPSAgent64.exe,y
|
|
|
|
[Template_RoboForm]
|
|
Tmpl.Title=RoboForm
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.roboform.com/
|
|
Tmpl.Scan=i
|
|
OpenFilePath=%Tmpl.RoboForm%
|
|
OpenFilePath=%Tmpl.RoboForm%\*
|
|
OpenIpcPath=*\BaseNamedObjects*\{45DB34C3-955C-11D3-ABEF-444553540000}*
|
|
OpenPipePath=\Device\NamedPipe\{9A04C483-2EDC-40CE-B4F9-D9809ADA75E1}
|
|
# ProcessGroup=<StartRunAccess>,identities.exe
|
|
OpenWinClass=RfWatcher333233
|
|
|
|
[Template_SafeEyes]
|
|
Tmpl.Title=Safe Eyes
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.internetsafety.com/safe-eyes-parental-control-software.php
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanWinClass=SE_LSP_MsgSink
|
|
OpenWinClass=ICA_Class
|
|
|
|
[Template_SafeCentral]
|
|
Tmpl.Title=SafeCentral
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.safecentral.com/index.html
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=AuthPluginServer
|
|
OpenPipePath=\Device\NamedPipe\*AuthPluginServer_Pipe
|
|
OpenPipePath=\Device\NamedPipe\*WebAdvisor_IpcPipe
|
|
OpenIpcPath=*\BaseNamedObjects*\LauncherServer*
|
|
OpenIpcPath=*\BaseNamedObjects*\CREATEPROCESS_RESPONCE_EVENT
|
|
|
|
[Template_SafeNet]
|
|
Tmpl.Title=SafeNet Authentication
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.safenet-inc.com/products/data-protection/multi-factor-authentication/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanIpc=*\BaseNamedObjects*\DatakeyTokenServerReadyEvent
|
|
OpenIpcPath=*\BaseNamedObjects*\Datakey*
|
|
|
|
[Template_SiteAdvisor]
|
|
Tmpl.Title=McAfee SiteAdvisor
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.siteadvisor.com/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=McAfee SiteAdvisor Service
|
|
# -- second version: run SiteAdvisor in sandbox
|
|
StartService=McAfee SiteAdvisor Service
|
|
LingerProcess=McSACore.exe
|
|
LingerProcess=McSvHost.exe
|
|
# -- first version: talk to SiteAdvisor outside sandbox
|
|
# Tmpl.Scan=s
|
|
# Tmpl.ScanKey=\REGISTRY\MACHINE\Software\Classes\Clsid\{5A90F5EE-16B8-4C2A-81B3-FD5329BA477C}
|
|
# OpenClsid={5A90F5EE-16B8-4C2A-81B3-FD5329BA477C}
|
|
# OpenClsid={5A90F5EE-16B8-4C2A-81B3-FD5329BA4780}
|
|
# OpenIpcPath=*\BaseNamedObjects*\McSACore_*
|
|
# OpenWinClass=ATL:1009CD70
|
|
# OpenWinClass=ATL:1009DDD8
|
|
|
|
[Template_Super_Socks5Cap]
|
|
Tmpl.Title=Super Socks5Cap / Super Network Tunnel / Ssh Tunnel Easy (LSP + Tunnel All)
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.networktunnel.net/
|
|
# Super Network Tunnel
|
|
OpenIpcPath=*\BaseNamedObjects*\*tunnelapi*
|
|
OpenIpcPath=*\RPC Control\*tunnelapi*
|
|
OpenIpcPath=*\BaseNamedObjects*\*NetworkTunnel*
|
|
OpenIpcPath=*\RPC Control\*NetworkTunnel*
|
|
OpenIpcPath=$:TunnelClient.exe
|
|
OpenIpcPath=$:TunnelClient_Portable.exe
|
|
# Super Socks5cap
|
|
OpenIpcPath=*\RPC Control\*networkdll*
|
|
OpenIpcPath=*\BaseNamedObjects*\*networkdll*
|
|
OpenIpcPath=*\BaseNamedObjects*\*SuperSocks5Cap*
|
|
OpenIpcPath=*\RPC Control\*SuperSocks5Cap*
|
|
OpenIpcPath=$:SuperSocks5Cap.exe
|
|
# Ssh Tunnel Easy
|
|
OpenIpcPath=*\BaseNamedObjects\*SshTunnelEasy*
|
|
OpenIpcPath=*\RPC Control\*SshTunnelEasy*
|
|
OpenIpcPath=$:SshTunnelEasy.exe
|
|
Tmpl.Scan=w
|
|
OpenWinClass=TSetupSocksForm
|
|
|
|
[Template_VipreAntiVirus]
|
|
Tmpl.Title=Vipre Antivirus
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.vipreantivirus.com/Software/VIPRE-Antivirus/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=SBAMSvc
|
|
OpenIpcPath=*\BaseNamedObjects*\SBAM*
|
|
OpenIpcPath=*\BaseNamedObjects*\OEAPI*
|
|
|
|
[Template_WindowsDefender]
|
|
Tmpl.Title=Windows Defender
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.microsoft.com/windows/products/winfamily/defender/default.mspx
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=\RPC Control\MsMp-*
|
|
|
|
[Template_ZoneAlarmSecuritySuite]
|
|
Tmpl.Title=ZoneAlarm Internet Security Toolbar
|
|
Tmpl.Class=Security
|
|
Tmpl.Url=http://www.zonealarm.com/security/en-us/zonealarm-computer-security-suite.htm
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=IswSvc
|
|
OpenPipePath=\Device\NamedPipe\IswSvc
|
|
OpenPipePath=\Device\NamedPipe\IswSessionMin*
|
|
OpenIpcPath=*\BaseNamedObjects*\ISW_WIEC_*
|
|
OpenIpcPath=*\BaseNamedObjects*\ISWUL_*
|
|
OpenIpcPath=*\BaseNamedObjects*\_ISWINTERNAL_*
|
|
OpenIpcPath=*\BaseNamedObjects*\IswSessionMinShared*
|
|
OpenIpcPath=*\BaseNamedObjects*\ISWDMP_*
|
|
|
|
#
|
|
# Desktop Utilities
|
|
#
|
|
|
|
[Template_4tTrayMinimizer]
|
|
Tmpl.Title=4t Tray Minimizer
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.4t-niagara.com/tray.html
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=*\BaseNamedObjects*\ShellEh*.dll
|
|
OpenWinClass=*UtilWindow
|
|
|
|
[Template_7zipShellEx]
|
|
Tmpl.Title=7-Zip Shell Extension
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.7-zip.org/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}
|
|
OpenIpcPath=*\BaseNamedObjects*\7zCompressMapping*
|
|
OpenIpcPath=*\BaseNamedObjects*\7zMap*
|
|
|
|
[Template_ActiveCaptions]
|
|
Tmpl.Title=Active Captions
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.shelltoys.com/minimize_tray/index.html
|
|
Tmpl.Scan=w
|
|
OpenWinClass=ActiveCaptions
|
|
|
|
[Template_ASUS_CapsHook]
|
|
Tmpl.Title=ASUS CapsHook
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://support.asus.com/Download.aspx?SLanguage=en&m=Eee+PC+1015PX&p=20&s=1
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct={4B5092B6-F231-4D18-83BC-2618B729CA45}
|
|
OpenWinClass=$:CapsHook.exe/IgnoreUIPI
|
|
|
|
[Template_AcerGridVista]
|
|
Tmpl.Title=Acer GridVista
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Scan=w
|
|
OpenWinClass=DritekScreenSplitterMainWindowClass
|
|
OpenIpcPath=*\BaseNamedObjects*\Dritek-WindowMessageHooker-FileMappingStamp
|
|
|
|
[Template_ActualWindowManager]
|
|
Tmpl.Title=Actual Tools Actual Window Manager
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.actualtools.com/
|
|
OpenIpcPath=*\BaseNamedObjects*\*_ServiceMapping
|
|
OpenIpcPath=*\BaseNamedObjects*\*_ParamStrings_*
|
|
OpenIpcPath=*\BaseNamedObjects*\MMF{*}
|
|
OpenIpcPath=*\BaseNamedObjects*\ActualTools*
|
|
OpenWinClass=*_MessengerServerWindow
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanIpc=*\BaseNamedObjects*\ActualTools_*
|
|
|
|
[Template_AdFender]
|
|
Tmpl.Title=AdFender
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.adfender.com/
|
|
OpenIpcPath=*\BaseNamedObjects*\AdFenderActive_*
|
|
OpenIpcPath=*\BaseNamedObjects*\AdFenderDisabled_*
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct=AdFender
|
|
|
|
[Template_AdGuard]
|
|
Tmpl.Title=AdGuard (Browser Assistant)
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=https://www.adguard.com/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=Adguard Service
|
|
NormalFilePath=%ProgramData%\Adguard\HostManifests\
|
|
OpenFilePath=Adguard.BrowserExtensionHost.exe,\Device\NamedPipe\????????-????-????-????-????????????
|
|
OpenIpcPath=Adguard.BrowserExtensionHost.exe,*\BaseNamedObjects*\Adguard*
|
|
OpenIpcPath=Adguard.BrowserExtensionHost.exe,*\BaseNamedObjects*\net.pipe:?bmV0LnBpcGU6Ly8rL0FER1VBUkRBUElFTkRQT0lOVC8=
|
|
|
|
[Template_ArumSwitcher]
|
|
Tmpl.Title=Arum Switcher
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.arumswitcher.com/
|
|
OpenIpcPath=*\BaseNamedObjects*\Arum_Switcher_Hook*
|
|
|
|
[Template_Asutype]
|
|
Tmpl.Title=Asutype
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.asutype.com/index.html
|
|
Tmpl.Scan=w
|
|
OpenIpcPath=*\BaseNamedObjects*\fa00000*
|
|
OpenWinClass=*asutype
|
|
|
|
[Template_AutoSizer]
|
|
Tmpl.Title=AutoSizer
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.southbaypc.com/autosizer/
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=*\BaseNamedObjects*\AutoSizer123
|
|
OpenWinClass=SysListView32
|
|
|
|
[Template_Babylon]
|
|
Tmpl.Title=Babylon
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.babylon.com/
|
|
Tmpl.Scan=w
|
|
OpenPipePath=\device\namedpipe\babypipe
|
|
|
|
[Template_BingToolbar]
|
|
Tmpl.Title=Bing Search Toolbar
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.discoverbing.com/toolbar/
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=*\BaseNamedObjects*\ChannelReady_ac620ca9-6743-44d7-b861-e1d5ad76dd2c
|
|
OpenPipePath=\Device\NamedPipe\msn\toolbar*
|
|
|
|
[Template_Bins_Windows7Taskbar]
|
|
Tmpl.Title=Bins for Windows 7 Taskbar
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.1upindustries.com/bins/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct=Bins
|
|
ClosedFilePath=*\TaskbarDockAppIntegration32.dll
|
|
ClosedFilePath=*\TaskbarDockAppIntegration64.dll
|
|
|
|
[Template_BookmarkBuddy]
|
|
Tmpl.Title=Bookmark Buddy
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.bookmarkbuddy.net/
|
|
Tmpl.Scan=w
|
|
OpenWinClass=BMKBUDDY
|
|
|
|
[Template_Chameleon_Window_Manager]
|
|
Tmpl.Title=Chameleon Window Manager
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.chameleon-managers.com/window-manager/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct=Chameleon Window Manager
|
|
OpenIpcPath=*\BaseNamedObjects*\{System-*-*-*-*-*}
|
|
OpenIpcPath=*\BaseNamedObjects*\chameleon*
|
|
|
|
[Template_DialogMate2]
|
|
Tmpl.Title=Dialog Mate 2
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://dm2.sourceforge.net/
|
|
Tmpl.Scan=iw
|
|
OpenIpcPath=*\BaseNamedObjects*\DM2_SharedMem
|
|
OpenIpcPath=*\BaseNamedObjects*\DM2_RollWindow_SharedMem
|
|
OpenWinClass=DM2 Server class
|
|
|
|
[Template_DragonNaturallySpeaking]
|
|
Tmpl.Title=Dragon NaturallySpeaking
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.nuance.com/naturallyspeaking/products/default.asp
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=*\BaseNamedObjects*\Dragon NaturallySpeaking*
|
|
|
|
[Template_FeedDemon]
|
|
Tmpl.Title=FeedDemon
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.feeddemon.com/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct=FeedDemon_is1
|
|
OpenPipePath=FeedDemon.exe,*\FeedDemon\v1\*
|
|
OpenIpcPath=FeedDemon.exe,*\BaseNamedObjects*\FeedDemonMutex
|
|
OpenWinClass=FeedDemon.exe,*
|
|
|
|
[Template_FileEx]
|
|
Tmpl.Title=File-Ex 3
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.cottonwoodsw.com/fx3summ.html
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct=File-Ex v3.*
|
|
OpenWinClass=$:FileEx.exe/IgnoreUIPI
|
|
|
|
[Template_GoogleToolbarIE]
|
|
Tmpl.Title=Google Toolbar for Internet Explorer
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://toolbar.google.com/
|
|
OpenIpcPath=*\BaseNamedObjects*\{40635BCA-4026-4CE3-9741-C8DC476E6268}
|
|
OpenIpcPath=*\BaseNamedObjects*\{B7F1F778-8315-4EB2-AC1E-5AFCAA603271}
|
|
OpenIpcPath=*\BaseNamedObjects*\{DEBFCCE1-B446-4992-9C9E-CA1CB548C718}
|
|
OpenIpcPath=*\BaseNamedObjects*\*{E709AE98-F4E6-40DE-BE47-CFBA9B4605C0}
|
|
OpenWinClass={A7E495BF-9589-4A6E-8479-DDA2D8D3C05F}
|
|
OpenWinClass=$:GoogleToolbarNotifier.exe/IgnoreUIPI
|
|
OpenClsid={FBA44040-BD27-4A09-ACC8-C08B7C723DCD}
|
|
LingerProcess=GoogleToolbarUser.exe
|
|
LingerProcess=GoogleToolbarUser_32.exe
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct={18455581-E099-4BA8-BC6B-F34B2F06600C}
|
|
|
|
[Template_Intel_HD_Graphics]
|
|
Tmpl.Title=Intel HD Graphics Driver
|
|
Tmpl.Class=Desktop
|
|
OpenIpcPath=\RPC Control\{27B4FD7B-035B-4853-938E-CC13FE3724D4}
|
|
OpenIpcPath=*\BaseNamedObjects*\{3BFDD3D2-761C-4206-990C-3CC0643CF73A}
|
|
OpenIpcPath=*\BaseNamedObjects*\?
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanIpc=\RPC Control\{27B4FD7B-035B-4853-938E-CC13FE3724D4}
|
|
|
|
[Template_IntelliTypePro]
|
|
Tmpl.Title=IntelliType Pro
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.microsoft.com/hardware/download/download.aspx?category=MK
|
|
OpenWinClass=TInstanceManager
|
|
|
|
[Template_Folder_Size]
|
|
Tmpl.Title=Folder Size
|
|
Tmpl.Url=http://foldersize.sourceforge.net/
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=FolderSize
|
|
OpenPipePath=\Device\NamedPipe\FolderSize
|
|
OpenIpcPath=*\BaseNamedObjects*\FolderSizeShellUpdateMutex
|
|
|
|
[Template_JetStart]
|
|
Tmpl.Title=JetStart
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.codesector.com/jetstart.php
|
|
Tmpl.Scan=w
|
|
OpenWinClass=MetaLauncher
|
|
OpenIpcPath=*\BaseNamedObjects*\MetaLauncherMapObject*
|
|
|
|
[Template_gMote]
|
|
Tmpl.Title=gMote
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.handform.net/gmote.php
|
|
Tmpl.Scan=w
|
|
OpenWinClass=TGestureConfigForm
|
|
|
|
[Template_GoogleJapaneseIME]
|
|
Tmpl.Title=Google Japanese Input Method (IME)
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.google.com/intl/ja/ime/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=GoogleIMEJaCacheService
|
|
OpenPipePath=\Device\NamedPipe\googlejapaneseinput.*
|
|
LingerProcess=GoogleIMEJaTool.exe
|
|
LingerProcess=GoogleIMEJaRenderer.exe
|
|
|
|
[Template_KeyboardNinja]
|
|
Tmpl.Title=Keyboard Ninja
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.intelife.net/ninja/
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=*\BaseNamedObjects*\KEYBOARD_NINJA_2
|
|
OpenWinClass=$:ninja.exe/IgnoreUIPI
|
|
|
|
[Template_Lingoes]
|
|
Tmpl.Title=Lingoes Translator
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.lingoes.net/
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=*\BaseNamedObjects*\OpenText_ZWFilter_GlobaData*
|
|
OpenIpcPath=*\BaseNamedObjects*\OpenText_GrabText_GlobaData*
|
|
OpenIpcPath=*\BaseNamedObjects*\OpenText_GrabText_Mutex*
|
|
OpenWinClass=$:lingoes.exe/IgnoreUIPI
|
|
|
|
[Template_Linkman]
|
|
Tmpl.Title=Linkman
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.outertech.com/index.php?_charisma_page=product&id=5
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=*\BaseNamedObjects*\Linkman*
|
|
OpenWinClass=TLinkmanF
|
|
OpenWinClass=opera.exe,op*
|
|
OpenWinClass=opera.exe,DDEMLAnsiClient
|
|
|
|
[Template_LinkStash]
|
|
Tmpl.Title=LinkStash
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.xrayz.co.uk/
|
|
Tmpl.Scan=w
|
|
OpenWinClass=LinkStash
|
|
OpenWinClass=LinkStashMonitor
|
|
OpenWinClass=$:lnkstash.exe/IgnoreUIPI
|
|
|
|
[Template_Listary]
|
|
Tmpl.Title=Listary
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=https://www.listary.com/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct=Listary_is1
|
|
OpenWinClass=ListaryToolbarCls
|
|
OpenWinClass=$:listary.exe/IgnoreUIPI
|
|
# v5
|
|
OpenIpcPath=*\BaseNamedObjects*\Listary_MainSharedMemory
|
|
# v6
|
|
OpenIpcPath=*\BaseNamedObjects*\ListaryX_MainSharedMemory
|
|
|
|
[Template_Logitech_G15_Keyboard]
|
|
Tmpl.Title=Logitech Keyboard LCD Display
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=https://support.logi.com/hc/en-us/articles/360024851053--Downloads-G15-Gaming-Keyboard
|
|
# This scan is unreliable and it should be disabled by default
|
|
#Tmpl.Scan=s
|
|
#Tmpl.ScanProduct=Logitech Gaming Software
|
|
OpenPipePath=\Device\NamedPipe\LGLCDPIPE-*
|
|
|
|
[Template_LogitechProcessMonitor]
|
|
Tmpl.Title=Logitech Process Monitor Service
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=LVPrcSrv
|
|
DelayLoadDll=LVPrcInj.dll
|
|
|
|
[Template_LogitechSetPoint]
|
|
Tmpl.Title=Logitech SetPoint Mouse
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=https://www.logitech.com/en-us/articles/11650
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Logitech\SetPoint
|
|
NoRenameWinClass=Internet Explorer_Server
|
|
|
|
[Template_LogitechScrollApp]
|
|
Tmpl.Title=Logitech Scroll App
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=https://www.softpedia.com/get/Tweak/System-Tweak/Scroll-App.shtml
|
|
Tmpl.Scan=w
|
|
OpenWinClass=LogiSmoothScrlBckGrndWnd
|
|
NoRenameWinClass=IEFrame
|
|
OpenIpcPath=*\BaseNamedObjects*\LogiSmoothWheelInUse
|
|
|
|
[Template_MacroExpress]
|
|
Tmpl.Title=Macro Express
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.macroexpress.com
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=*\BaseNamedObjects*\ME98aveR
|
|
OpenIpcPath=*\BaseNamedObjects*\MEBA3KGR
|
|
OpenIpcPath=*\BaseNamedObjects*\me4hml
|
|
OpenIpcPath=*\BaseNamedObjects*\me4hsd
|
|
OpenIpcPath=*\BaseNamedObjects*\me4mmm
|
|
OpenIpcPath=*\BaseNamedObjects*\me4msd
|
|
OpenIpcPath=*\BaseNamedObjects*\me4pml
|
|
OpenIpcPath=*\BaseNamedObjects*\me4esd
|
|
OpenWinClass=TMainWin
|
|
|
|
[Template_ManyCam]
|
|
Tmpl.Title=ManyCam
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.manycam.com/
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=*\BaseNamedObjects*\ManyCam_FileMapping*
|
|
|
|
[Template_Microsoft_MSMQ]
|
|
Tmpl.Title=Microsoft Message Queuing (MSMQ)
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://msdn.microsoft.com/en-us/library/windows/desktop/ms711472%28v=vs.85%29.aspx
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=\RPC Control\QMsvc$*
|
|
|
|
[Template_NTrig_DuoSense]
|
|
Tmpl.Title=N-Trig DuoSense
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.n-trig.com/Content.aspx?Page=DualModeTechnology
|
|
Tmpl.Scan=w
|
|
OpenIpcPath=*\BaseNamedObjects*\ntrignativegesturesmutex
|
|
OpenWinClass=NtrigSessionClient
|
|
|
|
[Template_nVidia_nView]
|
|
Tmpl.Title=nVidia nView
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.nvidia.com/object/nview_display_us.html
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=*\BaseNamedObjects*\nView Shared *
|
|
OpenIpcPath=*\BaseNamedObjects*\nView * Event
|
|
|
|
[Template_nVidia_Stereoscopic3D]
|
|
Tmpl.Title=nVidia Stereoscopic 3D Driver
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.nvidia.com/object/3d-vision-main.html
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=Stereo Service
|
|
OpenPipePath=\Device\NamedPipe\stereosvrpipe
|
|
|
|
[Template_ObjectDock]
|
|
Tmpl.Title=ObjectDock
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.stardock.com/products/objectdock/
|
|
Tmpl.Scan=w
|
|
OpenWinClass=ObjectDockServer
|
|
|
|
[Template_OfficeLicensing]
|
|
Tmpl.Title=Windows and Office Licensing Services
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://office.microsoft.com
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=osppsvc
|
|
# Office 2010
|
|
OpenIpcPath=\RPC Control\OSPPCTransportEndpoint-*
|
|
# Office 2013
|
|
Tmpl.ScanService=sppsvc
|
|
OpenIpcPath=\RPC Control\SPPCTransportEndpoint-*
|
|
# piggyback a fix for Excel
|
|
UseDragDropHack=excel.exe,n
|
|
|
|
[Template_OfficeClickToRun]
|
|
Tmpl.Title=Microsoft Office Click-to-Run
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://office.microsoft.com
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=ClickToRunSvc
|
|
HostInjectDll=\SboxHostDll.dll
|
|
HostInjectDll64=\SboxHostDll.dll
|
|
HostInjectDllARM64=\SboxHostDll.dll
|
|
HostInjectProcess=OfficeClicktoRun.exe|ClickToRunSvc
|
|
OpenIpcPath=\RPC Control\C2RClientAPI_Server_System*
|
|
OpenIpcPath=\RPC Control\ClickToRun_Pipeline*
|
|
OpenIpcPath=\RPC Control\AppV-ISV-*
|
|
BoxNameTitle=EXCEL.EXE,-
|
|
BoxNameTitle=MSACCESS.EXE,-
|
|
BoxNameTitle=MSPUB.EXE,-
|
|
BoxNameTitle=ONENOTE.EXE,-
|
|
BoxNameTitle=OUTLOOK.EXE,-
|
|
BoxNameTitle=POWERPNT.EXE,-
|
|
BoxNameTitle=WINWORD.EXE,-
|
|
|
|
[Template_QQ]
|
|
Tmpl.Title=Tencent QQ
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=https://im.qq.com/pcqq
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct={052CFB79-9D62-42E3-8A15-DE66C2C97C3E}
|
|
NoRenameWinClass=QQ.exe,*
|
|
|
|
[Template_RadeonPro]
|
|
Tmpl.Title=RadeonPro
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://radeonpro.info/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=RadeonPro Support Service
|
|
OpenIpcPath=*\BaseNamedObjects*\_rppmdata
|
|
OpenIpcPath=*\BaseNamedObjects*\__rpapicf
|
|
OpenIpcPath=*\BaseNamedObjects*\__rpssd
|
|
|
|
[Template_RBTray]
|
|
Tmpl.Title=RBTray
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://rbtray.sourceforge.net/
|
|
Tmpl.Scan=w
|
|
OpenWinClass=RBTrayHook
|
|
|
|
[Template_RemoteDesktop]
|
|
Tmpl.Title=Remote Desktop
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=*\BaseNamedObjects*\RDPSound*
|
|
|
|
[Template_RoboType3]
|
|
Tmpl.Title=RoboType 3 (PC Magazine Downloads)
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.pcmag.com/article2/0,2817,427378,00.asp
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Classes\RoboType.document
|
|
OpenWinClass=Afx:400000:b:10003:*
|
|
OpenWinClass=Afx:400000:b:10011:*
|
|
|
|
[Template_RocketDock]
|
|
Tmpl.Title=RocketDock
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://rocketdock.com/
|
|
Tmpl.Scan=iw
|
|
OpenIpcPath=*\BaseNamedObjects*\FdMe
|
|
OpenWinClass=ROCKETDOCK
|
|
|
|
[Template_RTSS]
|
|
Tmpl.Title=Rivatuner Statistics Server
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=https://www.guru3d.com/files-details/rtss-rivatuner-statistics-server-download.html
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct=RTSS
|
|
OpenPipePath=\Device\NamedPipe\rtss_frametime
|
|
OpenIpcPath=*\BaseNamedObjects*\RTSSSharedMemoryV2
|
|
|
|
[Template_ShortKeys]
|
|
Tmpl.Title=ShortKeys (Lite)
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.shortkeys.com
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=*\BaseNamedObjects*\sh02hasd
|
|
OpenIpcPath=*\BaseNamedObjects*\sh03hasd
|
|
OpenIpcPath=*\BaseNamedObjects*\sh02mpas
|
|
OpenIpcPath=*\BaseNamedObjects*\sh03mpas
|
|
OpenWinClass=TMainWin
|
|
|
|
[Template_SnagIt]
|
|
Tmpl.Title=TechSmith SnagIt
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.techsmith.com/
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=*\BaseNamedObjects*\SnagPriv*
|
|
OpenPipePath=\Device\NamedPipe\SnagPriv.*
|
|
|
|
[Template_SrsAudioSandbox]
|
|
Tmpl.Title=SRS Audio Sandbox
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.srslabs.com/store/audioproducts.asp
|
|
OpenIpcPath=*\BaseNamedObjects*\AudioEngineDuplicateHandleApiPort*
|
|
|
|
[Template_StrokeIt]
|
|
Tmpl.Title=StrokeIt
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.tcbmi.com/strokeit/
|
|
Tmpl.Scan=w
|
|
OpenWinClass=StrokeIt
|
|
OpenWinClass=StrokeIt/IgnoreUIPI
|
|
OpenWinClass=#
|
|
|
|
[Template_SynapticsTouchPad]
|
|
Tmpl.Title=Synaptics TouchPad
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.synaptics.com/support/drivers
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Synaptics\SynTP
|
|
NoRenameWinClass=MozillaWindowClass
|
|
|
|
[Template_SystemAudioStream]
|
|
Tmpl.Title=System Audio Stream
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=*\BaseNamedObjects*\System_Audio_Stream_*
|
|
|
|
[Template_TIM]
|
|
Tmpl.Title=Tencent TIM
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=https://office.qq.com/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanProduct=TIM
|
|
NoRenameWinClass=TIM.exe,*
|
|
|
|
[Template_TypingAssistant]
|
|
Tmpl.Title=Typing Assistance
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.sumitsoft.com/
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=*\BaseNamedObjects*\Typing Assistant (*)
|
|
OpenWinClass=$:Typing Assistant (English).exe/IgnoreUIPI
|
|
OpenWinClass=$:Typing Assistant (French).exe/IgnoreUIPI
|
|
OpenWinClass=$:Typing Assistant (German).exe/IgnoreUIPI
|
|
OpenWinClass=$:Typing Assistant (Hungarian).exe/IgnoreUIPI
|
|
OpenWinClass=$:Typing Assistant (Italian).exe/IgnoreUIPI
|
|
OpenWinClass=$:Typing Assistant (Portuguese).exe/IgnoreUIPI
|
|
OpenWinClass=$:Typing Assistant (Spanish).exe/IgnoreUIPI
|
|
|
|
[Template_TwoPilots_SpeedTyping]
|
|
Tmpl.Title=Two Pilots Speed Typing
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.colorpilot.com/speed-typing.html
|
|
Tmpl.Scan=w
|
|
OpenWinClass=TYPEPILOTMAINWND
|
|
|
|
[Template_UltraMon]
|
|
Tmpl.Title=UltraMon
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.realtimesoft.com/de/ultramon/
|
|
Tmpl.Scan=w
|
|
OpenWinClass=UltraMon App
|
|
OpenWinClass=UltraMonWndExtMsg
|
|
|
|
[Template_WacomTablet]
|
|
Tmpl.Title=Wacom Tablet
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.wacom.com/customercare/drivers.aspx
|
|
OpenIpcPath=*\BaseNamedObjects*\Wacom*WintabConnection*
|
|
OpenIpcPath=$:Tablet.exe
|
|
Tmpl.Scan=i
|
|
|
|
[Template_WindowsRasMan]
|
|
Tmpl.Title=Windows Remote Access Connection Manager (dial-up/VPN)
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=\RPC Control\RasManLrpc
|
|
|
|
[Template_VirtuaWin]
|
|
Tmpl.Title=VirtuaWin
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://virtuawin.sourceforge.net/
|
|
Tmpl.Scan=w
|
|
OpenWinClass=VirtuaWinMainClass
|
|
NoAutoExitExplorer=y
|
|
|
|
[Template_Volumouse]
|
|
Tmpl.Title=NirSoft Volumouse
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.nirsoft.net/utils/volumouse.html
|
|
Tmpl.Scan=w
|
|
OpenWinClass=NirSoft_VolumouseMsg*
|
|
|
|
[Template_Weasel]
|
|
Tmpl.Title=Weasel (Rime)
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3F4CDED-B1E9-41EE-9CA6-7B4D0DE6CB0A}
|
|
OpenPipePath=\Device\NamedPipe\%user%\WeaselNamedPipe
|
|
ReadFilePath=%LocalAppData%\Microsoft\Windows\Fonts
|
|
|
|
[Template_WindowsLive]
|
|
Tmpl.Title=Windows Live
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.live.com
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanService=wlidsvc
|
|
OpenIpcPath=\RPC Control\LiveIdSvc
|
|
ClosedFilePath=%SystemRoot%\System32\IDStore.dll
|
|
ClosedFilePath=%SystemRoot%\System32\wlidprov.dll
|
|
ClosedKeyPath=\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\NetworkServiceTriggers\Triggers\bc90d167-9470-4139-a9ba-be0bbbf5b74d\CC105610-DA03-467E-BC73-5B9E2937458D
|
|
|
|
[Template_WindowBlinds]
|
|
Tmpl.Title=WindowBlinds
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.stardock.com/products/windowblinds/
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanKey=\REGISTRY\MACHINE\Software\Stardock\WindowBlinds
|
|
OpenPipePath=\Device\NamedPipe\WBServer*
|
|
OpenIpcPath=*\BaseNamedObjects*\WB_WAIT
|
|
|
|
[Template_ZoomText]
|
|
Tmpl.Title=ZoomText
|
|
Tmpl.Class=Desktop
|
|
Tmpl.Url=http://www.synapseadaptive.com/aisquared/zoomtext_9/zoomtext_9_home_page.htm
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=*\BaseNamedObjects*\AH_XMSAA_*
|
|
OpenIpcPath=*\BaseNamedObjects*\ZSMEscapeKeyEvent
|
|
OpenIpcPath=*\BaseNamedObjects*\Ai2_HOOKDATA_FILEMAP*
|
|
OpenIpcPath=*\BaseNamedObjects*\ZoomTextRunning*
|
|
OpenWinClass=ZT9MainWindow
|
|
|
|
#
|
|
# Media Players
|
|
#
|
|
|
|
[Template_VLC_Force]
|
|
Tmpl.Title=#4323,VLC
|
|
Tmpl.Class=MediaPlayer
|
|
ForceProcess=vlc.exe
|
|
|
|
[Template_VLC_DirectAccess_Profile]
|
|
Tmpl.Title=#4338,VLC
|
|
Tmpl.Class=MediaPlayer
|
|
OpenFilePath=vlc.exe,%AppData%\vlc\*
|
|
|
|
[Template_VLC_DirectAccess_Photos]
|
|
Tmpl.Title=#4395,VLC
|
|
Tmpl.Class=MediaPlayer
|
|
OpenFilePath=vlc.exe,%UserProfile%\Pictures\*
|
|
|
|
[Template_MPC-HC_Force]
|
|
Tmpl.Title=#4323,MPC-HC
|
|
Tmpl.Class=MediaPlayer
|
|
ForceProcess=mpc-hc64.exe
|
|
ForceProcess=mpc-hc.exe
|
|
|
|
[Template_MPC-HC_DirectAccess_Profile]
|
|
Tmpl.Title=#4338,MPC-HC
|
|
Tmpl.Class=MediaPlayer
|
|
OpenFilePath=mpc-hc64.exe,%AppData%\MPC-HC\*
|
|
OpenFilePath=mpc-hc.exe,%AppData%\MPC-HC\*
|
|
|
|
[Template_MPC-HC_DirectAccess_Photos]
|
|
Tmpl.Title=#4395,MPC-HC
|
|
Tmpl.Class=MediaPlayer
|
|
OpenFilePath=mpc-hc64.exe,%UserProfile%\Pictures\*
|
|
OpenFilePath=mpc-hc.exe,%UserProfile%\Pictures\*
|
|
|
|
[Template_MPC-BE_Force]
|
|
Tmpl.Title=#4323,MPC-BE
|
|
Tmpl.Class=MediaPlayer
|
|
ForceProcess=mpc-be64.exe
|
|
ForceProcess=mpc-be.exe
|
|
NoRenameWinClass=MPC-BE
|
|
|
|
[Template_MPC-BE_DirectAccess_Profile]
|
|
Tmpl.Title=#4338,MPC-BE
|
|
Tmpl.Class=MediaPlayer
|
|
OpenFilePath=mpc-be64.exe,%AppData%\MPC-BE\*
|
|
OpenFilePath=mpc-be.exe,%AppData%\MPC-BE\*
|
|
|
|
[Template_MPC-BE_DirectAccess_Photos]
|
|
Tmpl.Title=#4395,MPC-BE
|
|
Tmpl.Class=MediaPlayer
|
|
OpenFilePath=mpc-be64.exe,%UserProfile%\Pictures\*
|
|
OpenFilePath=mpc-be.exe,%UserProfile%\Pictures\*
|
|
|
|
[Template_PotPlayer_Force]
|
|
Tmpl.Title=#4323,PotPlayer
|
|
Tmpl.Class=MediaPlayer
|
|
ForceProcess=PotPlayerMini64.exe
|
|
ForceProcess=PotPlayerMini.exe
|
|
|
|
[Template_PotPlayer_DirectAccess_Profile]
|
|
Tmpl.Title=#4338,PotPlayer
|
|
Tmpl.Class=MediaPlayer
|
|
OpenFilePath=PotPlayerMini64.exe,%AppData%\PotPlayerMini64
|
|
OpenFilePath=PotPlayerMini.exe,%AppData%\PotPlayerMini
|
|
|
|
[Template_SMPlayer_Force]
|
|
Tmpl.Title=#4323,SMPlayer
|
|
Tmpl.Class=MediaPlayer
|
|
ForceProcess=smplayer.exe
|
|
|
|
[Template_SMPlayer_DirectAccess_Profile]
|
|
Tmpl.Title=#4338,SMPlayer
|
|
Tmpl.Class=MediaPlayer
|
|
OpenFilePath=smplayer.exe,%AppData%\mpv\*
|
|
|
|
[Template_SMPlayer_DirectAccess_Photos]
|
|
Tmpl.Title=#4395,SMPlayer
|
|
Tmpl.Class=MediaPlayer
|
|
OpenFilePath=smplayer.exe,%UserProfile%\Pictures\smplayer_screenshots
|
|
OpenFilePath=smplayer.exe,%UserProfile%\Pictures\smplayer_screenshots
|
|
|
|
[Template_KMPlayer_Force]
|
|
Tmpl.Title=#4323,KMPlayer
|
|
Tmpl.Class=MediaPlayer
|
|
ForceProcess=KMPlayer64.exe
|
|
ForceProcess=KMPlayer.exe
|
|
|
|
[Template_KMPlayer_DirectAccess_Profile]
|
|
Tmpl.Title=#4338,KMPlayer
|
|
Tmpl.Class=MediaPlayer
|
|
OpenFilePath=KMPlayer64.exe,%AppData%\KMP
|
|
OpenFilePath=KMPlayer.exe,%AppData%\KMP
|
|
|
|
[Template_Clementine_Force]
|
|
Tmpl.Title=#4323,Clementine
|
|
Tmpl.Class=MediaPlayer
|
|
ForceProcess=clementine.exe
|
|
|
|
[Template_Clementine_DirectAccess_Profile]
|
|
Tmpl.Title=#4338,Clementine
|
|
Tmpl.Class=MediaPlayer
|
|
OpenFilePath=clementine.exe,%UserProfile%\current\.config\Clementine\*
|
|
|
|
[Template_Clementine_DirectAccess_Music]
|
|
Tmpl.Title=#4398,Clementine
|
|
Tmpl.Class=MediaPlayer
|
|
OpenFilePath=clementine.exe,%UserProfile%\Music\*
|
|
|
|
[Template_Strawberry_Force]
|
|
Tmpl.Title=#4323,Strawberry Music Player
|
|
Tmpl.Class=MediaPlayer
|
|
ForceProcess=strawberry.exe
|
|
|
|
[Template_Strawberry_DirectAccess_Profile]
|
|
Tmpl.Title=#4338,Strawberry Music Player
|
|
Tmpl.Class=MediaPlayer
|
|
OpenFilePath=strawberry.exe,%Local AppData%\Strawberry
|
|
|
|
[Template_Strawberry_DirectAccess_Music]
|
|
Tmpl.Title=#4398,Strawberry Music Player
|
|
Tmpl.Class=MediaPlayer
|
|
OpenFilePath=strawberry.exe,%UserProfile%\Music\*
|
|
|
|
#
|
|
# Torrent Clients
|
|
#
|
|
|
|
[Template_qBittorrent_Force]
|
|
Tmpl.Title=#4323,qBittorrent
|
|
Tmpl.Class=TorrentClient
|
|
ForceProcess=qBittorrent.exe
|
|
|
|
[Template_qBittorrent_DirectAccess_Profile]
|
|
Tmpl.Title=#4338,qBittorrent
|
|
Tmpl.Class=TorrentClient
|
|
OpenFilePath=qBittorrent.exe,%Local AppData%\qBittorrent
|
|
OpenFilePath=qBittorrent.exe,%AppData%\qBittorrent
|
|
|
|
[Template_Transmission_Force]
|
|
Tmpl.Title=#4323,Transmission
|
|
Tmpl.Class=TorrentClient
|
|
ForceProcess=transmission-qt.exe
|
|
|
|
[Template_Transmission_DirectAccess_Profile]
|
|
Tmpl.Title=#4338,Transmission
|
|
Tmpl.Class=TorrentClient
|
|
OpenFilePath=transmission-qt.exe,%Local AppData%\transmission
|
|
|
|
[Template_BiglyBT_Force]
|
|
Tmpl.Title=#4323,BiglyBT
|
|
Tmpl.Class=TorrentClient
|
|
ForceProcess=BiglyBT.exe
|
|
|
|
[Template_BiglyBT_DirectAccess_Profile]
|
|
Tmpl.Title=#4338,BiglyBT
|
|
Tmpl.Class=TorrentClient
|
|
OpenFilePath=BiglyBT.exe,%AppData%\BiglyBT
|
|
|
|
[Template_Popcorn-Time_Force]
|
|
Tmpl.Title=#4323,Popcorn Time (popcorntime.app)
|
|
Tmpl.Class=TorrentClient
|
|
ForceProcess=Popcorn-Time.exe
|
|
|
|
[Template_Popcorn-Time_DirectAccess_Profile]
|
|
Tmpl.Title=#4338,Popcorn Time (popcorntime.app)
|
|
Tmpl.Class=TorrentClient
|
|
OpenFilePath=Popcorn-Time.exe,%Local AppData%\popcorn-time
|
|
|
|
[Template_PicoTorrent_Force]
|
|
Tmpl.Title=#4323,Pico Torrent
|
|
Tmpl.Class=TorrentClient
|
|
ForceProcess=PicoTorrent.exe
|
|
ForceRestart=PicoTorrent.exe
|
|
|
|
#
|
|
# Download Managers
|
|
#
|
|
|
|
|
|
[Template_FreeDownloadManager]
|
|
Tmpl.Title=Free Download Manager
|
|
Tmpl.Class=Download
|
|
Tmpl.Url=http://www.freedownloadmanager.org/
|
|
RpcMgmtSetComTimeout=fdm.exe,y
|
|
|
|
[Template_SothinkWebVideoDownloader]
|
|
Tmpl.Title=Sothink Web Video Downloader Stand-alone
|
|
Tmpl.Class=Download
|
|
Tmpl.Url=http://www.sothinkmedia.com/web-video-downloader/
|
|
Tmpl.Scan=w
|
|
OpenWinClass=WVD_Class
|
|
OpenIpcPath=$:VideoDownloader.exe
|
|
|
|
[Template_OrbitDownloader]
|
|
Tmpl.Title=Orbit Downloader
|
|
Tmpl.Class=Download
|
|
Tmpl.Url=http://www.orbitdownloader.com
|
|
Tmpl.Scan=w
|
|
OpenIpcPath=*\BaseNamedObjects*\GRABPRO_WEBSITEMUTEX_*
|
|
OpenIpcPath=*\BaseNamedObjects*\orbitcth_ipc*
|
|
OpenIpcPath=*\BaseNamedObjects*\orbitdm_app*
|
|
OpenIpcPath=*\BaseNamedObjects*\ORBTPROS_APP
|
|
OpenWinClass=ORBTPROS_APP
|
|
OpenWinClass=orbitdm_app
|
|
|
|
[Template_Replay_Music]
|
|
Tmpl.Title=Applian Replay Music
|
|
Tmpl.Class=Download
|
|
Tmpl.Url=http://www.applian.com/replay-music/index.php
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=*\BaseNamedObjects*\{034DBD6D-6784-4CB3-97D8-749947D01F70}
|
|
OpenIpcPath=*\BaseNamedObjects*\{3EA1EB13-8045-44FC-AD59-B4F05478B400}
|
|
OpenIpcPath=*\BaseNamedObjects*\{6560EAD3-F709-4B66-B90B-EA2D2C85AE30}
|
|
OpenIpcPath=*\BaseNamedObjects*\{F22F2429-009C-4B5D-959F-519B59E25170}
|
|
|
|
[Template_Replay_Media_Catcher]
|
|
Tmpl.Title=Applian Replay Media Catcher
|
|
Tmpl.Class=Download
|
|
Tmpl.Url=http://www.applian.com/download-videos/
|
|
Tmpl.Scan=i
|
|
OpenIpcPath=*\BaseNamedObjects*\{F22F2429-009C-4B5D-959F-519B59E25176}
|
|
OpenIpcPath=*\BaseNamedObjects*\{6560EAD3-F709-4B66-B90B-EA2D2C85AE3B}
|
|
OpenIpcPath=*\BaseNamedObjects*\{3EA1EB13-8045-44FC-AD59-B4F05478B40D}
|
|
OpenIpcPath=*\BaseNamedObjects*\{034DBD6D-6784-4CB3-97D8-749947D01F72}
|
|
|
|
#
|
|
# Other
|
|
#
|
|
|
|
[Template_ScreenReader]
|
|
Tmpl.Title=#4305,JAWS, NVDA, Window-Eyes, System Access
|
|
Tmpl.Class=Misc
|
|
# Tmpl.Scan=i
|
|
Tmpl.Hide=y
|
|
OpenIpcPath=\RPC Control\epmapper
|
|
OpenIpcPath=\RPC Control\OLE*
|
|
OpenIpcPath=\RPC Control\LRPC*
|
|
OpenIpcPath=*\BaseNamedObjects*\JAWS*
|
|
OpenIpcPath=*\BaseNamedObjects*\JFW*
|
|
OpenIpcPath=*\BaseNamedObjects*\GWM*
|
|
OpenIpcPath=*\BaseNamedObjects*\GWSync*
|
|
OpenIpcPath=*\BaseNamedObjects*\GWSync*
|
|
OpenIpcPath=*\BaseNamedObjects*\FS_CACHED_MSAA_DATA_MUTEX
|
|
OpenIpcPath=*\BaseNamedObjects*\FS_FSDOM_LOADER_MUTEX
|
|
OpenIpcPath=*\BaseNamedObjects*\SharedFSDomLoaderData*
|
|
OpenIpcPath=\RPC Control\nvdaHelperRemote_*
|
|
OpenIpcPath=*\BaseNamedObjects*\Serotek-*
|
|
OpenWinClass=*
|
|
|
|
# [Template_PlugPlayService]
|
|
# Tmpl.Title=#3938
|
|
# Tmpl.Class=Misc
|
|
# OpenIpcPath=\RPC Control\plugplay
|
|
# OpenIpcPath=\RPC Control\ntsvcs
|
|
|
|
[Template_TaskbarJumpList]
|
|
Tmpl.Title=#4294
|
|
Tmpl.Class=Misc
|
|
OpenPipePath=%Recent%\AutomaticDestinations\*
|
|
OpenPipePath=%Recent%\CustomDestinations\*
|
|
|
|
[Template_ActivIdentity]
|
|
Tmpl.Title=ActivIdentity (CAC)
|
|
Tmpl.Url=https://www.hidglobal.com/identity-management
|
|
Tmpl.Class=Security
|
|
Tmpl.Scan=s
|
|
Tmpl.ScanKey=\REGISTRY\MACHINE\SOFTWARE\ActivCard
|
|
OpenClsid={5E248397-8614-4EC5-8926-BD242DC9830A}
|
|
OpenClsid={30E5C61A-E359-498B-B833-1FB56CCDDCE2}
|
|
OpenClsid={884E2007-217D-11DA-B2A4-000E7BBB2B09}
|
|
OpenClsid={8BF9A910-A8FF-457F-999F-A5CA10B4A885}
|
|
OpenIpcPath=\RPC Control\LSMApi
|
|
OpenIpcPath=\RPC Control\samss lpc
|
|
OpenIpcPath=*\BaseNamedObjects*\Microsoft Smart Card Resource Manager*
|
|
|
|
[Template_Yubikey]
|
|
Tmpl.Title=Yubikey Authentication
|
|
Tmpl.Class=Security
|
|
OpenIpcPath=\RPC Control\keysvc
|
|
|
|
[Template_SymantecEP]
|
|
Tmpl.Title=Symantec Endpoint Protection
|
|
Tmpl.Class=Security
|
|
Tmpl.Scan=s
|
|
Tmpl.Url=http://www.broadcom.com/
|
|
Tmpl.ScanProduct={AB2C803C-5D82-4D6A-AC6A-5A7357D8B2F9}
|
|
NormalFilePath=*\sysfer.dll
|
|
|
|
[Template_Chrome_KB5027231_fix]
|
|
Tmpl.Title=Chromium fix for Windows 11 with KB5027231
|
|
Tmpl.Class=WebBrowser
|
|
#Tmpl.Scan=u
|
|
#Tmpl.ScanUpd=KB5027231
|
|
Tmpl.ScanScript=if(system.version().major != 11) return false; return system.checkUpdates("KB5027231");
|
|
ClosedKeyPath=<Template_Chromes>,HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice
|
|
ClosedKeyPath=<Template_Chromes>,HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice
|
|
ProcessGroup=<Template_Chromes>,chrome.exe
|
|
|
|
|
|
|
|
|
|
|
|
#
|
|
# Default settings
|
|
#
|
|
|
|
[Template_AutoRecoverIgnore]
|
|
Tmpl.Title=#4291
|
|
Tmpl.Class=Misc
|
|
AutoRecoverIgnore=.part
|
|
AutoRecoverIgnore=.jc!
|
|
AutoRecoverIgnore=.leechget
|
|
AutoRecoverIgnore=.dlm
|
|
AutoRecoverIgnore=.tmp
|
|
AutoRecoverIgnore=.download
|
|
AutoRecoverIgnore=.dtapart
|
|
AutoRecoverIgnore=.crdownload
|
|
AutoRecoverIgnore=.crx
|
|
AutoRecoverIgnore=.ob!
|
|
AutoRecoverIgnore=.partial
|
|
AutoRecoverIgnore=.!ut
|
|
AutoRecoverIgnore=.lnk
|
|
AutoRecoverIgnore=desktop.ini
|
|
AutoRecoverIgnore=.opdownload
|
|
|
|
[Template_LingerPrograms]
|
|
Tmpl.Title=#4292
|
|
Tmpl.Class=Misc
|
|
LingerProcess=mscorsvw.exe
|
|
LingerProcess=AcroRd32.exe
|
|
LingerProcess=Adobe_Updater.exe
|
|
LingerProcess=JUSched.exe
|
|
LingerProcess=SynCor.exe
|
|
LingerProcess=GoogleUpdate.exe
|
|
LingerProcess=GoogleToolbarNotifier.exe
|
|
LingerProcess=RunDll32.exe
|
|
LingerProcess=RealSched.exe
|
|
LingerProcess=wisptis.exe
|
|
LingerProcess=CS5ServiceManager.exe
|
|
LingerProcess=AcrobatInfo.exe
|
|
LingerProcess=IeLowUtil.exe
|
|
LingerProcess=DllHost.exe
|
|
LingerProcess=SplWow64.exe
|
|
LingerProcess=nacl.exe
|
|
LingerProcess=nacl64.exe
|
|
LingerProcess=pdf24.exe
|
|
LingerProcess=RuntimeBroker.exe
|
|
LingerProcess=ssh-agent.exe
|
|
# Vivaldi Updater
|
|
LingerProcess=update_notifier.exe
|
|
# Firefox telemetry process
|
|
LingerProcess=pingsender.exe
|
|
# Chrome telemetry process
|
|
LingerProcess=software_reporter_tool.exe
|
|
# Opera background processes
|
|
LingerProcess=opera_crashreporter.exe
|
|
LingerProcess=opera_autoupdate.exe
|
|
|
|
[Template_BlockPorts]
|
|
Tmpl.Title=#4293
|
|
Tmpl.Class=Misc
|
|
#BlockPort=137,138,139,445
|
|
NetworkAccess=*,Block;Port=137,138,139,445
|
|
|
|
[Template_BlockDNS]
|
|
Tmpl.Title=Block DNS
|
|
Tmpl.Class=Misc
|
|
NetworkAccess=*,Block;Port=53;Protocol=UDP
|
|
|
|
[Template_BlockTelemetry]
|
|
Tmpl.Title=#4307
|
|
Tmpl.Class=Misc
|
|
# Block Firefox telemetry process
|
|
ClosedFilePath=pingsender.exe
|
|
# Block Chrome telemetry process
|
|
ClosedFilePath=software_reporter_tool.exe
|
|
# Block Opera telemetry process
|
|
ClosedFilePath=opera_crashreporter.exe
|
|
|
|
[Template_qWave]
|
|
Tmpl.Title=#3459
|
|
Tmpl.Class=Misc
|
|
OpenPipePath=\Device\QWAVEdrv
|
|
|
|
[Template_SkipHook]
|
|
Tmpl.Title=#3460
|
|
Tmpl.Class=Misc
|
|
SkipHook=DragonSaga.exe,ntqsi,enumwin,findwin
|
|
SkipHook=BatmanAC.exe,enumwin,findwin
|
|
SkipHook=PotPlayer64.exe,cocreate
|
|
SkipHook=PotPlayerMini64.exe,cocreate
|
|
SkipHook=mpc-hc64.exe,cocreate
|
|
|
|
[Template_FileCopy]
|
|
Tmpl.Title=#4295
|
|
Tmpl.Class=Misc
|
|
DontCopy=*.url
|
|
CopyEmpty=*\microsoft\windows\explorer\thumbcache_*
|
|
CopyEmpty=*\microsoft\windows\explorer\iconcache_*
|
|
# firefox
|
|
CopyAlways=*\places.sqlite
|
|
CopyAlways=*\xul.mfl
|
|
# windows installer etc
|
|
CopyAlways=*\qmgr0.dat
|
|
CopyAlways=*\qmgr1.dat
|
|
CopyAlways=*\infcache.1
|
|
CopyAlways=*\cbs.log
|
|
# internet explorer 10 web cache
|
|
CopyAlways=*\webcachev*.dat
|
|
# Media Players
|
|
DontCopy=*.aac
|
|
DontCopy=*.ac3
|
|
DontCopy=*.aiff
|
|
DontCopy=*.ape
|
|
DontCopy=*.asf
|
|
DontCopy=*.avi
|
|
DontCopy=*.f4v
|
|
DontCopy=*.flac
|
|
DontCopy=*.flv
|
|
DontCopy=*.m4a
|
|
DontCopy=*.m4v
|
|
DontCopy=*.mid
|
|
DontCopy=*.mka
|
|
DontCopy=*.mkv
|
|
DontCopy=*.mov
|
|
DontCopy=*.mp3
|
|
DontCopy=*.mp4
|
|
DontCopy=*.mpeg
|
|
DontCopy=*.mpg
|
|
DontCopy=*.oga
|
|
DontCopy=*.ogg
|
|
DontCopy=*.ogv
|
|
DontCopy=*.opus
|
|
DontCopy=*.ra
|
|
DontCopy=*.rm
|
|
DontCopy=*.rmvb
|
|
#DontCopy=*.ts
|
|
DontCopy=*.vob
|
|
DontCopy=*.wav
|
|
DontCopy=*.webm
|
|
DontCopy=*.wma
|
|
DontCopy=*.wmv
|
|
|
|
[Template_RpcPortBindings]
|
|
Tmpl.Title=#4296
|
|
Tmpl.Class=Misc
|
|
#Tmpl.Scan=s
|
|
#Tmpl.ScanService=RpcSs
|
|
#Tmpl.ScanService=RpcEptMapper
|
|
#Tmpl.ScanService=DcomLaunch
|
|
|
|
# hardcoded options:
|
|
#RpcPortBinding=*,{906B0CE0-C70B-1067-B317-00DD010662DA},IpcPort="samss lpc"
|
|
#RpcPortBinding=winspool.drv,'ncalrpc:[,Security=Impersonation Dynamic False]',Resolve=PrintSpooler
|
|
#RpcPortBindingSvc=Spooler,PrintSpooler
|
|
|
|
|
|
# AppInfo
|
|
RpcPortBinding=kernel32.dll,'0497b57d-2e66-424f-a0c6-157cd5d41700@ncalrpc:',Resolve=AppInfo,TimeOut=y
|
|
RpcPortBindingIfId=AppInfo,{0497b57d-2e66-424f-a0c6-157cd5d41700}
|
|
#RpcPortBindingSvc=AppInfo,appinfo
|
|
|
|
# AppInfo for Store Apps
|
|
RpcPortBinding=apisethost.appexecutionalias.dll,'0497b57d-2e66-424f-a0c6-157cd5d41700@ncalrpc:',Resolve=AppInfo,TimeOut=n
|
|
|
|
|
|
# RpcMgmtSetComTimeout presets
|
|
#UseRpcMgmtSetComTimeout=AppXDeploymentClient.dll,y
|
|
UseRpcMgmtSetComTimeout=WINNSI.DLL,n
|
|
|
|
# windows proxy auto discovery
|
|
#Tmpl.ScanService=WinHttpAutoProxySvc
|
|
RpcPortBinding=WinHttp.dll,'ncalrpc:',Resolve=WPAD,TimeOut=y
|
|
RpcPortBindingSvc=WPAD,WinHttpAutoProxySvc
|
|
|
|
# windows 10 game port
|
|
#Tmpl.ScanService=???
|
|
RpcPortBinding=resourcepolicyclient.dll,{00000000-0000-0000-0000-000000000000},Resolve=GamePort
|
|
RpcPortBindingIfId=GamePort,{88ABCBC3-34EA-76AE-8215-767520655A23}
|
|
|
|
# windows 11 NLA
|
|
RpcPortBinding=nlansp_c.dll,'ncalrpc:',Resolve=NetworkProfiles,TimeOut=y
|
|
RpcPortBindingIfId=NetworkProfiles,{3F787932-3452-4363-8651-6EA97BB373BB}
|
|
#RpcPortBindingSvc=NetworkProfiles,netprofm
|
|
|
|
|
|
[Template_NoUACProxy]
|
|
Tmpl.Title=#4306
|
|
Tmpl.Class=Misc
|
|
NoUACProxy=y
|
|
|
|
#UAC for compartment Mode Win10
|
|
RpcPortBinding=windows.storage.dll,'201ef99a-7fa0-444c-9399-19ba84f12a1a@ncalrpc:',Resolve=UAC,TimeOut=n
|
|
RpcPortBindingIfId=UAC,{201EF99A-7FA0-444C-9399-19BA84F12A1A}
|
|
|
|
#UAC for compartment Mode Win7
|
|
RpcPortBinding=SHELL32.dll,'201ef99a-7fa0-444c-9399-19ba84f12a1a@ncalrpc:',IpcPort=senssvc,TimeOut=n
|
|
|
|
|
|
|
|
#
|
|
# COM/RPC Presets
|
|
#
|
|
|
|
[Template_OpenCOM]
|
|
OpenIpcPath=*\BaseNamedObjects*\__ComCatalogCache__
|
|
OpenIpcPath=\RPC Control\epmapper
|
|
OpenIpcPath=\RPC Control\OLE*
|
|
OpenIpcPath=\RPC Control\LRPC*
|
|
|
|
[Template_BoxedCOM]
|
|
NormalIpcPath=*BaseNamedObjects*\__ComCatalogCache__
|
|
NormalIpcPath=*BaseNamedObjects*\ComPlusCOMRegTable
|
|
NormalIpcPath=*BaseNamedObjects*\RotHintTable
|
|
NormalIpcPath=*BaseNamedObjects*\{A3BD3259-3E4F-428a-84C8-F0463A9D3EB5}
|
|
NormalIpcPath=*BaseNamedObjects*\{A64C7F33-DA35-459b-96CA-63B51FB0CDB9}
|
|
NormalIpcPath=\RPC Control\actkernel
|
|
NormalIpcPath=\RPC Control\epmapper
|
|
NormalIpcPath=\RPC Control\OLE*
|
|
NormalIpcPath=\RPC Control\LRPC*
|
|
|
|
|
|
|
|
#
|
|
# Optional RPC Port Config
|
|
#
|
|
|
|
[Template_RpcPortBindingsExt]
|
|
Tmpl.Title=#4300
|
|
Tmpl.Class=Misc
|
|
|
|
# NSI
|
|
RpcPortBinding=WINNSI.DLL,'ncalrpc:[,Security=Impersonation Dynamic True]',Resolve=NSI,TimeOut=n
|
|
RpcPortBindingIfId=NSI,{7ea70bcf-48af-4f6a-8968-6a440754d5fa}
|
|
#RpcPortBindingSvc=NSI,nsi
|
|
|
|
|
|
[Template_OpenBluetooth]
|
|
Tmpl.Title=#4297
|
|
Tmpl.Class=Misc
|
|
#bluetooth
|
|
RpcPortBinding=BluetoothApis.dll,'ncalrpc:',Resolve=Bluetooth,TimeOut=y
|
|
RpcPortBindingIfId=Bluetooth,{2ACB9D68-B434-4B3E-B966-E06B4B3A84CB}
|
|
#RpcPortBindingSvc=Bluetooth,bthserv
|
|
|
|
[Template_OpenSmartCard]
|
|
Tmpl.Title=#4298
|
|
Tmpl.Class=Misc
|
|
#smartcard
|
|
RpcPortBinding=WinSCard.dll,{00000000-0000-0000-0000-000000000000},Resolve=SmartCard
|
|
RpcPortBindingIfId=SmartCard,{C6B5235A-E413-481D-9AC8-31681B1FAAF5}
|
|
|
|
[Template_SSDP]
|
|
Tmpl.Title=#4299
|
|
Tmpl.Class=Misc
|
|
#upnp
|
|
#Tmpl.ScanService=ssdpsrv
|
|
RpcPortBinding=SSDPAPI.dll,'ncalrpc:',Resolve=SSDP
|
|
RpcPortBindingIfId=SSDP,{4B112204-0E19-11D3-B42B-0000F81FEB9F}
|
|
#RpcPortBindingSvc=SSDP,ssdpsrv
|
|
|
|
|
|
|
|
[SysCallPresets]
|
|
|
|
#
|
|
# disabled hooks
|
|
#
|
|
|
|
DisableWinNtHook=MapViewOfSection
|
|
DisableWinNtHook=YieldExecution
|
|
|
|
# CallEnclave causes a BSOD when kernel stack protection is enabled
|
|
|
|
DisableWinNtHook=CreateEnclave
|
|
DisableWinNtHook=LoadEnclaveData
|
|
DisableWinNtHook=InitializeEnclave
|
|
DisableWinNtHook=CallEnclave
|
|
DisableWinNtHook=TerminateEnclave
|
|
|
|
# filtered system calls not allowed
|
|
|
|
#DisableWinNtHook=CreatePagingFile
|
|
|
|
|
|
#
|
|
# approved system calls for Security Hardened sandboxes
|
|
#
|
|
|
|
# system calls filtered by driver
|
|
|
|
ApproveWinNtSysCall=OpenFile
|
|
ApproveWinNtSysCall=CreateFile
|
|
ApproveWinNtSysCall=CreateMailslotFile
|
|
ApproveWinNtSysCall=CreateNamedPipeFile
|
|
|
|
ApproveWinNtSysCall=ConnectPort
|
|
ApproveWinNtSysCall=SecureConnectPort
|
|
ApproveWinNtSysCall=CreatePort
|
|
ApproveWinNtSysCall=AlpcConnectPort
|
|
ApproveWinNtSysCall=AlpcConnectPortEx
|
|
ApproveWinNtSysCall=AlpcCreatePort
|
|
ApproveWinNtSysCall=ImpersonateClientOfPort
|
|
ApproveWinNtSysCall=AlpcImpersonateClientOfPort
|
|
ApproveWinNtSysCall=RequestPort
|
|
ApproveWinNtSysCall=RequestWaitReplyPort
|
|
ApproveWinNtSysCall=AlpcSendWaitReceivePort
|
|
|
|
ApproveWinNtSysCall=OpenEvent
|
|
ApproveWinNtSysCall=CreateEvent
|
|
ApproveWinNtSysCall=OpenEventPair
|
|
ApproveWinNtSysCall=CreateEventPair
|
|
ApproveWinNtSysCall=OpenKeyedEvent
|
|
ApproveWinNtSysCall=CreateKeyedEvent
|
|
ApproveWinNtSysCall=OpenMutant
|
|
ApproveWinNtSysCall=CreateMutant
|
|
ApproveWinNtSysCall=OpenSemaphore
|
|
ApproveWinNtSysCall=CreateSemaphore
|
|
ApproveWinNtSysCall=OpenSection
|
|
ApproveWinNtSysCall=CreateSection
|
|
ApproveWinNtSysCall=CreateSectionEx
|
|
ApproveWinNtSysCall=OpenJobObject
|
|
ApproveWinNtSysCall=CreateJobObject
|
|
ApproveWinNtSysCall=CreateSymbolicLinkObject
|
|
ApproveWinNtSysCall=OpenSymbolicLinkObject
|
|
ApproveWinNtSysCall=CreateDirectoryObject
|
|
ApproveWinNtSysCall=CreateDirectoryObjectEx
|
|
ApproveWinNtSysCall=OpenDirectoryObject
|
|
|
|
ApproveWinNtSysCall=DuplicateObject
|
|
ApproveWinNtSysCall=GetNextProcess
|
|
ApproveWinNtSysCall=GetNextThread
|
|
ApproveWinNtSysCall=DeviceIoControlFile
|
|
#ApproveWinNtSysCall=FsControlFile
|
|
ApproveWinNtSysCall=QuerySystemInformation
|
|
|
|
ApproveWinNtSysCall=OpenProcessToken
|
|
ApproveWinNtSysCall=OpenProcessTokenEx
|
|
ApproveWinNtSysCall=OpenThreadToken
|
|
ApproveWinNtSysCall=OpenThreadTokenEx
|
|
ApproveWinNtSysCall=SetInformationProcess
|
|
ApproveWinNtSysCall=SetInformationThread
|
|
ApproveWinNtSysCall=ImpersonateAnonymousToken
|
|
ApproveWinNtSysCall=OpenProcess
|
|
ApproveWinNtSysCall=OpenThread
|
|
ApproveWinNtSysCall=AlpcOpenSenderProcess
|
|
ApproveWinNtSysCall=AlpcOpenSenderThread
|
|
|
|
# system calls allowed without filtering
|
|
|
|
ApproveWinNtSysCall=OpenKey
|
|
ApproveWinNtSysCall=OpenKeyEx
|
|
ApproveWinNtSysCall=CreateKey
|
|
#ApproveWinNtSysCall=DeleteKey
|
|
ApproveWinNtSysCall=SetValueKey
|
|
#ApproveWinNtSysCall=SaveKey
|
|
#ApproveWinNtSysCall=SaveKeyEx
|
|
ApproveWinNtSysCall=LoadKey
|
|
ApproveWinNtSysCall=LoadKey2
|
|
ApproveWinNtSysCall=LoadKey3
|
|
ApproveWinNtSysCall=LoadKeyEx
|
|
|
|
ApproveWinNtSysCall=SetInformationFile
|
|
ApproveWinNtSysCall=SetInformationKey
|
|
ApproveWinNtSysCall=SetInformationVirtualMemory
|
|
ApproveWinNtSysCall=SetInformationWorkerFactory
|
|
ApproveWinNtSysCall=SetInformationJobObject
|
|
#ApproveWinNtSysCall=SetInformationSymbolicLink
|
|
#ApproveWinNtSysCall=SetInformationToken
|
|
#ApproveWinNtSysCall=SetInformationObject
|
|
|
|
ApproveWinNtSysCall=RaiseHardError
|
|
|
|
ApproveWinNtSysCall=DeleteFile
|
|
|
|
ApproveWinNtSysCall=AlpcAcceptConnectPort
|
|
ApproveWinNtSysCall=AlpcCreateSecurityContext
|
|
|
|
ApproveWinNtSysCall=CreateLowBoxToken
|
|
|
|
ApproveWinNtSysCall=TraceControl
|
|
ApproveWinNtSysCall=NtTraceEvent
|
|
|
|
ApproveWinNtSysCall=CreatePrivateNamespace
|
|
|
|
ApproveWinNtSysCall=CreateTimer
|
|
ApproveWinNtSysCall=CreateTimer2
|
|
ApproveWinNtSysCall=OpenTimer
|
|
|
|
ApproveWinNtSysCall=CreateUserProcess
|
|
#ApproveWinNtSysCall=CreateThreadEx
|
|
|
|
ApproveWinNtSysCall=QueryAttributesFile
|
|
ApproveWinNtSysCall=QueryFullAttributesFile
|
|
|
|
# Windows Notification Facility
|
|
ApproveWinNtSysCall=SubscribeWnfStateChange
|
|
ApproveWinNtSysCall=UnsubscribeWnfStateChange
|
|
ApproveWinNtSysCall=QueryWnfStateData
|
|
|
|
# token stuff
|
|
|
|
ApproveWinNtSysCall=DuplicateToken
|
|
ApproveWinNtSysCall=FilterToken
|
|
ApproveWinNtSysCall=AdjustPrivilegesToken
|
|
ApproveWinNtSysCall=AccessCheck
|
|
ApproveWinNtSysCall=AccessCheckByType
|
|
|
|
# atom stuff
|
|
|
|
ApproveWinNtSysCall=AddAtom
|
|
ApproveWinNtSysCall=AddAtomEx
|
|
ApproveWinNtSysCall=FindAtom
|
|
ApproveWinNtSysCall=DeleteAtom
|
|
|
|
|
|
# allowed Win32 system calls
|
|
|
|
ApproveWin32SysCall=GdiDdDDI*
|
|
|
|
|
|
|
|
|
|
#
|
|
# Known Conflicts
|
|
#
|
|
|
|
[Template_KnownConflicts]
|
|
Tmpl.Entry=Folder Lock | Folder Lock
|
|
Tmpl.Entry=StrokeIt | StrokeIt
|
|
#Tmpl.Entry=AquaSnap 1.16.2 | {CF0C7CA1-9BDC-4660-9CF5-E44446D49725}
|
|
#Tmpl.Entry=avast! Antivirus | avast
|
|
#Tmpl.Entry=AVG Antivirus | AVG
|
|
#Tmpl.Entry=BitDefender Antivirus | BitDefender
|
|
#Tmpl.Entry=Blue Ridge Networks AppGuard 3.0.13.1 | {2C9B1E69-DD05-40F5-8378-056A117028F9}
|
|
#Tmpl.Entry=Comodo Antivirus | {4E9C1938-BDC8-4897-8368-9574F9AF83E3}
|
|
#Tmpl.Entry=Comodo GeekBuddy 4.19.131 | {266FA04F-F0FA-4F7A-AA1E-387A57F579F2}
|
|
#Tmpl.Entry=Dr. Web 9 | {937CFD3F-8BFB-4208-81CB-F5004CD7B000}
|
|
#Tmpl.Entry=Dr. Web Katana | {7599F709-61D5-44F1-996C-4DFEB1B855E0}
|
|
#Tmpl.Entry=iTunes | {FBEB98F8-64E4-4FA3-A15E-4A9F42FF962E}
|
|
#Tmpl.Entry=Kaspersky Total Security 16 | {77E7AE5C-181C-4CAF-ADBF-946F11C1CE26}
|
|
#Tmpl.Entry=Norton Security | NS
|
|
#Tmpl.Entry=Nuance Power PDF Advanced 1.0 | {BD71D245-1A8B-4FB3-83E4-74F77FB39267}
|
|
#Tmpl.Entry=Office 2016 Click-to-Run | {90160000-007E-0000-0000-0000000FF1CE}
|
|
#Tmpl.Entry=PC Tools Firewall Plus | PC Tools Firewall Plus
|
|
|
|
|
|
|
|
#
|
|
# Deprecated templates
|
|
#
|
|
|
|
[Template_Firefox_Addon_FoxNotes]
|
|
|
|
[Template_Firefox_Addon_SpeedDial]
|
|
|
|
[Template_Firefox_Addon_ScrapBook]
|
|
|
|
[Template_Neon_Force]
|
|
|
|
[Template_Neon_Bookmarks_DirectAccess]
|
|
|
|
[Template_Neon_History_DirectAccess]
|
|
|
|
[Template_Neon_Cookies_DirectAccess]
|
|
|
|
[Template_Neon_Passwords_DirectAccess]
|
|
|
|
[Template_Neon_Preferences_DirectAccess]
|
|
|
|
[Template_Neon_Profile_DirectAccess]
|
|
|
|
[Template_Neon_WallpaperAccess]
|
|
|
|
[Template_Maxthon2_Force]
|
|
|
|
[Template_Maxthon2_Favorites_DirectAccess]
|
|
|
|
[Template_Maxthon2_SharedAccount_DirectAccess]
|
|
|
|
[Template_Outlook_Express]
|
|
|
|
[Template_DefenseWall]
|
|
|
|
[Template_StickyPassword]
|
|
|
|
[Template_ActiveSync]
|
|
|
|
[Template_Windows2000Internat]
|
|
|
|
[Template_FreeDownloadManager]
|
|
|
|
[Template_WindowsFontCache]
|
|
|
|
[Template_Windows10CoreUI]
|
|
|
|
[Template_FireFix_for_Win7]
|
|
|
|
[Template_PlugPlayService]
|
|
|
|
[Template_IExplore_Credentials]
|
|
|
|
[Template_VirtualDesktopManager]
|
|
|
|
[Template_DeviceSecurity]
|
|
|
|
[Template_OnlineArmor]
|
|
|
|
[Template_VPNTunnel]
|
|
|
|
[Template_Edge_Win11Fix]
|
|
|
|
[Template_InternetDownloadManager]
|