Removing INDEX.DAT

Printable View

November 26th, 2001, 04:54 PM
Negative

Removing INDEX.DAT

I've seen some discussions on the forums about index.dat. Removing it in Win98 isn't difficult (boot to a DOS-prompt), but what about WinXP? The problem is that it can't be deleted because it always is in use by Windows.

Let's say your default username is 'Negative'. Then INDEX.DAT can be found in C:\Documents and Settings\Negative\Cookies

Here's how to delete Index.dat in WinXP:

1. Create another user-account: Start --> ConfigurationScreen --> User Accounts --> Create New Account.
Let's say you create another user named 'Noindex'.

2. Log off, and log on as 'Noindex'.

3. Log off AGAIN.

4. Log ON AGAIN as yourself.

5. Log OFF AGAIN, AND LOG IN AGAIN as 'Noindex'.

6. Logged on as 'Noindex', you can now go to C:\Documents and Settings\Negative\Cookies , and delete Negative's Index.dat.

Don't ask me why you have to log on and off that much: it's the only way it works...

This also should work for WinME.
November 26th, 2001, 05:02 PM
IchNiSan

hmm... in win98 I have had some luck simply renaming files that I could not delete as they were in use by the OS. Then deleting them after they had been renamed.

Wonder if that would work....

Im gonna try it, as soon as I get my XP machine running again...
November 26th, 2001, 11:49 PM
StressCrash

There is more than one index.dat, and also deleteing them will do you no good, seeing as they are just recreated everytime MSIE restarts, there is a very interesting article on this at http://www.****microsoft.com/content...n-files.shtml,
i am working on a program to disable these files, as soon as i complete it i will post a link.
November 26th, 2001, 11:58 PM
gaxprels

An easier way...

In win9x you can delete the files that are normally in use by Windows by simply booting into DOS mode and deleting them from there. That's how I manually remove some virus components when I'm cleaning an infected system at work. I haven't tried this with XP as I do not know if it has a "DOS" mode (since it's based off of the NT kernel, I would think it doesn't, but Microsoft has done stranger stuff.)

Hope this helps.

Happy Hacking
November 27th, 2001, 12:40 AM
StressCrash

Nope, not as far as i know, when i had XP installed i could not find a way to boot into dos, without a boot disk, that i had to make on my other comp, and since it was running ME it didnt work correctly with XP, anyway XP sucks, and im back to 98.
November 27th, 2001, 05:25 AM
Negative

Quote:

Originally posted by StressCrash
There is more than one index.dat, and also deleteing them will do you no good, seeing as they are just recreated everytime MSIE restarts

As I said in my first post, I'm talking about the URL-cache index.dat-file, located in the 'Cookies'-directory. You say deleting it 'will do you no good': have you ever opened the file? That's like saying deleting cookies is no good. There have been discussions on AO on how to remove the d**n thing. Well, the log-on and -off thing allows you to remove it. Nothing more, nothing less.

Quote:

Originally posted by StressCrash
there is a very interesting article on this at http://www.****microsoft.com/content...n-files.shtml,

Quote:

The requested URL /content/ms-hidden-files.shtml, was not found on this server.
Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.
--------------------------------------------------------------------------------
RedApache/X.X.XX Server at www.****Microsoft.com Port 80

Enough said...

Quote:

Originally posted by Gaxprels
In win9x you can delete the files that are normally in use by Windows by simply booting into DOS mode and deleting them from there. That's how I manually remove some virus components when I'm cleaning an infected system at work. I haven't tried this with XP as I do not know if it has a "DOS" mode (since it's based off of the NT kernel, I would think it doesn't, but Microsoft has done stranger stuff.)

Didn't I say that in my first post?
WinXP doesn't have a "DOS"mode, that's where the log-on and -off thing comes in...

Quote:

Originally posted by StressCrash
Nope, not as far as i know, when i had XP installed i could not find a way to boot into dos, without a boot disk, that i had to make on my other comp, and since it was running ME it didnt work correctly with XP, anyway XP sucks, and im back to 98.

Huh? That's an easy way to bash Windows...
I once tried booting Mandrake with a RedHat bootdisk... It didn't work... Linux sucks... Yeah right...
November 27th, 2001, 05:29 AM
Matty_Cross

Hey Neg,
He just stuffed up the url, theres a comma on the end that isn't meant to be there....
November 27th, 2001, 08:39 PM
gaxprels

Oops.....

Quote:

Didn't I say that in my first post?
WinXP doesn't have a "DOS"mode, that's where the log-on and -off thing comes in...

Sorry...
Not enough caffein and not enough sleep. (I have two children, 'nuff said for that) I'll try to reread the posts next time. Good information, though. Thanks.

Happy Hacking
November 27th, 2001, 10:47 PM
StressCrash

As I said in my first post, I'm talking about the URL-cache index.dat-file, located in the 'Cookies'-directory. You say deleting it 'will do you no good': have you ever opened the file? That's like saying deleting cookies is no good. There have been discussions on AO on how to remove the d**n thing. Well, the log-on and -off thing allows you to remove it. Nothing more, nothing less.

In that case ==>> http://www.fsm.nl/ward/

Huh? That's an easy way to bash Windows...
I once tried booting Mandrake with a RedHat bootdisk... It didn't work... Linux sucks... Yeah right...

I wasnt bashing windows for not booting correctly, i didnt expect it to, i was bashing XP for the lack of dos........
November 28th, 2001, 08:47 AM
Matty_Cross

WtF?!?!.. Someone gave me negative antipoints for pointing out that there was a comma that didn't belong on the end of the url StressCrash posted.
November 29th, 2001, 05:57 AM
purple

Great info....

Thanks for the great info. guys. I never realized
how many footprints we leave lying around on our computers.

Are there any other files that I should be concerned with besides index.dat?

I've been programming for years and I have just recently started
getting my feet wet into security, so any info. would be great.
November 29th, 2001, 08:38 AM
madrone15

index.dat

What is the purpose of removing the index.dat file?
November 29th, 2001, 09:15 AM
Matty_Cross

Madrone15: The index.dat files store information about your browsing and such.. deleting it is simply a privacy issue, as if you open up certain index.dats you can scroll through and see what websites a person has been visiting, even usernames and passwords....

Oh and to the complete and utter idiot who gave me negative antipoints because they thought my signature was wrong..
The Band is called "System of a Down" not "System of the downed?"
Before you start giving out antipoints next time, maybe you should check whether you actually know what your talking about...
November 29th, 2001, 12:17 PM
dieterle81

[QUOTE]Originally posted by Matty Cross
[B]Madrone15: The index.dat files store information about your browsing and such.. deleting it is simply a privacy issue, as if you open up certain index.dats you can scroll through and see what websites a person has been visiting, even usernames and passwords....

very interesting posting but how can i read the content of the index.dat file?
November 29th, 2001, 01:07 PM
Matty_Cross

Notepad can do it with IE5..
I believe the index.dat in IE6 is actually encrypted, so I don't know what can read that....
November 29th, 2001, 02:25 PM
dieterle81

Quote:

Originally posted by Matty Cross
Notepad can do it with IE5..
I believe the index.dat in IE6 is actually encrypted, so I don't know what can read that....

yep, i have tried but i got things like that:
Client UrlCache MMF Ver 5.2 Ã€ @ < â‚¬ Â*
Ã°Â*Ã°Â*Ã°Â*Ã°Â*Ã°Â*Ã°
and so on.. thats all.
can i "decrypt" in humanreadable form??
thanks
November 29th, 2001, 02:29 PM
Matty_Cross

I take it your using IE5..

How far did you scroll down?? there is usually a fair distance between the start of the file and the entries...

As for decrypting the index.dat in IE6, I don't know.. its possible, thats for sure.. but how beats me...

I'll ask one of my friends and see if he wants a mini project to work on...
November 29th, 2001, 03:16 PM
dieterle81

[QUOTE]Originally posted by Matty Cross
[B]I take it your using IE5..

How far did you scroll down?? there is usually a fair distance between the start of the file and the entries...

i did it and you can read the sites and cookies but after erase from the history/temp..files i've got only the cryptical signs..
i found similar signs in \windows\system\wininet.dll as well and the file was very big (ca. 500kb) compare to the index.dat.
anyway, i like to decrypt the signs.if anybody can help me it would be nice.
cheers!!
November 29th, 2001, 10:53 PM
StressCrash

You want to view/remove all these files and hidden info, go here

http://www.fsm.nl/ward/

And download Spyder 1.6, that will unencrypt it for you and show you all the hidden info, it even works with IE6 i belive.
November 30th, 2001, 05:59 PM
dieterle81

first i like to say thanks for that good posting from negative!!
i have tried the spider software .. you can see alll url's but you can't remove (i 'm using ie5.. is it a bug??) and then i did manually:
cd \windows\tempor~1
deltree/y content.ie5
after 5 min all was erased..
but anyway i can say only :
don't believe the hype!!
November 30th, 2001, 09:46 PM
xstonedogx

Couldn't you use your dual boot system to boot into Linux, mount the Windows partition, and delete the file?
December 1st, 2001, 04:13 AM
StressCrash

in theory yes