The Really Hidden Files...

I'm sure that most people know something about this, but I didn't see too much about it posted here. Well, I found a text while searching Gnutella, and I'll post it here for you people to download and read...

Quote:

---

There are folders on your computer that Microsoft has tried hard to keep
secret. Within these folders you will find two major things: Microsoft
Internet Explorer has been logging all of the sites you have ever visited --
even after you've cleared your history, and Microsoft's Outlook Express has
been logging all of your e-mail correspondence -- even after you've erased
them from your Deleted Items bin. (This also includes all incoming and
outgoing file attachments.) And believe me, that's not even the half of it.

---

I've gone through a little bit of this, and for some reason, I wasn't really able to see the files that it was stressing about so much... Maybe I've got a good config...? Either that, or they really are hidden well... I did see some of my very, very old e-mails, but no trace what-so-ever of my more recent e-mails... At least it explained what Find-Fast (supposedly) does...

-Tim_axe

kewl.. i wonder if MS also READS those e-mails..

haha well they probably have access to all our Hotmail and MSN accounts...they might read those...

I don't think they would read everyones e-mails it would cost them loads in money and manpower, but yeah it is scary to think that they could have access to our emails

they exist..believe me, they exist.

they're quite useful to law enforcement forensics because they can open them all up and see where you've been.

It is indeed very scary. Thanks for the info, Tim_axe. :)

these files existing are somewhat of a double edge sword. i don't like knowing that bill can see where i've been, but as Kezil mentioned they are useful for law enforcement forensics. i used them when we *asked* one of our powers that be to leave the company for surfing porn at work. he thought he'd covered his tracks, but he had no clue about the hidden files(and probably still doesn't know how i got the files).

as for m$ reading our hotmail or msn accounts. that does not apply to only m$, it applies to anyone hosting YOUR mail. my advice, host your own mail server.

great article, thanks a million Tim_axe :-)

-Prankster

They only read your e-mail if your important so I guess were all safe :)

help? i got 6.0, with XP, c:\windows\explorer /e,c:\windows\tempor~1\content.ie5\ this does not work, no does tools and options, this is pree XP?

I'm fairly sure the same type of files (if not the same files) are in XP, too. They're not normally labelled blatantly like "cookies" and "temporary internet files".

btw, the reason for the files is windows is to lazy to clean itself, so it just stores them like that, I believe

im sure they have programs to screen the email so they no which ones to read, for example, if your email says 'bill gates' in it bill gates will read it and if he thinks you might be up to something or targeting his company then he sends his teams of crackers to fry your computer, if you target the government then he just hides it away so that when you do something he can sue you for misuse of his services...well at least that swhat i think but ya there are those truly hidden files, they say the only way you can ever truly get rid of a file is to destroy your hard drive(physically, maybe a hammer?)

Whatever they are using it for, I think it is an invasion of privacy and that's wrong.

whats really wierd is that even after you format -- they still stay there --

btw i have known this for around 2years :o so its old new..

the original guy that found it was a hacker - on a hacker forum :)

The more I think about the information in the post, the more I think about it seems to me to be more M$ 'features' that could be abused; however, that wasn't likely to be the intent. It is pretty obvious that IE stores information about past things anyways, how do you think it magically completes URL's or fills in form boxes, or various other things like that, it stores them. I would think that M$ would make some kind of an attempt to hide the information because it can be somewhat sensitive; however, at the same time I would be interested to know how much of that stuff would still be there if you turned off the features like autocomplete...

That wasw also posted on ****microsoft.com. Interesting anti- Bill site.

thanks! great info!

In winxp, look under c: documents and setting/username/local settings/temporary internet files/ (its a hidden folder)
These can be deleted, but there is also a .dat file that I have been unable to remove. It contains a list of urls visited. I suppose that if you want rid of that one, you would have to use athe command line to delete it, but I don't know what overall affect that would have on your OS. Any additional input or info is appreciated.

couple of opinions and hints here.... (dons flameproof suit from his closet of reality)

1) if you dont like it... dont use it...
2) this came up at my company from an employee (who by chance is the worst abuser of bandwidth and gets nothing done... go figure) about email... as I am the email admin.... Fact is... I dont have time to read MY email... why would I care to take the time to find out what lame gossip someone else is sending out or receiving....

3) tools > folder options > show all files

4) If you read the documentation and liscensing of most the products you use, you will realize that there is in fact no punches pulled... nobody is spying on you without your knowledge... anybody with common sense should be able to see this. This is the benefit of living in the US or using US merchandise.... the information IS there and it IS available, it may be harder to find (buried in marketing and other babble) but it's there.

5) this all points to the fact that Dimestore anarchist actions, and the nationwide (sadly) paranoia view that "everyones against me" have little or nothing to do with reality.

6) (this ones bound to get me flamed.... oye) in respect to number 5... everybody wants a free society with no controlling entity... but when a tragedy happens due to lack of control (ex. Sept 11th) everybody changes their view.... and of course here in the US... there is a typical 6 month memory span... everybody wanted stricter airport security.... now... there is an uprising of cases where people feel their rights were violated by the stricter airport security. I'm sorry... but everybodys a hypocrite (even myself) dont whine about lax security one day, and then whine about having your rights violated because you were in a hurry to get somewhere the next.... reality doesnt work like that.

Bottom line... its not the government, its not bill gates, its your head.... yes things are monitored... and yes there is risk.... thats part of the reality of society.. I happen to think we've gotten fairly close to balance right now, and balance will probably never be acheived... if you really dont like it.... dont use it... dont live there, dont buy it, dont wear it, and dont think about it

he he... que flames.... argh...

allenb1963
if the file is small enough copy it 2 a floppy or another drive or something and then if ne thing goes wrong after you delete it try putting it back

thank`s for the info tim axe but couldnt u just tweek the file`s in your registery so they wont store stuff just a thought

like lench says, copy it, but if you wanna do your dirtys then copy the files before they are used, then copy the clean ones back after there dirty. sure it shouts out that you did it cause it says you havent accesed that resource at all (like get them right off a fresh install) but in todays society lack of evidence isnt evidence.......... oh well

also if you use a 3rd party partitioner itll get rid of them probly (install linux, it dosnt use M$ to format anything and even goes over the MBR as well)

Bill gates sucks, its obvious that they are recording our doing and so on, Why? for marketing of course, they'll check out where we go and sell on the info, you know what them coporate bastards are like...

Quote:

---

Originally posted here by hellbringer87
haha well they probably have access to all our Hotmail and MSN accounts...they might read those...

---

They wouldn't want to read all of the spam that gets sent to those accounts. Unless they are the ones that sign us up for e-mail lists on pornography and the such.

The approach I use on my PC at home to remove IE history & index files is to run this bat file from time to time.

del "C:\windows\tempor~1\content.ie5\index.dat"
del "C:\windows\history\history.ie5\index.dat"
deltree "C:\windows\tempor~1\content.ie5"
deltree "C:\windows\history\history.ie5"
deltree "C:\windows\temp" /y
md "C:\windows\temp"

I’m sure this could be improved, but it seems to do the basics !

This has to be run in safe mode or under "MS-DOS mode". As my PC at home still runs Windows98 I have an icon on the desktop which executes this batch file, but with the option checked to make it run in MS-DOS mode. So the PC reboots, runs the batch file, and reboots again at the end to restart Windows.

If you are worried about your email folders, just find the originals (*.dbx for Outlook express for example, and browse them using notepad etc. to see what they contain.) If there is nothing you want to keep then you can delete the inbox & deleted items folders, as they will be recreated when you restart your email software.

All the index.dat files get recreated at boot time, but I'm still not sure where some of the data comes from.

I just want to give everyone some PRELIMINARY info. I decided to post now because there COULD be some problems with the recommendations in the download file:

I draw your attention to:

"3.5. KEEPING MICROSOFT'S PRODUCTS"
And then "If you insist on using Microsoft Internet Explorer then I strongly recommend
that you check out at least one of these programs:
PurgeIE (www.aandrc.com/purgeie)"


I was familiar with the other recommended programs, but not PurgeIE. I downloaded PurgIE from the above link. I use PestPatrol, which is a program like ad-aware (http://pestpatrol.com ). PestPatrol also supposedly finds trojans and keyloggers. I say SUPPOSEDLY because I don't 100% trust anything anymore.

However, here's the log info from Pestpatrol:

--------------------------------log begins----------------------------------------------------------

Pest Detected in c:\Program Files\PurgeIE\unins000.exe
Pest: WinSpy
Category: Key Logger
Description: From the doc: 'Want to find out what activities have done on your computer ? With @WinSpy, You can find out exactly what others have done on your computer , including what web sites they have been, what text, images, movies they have seen. and also what files they opened/saved, what kind of search they have done and what they ran at the start menu. Double click the displayed item will directly open or link to the file or the URL stored on your computer.' Commercial product from http://www.monitoring-spy-sof
Author: AceSoft
Release Date: 7/17/2002
User Action: deleted


Pest:
Category: Key Logger
Description: From the doc: 'Want to find out what activities have done on your computer ? With @WinSpy, You can find out exactly what others have done on your computer , including what web sites they have been, what text, images, movies they have seen. and also what files they opened/saved, what kind of search they have done and what they ran at the start menu. Double click the displayed item will directly open or link to the file or the URL stored on your computer.' Commercial product from http://www.monitoring-spy-sof
Author: AceSoft
Release Date: 7/17/2002
User Action: deleted

---------------------------------------------------log ends--------------------------------------------------

I don't want to raise an alarm here, I just think that if you are going to use a cookie and/or url eraser, then until I - or someone else here - can investigate and followup, then use one of the other programs.

Followup:

I contacted the creator of PurgeIE. He has received another inquiry regarding this keylogger alert that I mentioned in my preceding post. He has double-checked the executables in the download archive files and they seem OK. This may very well be false positive, but we'll see.

Also, I have contacted PestPatrol's help desk and should get an answer within the next 24 hours.

I thought that a forum like this would be a good place to get help in tracking this type of thing down.

Thanks to all who can help.

Conspiracy theory or what? Of course no such log exists.

True, Windows modifes a lot of stuff all the time

It logs cookies (of course, otherwise what would be the point). It uses a cache (to speed things up). True, some URLs do sometimes creep into one or two other places, but it's not deliberate logging:

a) Even the logistics of gathering logging from everyone's PCs would be mind-boggling
b) If "they" wanted to log all the web pages you visited, they would bug your ISP as it's much easier and more reliable (like "they" can do here in the UK)
c) Even M$ aren't that stupid.

Perhaps you've recieved a knock on the head, or been abduced by aliens lately?

Quote:

---

Originally posted here by slarty
Conspiracy theory or what? Of course no such log exists.

True, Windows modifes a lot of stuff all the time

It logs cookies (of course, otherwise what would be the point). It uses a cache (to speed things up). True, some URLs do sometimes creep into one or two other places, but it's not deliberate logging:

a) Even the logistics of gathering logging from everyone's PCs would be mind-boggling
b) If "they" wanted to log all the web pages you visited, they would bug your ISP as it's much easier and more reliable (like "they" can do here in the UK)
c) Even M$ aren't that stupid.

Perhaps you've recieved a knock on the head, or been abduced by aliens lately?

---

Agree with your comments, except it does seem a bit odd that some of these files cannot be seen from Windows. For example if you do a search for index.dat (using Start/Find), then it will show you some of them, but not others. Of course, if you try and delete any of them, it won't work, as Windows is actively using them.

The main reason I run my bat file from time to time is to tidy up my HDD.
In IE, if you have history set to 0 days, and delete temporary files on exit, it does remove these files if IE shuts down normally (although the index.dat files are not updated - they still contain pointers to things that no longer exist, which includes the name of any URL you visited). However, if IE crashes for any reason, then the history/temporay cache files for your last session are left on your HDD, and will never be removed unless you manually delete them.
Cookies are a slightly different issue, as with IE6/Netscape and/or various third party products, you can choose whether or not to accept cookies on a site by site basis.

Quote:

---

Originally posted here by spirit909
whats really wierd is that even after you format -- they still stay there --

btw i have known this for around 2years :o so its old new..

the original guy that found it was a hacker - on a hacker forum :)

---

Um, I dono about AFTER a format, it might just be a 'virtual' file created by the Bios to stop the 0 file's problem... (Comp's can handel 0's most of the time)

- Noia

regarding the POTENTIAL for a trojan in purgie...

The PestPatrol tech support folks have given the program a clean bill of health.

They should apologize to Jim Lawler, the creator of PurgeIE. He was very helpful in straightening this out.

I like his program, and will continue to use it. PurgIE seems to do a great job deleting the leftovers that IE uses for cache purposes and other reasons.

http://www.purgeie.com

I was affraid of this type false alarm causing problems for good people.

Great post.. now where are those damn folders ...heheh

How does one locate theses hidden folders/files that seem to be sleeping in the background ?

Quote:

---

Originally posted here by TheCanCerMan
How does one locate theses hidden folders/files that seem to be sleeping in the background ?

---

Not quite sure what you were asking.
The txt file attached to the first post explains what to look for.

However if you want to look from scratch, then open a DOS window under Windows (don’t know if this will work under WindowsXP as it only emulates DOS) - may need to boot from a DOS floppy.
From the C:\WINDOWS prompt enter DIR /AS (to look for system files) - these are the ‘hidden’ directories that have been mentioned.
Next select one, e.g. TEMPOR~1 by entering CD TEMPOR~1, and enter DIR /AS again.
In this case CD CONTENT.IE5 will take you to the relevant directory.
Now entering DIR will show the INDEX.DAT file, and DIR /AS will show you all the temporary cache directories that have been created. You can browse or edit these directories to see what they contain.
If you want to delete them then a DELTREE *.* at this point will remove them (it will prompt you for each directory, so you can be sure you are not accidentally trashing your HDD!)
You won’t be able to delete the INDEX.DAT files, as these are in use by Windows itself.
To delete these you need to boot in DOS mode (or restart in MSDOS mode in Windows98).

For emails, you need to locate all copies of the folders that you are using to save your inbox, deleted files etc. AFAIK all normal email applications store these as a text file, so you can easily browse it and see what it contains. None of these files are hidden, but in a work environment there will be additional copies on the server, so deleting your personal copy won’t make any difference (assuming your sysadmin knows his job!)

Just to let you know, THEJRC, no heat from me...

I agree with your comments. With the exception of the current <euphemism>fluff</euphemism> flying around
regarding P2P hacking by the Corps, a little logging can be a good thing. If someone's got illicit messages/pr0n/
<insert possibly illegal whatever here> flying around, and they're getting nervous and/or indignant, there's
probably a good reason. This medium (the Internet in general, that is) was meant as a source of information,
education and (eventually) entertainment. What I find ironic is that since it was a DARPA project (if anyone
wants me to wax historical about this in detail, let me know), then gradually released into the public domain,
the technology that was meant to "keep clear and reliable means of communication" to the Armed Forces
has now turned around, in the hands of certain people, to bite them in the ass. Please excuse the
inappropriate language (I do try to keep on-line language cleaner than in real-life). Striking a balance is
the key here, folks. As a Canadian, I don't have a voice in the process the way Americans do. As amusing
as it would be to e-mail a senator or Congressional Rep (hmm, Washington State's pretty close...),
I really don't need to be raided by The Man for an unsolicited harassment from another country. If there's a way
to involve Canucks, I'm sure there'd be quite a few of us getting behind you guys. I've seen the petition URL's
floating around the forums regarding the bill/s before the House/Congress(?), and if there was only one thing I
can truly admire about the American democratic process (there is more than one, BTW) is that the voice of the
people can be very powerful, if properly applied. Band together, work with the system (it can be done) and
I'm sure there's a way to craft a bill that can be a deterrent to electronic terrorism (in its' myriad forms) without
turning well-intentioned geeks (wear that badge proudly, brothers and sisters!) into criminals by definition.

Phew! I really have to keep that verbal diarrhea i check.
Donning his asbestos jammies,

zaddikim

bids you good night

I believe that Microsoft is monitoring e-mails and internet browsing habits, but anyone who lives in the US is under that kind of scruteny from the government too. The US government passed a law after 9-11 that allows them to monitor e-mails, internet habits, cell phone calls, credit-card bills, and even what books you check out of the library.

For example, take cell phone calls. The US government has computers running through the cell frequencies listening in on conversations. If it hears a trigger-word(i.e. bomb, nuke, target, explosion, terrorist....) then it flags the person who said the word in a database on the computer. Too many flags and you get investigated by the F.B.I. They say it's for national security, but I say it's a little too far. I doubt that a person is sitting at a computer listening to me talking to my girlfriend, but I don't even want to have to think about even the *possability* of someone listening to my private conversations.

So, it's not just Microsoft out to destroy privacy, the US government is on that boat too.

In reply to The_Magistrate & zaddikim about emails/net/phone activity being logged.
It is a legal requirement of ISPs & phone companies in the US & Europe to keep a log of all activity. This data has to be divulged to certain law enforcement government agencies if they request it.
What has got people worried is that recently, both the US & the UK have put forward bills to allow any government agency access to this information without going through the courts. The UK government said it was 'surprised' at the number of protests from civil rights groups etc. over its proposals to make this data available to any person who works for the government.
There is a similar bill in the US which is going through the Senate at the moment (quote from Electronic Frontier Foundation ) - permission is given to freely reproduce their material:
"On July 15, 2002, the House of Representatives passed the Cyber Security Enhancement Act (CSEA) in a landslide vote of 385-3. CSEA is a bill that, among other things, makes it easy for the government to get your electronic communications without a warrant or probable
cause. Here's a brief summary:
- If CSEA is passed by the Senate, your stored communications like voicemail and email will be available to any "government entity" (not just law enforcement agencies) that can convince your service provider that releasing your personal information is necessary to prevent "death or serious physical injury." Instead of appearing before a judge and getting a warrant, any government agent may be able to get your information for nothing more than a scary story that might never get checked against the evidence."

The reason for this is supposed to be to combat terrorism.
Draw your own conclusions .....

With all that, it's quite obvious that MS apps keeps all kinds of user habits information onto your personnal computer. I don't really believe that they have the time to check everything that goes through the net since it would be a hell of a job...

The thing I hate the most, is that they take avantage of Net newbies that don't understand **** about all the security issues out there. In IE, your search for a web site, if it's spelt badly you get to a search page in a form format... Where does the post go ? Don't know, and I don't wanna know !

Anyway, a lot of 3rd party apps exist out there to help you clean you PC even at a raw level. Some bad minds would use it to erase their trace (don't even think about it, you may erase what's on your disks, but you still went through the net and your MAC adress won't change... think about it).

Personnaly I've tried Evidence Eliminator http://www.evidence-eliminator.com . It's a real good product to erase all the garbage left by your applications and gain a little performance at the same time...

Enjoy !

Quote:

---

Originally posted here by DBEAUCHAMP
[B]...don't even think about it, you may erase what's on your disks, but you still went through the net and your MAC adress won't change... think about it

---

I agree, and, although I don't know exactly how those evidence eliminator programs work, unless it over-writes the deleted data many times, it is still possible to retrieve that data....i.e. by the fbi/nsa....

I'm sure that products like Evidence Eliminator do a good job - looks like it uses reasonable data wiping techniques (DoD approved, which will defeat any normal hacker).
I don't think that MS deliberately set out to log info about you, but like a lot of apps they are not very good about garbage removal (and yes, this does apply to a lot of*nix software as well!). Which means that your HDD ends up with all sorts of footprints about what you have used it for. On an unsecured PC connected to the net, this info can be hacked, or the data can be recovered if you sell your PC or have it repaired.

Securing your PC and getting rid of the garbage is not likely to help much if you are using it for something illegal, as there are all sorts of other ways of finding out what you were doing.
However, it will protect against attempts to steal your CC details, online banking details, personal emails etc. - and if you are sending emails that are personal/confidential then you should be using something like PGP anyway.