Solved AppCompatCache registry Windows 7

[Kdmeizk]

[SOLVED] AppCompatCache registry Windows 7 + database

Hello,

I can't delete once and for all the old content of this key (HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\AppCompatCache) and I'm becoming crazy, really. The content of the key back every shutdown of Windows, with nearly the same content. My problem is that the old, very old *.exe are kept (around 8 months) in this key.
During my tests, once, all old *.exe were deleted. Once but, I don't know really how. I tried with a delete of C:\WINDOWS\AppCompat & C:\WINDOWS\AppPatch and it seems it worked. But, after another test, there was no good result.
I logged every acts from Windows when it shutdown, and I don't see what it loads to write this key everytime between the opening of the key and the closing.

Now, I have :

• Program Compatibility Assistant is disabled in Services ;
• Both Windows' folders above are deleted ;
• Tasks with a link with Program Compatibility Assistant in Task Scheduler are deleted ;
• The content of Prefetch's Folder deleted (AgRobust.db + AgAppLaunch.db (I think for this file, I don't remember) could contain a link with AppCompatCache).

I'm depressing... I need your help...


I would like to delete the old content of AppCompatCache which keeps old paths + its executable because I have them until 8 months ago... It's a security break that I don't want keep until 8 months.


SOLUTION:

rundll32.exe kernel32.dll,BaseFlushAppcompatCache

is the batch command. Then, you can schedule it for your needs. But, if you are a rigorous person, after each executable deleted or uninstalled, after the reboot of the computer when your executable is already deleted, launch this command. Because, AppCompatCache is wrote at the end of the Windows's shutdown procedure. So it's not possible to execute it efficiently for the shutdown.

C:\WINDOWS\Prefetch\AgAppLaunch.db
C:\WINDOWS\Prefetch\AgRobust.db

Also, these both files contain old paths + executable like AppCompatCache. Delete them just after the batch command wrote above if they are present.
If you disabled services linked with Program Compatibility Assistant and Prefetch, these files need normally to be deleted once only.

 

[Layback Bear]

AppCompatCache to the best of my knowledge is under the control of Trusted Installer and is part of Windows 7.

To me that means don't do anything with it. Leave it alone.

Than being said; have you run any security scans and if so which ones. What were the results.

Some infection might be hiding in App Compat Cache.

Why are you wanting to remove AppCompatCache?

Hopefully more will respond to your thread with more knowledge than I.
Could take some time, so just leave AppCompatCache alone until more members drop by.

 

[Kdmeizk]

No it's not an infection problem because all my tests are done on the main + a fresh Windows 7. The problem is this Program Compatibility Application has a "hidden part" somewhere, I'm nearly sure.

I changed a bit my first post to precise, I want have a control on the content. I can't delete this key, but I can, normally, have an impact on its content. But, I don't know how.
I want have the control on for never see my old paths of *.exe. This key is like a history.

 

[Kdmeizk]

I found something which is probably my last option : https://msdn.microsoft.com/en-us/library/bb432197%28v=vs.85%29.aspx
But I'm not able to launch this function. It seems "#include <windows.h>" is necessary, but there is no result... It doesn't find it.
Microsoft don't help more, or I understand nothing.

 

[Kdmeizk]

Well. There is a way very easy to flush the cache that I know now thanks to a great person. A lot of time, for a really small command... The solution is located in my first post.