The full cleaning and repair feature set

What this covers

“Cleaning and repairing Windows” sounds like one job. It decomposes into six, and TuneBit's sidebar is organized around that split: reclaiming disk space, working with the files themselves, changing settings that affect speed and privacy, repairing subsystems that have broken, checking the machine's defenses, and reading what the machine already knows about its own condition.

Every tool below is unlocked on every paid plan. There is no Basic and no Pro: the difference between TuneBit Personal and TuneBit Technician is how many machines a license covers and what it binds to, not which buttons work.

Clean up

Junk Cleaner

Ten categories of cache and temporary file, each a named list of folders rather than a heuristic, so a category is inspectable before anything is deleted: your temp folder and C:\Windows\Temp, the Windows Update download cache and the Delivery Optimization cache under SoftwareDistribution, the servicing logs in C:\Windows\Logs, crash dumps (MEMORY.DMP and the minidumps), queued and archived error reports, Explorer's thumbnail cache, the font cache, the prefetch cache, and the Recycle Bin across every fixed drive.

Every category is measured before you commit, and only five are ticked by default. Crash dumps, thumbnails, the font cache, prefetch and the Recycle Bin start unticked because each costs something to clear. Folder contents go while the folder stays, since Windows expects those paths to exist.

Browser Cleaner

Finds Chrome, Edge, Brave, Vivaldi, Opera and Firefox, and inside each enumerates every profile — the Chromium Default plus Profile 1, Profile 2 and so on, and each Firefox profile directory. Six kinds of data per profile: cache, browsing history, cookies, download history, saved sessions, autofill form data. Saved passwords are not touched.

It deletes known files inside the profile directory rather than driving each browser's own settings UI, which is what lets it clean six browsers in one pass. Cache and download history are on by default; cookies, history and sessions are not, because clearing them signs you out of websites and loses the tabs that reopen after a crash. TuneBit names any browser it found running, since a running browser holds its own files open.

Disk Space

Walks the tree, sizes each folder, sorts largest first and lets you drill in; alongside it, the fifty largest individual files over 500 MB. Read-only by design — it tells you where to point the other tools.

Disk Optimizer

The important part is knowing which drive is which, and TuneBit works that out for you. A mechanical drive gets a real defragmentation pass; a solid-state drive gets the TRIM treatment instead, because defragmenting an SSD burns write cycles for no benefit. You can also analyze a drive without changing anything, and Windows' own scheduled optimization task can be toggled here.

Uninstaller

Reads the uninstall keys from both hives and both bitnesses — HKLM and HKCU, plus the WOW6432Node versions — skipping entries marked SystemComponent, and runs the program's own quiet uninstall string where one exists. Then the interesting half: a scan for what the uninstaller did not take. It checks the install directory, Roaming and Local AppData, ProgramData and TEMP, the publisher-then-app folder pattern, Start Menu and desktop shortcuts, top-level keys under HKLM\SOFTWARE, HKCU\SOFTWARE and HKCR, and — where the program has a product GUID — a registry search eight levels deep for that GUID plus a five-level search for values still pointing at the old install path. A hard list of protected paths (C:\Windows, both Program Files directories, C:\Users, any drive root) can never be flagged.

Registry Scanner

Eight categories of stale entry: missing shared DLLs, file extensions whose ProgID no longer exists, orphaned COM entries whose InprocServer32 or LocalServer32 points at a file that is gone, broken App Paths, installer references whose install directory has vanished, registry font entries with no font file, obsolete Run and RunOnce entries, and broken Start Menu shortcuts.

Two details separate this from a cleaner that inflates its numbers. Every candidate is tested for write access before it is reported, so protected keys are skipped rather than listed as findings you can never clear. And a scan only reads: nothing changes until you clean, at which point TuneBit takes a restore point and runs reg export on the affected keys into %LOCALAPPDATA%\TuneBit\backups\ before it writes.

File tools

Checksums

CRC32, MD5, SHA-1, SHA-256 and SHA-512 over one or many files. Every algorithm you tick is fed from a single pass over the file, so asking for five costs barely more than asking for one — the alternative, reading a 4 GB ISO once per algorithm, is what makes most checksum tools feel slow. The paste box takes a published checksum in whatever shape it arrived in — a bare hash, SHA256: …, grouped hex, or a .sha256 sidecar line of <hash>  filename — works out which algorithm it is from its length, and says plainly whether it matches.

CRC32, MD5 and SHA-1 can all be deliberately collided, and the app says so on the same screen that offers them. They are there to match a value someone else published and to catch accidental corruption, not to prove a file was not tampered with; SHA-256 and SHA-512 are the ones that carry that weight.

Fast Find

Windows Search only covers the locations it has been told to index, and walking a whole disk folder by folder takes minutes. TuneBit reads the NTFS master file table directly instead — one contiguous record list rather than a tree — and indexes every name on your fixed drives in one pass. On a 1.68 million-item system volume that is about 14 seconds, against roughly three minutes for the folder-by-folder walk. Every search after that returns in well under a tenth of a second, as you type.

Wildcards work (*.log, report?.pdf), results can be narrowed to files or folders, and a query containing a backslash is matched against the whole path. A result opens in Explorer with the file already selected. Reading the master file table needs administrator, which TuneBit already runs as; on a non-NTFS drive, or if that read is refused, it falls back to an ordinary directory walk and tells you which path it used rather than quietly being slow.

Duplicate Finder

Files are compared in three passes, cheapest first, so the expensive comparison only ever runs on the handful of files that could plausibly match. Checking every file thoroughly from the start is what makes naive duplicate finders slow. Windows' own protected folders are skipped. The convenience tick-box selects every copy in a set except the most recently modified one; deletions go to the Recycle Bin, not a hard delete, and a set with every copy ticked is refused rather than obeyed — that selection deletes the file, not a duplicate of it.

Optimize

Performance

Tweaks in ten groups — visual effects, memory and processes, power and startup, gaming, disk, background apps, network, background services, system, Windows preferences — covering transparency and menu delay, SysMain and Search indexing, fast startup and hibernation, Game Bar and Game DVR, NTFS last-access timestamps and 8.3 short names, network throttling and SystemResponsiveness, and the DiagTrack telemetry service. Each tweak carries what it changes (a registry value, a service startup type, or a command such as powercfg, fsutil or netsh), the optimized value, and the Windows default — which is what makes Revert a real operation rather than a guess. The handful that trade something away warn first: disabling Memory Integrity reduces security, disabling automatic maintenance stops Windows running its own scan passes.

Privacy

The same shape applied to telemetry and data collection, Cortana and search, location and input, ads and suggestions, and sync and cloud: diagnostic data, tailored experiences, the advertising ID, activity history, app-launch tracking, Bing results in Start, Copilot, location, online speech recognition, typing data, lock-screen and Start-menu suggestions, consumer-feature auto-installs, settings sync, clipboard cloud sync. Items that exist only on some builds are gated by build number. Each stores both the tracking value and the private one so it can be put back, and the affected keys are exported to %LOCALAPPDATA%\TuneBit\backups\ before the first write.

Debloater

Lists the built-in and preinstalled apps actually present. Detection is one PowerShell round trip — Get-AppxPackage -AllUsers once, matched locally — rather than one launch per app. Removing an app removes the package for all users and the provisioned package, which is what stops it reappearing for the next user profile created on the machine. OneDrive is handled separately because it is not an AppX package: stop the process, find OneDriveSetup.exe in System32, SysWOW64 or the per-user versioned folder, run its /uninstall, clear the leftover registry key.

CPU Affinity

Running processes with their memory use, assigned cores and priority, and the controls to pin one to specific processor cores or change its priority. Rules can be saved by program name, and TuneBit watches for those programs launching so the rule applies as they start rather than after you notice them running. That watcher can also run in the background with no window, through the /affinity-watch switch.

Scheduled Tasks

Ten maintenance jobs TuneBit can run on a schedule — clearing temporary files, emptying the Recycle Bin, Disk Cleanup and flushing DNS are on by default; browser caches, an SFC scan, a restore point, an update check, a health-score refresh and a registry scan are available and off. Scheduling registers a Task Scheduler entry launching TuneBit with /maintenance, which runs the ticked tasks with no window and appends a dated log to %LOCALAPPDATA%\TuneBit\maintenance\.

Default Apps

Reads the UserChoice association for 28 common file extensions plus http, https and mailto, and saves the set as a snapshot. Reload later and anything that has changed is highlighted with what it used to be — which is how you catch an installer that quietly took over your PDFs. Restoring is attempted with the caveat stated plainly in the log: Windows protects the association keys, so some entries need confirming through Windows itself.

Fonts

Preview what is installed, install new files, remove ones you do not use. “Installed” means a value under the Windows Fonts registry key, because that is what makes a font load at sign-in — a file sitting in the fonts folder with no registry entry is invisible to Windows. Family and style names come from the font file's own name table, not the registry value, which is a display string installers write however they like. Fonts are listed per scope and flagged where Windows itself needs them, and orphans — an entry whose file has gone — are reported rather than hidden, because Windows tries to load each one at every sign-in.

Repair

Repair Tools

Nineteen standard Windows fixes, each described in a sentence, tickable, runnable as a batch, in five groups:

• Disk and storage — clear temporary files, run cleanmgr with the safe categories selected, empty the Recycle Bin, queue chkdsk /f /r on C: for the next restart.
• Network — flush DNS, reset Winsock and the IP stack, set Google and Cloudflare DNS on active adapters, release and renew DHCP.
• Security — firewall on for all profiles, re-enable Defender and update its signatures, turn UAC back on, trigger an update detection pass.
• System repair — sfc /scannow, DISM /Online /Cleanup-Image /RestoreHealth, create a restore point, rebuild the search index.
• Cleanup — reset the hosts file keeping a backup beside it, open the startup manager, clear the Chrome and Edge caches.

Running several at once offers to take a restore point first. Re-enabling Defender checks Security Center for a third-party antivirus and skips itself if one is active, rather than fighting the product the user actually installed.

Windows Update

Diagnoses first: when the last update actually succeeded, whether wuauserv and BITS are running, free space on the system drive, whether a reboot is pending. Then eight repairs in rough order of severity — stop the update services and rename SoftwareDistribution and catroot2 with a timestamp so Windows rebuilds them; clear just the download cache; re-register the 32 DLLs Windows Update depends on, which fixes the class of failure where an update leaves a COM registration broken; repair BITS by resetting its service descriptor and start type; delete the WindowsUpdate policy keys and run gpupdate /force; force detection through DetectNow and UsoClient StartScan; launch the troubleshooter, falling back to Settings on builds where msdt.exe has been removed; and repair the recovery environment with reagentc /enable.

Services

Every service with its status and start type, and — for the ones TuneBit has a documented default for — the start type it should have, with mismatches flagged. Five reset groups cover the failures people actually hit: Windows Update, Networking, Security, System Core and Print Spooler. Resetting a group sets each start type with sc config and then starts the ones that should be running, because a correct start type on a stopped service still leaves the symptom you came here to fix. Below that sit the permission repairs: reapply the default security policy with secedit, reset the ACLs under C:\Windows with icacls /reset /t, re-register fifteen core DLLs, verify and salvage the WMI repository with winmgmt.

Shell & Explorer

The desktop-is-broken section. Rebuild the icon or thumbnail cache (Explorer stopped, the iconcache*.db or thumbcache*.db files deleted, Explorer restarted); reset per-folder views by clearing the BagMRU and Bags keys; re-register nine shell components; reset the pinned taskbar layout; reset default app associations with dism /Online /Remove-DefaultAppAssociations; switch the Windows 11 right-click menu back to the classic one and back again; restore Explorer defaults; shorten the timeouts Explorer waits on hung windows. Anything that stops Explorer verifies it came back, retrying up to three times and printing the Task Manager recovery steps if it has not — a desktop that never returns is worse than the problem being fixed.

Network

Diagnoses first: IPv4 address, gateway and DNS servers per adapter, whether 8.8.8.8 answers a ping and how fast, and whether a hostname resolves — which separates “no connection” from “connection, broken DNS” before you change anything. The repairs: flush DNS, reset Winsock and the IP stack, set public DNS via the SetDNSServerSearchOrder WMI method, release and renew DHCP, clear both the per-user and the WinHTTP proxy, reset the firewall, toggle IPv6, and fix network discovery by setting its four services to automatic and re-enabling the firewall rule group.

Sharing

Everything this PC is sharing with the network, with the hidden shares Windows creates itself separated from the ones somebody deliberately made. Any share can be stopped. Four switches control the rest: network discovery, file and printer sharing, password-protected sharing, and SMBv1.

The SMBv1 switch only goes one way. TuneBit will turn it off — warning that very old NAS boxes and network printers may stop working — and it will not turn it back on. SMBv1 is the protocol WannaCry spread over, and a utility that offers to re-enable it is a utility that will eventually be used to re-enable it.

File Unlocker

For the file Windows says is in use without saying by what. TuneBit asks the Windows Restart Manager (rstrtmgr.dll) which processes hold a handle to a file or folder, registering directory contents in batches so a large folder still returns an answer, and names each one with its PID and image path before offering to terminate it. Naming the process first is the point: often it is something you would rather close properly than kill.

Security

Security Audit

Six protection checks, each with a status and an explanation: Windows activation (via slmgr /xpr), firewall state per profile, Defender's real-time protection and signature age (from Get-MpComputerStatus, falling back to Security Center when a third-party antivirus has taken over — Defender reporting itself off in that case is healthy, not a fault), UAC including its prompt level, Secure Boot, and BitLocker on C: with the encrypted percentage.

Two lists follow. Every port this PC is listening on, resolved to the program that owns it, with nine ports flagged and the reason given in words — FTP and Telnet send credentials in clear text, RPC, NetBIOS and SMB should not face the internet, RDP is a brute-force target, VNC is often unauthenticated. And every scheduled task that did not come with Windows, since anything under \Microsoft\ is Microsoft's and everything else was put there by something.

VirusTotal

A fingerprint of the file is calculated on your PC and looked up first, so a file that has been seen before gets an answer without leaving your machine at all; uploading the file itself is a separate, deliberate action. Results link through to the full report, and your API key is stored locally and can be forgotten from the same screen. This is the one feature that talks to a third party, it is always user-initiated, and the third party is VirusTotal.

File Shredder

Overwrites a file's bytes in place before unlinking it, so undelete tools have nothing to recover. Four methods: one pass of zeros (enough for any modern drive, and the honest default), one random pass, three passes, seven. Each pass is flushed to disk rather than left to the cache, and the file is renamed to a random GUID before deletion so the original name does not survive in the directory entry either. Free space on a whole drive can be overwritten separately with cipher /w, which does not touch existing files.

Product Keys

Decodes the Windows product key from the DigitalProductId registry value and reports the activation status beside it. Office keys are found both ways installers write them — the registration GUIDs under the versioned Office keys for MSI installs, the Click-to-Run configuration for modern ones, with OSPP.VBS consulted where it exists. Saved Wi-Fi passwords are available too, behind their own confirmation, and exporting warns before it writes that the file will hold all of it in plain text.

Diagnose

Health Score

A weighted score out of 100 across ten checks, each reporting its own detail line so the number is always accountable to something you can read:

Blue Screens

Pulls bugcheck events out of the event log and presents each crash with its stop code, the human name of that code, the bugcheck parameters and the dump file it wrote; the dumps on disk are listed with sizes and dates. Each crash carries a ready-made search term built from the stop name and your Windows version, because for most stop codes the useful next step is finding out which driver is known to cause it.

Event Log

Reads the System and Application channels through the event log API, newest first, filtered to everything, errors, warnings, critical events, or the specific IDs that mean an unexpected shutdown or an application crash, over a time window you choose. Up to 500 rows with source, event ID and message, exportable. A channel that cannot be read under the current permissions is skipped rather than sinking the whole query.

Battery & Power

Charge, status and chemistry — and, where Windows' usual source leaves the capacity numbers blank, TuneBit goes after them another way, which is what makes a real health percentage possible rather than a guess. Alongside it: every power plan with the active one marked, the fast startup and hibernation switches (turning hibernation off also frees hiberfil.sys, often several GB), the available sleep states, and Windows' own battery report and 60-second energy report written as HTML into %LOCALAPPDATA%\TuneBit\reports\.

Hardware

Seven groups of labeled facts, read straight from the machine: overview (Windows version, uptime, boot time, manufacturer and model, installed memory), processors (cores, logical processors, base and current clock, socket, L2 and L3 cache, virtualization), memory per slot (capacity, DDR generation, speed, form factor, part and serial number, plus the board's slot count and maximum), storage (model, interface, firmware, serial, per-volume usage), graphics (video memory, driver version and date, current mode and refresh rate), motherboard and firmware (BIOS vendor and version, UEFI versus legacy, Secure Boot, TPM), and network adapters.

Drive health is read properly: TuneBit queries the drive directly for its full SMART attribute table, with current, worst and threshold values for each one — not the single OK/not-OK flag Windows normally reports.

Drivers

Every driver on the machine, cross-referenced against the devices reporting problems, so four kinds of trouble surface: no driver installed at all, a device reporting an error, an unsigned driver, and a driver more than two years old. Third-party drivers can be exported to %LOCALAPPDATA%\TuneBit\driver-backups\ and restored from there. Force-reinstalling one driver is the risky operation here, so it is wrapped: the current driver is backed up first, then removed and reinstalled. If the removal fails, nothing was changed. If the reinstall fails, the log tells you exactly where the backup sits.

System Report

Twelve sections collected into one HTML file you can save, print or send: summary, health score with the ten checks itemized, hardware, SMART drive health, security, listening ports, drivers, storage usage, startup programs, recent crashes, recent errors, power. Nine are ticked by default; listening ports, the event-log dump and power are not. This is the artifact a technician hands to a customer.

Two closing notes

Fonts is new. Everything else on this page is a section the original TuneBit had and this rebuild carries forward. The font manager is the one the original never had — the only tool here that exists because it was missing rather than because it was inherited.

One-Click Tune-Up exists for people who do not want to choose. It chains a deliberately safe subset of the above from one button behind one confirmation: the junk cleaner, the browser cleaner and the registry cleaner, then the security audit and the health score. It includes only the categories those sections mark as on-by-default, which keeps cookies, browsing history, saved sessions, the Recycle Bin and the prefetch cache out of it — nothing in the batch should surprise somebody who did not read the list. It is a section like any other, reachable from the same sidebar as everything else, so nobody is ever stuck in the simple view.

Further reading

• Why you need TuneBit — the case for the product, and what it deliberately is not.
• What TuneBit does — the same 34 tools at a glance, if this page is more atlas than you needed.
• How TuneBit works — the architecture, the safety model and the licensing mechanism underneath all of it.
• TuneBit for everyday users — the same app from the point of view of somebody who just wants their PC fixed.
• USB-bound licensing for professionals — running the whole set from a stick, on any machine you service.
• TuneBit vs. CCleaner, IObit and iolo — how it compares to the rest of the category, feature by feature and dollar by dollar.