Date: Tue, 18 Sep 2001 11:34:20 -0700
Unfinished Revolution
unrev-II@egroups.com
OHS DKR Project
SRI International
333 Ravenswood Avenue
Menlo Park, CA 94025
650 326 6200
| Subject: | Microsoft's Secret Files - on YOUR PC |
Linux and Mac users can ignore this post.
I wouldn't forward this if I hadn't tried snooping around in my C:WINDOWS directory as suggested at this web page. What they say is there, is there! A rather large file with all the web sites I have visited.
Jack
Jack Park
jackpark@thinkalong.com
| From: | Simon Polovina |
|
polovina@LINEONE.NET INTERNATIONAL DISCUSSION GROUP PORT-L@LISTSERV.IUPUI.EDU |
| To: | Jack Park |
|
jackpark@thinkalong.com |
| Subject: | Microsoft's Secret Files - on YOUR PC |
PORTers, at the risk of going OT that below
may interest given some of the
discussion on this group a while ago.
Simon
Date: Mon, 17 Sep 2001 12:38:53 +0000
Author: David Shearer
d.w.shearer@herts.ac.uk
| Subject: | Microsoft's Secret Files - on YOUR PC |
Dear Colleagues,
A couple of colleagues have suggested that I share this URL with you. Please excuse the somewhat offensive web site name, but it does contain some very interesting and useful information about the way MS Windows collects information about you and the way your PC is used - and you're not consulted about Microsoft using up megabytes of your hard disc and stealing the bandwidth off you when they come snooping. The web site contains some useful info on how to delete these really hidden files and free up more free disc space and improve your PC's performance.
Department of Computer Science
David
David Shearer University of Hertfordshire College Lane Hatfield Herts AL10 9AB
01707 284337 (Voice) 01707 284303 (Fax)
d.w.shearer@herts.ac.uk
http://homepages.feis.herts.ac.uk/~comqdws/
Make a difference: Make a difference: http://www.thehungersite.com/
Microsoft's Really Hidden Files v2.1b
by The Riddler
June 8 - August 25, 2001
(v2.0 written May 16, 2001; v1.0 written June 11, 2000)
I will not be liable for any damage or lost information, whether due to reader's error, or any other reason.
If you'd like to comment specifically on this article (and not this website as a whole), please write directly to the author at ther1ddler@fuckMicrosoft.com.
There are folders on your computer that Microsoft has tried hard to keep secret. Within these folders you will find two major things: Microsoft Internet Explorer has been logging all of the sites you have ever visited -- even after you've cleared your history, and Microsoft's Outlook and Outlook Express has been logging all of your e-mail correspondence -- even after you've erased them from your trash bin. (This also includes all incoming and outgoing e-mail attachments.) And believe me, that's not even the half of it.
When I say these files are hidden well, I really mean it. If you don't have any knowledge of DOS, then don't plan on finding these files on your own. I say this because some of these files/folders won't be displayed in Windows Explorer at all -- only DOS. (Even after you have enabled Windows Explorer to "view all files.") And to top it off, the only way to find them in DOS is if you knew the exact location of them. Basically, what I'm saying is if you didn't know the files existed, then the chances of you running across them is slim to slimmer.
Funny that Microsoft would make no mention of this on microsoft.com.
FORWARD:
I know there are some people out there that are already aware of some of the things I mention. I also know that most people are not. The purpose of this tutorial is teach people what is really going on with Microsoft's products and how to take control of their privacy again.
Thanks for reading.
INDEX
8.1) Removing Find Fast
9.1) Recommended reading
Coming Very Soon:
Well, the best definition I have been able to come up with is the following:
DOS = Disk Operating System
MSIE = Microsoft Internet Explorer
TIF = Temporary Internet Files (folder)
HD = Hard Drive
OS = Operating System
Step by step information on how to erase these files as soon as possible. This section is recommended for the non-savvy. Further explanation can be found in Section 4.0. Please note that following these next steps will erase all your cache files, all your cookie files, and all of your e-mail. If you use the offline content feature with MSIE, following these next steps will remove this as well.
CD\WINDOWS\TEMPOR~1\
DELTREE/Y CONTENT.IE5
(If that didn't work then type this:)
CD\WINDOWS\APPLIC~1\TEMPOR~1
DELTREE/Y CONTENT.IE5
(If that didn't work then type this:)
CD\WINDOWS\LOCALS~1\TEMPOR~1
DELTREE/Y CONTENT.IE5
(If this still does not work, and you are sure you are using MSIE5, then please e-mail me. Finding the location of these is a mission, and I'd certainly like to know where else MSIE likes to hide its cache. I believe older versions of MSIE keep them under "c:\windows\content\".)
CD\
DELTREE/Y TEMP
DELTREE/Y WIN386.SWP
CD WINDOWS
DELTREE/Y COOKIES
DELTREE/Y TEMP
DELTREE/Y WIN386.SWP
DELTREE/Y HISTORY
Reboot your computer and wait for Windows to load back up.
regedit
HKEY_USERS/Default/Software/Microsoft/Internet Explorer/TypedURLs/
HKEY_CURRENT_USER/Software/Microsoft/Internet Explorer/TypedURLs/
HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/Current
Version/Explorer/RemoteComputer/NameSpace/
{d6277990-4c6a-11cf-8d87-00aa0060f5b5}
Warning: This conveniently does not erase any e-mail correspondence. To double check drop back to your DOS prompt and type this:
dir *.mbx /s/p
The files you are looking for are:
INBOX.MBX
OUTBOX.MBX
SENTIT~1.MBX
DELETE~1.MBX
DRAFTS.MBX
If these files come up they will be listed in either of these folders:
C:\Windows\Application Data\Microsoft\Outlook Express\Mail\
C:\Program Files\internet mail and news\%USER%\mail\
Now type either of the following (depending on the location of your .mbx files...)
(Remember, this will erase all your e-mail correspondence, so backup what you want to keep. By now, you should have already imported your mail into Eudora or Pegasus Mail.)
CD\WINDOWS\APPLIC~1\MICROS~1\OUTLOO~1
DELTREE/Y MAIL
CD\PROGRA~1\INTERN~1\%USER%
(replace "%user%" with the proper name.)
DELTREE/Y MAIL
As you may already know, deleting files only deletes the references to them. They are in fact still sitting there on your HD and can be easily recovered by anyone.
If you insist on using Microsoft Internet Explorer then I strongly recommend that you check out at least one of these programs:
I have already tried and tested some other programs and you'd be surprised on how many of them don't pass the tests. For example, HistoryKiller 2001 claims it erases all the files, but don't count on it.
And if you insist on using Outlook or Outlook Express then I recommend that you get in the habit of compacting your mailboxes.
You can do this by going to "File" > "Folder" > "Compact All."
This next section is for those of you who are more interested in learning the ins and outs of your computer. This section is intended for the savvy user.
The most important files to be paying attention to are your "index.dat" files. These are database files that reference your history, cache and cookies. The first thing you should know is that the index.dat files is that they don't exist in less you know they do. They second thing you should know about them is that some will not get cleared after deleting your history and cache.
A log of your browsing history saved to a hidden file that you didn't know existed.
c:\windows\explorer /e,c:\windows\tempor~1\content.ie5\
You see all those alphanumeric names listed under "content.ie5?" (left-hand side.) That's Microsoft's idea of making this project as hard as possible. Actually, these are your alphanumeric folders that was created to keep your cookies and cache. Write these names down on a peice of paper. (They should look something like this: 6YQ2GSWF, QRMTKLWF, U7YHQKI4, 7YMZ516U, etc...) If you click on any of the alphanumeric folders then nothing will be displayed. Not because there aren't any files here, but because Windows Explorer has lied to you. If you want to view the contents of these alphanumeric folders you will have to do so in DOS. (Actually, there is a workaround that Skywalker taught me, but it's a little bit harder to explain. I will cover this tip in one of next versions.)
CD\WINDOWS\TEMPOR~1\CONTENT.IE5
CD %alphanumeric%
(replace the "%alphanumeric%" with the first name that you just wrote down.)
DIR/P
The files you are now looking at are directly responsible for the mysterious erosion of HD space you may have been noticing. One thing particularly interesting is the ability to view some your old e-mail if you happen to have a Hotmail account. (Oddly, I've only been able to retreive Hotmail e-mail, and not e-mail from my other web-based e-mail accounts. Send me your experiences with this.) To see them for yourself you must first copy them into another directory and open them with your browser. Don't ask me why this works.
CD\WINDOWS\TEMPOR~1\CONTENT.IE5
EDIT /75 INDEX.DAT (or "EDIT /16 index.dat")
You will be brought to a blue screen with a bunch of binary.
DELTREE/Y C:\WINDOWS\TEMPOR~1\
(replace "c:\windows\tempor~1\" with the location of your TIF folder if different.)
This will take a seriously long time to process.
CD\WINDOWS\HISTORY\HISTORY.IE5
EDIT /75 INDEX.DAT (or "EDIT /16 index.dat")
You will be brought to a blue screen with more binary.
CD\WINDOWS\HISTORY
CD\WINDOWS\HISTORY\HISTORY.IE5
CD MSHIST~1
EDIT /75 INDEX.DAT (or "EDIT /16 index.dat")
More URLs from your Internet history. Note there are probably other mshist~x folders here.
CD WINDOWS
DELTREE/Y HISTORY
This is about it as far as I know. You may also want to take a look at your *.mbx files if you own Outlook. (dir *.mbx/s) All your e-mail correspondence and file attachments are located within these files. More detailed information is covered in the next section.
Would you think twice about what you said if you knew it was being recorded? E-mail correspondence leaves a permanent record of everything you've said -- even after you've told Outlook to erase it. You are given a false sense of security sense you've erased it twice, so surely it must be gone. The first time Outlook simply moves it to your "Deleted Items" folder. The second time you erase it Outlook simply "pretends" it is gone. The truth is your messages are still being retained in the database files on your hard drive.
Furthermore, as if that wasn't disturbing enough, Outlook Express also keeps records of EVERY SINGLE file attachment, after you told Outlook to erase it as well.
For earlier versions of Outlook Express, they will be located in either of the following folder:
c:\program files\internet mail and news\%user%\mail\*.mbx(replace %user% with the name you use.) or, if you're lucky, it will be located here:
c:\windows\application data\microsoft\outlook\mail\*.mbxI found it odd that the first time I installed Outlook, my e-mail data was saved automatically into "internet mail and news." After I uninstalled and reinstalled, it changed its mind and put it into my "application data." At this point you have two choices.
Deltree c:\windows\intern~1\%user%\mailor
Deltree c:\windows\applic~1\micros~1\outloo~1\mail(Typing in the above commands will kill all your e-mail correspondence. Do not follow those steps in less you have already backed up your e-mail.)
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
Found in the c:\windows\history\desktop.ini and the
c:\windows\history\history.ie5\desktop.ini contains this text:
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
CLSID={FF393560-C2A7-11CF-BFF4-444553540000}
The UICLSID line cloaks the folder in both DOS and Explorer. The CLSID
line disables the "FIND" utility from searching through the folder.
(Additionally, it gives a folder the appearance of the "History"
folder.)
To see for yourself, you can simply erase the desktop.ini files. You'll
see that it will instantly give Windows Explorer proper viewing
functionality again, and the "FIND" utility proper searching
capabilities again. Problem solved right? Actually, no. As it turns
out, the desktop.ini files get reconstructed every single time you
restart your computer. Nice one, Billy.
Luckily there is a workaround which will keep Windows from hiding these
folders. You can manually edit the desktop.ini's and remove everything
except for the "[.ShellClassInfo]" line. This will trick windows into
thinking they have still covered their tracks, and (wininet.dll >
rundll32.exe) won't think to reconstruct them.
CD\
DIR *.IE5 /s/as
The problem is that you will receive a "No files found" error
message.
Since we already know there is a content.ie5 subfolder located here,
why is it giving me the "no files found" message?
Now, the really interesting thing is that you (luckily) can get
around this brick wall. That is, once you are in the system folder,
then the brick wall no longer has an effect on the directory
listings. For example, if you enter the system folder first, and
THEN try and find any folders then you can see them just fine:
CD\WINDOWS\TEMPOR~1
DIR *.IE5 /as
1 folder(s) found.
Now you will get a "1 folder(s) found." message. (But only after
you knew the exact location.) In other words, if you didn't know
the folders existed then finding them would be almost impossible.