By Josh VinneyIntroduction:There are folders on your computer that Microsoft has tried hard to keepsecret. Within these folders you will find two major things: MicrosoftInternet Explorer has been logging all of the sites you have ever visited –even after you’ve cleared your history, and Microsoft’s Outlook Express hasbeen logging all of your e-mail correspondence — even after you’ve erasedthem from your Deleted Items bin. (This also includes all incoming andoutgoing file attachments. ) And believe me, that’s not even the half of it.
When I say these files are hidden well, I really mean it. If you don’t haveany knowledge of DOS then don’t plan on finding these files on your own. Isay this because these files/folders won’t be displayed in Windows Explorer atall — only DOS. (Even after you have enabled Windows Explorer to “view allfiles. “) And to top it off, the only way to find them in DOS is if you knewthe exact location of them. Basically, what I’m saying is if you didn’t knowthe files existed then the chances of you running across them is slim toslimmer.
It’s interesting to note that Microsoft does not explain this behavioradequately at all. Just try searching on microsoft. com. I know there are some people out there that are already aware of some of the things I mention. I also know that most people are not. The purpose of this tutorial is teach people what is really going on with Microsoft’s products andhow to take control of their privacy again.
This tutorial was written by me,so if you see a mistake somewhere then it is my mistake, and I apologize. Thanks for reading. INDEX:1) DEFINITIONS AND ACRONYMS2) WHY YOU SHOULD ERASE THESE FILES3) HOW TO ERASE THE FILES ASAP3. 1) If You Own Microsoft Internet Explorer3. 2) Clearing Your Registry3. 3) If You Own Outlook Express3.
4) Slack files3. 5) Keeping Microsoft’s Products4) STEP-BY-STEP GUIDE THROUGH YOUR HIDDEN FILES (For the savvy. )1. DEFINITIONS AND ACRONYMSWell, the best definition I have been able to come up with is the following:I) A “really hidden” file/folder is one that cannot be seen in WindowsExplorer after enabling it to “view all files,” and cannot be seen in MS-DOSafter receiving a proper directory listing from root. a) There is at least one loophole to enabling Windows Explorer to see them.
b) There is at least one loophole to enabling MS-DOS to see them. (Interesting to note that the “Find: Files or Folders” utility cannot evensearch through one of these folders. It doesn’t even exist on the Browsemenu. )II) Distinguishes “really hidden” file/folders from just plain +hidden ones, such as your “MSDOS. SYS” or “Sysbckup” folder. III) Distinguishes from certain “other” intended hidden files, such as a filewith a name with high ascii characters (eg, “ei”).
DOS = Disk Operating SystemMSIE = Microsoft Internet ExplorerTIF = Temporary Internet Files (folder)HD = Hard DriveOS = Operating System2. WHY SHOULD I ERASE THESE FILES?Just from one of these files I would be able to tell you which web sites youpreviously visited, what types of things you search for in search engines, andprobably gather your ethnicity, religion, and sexual preference. Needless tosay, one can build quite a profile on you from these files. It has thepotential to expose and humiliate — putting your marriage, friendship, andcorporation at risk.
Here’s one good example of the forensic capabilities. . . ——————————————————————————“I’ve been reading your article as I have a problem with an employee of mine.
He has been using the works pc for the internet and using it to chat and lookat porn sites. He was then deleting the cookies and history in order to coverhis tracks. A friend of mine pointed me in the direction of this site andyour article. I have found it to be incredibly useful,.
. . “–Concerned Boss, 8/24/01——————————————————————————3. HOW TO ERASE THE FILES ASAPStep by step information on how to erase these files as soon as possible.
This section is recommended for the non-savvy. Further explanation can befound in Section 4. 0. Please note that following these next steps will erase all your cache files and cookies files. If you use the offline contentfeature with MSIE, it will remove this as well. It will not erase yourbookmarks.
3. 1. IF YOU OWN A COPY OF MICROSOFT INTERNET EXPLORER1) Shut your computer down, and turn it back on. 2) While your computer is booting keep pressing the F8 key until you aregiven an option screen.
3) Choose “Command Prompt Only” This will take you to real DOS mode. MEusers must use a bootdisk to get into real DOS mode. 4) When your computer is done booting, you will have a C:> followed by ablinking cursor. Type in this hitting enter after each line (sansparenthesis):C:WINDOWSSMARTDRV (Loads smartdrive to speed things up. )CDDELTREE/Y TEMP (this line removes temporary files.
)CD WINDOWS DELTREE/Y COOKIES (This line removes cookies. )DELTREE/Y TEMP (This removes temporary files. )DELTREE/Y HISTORY (This line removes your browsing history. )DELTREE/Y TEMPOR1(If this last line doesn’t work then type this:) CDWINDOWSAPPLIC1DELTREE/Y TEMPOR1 (If this doesn’t work then type this:) CDWINDOWSLOCALS1DELTREE/Y TEMPOR1(If this still does not work, and you are sure you are using MSIE5.
x, thenplease e-mail me. Finding the location of these may be difficult and I’dcertainly like to know where else MSIE likes to hide its cache. I believeolder versions of MSIE keep them under “windowscontent”. )This last one will take a ridiculous amount of time to process. The reason ittakes so incredibly long is because there is a ton of semi-useless cachestored on your HD.
3. 2. CLEARING YOUR REGISTRYIt was once believed that the registry is the central database of Windows thatstores and maintains the OS configuration information. Well, this is wrong. Apparently it also maintains a bunch of other doo-dah that has absolutelynothing to do with the configuration.
I won’t get into the other stuff, butfor one, your Typed URLs are stored in the registry. HKEY_USERS/Default/Software/Microsoft/Internet Explorer/TypedURLs/HKEY_CURRENT_USER/Software/Microsoft/Internet Explorer/TypedURLs/These “Typed URLs” come from MSIE’s autocomplete feature. It records all URLsthat you’ve typed in manually in order to save you some time filling out theaddress field. By typing “ama” the autocomplete feature might bring up”amazon. com” for you.
Although, I find it annoying, some people prefer thisfeature. One thing is for sure, however — it’s an obvious privacy risk. Youwouldn’t want a guest to type “ama” and have it autocomplete”amaturemudwrestlers. com” now would you?You can clear your Typed URLs out of your registry by doing going to Tools >Internet Options > Content > AutoComplete > and finally Clear Forms underMSIE. If you do not like the AutoComplete feature then uncheck theappropriate boxes here.
3. 3. IF YOU HAVE OUTLOOK OR OUTLOOK EXPRESS INSTALLEDMicrosoft’s e-mail clients DO NOT delete your messages until a) you reallyknow how, and b) you go through the redundant process. And besides this,there’s the glaring e-mail virus problems (in which virtually all other e-mailclient’s are immune to.
) This, alone, should be enough to want to strangleSlick Willy — as I like to call him. My suggestion?1) Install another e-mail program like Eudora or Pegasus Mail. Make sureeverything is setup correctly. (www. eudora. com / www.
pmail. com)2) Backup any e-mail and address books that you wish to save by making use ofthe export/import features. 3) Uninstall Outlook. Warning: Simply uninstalling Outlook does not erase any of your e-mailcorrespondence. The database files are still there on your hard drive.
Tofind them open up a DOS window and type this:dir *. mbx /s/pThe files you are looking for are: INBOX. MBXOUTBOX. MBXSENTIT1. MBXDELETE1. MBXDRAFTS.
MBXIf these files come up they should be listed in either of these folders: C:WindowsApplication DataMicrosoftOutlook ExpressMailC:Program Filesinternet mail and news%USER%mailNow type either of the following (depending on the location of your . mbx files. . . )*Remember, this will erase all your e-mail correspondence so backup what youwant to keep. By now you should have already imported your mail into Eudora,or Pegasus Mail.
CDWINDOWSAPPLIC1MICROS1OUTLOO1DELTREE/Y MAILorCDPROGRA1INTERN1%USER%(replace “%user%” with the proper name. )DELTREE/Y MAILIf you have newer versions of Outlook or Outlook Express the databases are*. dbx, or *. pst files. Five times as creepy as the *.
mbx files. I recommendthat you take a look at them yourself. )3. 4.
SLACK FILESAs you may already know, deleting files only deletes the references to them. They are in fact still sitting there on your HD and can still be recovered bya very motivated person. u BCWipe is a nice program that will clear these files. (www. bcwipe. com).
u For you DOS buffs, there’s a freeware file wiper on simtel. net that I use. (www. simtel. net/pub/dl/45631. shtml).
u If you are using PGP then there is a “Freespace Wipe” option under PGPtools. u The latest version of Norton Utilities has a nice filewiping utility. u You might want to check out Evidence Eliminator’s 30 day trial. This isprobably the best program as far as your privacy goes. (www.
evidence-eliminator. com)3. 5. KEEPING MICROSOFT’S PRODUCTSIf you insist on using Microsoft Internet Explorer then I strongly recommendthat you check out at least one of these programs: u PurgeIE (www. aandrc. com/purgeie)u Cache and Cookie Cleaner for IE (www.
webroot. com/washie. htm)u Anonymizer Window Washer (www. anonymizer.
com/anonwash)Other programs that claim to clear your history don’t seem to work, althoughI haven’t run any tests in a while. And if you insist on using Outlook or Outlook Express then you should get inthe habit of compacting your mailboxes. You can do this by going to File > Folder > Compact All if you have OutlookExpress. orTools > Options > Other tab > Auto Archive if you have Outlook. Make sureto set things up here.
4. STEP-BY-STEP GUIDE THROUGH YOUR HIDDEN FILESThis next section is for those of you who are more interested in learning the ins and outs of your computer. This section is intended for the savvy user. The most important files to be paying attention to are your “index. dat” files. These are database files that reference your history, cache and cookies.
Thefirst thing you should know is that the index. dat files is that they don’texist in less you know they do. They second thing you should know about themis that some will *not* get cleared after deleting your history and cache. The result:A log of your browsing history hidden away on your computer after you thoughtyou cleared it. To view these files, follow these steps:In MSIE 5.
x, you can skip this first step by opening MSIE and going to Tools >Internet Options > Settings > View Files. Now write down the names ofyour alphanumeric folders on a peice of paper. If you can’t see anyalphanumeric folder names then start with step 1 here:1) First, drop to a DOS box and type this at prompt (in all lower-case) tobring up Windows Explorer under the correct directory. .
. c:windowsexplorer /e,c:windowstempor1content. ie5You see all those alphanumeric names listed under “content. ie5?” (left-handside. ) That’s Microsoft’s idea of making this project as hard as possible.
Actually, these are your alphanumeric folders that was created to keep yourcache. Write these names down on a peice of paper. (They should looksomething like this: 6YQ2GSWF, QRM7KL3F, U7YHQKI4, 7YMZ516U, etc. . . ) If youclick on any of the alphanumeric folders then nothing will be displayed.
Notbecause there aren’t any files here, but because Windows Explorer has lied toyou. If you want to view the contents of these alphanumeric folders you willhave to do so in DOS. (Actually, this is not always true. *Sometimes*Windows Explorer will display the contents of the alphanumeric folders — butmostly it won’t. I can’t explain this.
)2) Then you must restart in MS-DOS mode. (Start > Shutdown > Restart inMS-DOS mode. ME users use a bootdisk. )Note that you must restart to DOS because windows has locked down some of thefiles and they can only be accessed in real DOS mode.
3) Type this in at prompt:CDWINDOWSTEMPOR1CONTENT. IE5CD %alphanumeric%(replace the “%alphanumeric%” with the first name that you just wrote down. )DIR/PThe cache files you are now looking at are directly responsible for themysterious erosion of HD space you may have been noticing. One thingparticularly interesting is the ability to view some your old e-mail if youhappen to have a hotmail account. (Oddly, I’ve only been able to retreivehotmail e-mail, and not e-mail from my other web-based e-mail accounts.
Sendme your experiences with this. ) To see them for yourself you must first copythem into another directory and then open them with your browser. Don’t askme why this works. A note about these files: These are your cache files that help speed upyour internet browsing.
It is quite normal to use this cache system, as everymajor browser does. On the other hand. It isn’t normal for some cache filesto be left behined after you have instructed your browser to erase it.
