Release Notes – Safe Clean Mode, Windows Updates That Skip Feature Upgrades and More Tool Fixes

Hi folks –

This update adds a Safe Clean mode to the Clean tools, stops Install Windows Updates from installing feature upgrades, and fixes reports that gave misleading answers in more than a dozen other tools. Only the account holder can change account settings. There’s nothing to install. TechSuite picks up the new versions automatically.

Clean tools: new Safe Clean mode

The BleachBit-based Clean tools (Clean Google Chrome, Clean Firefox, Clean System, Clean Microsoft Edge and the rest) each have an All mode, which also wipes cookies, history and saved passwords. That’s the wrong thing to run by default, and presets can’t list a dozen separate modes per tool.

Every Clean tool now has a Safe Clean mode, listed first so it’s the one that runs by default. It removes only caches, temporary files and application logs. Cookies, browsing history and saved passwords stay where they are.

Chat clients keep their logs. Safe Clean skips the logs of chat programs such as Pidgin and HexChat, because those are the user’s conversations.
Windows Defender’s evidence is kept. For the Windows Defender cleaner, Safe Clean only clears temporary files.
The Cleanup and Malware Removal presets use Safe Clean. The Clean Google Chrome, Clean Firefox and Clean System steps in both presets now run it.
Some modes are gone. Clean Windows Defender no longer has an All mode or modes for its quarantine, history and backups, and Clean Zoom no longer has a mode for recordings, so they can’t be run by mistake.

Check your saved procedures. A procedure that still names an All mode will still run it. A procedure that used one of the removed modes needs that step replaced.

The Clean reports are more honest too. When BleachBit couldn’t clean, because the program was open or it reported errors, the report now says so instead of showing “0 deleted” as if the clean had worked. If BleachBit’s output isn’t in English, the report says it couldn’t read the summary instead of showing 0.

Install Windows Updates

Feature upgrades are never installed. Updates in Windows Update’s “Upgrades” category, such as a move to a new Windows version, are now skipped in every mode and can’t be switched back on from the options. The report lists each one it skipped.
Security-only mode installs security updates. The mode asked for “Security” and matched nothing, because Windows names the category “Security Updates”. Add Critical Updates yourself if you want them as well.

Fix Filesystem Issues

System File Checker results are right. The tool never saw what sfc printed, so it guessed from the CBS log. On current versions of Windows, that guess said “SFC: no errors found” for most of the scans in our sample where sfc had actually found integrity violations. The tool now reads sfc’s own output. If that output can’t be read, the report says the result is inconclusive. It never shows a pass.
chkdsk exit code 3 is not a failure. A scheduled disk check was reported as “could not schedule”. Whether a check is scheduled is now judged from chkdsk’s own text and the volume’s dirty bit.
Only real disk events are listed. The event log check matched event IDs 7 and 11 from any source, so an unrelated Hyper-V virtual switch event showed up as a disk problem on a clean machine. Only the disk, Ntfs and volmgr sources count now.
The check after a repair counts correctly. It no longer recounts the first pass’s repairs as new problems.

If you alert on exit codes: an inconclusive System File Checker result exits with code 2.

Create Restore Point

When the Volume Shadow Copy service is disabled, Windows can’t create restore points, but the report still said System Restore was Enabled and then failed. It now checks the service and the System Restore policy first, tells you what’s wrong and what to do about it, and exits with code 1.

Check Battery Health

Healthy batteries showed many false “critical battery” lines. They came from Windows events that mean a change of power source or an ordinary shutdown. The report now lists only unexpected power loss. It also reads correctly on PCs that use a comma as the decimal separator.

List Windows Services

Fewer wrong labels. Services are matched to a manufacturer by their whole name or install folder, not by the first letters of the name.
Less noise. Services that are meant to be stopped, such as delayed-start and trigger-start services and the Edge and Google updaters, are no longer listed as stopped automatic services.
RemoteRegistry is flagged where it belongs. It moved from the telemetry group to remote access risks.

Diagnose Printer Issues

Repair mode now clears only print jobs that have been stuck for more than 60 minutes. Newer jobs, and jobs whose age can’t be read, are left in the queue. It also no longer changes the Windows setting for managing the default printer, and the recommendation to turn that setting off is gone.

List Startup Applications

The known-good and PUP lists are used. They weren’t being applied. They are now.
Whole-name matching. A list entry such as “dell” used to flag every startup entry that contained the word. Entries are now matched as whole names.
Lantern is recognized. Lantern’s startup entries are always shown as known and never as unwanted or suspicious.
No false “missing file”. A command such as conhost.exe or powershell.exe is looked up in the Windows folders and on the PATH, the way Windows would find it. It used to be reported as a missing file and then as safe to remove.

Windows Defender

A readable Detected Threats table. One detection can list hundreds of near-identical files. The report now shows the first three, one per line, and counts the rest. An empty threat name reads “Unnamed detection”, and the result of the action reads “Action succeeded” or “Action failed”.
The program is now called DefenderCheck.exe. It used to be WindowsDefender.exe, which looked like a Microsoft file and had no publisher in its file details. One shop’s endpoint security refused to start it. The new name has the product, company and description filled in. If your endpoint protection has an allow-list entry for the old name, add DefenderCheck.exe.

ProcessHawk

ProcessHawk’s list of programs to leave alone now includes Lantern, the Watchman Monitoring client, Tailscale and the Windows OpenSSH client.

Reports for Install tools and RKill

Install tools that use Chocolatey report the real result. The report used to treat “X has been installed” as a success. Chocolatey prints that line before the install script runs, so a failed install could look like a success. The result now comes from Chocolatey’s own “was successful” and “was NOT successful” lines.
The RKill report is shorter. RKill lists every service whose path it doesn’t recognize, which on current Windows is a hundred or more normal services. They’re now counted on one line. Killed processes and services, registry fixes, policy changes and HOSTS entries are shown as before.

Check for App Crashes

Crash details are matched correctly. The details of a Windows Store app crash or hang were read by position, which put each value one slot off, so the wrong fault information was shown. They’re now read by name. Store apps are listed by their package name instead of <package> praid:App, and a hang no longer shows a fault module or exception code.
Hangs have their own section. They’re listed and counted separately and don’t count toward the stability rating.
The trend compares equal periods. It compares the last half of the lookback period with the half before it, and shows N/A when there are fewer than 3 crashes or the history doesn’t reach back far enough.
Every user’s crashes are included. The tool also reads each user profile’s own Windows Error Reporting folder, and counts a report once even if it appears in both places.
TechSuite’s own crashes are left out. They no longer appear in the crash list, the stability rating or the recommendations. The log notes how many were ignored.

List Installed Apps

Whole-name PUP matching. The PUP list was matched as loose pieces of text, so a short entry flagged every app with that word in its name. Entries are now matched as whole names, ignoring case.
Antivirus products are listed once. Windows Defender no longer counts toward the multiple-antivirus warning.
The 32-bit and 64-bit lists are the right way round. The registry paths, labels and counts for the two had been swapped.

Check Device Manager

The error-code descriptions now follow Microsoft’s documentation. We corrected codes 32 (driver service disabled), 47 (prepared for safe removal), 48 (driver blocked) and 49 (system hive too large), added codes 55, 56 and 57, and changed the wording of the other codes to match Microsoft’s.

Test HDD for Issues

“Attributes: OK” means the attributes were read. A drive that was skipped or came back empty now shows “Not read” instead of OK.
NVMe drives are treated as SMART-enabled. A recognized NVMe controller is no longer reported as having SMART turned off, and the tool no longer tries to switch it on.
USB storage is labelled. A USB disk that can’t report SMART data, such as the TechSuite boot stick, shows “USB storage, SMART not available” instead of a skipped-drive warning.
Unreadable drives leave more to go on. For a drive the tool can’t read, the log now includes the raw responses and Windows’ own view of the disk, so we can work out why.

Microsoft Surface isn’t a virtual machine

Create Restore Point, Check Battery Health, List Windows Services, Check for App Crashes, Check Device Manager and Test HDD for Issues guessed that a PC was a virtual machine by looking for words such as “virtual” and “xen” in the maker and model. A physical Surface matched. They now compare against exact hypervisor signatures.

Account settings are for the account holder

Only the account holder can now change account settings, report layouts and the WSUS configuration file. A technician who isn’t the account holder is sent back to the dashboard with a message saying who can make the change. The billing page works the same way: it tells a technician who to ask instead of showing a card form they can’t submit.

If your account has no account holder set, email us and we’ll set one. Until then, nobody on it can change these settings.

Tools we’ve retired

These tools are no longer in the tool list:

Zemana AntiMalware, Emsisoft Command Line Scanner, McAfee Stinger and Reason Core Security: replaced by the Windows Defender tool.
Recover Browser Passwords and Recover Outlook PST Password: they depended on NirSoft downloads that no longer work reliably, and antivirus programs flag them.
Install Skype, Install AdBlock Plus for Firefox, Install AdBlock Plus for Chrome: the products are discontinued.
Install Backblaze and Install Microsoft Office Deployment: almost never used.
Clean Flash: Flash has been discontinued since 2020.

Nothing was deleted. If you need one of these brought back, email us.

Questions or feedback? Email us at [email protected].

Ian & Garrett