Stop Microsoft

All Things Microsoft => Microsoft Software => Topic started by: OperationUndermind on 14 August 2005, 03:58

Title: Easy Removal of Windows Super Hidden Temp Files
Post by: OperationUndermind on 14 August 2005, 03:58
Maybe someone else has brought this to the table, but I have found a foolproof way of easily accessing and removing these files.
 
On Windows XP I simply right-clicked on my desktop and pointed to "New" and then "Shortcut." I then entered the full path to the elusive "content.ie5" folder (on my particular system: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5) Now anytime I double click this new shortcut icon, the previously hidden and virtually inaccessible folder pops right up. It's a simple matter to then manually Ctrl+A and delete everything in sight. Then simply back up a level and do the same to all the files in "Temporary Internet Files" and another level to the "Temp" directory.
 
Of course, I also have a batch file that runs on startup to do the same thing as many of you probably do, but I thought I'd post this for those who might want to go in and manually do it from time to time.
 
Please post to this thread your experience using this technique.
 
Thanks for reading!
 
:thumbup:
 
operationundermind
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Lead Head on 14 August 2005, 04:00
thats a good idea, and welcome to the forums
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: DBX_5 on 14 August 2005, 04:03
good idea, but wouldnt it be better and easier way just to stop using IE, or wiping out windows and installing something else? (warning this could be off-topic)
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Pathos on 14 August 2005, 05:39
???

That folder is perfectly accessible from explorer on my machine. The subfolders are all apparently empty. Are the "Super Hidden Temp Files" in theses subfolders or should they be visible?

What would happen if you made it read only?
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Orethrius on 14 August 2005, 06:12
Quote from: Pathos
What would happen if you made it read only?

IE throws shitfits trying to save cookies in a locked folder.  Kinda funny, but stupid all at once.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Aloone_Jonez on 14 August 2005, 22:27
Since Windows XP removes the content from these files anyway when you delete your history and temporary Internet files anyway this doesn't serve any purpose.

However it might be worth while to do this on pre-Windows 2000 systems. By the way if Explorer is running while you try to delete these files it won't work since it's using the files.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Jenda on 20 August 2005, 15:48
How would this work in win2k? I'm planning to add them to my Ubuntu computer sometime, I even left the first ten gigs on the harddisk free for them.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: OperationUndermind on 27 August 2005, 11:29
Quote from: Aloone_Jonez
Since Windows XP removes the content from these files anyway when you delete your history and temporary Internet files anyway this doesn't serve any purpose.
 
Sorry, no time for love, Dr. Jonez.
 
You are mistaken.
 
These files are NOT deleted.
 
Ever heard of "Content.ie5"?
 
Try looking at the properties of your "Temporary Internet Files" folder. There are folders that DO NOT show up in the icon view (yes, even with "show hidden files" turned on), but that are nonetheless there and storing all your surfing history, site graphics files and even emails you send.
 
Maybe even try a manual delete of everything in the "Temporary Internet Files" folder and looking at the properties of the seemingly "empy" folder again...
 
Those same inaccessible folders are still there and so is all that porn you have been looking at for all these years without doing something about these hundreds of megabytes of breadcrumb, telltale files.
 
So, keep on thinking that these files don't exist or that Windows is actually deleting ALL your internet files and history when you click the "delete files" and "clear history" buttons in internet options.
 
Keep on thinking that I went through the trouble of researching the issue, installing a "cleaner" app in my startup file and posting a message to the forum.
 
Keep on thinking that this is all a hoax and that thousands of other people out there are just paranoid and out of a severe case of boredom go about writing useless apps to delete files that aren't there in some kind of purposeless intellectual exercise. It's your bit-trail buddy, not mine.
 
What I find truly disconcerting is that you appear to be a long time techie who should have known about this issue long ago and that you come across as if you are actually DEFENDING Microsoft's integrity...like you think they don't mislead us, spy on us or collect personally identifying information and track our internet activity? Right.
 
Now, trying to get us to believe that really "doesn't serve any purpose."
 
:nothappy: o p e r a t i o n u n d e r m i n d :nothappy:
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Aloone_Jonez on 27 August 2005, 14:13
I've being arguing this point for a long time, I am not defending Microsoft I'm just being fair to them. These files are no big scam to find out what everyone is looking at on the Internet if they wanted to do that they would've come up something far more devious than this.

On Windows 9x I'm sure the contents of the files still remain after you've deleted your temporary internet files, but with Windows XP the files still remain in place but their contents have gone.

Try this, in your normal user account browse the Internet for anything, and remember some of the websites you've visited. Create annother user account as WMD said and look at the files in Explorer, look at the size of the index files, veiw them with a text editor and you'll see the names of the pages you've visited. Now log off your special account and log back in to your normal account, delete the files the usal way in Internet Explorer. You'l find when you view them with you other account they'll still be there but they'll be a lot smaller and if use a text editor you'll notice all the website names are gone.

This is the case with my machine running XP home edition sp 2 with all the updates installed,  don't know about Windows 2000, but the article is out of date as far as XP goes.

Appendum:
Here's (http://www.illhostit.com/files/9867465356903842/notepad%20shot.PNG) a screenshot of the index.dat files open in notepad, before the deletion is on the left and after is on the right, notice how all the porn sites have gone they've been replaced with a repeating pattern of bytes, the only site left was the MSN (the default homepage in IE).

So for your self I've uploaded my index.dat files, you can view them in a text editor such as notepad, I recommend using the word wrap option.

index.dat (http://www.illhostit.com/files/3910468447685705/index%20before.dat) before deleting.

index.dat (http://www.illhostit.com/files/8898586895626439/index%20after.dat) after.

I was wrong about one thing the files are the same size before and after, but the information contained with in them has gone - it's been overwritten.

Of course this doesn't prove anything, I could've easily   faked this, so I urge you to do the same experiment so you can see for yourself.

EDIT:
I forgot to say that Microsoft didn't mean any ill intent by not deleting the files in Windows 9x it was just a bug caused by poor programming.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Kintaro on 27 August 2005, 18:08
Yep, this is a myth even under Windows 2000, and it is busted.
http://www.microsuck.com/forums/showthread.php?p=101866#post101866
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: OperationUndermind on 27 August 2005, 22:18
Thanks for your input, but I'll keep letting my startup batch file delete these files anyway just to be certain.
 
:nothappy: o p e r a t i o n u n d e r m i n d :nothappy:
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: piratePenguin on 27 August 2005, 22:38
Quote from: Aloone_Jonez
I forgot to say that Microsoft didn't mean any ill intent by not deleting the files in Windows 9x it was just a bug caused by poor programming.
What about the folders being "really hidden" then? Surely they put alot of effort into doing that.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Aloone_Jonez on 27 August 2005, 22:49
The folders are hidden because Explorer doesn't read them  the same way as normal folders it treats them as system folders uses the indexing system made up of the index.dat files to read them. When you view the Temporary Internet Files folder you're actually looking at the contents of Content.IE5 DSFSDFSDF, SEWREWR, and WEREWRE, the index.dat files store a list of websites and the  appropiete files for each in the Content.IE5 folder.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: MarathoN on 27 August 2005, 22:54
Quote from: Aloone_Jonez
When you view the Temporary Internet Files folder you're actually looking at the contents of Content.IE5 DSFSDFSDF, SEWREWR, and WEREWRE, the index.dat files store a list of websites and the appropiete files for each in the Content.IE5 folder.

I always thought that was the case, thanks for assuring me that I was correct. :thumbup:
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: davidnix71 on 28 August 2005, 03:06
Editing the desktop.ini files works fine in 98/ME to unhide ContentIE, but what about anything NT based? (NT,2000,XP). Root-kits take advantage of a "feature" in NT that allows someone to create a file at the root and then hide it from the root.

If M$ really wanted to be devious, they would simply have IE create an accelerated privilege account to store all the info they wanted to have sent home to Bill. Even if YOU knew the info was hidden and where it was hidden, short of 'forcing' the hd open to force overwrite those sectors, or reformatting the hd, you couldn't view or delete it.

I had a Trash-80 a lonnnng time ago. There were commands called peek and poke that allowed you to manually read or write to an address, but even that was ram only.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Kintaro on 28 August 2005, 06:57
I just discovered with Windows 98 it is also a myth that the really hidden files store information that isn't removed.

Even with a typical disk cleanup, the stuff from Index.Dat is removed.

I will upload screenshots to prove my point.

Coming next: Windows XP.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: WMD on 28 August 2005, 07:02
Quote from: kintaro
I just discovered with Windows 98 it is also a myth that the really hidden files store information that isn't removed.

Even with a typical disk cleanup, the stuff from Index.Dat is removed.

I will upload screenshots to prove my point.

I don't know about that...I've seen plenty of large index.dat files, even after cleaning.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Kintaro on 28 August 2005, 07:52
Well I can assure you that it is the result of third party spyware, not Microsoft.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Aloone_Jonez on 28 August 2005, 14:28
WMD,
The two index.dat files I've posted above are the same size,  I didn't do a disc cleanup I just deleted them using Internet Explorer. Even though the size of the file after the deletion is the same as it was before it's contents have been overwritten by a repeating sequence of bytes, the list of porn sites has gone, the MSN home page is all that remains.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Kintaro on 28 August 2005, 16:07
Yeah, I noticed that myself. The size does not change on the files. They are filled with a not very white binary whitespace.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: WMD on 28 August 2005, 19:21
If this is all as you say...why would MS design such a complex/retarded system of storing something as simple as internet cache?
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Aloone_Jonez on 29 August 2005, 11:01
The Microsoft method may be complex/retarded but do you seriously think Mozilla Firefox does any better?

(http://illhostit.com/files/3211245883117819/Firefox%20cache.PNG)
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Kintaro on 29 August 2005, 13:02
I have no idea how either work, I might look into how the Mozilla one works. I have seen its strange footprint on my filesystem for some time. I will have to get the firefox sources and poke around.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Refalm on 29 August 2005, 18:00
At least the Firefox cache is in one directory and isn't hidden (like some files in "Temporary Internet Files" are).
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Kintaro on 29 August 2005, 18:15
Personally I feel the design is in place because the browsers need to keep track of what is in there, and also keep get rid of stuff that hasn't been used for a while, and not break things while doing that.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Aloone_Jonez on 29 August 2005, 19:09
Alright I'll try to explain thing at bit more clearly and I'll give and example.

The files are only hidden because Explorer is shows them as the list of files as URLs, each file has two names and locations the Windows one which you don't see Content.IE5\QWESADE\09.jpg and the URL (...) which is normally displayed, the index.dat files store each URL up against where the file is actually stored on the hard drive. This is done because the Windows file system doesn't allow for names like the above. Microsoft just thought it'd be more user friendly for the user to see the URL rather than the real location of the on the hard disc.

Refalm: Content edit. Crazy motherfucker, no pornography on this forum!
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: passive wind on 29 August 2005, 19:24
Dumbarse Fucking Retard!
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Aloone_Jonez on 29 August 2005, 19:46
:fu:
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: WMD on 29 August 2005, 22:11
Quote from: Aloone_Jonez
The Microsoft method may be complex/retarded but do you seriously think Mozilla Firefox does any better?

So, Firefox doesn't do better.  That's why I use Opera :p

Opera keeps everything in one directory, but it changes the filenames (not the extensions or anything).
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Refalm on 29 August 2005, 22:48
Quote from: WMD
So, Firefox doesn't do better.  That's why I use Opera :p

Opera keeps everything in one directory, but it changes the filenames (not the extensions or anything).

Yes, I like this too. It's perfect for ripping Flash files :)
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Kintaro on 1 September 2005, 17:39
While your at the job deleting your really hidden files, protect your Really Hidden Thoughts as well! (http://zapatopi.net/afdb/).
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: H_TeXMeX_H on 3 November 2005, 06:07
Quote from: kintaro
While your at the job deleting your really hidden files, protect your Really Hidden Thoughts as well! (http://zapatopi.net/afdb/).

Remember to put the shiny side out ... I know there are other theories on which side should face outward, but I argue it's the shiny side :cool:
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: pofnlice on 14 November 2005, 17:39
Maybe I'm a fuckwit, but this puter is running win XP service pack 2 and has no content.ie5 folder on it. Or at least one I can find...
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Jack2000 on 14 November 2005, 18:24
muauhahahua
ahhahha!
AFDB!:D
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: themacuser on 19 November 2005, 06:33
Really Hidden Thoughts is a myth too.

http://people.csail.mit.edu/rahimi/helmet/

Tinfoil hats don't work.

Oh, that site before says that it's suspect research and that there are many things wrong. Many things like what? They seem to be finding silly insignificant mistakes that would have no effect on the research. Who says that was the aluminium foil box they used? Or the antenna?
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: 187nimd4 on 21 November 2005, 19:57
Quote from: Aloone_Jonez
EDIT:
I forgot to say that Microsoft didn't mean any ill intent by not deleting the files in Windows 9x it was just a bug caused by poor programming.
HAHAHAHA Yea, it's all just a simple misunderstanding, isn't it ;P

Quote from: pofnlice
but this puter is running win XP service pack 2 and has no content.ie5 folder on it.
It's there you can bet your bottom dollar ;)
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Aloone_Jonez on 21 November 2005, 20:21
Quote from: 187nimd4
HAHAHAHA Yea, it's all just a simple misunderstanding, isn't it ;P

No seriously Microsoft aren't spying on you the files don't get deleted when you attempt to delete them on Windows 95/98 because of a bug. Why is this a suprize toy you, surly you must believe that Microsoft are guilty of poor programming.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: H_TeXMeX_H on 21 November 2005, 21:08
What about the registry keys ? They keep shit in there don't they ? Those are not quite as easy to get rid of ... at least by people who don't know what they are doing (this includes many)
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: 187nimd4 on 21 November 2005, 21:19
Quote from: Aloone_Jonez
No seriously
.. seriously I'm not worried about Microsoft (they're just gay), it's just what to do when the FBI come knocking and my killdisk crashes ;)
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: H_TeXMeX_H on 21 November 2005, 21:42
My killdisk is a big magnet ... and a sledgehammer just in case the magnet might have failed :D
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: skyman8081 on 22 November 2005, 01:38
Quote from: H_TeXMeX_H
My killdisk is a big magnet ... and a sledgehammer just in case the magnet might have failed :D

Thermite.  If it's good enough for the DoD, It's good enough for me.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: H_TeXMeX_H on 22 November 2005, 03:03
Quote from: skyman8081
Thermite.  If it's good enough for the DoD, It's good enough for me.

Thermite kicks ass ... only problem is getting it going, it doesn't always start, of course you could just keep a lot of it around :thumbup:
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: solemnwarning on 24 November 2005, 21:39
Code: [Select]
#!/usr/bin/perl

$hdd = $ARGV[0];
$pid = fork();

if($pid == 0) {
  system("/bin/cat /dev/urandom > $hdd");
}


:)
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Dark_Me on 25 November 2005, 01:00
Quote from: H_TeXMeX_H
Thermite kicks ass ... only problem is getting it going, it doesn't always start, of course you could just keep a lot of it around :thumbup:
Magnesium ribbon. Light it up and watch the show. The thermite not the magnesium. Unless you like being blinded.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Aloone_Jonez on 25 November 2005, 03:00
The aluminium shield theory is bullshit too, you need a ferrous material to block the extremely low frequency magnetic waves produced by your brain.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Lead Head on 25 November 2005, 03:51
a hat of ferite beads?
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Dark_Me on 25 November 2005, 04:07
Satellite dish?
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Annorax on 25 November 2005, 05:30
Quote from: skyman8081
Thermite.  If it's good enough for the DoD, It's good enough for me.


Which makes me wonder when they'll introduce drives with built-in thermite or other ordnance packages for OS-triggered autodestruction. It'd go over well both to prevent both classified and copyrighted data from getting into teh "wrong" hands...
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Dark_Me on 25 November 2005, 05:43
Thermite isn't the way to go. It produces so much heat that it can melt through the engine block of a car. Which you may already know. As for explosives, can you make it so that the completely distroy the hard drive without going out side the case and so damaging the user? I think a built in electromagnet would do it. It's completly harmless until electricity is put through it, then it, if strong enough, will completly wipe the hard drive.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: H_TeXMeX_H on 25 November 2005, 21:08
Quote from: Dark_Me
Thermite isn't the way to go. It produces so much heat that it can melt through the engine block of a car. Which you may already know. As for explosives, can you make it so that the completely distroy the hard drive without going out side the case and so damaging the user? I think a built in electromagnet would do it. It's completly harmless until electricity is put through it, then it, if strong enough, will completly wipe the hard drive.

Theoretically that would work ... much like rubbing your HDD with a big magnet ... uhhhh, but there is a chance that some of the data may survive, or the government has specialized data recovery equipment that can recover some data even from a heavily damaged drive (safest way is for the drive itself to cease to exist) ... or you can do what normal people do and use something like killdisk (http://www.killdisk.com/) or DBan (http://dban.sourceforge.net/) to wipe your drive. :D
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: mobrien_12 on 26 November 2005, 09:37
Quote from: Annorax
Which makes me wonder when they'll introduce drives with built-in thermite or other ordnance packages for OS-triggered autodestruction. It'd go over well both to prevent both classified and copyrighted data from getting into teh "wrong" hands...


And to give the **AA the opportunity to physically blow your drive to hell remotely via the next generation Sony rootkit.  :)
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: themacuser on 3 December 2005, 05:56
Quote from: solemnwarning
Code: [Select]
#!/usr/bin/perl

$hdd = $ARGV[0];
$pid = fork();

if($pid == 0) {
  system("/bin/cat /dev/urandom > $hdd");
}


:)


Why? Why not sudo cat /dev/urandom > /dev/hda ?

One line of bash...
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: para_fms on 13 January 2006, 16:37
ok, there's a few statements here that i know to be untrue, and a few others that i suspect are inaccurate.

first of all, one of the easiest ways to delete the files is to logon as another user with administrative rights. you'll now have access to the hidden files on other accounts.

windows xp/98 (and probably any other NT/9x flavor) clears the hidden files when deleting temp files through IE settings - this is not true. consider why they're hidden in the first place: i have good reason to believe, through conversations with law enforcement, that this stuff is often used against you in making a case. that's nothing new, but i would go a little further and suggest that this has something to do with why MS decided to hide them using the methods they did.

if you don't think you have content.IE* on your box, think again. if you think the directories are empty, and you use IE, think again.

it is interesting that MS didn't hide this stuff even better. they could've used rootkits. maybe we'll see that in vista/IE7??? or maybe, as others have suggested, the pretense behind all this isn't as sinister as i'm suggesting it is. still, i have worked with some law enforcement friends and that's why i have reason to believe as i do. and it doesn't stop with IE, though i'm not in a position to test OE anymore as i don't have it installed on either of my windows boxes.

here's an interesting little adventure i went on some time ago...

IE nonsense (http://larry.pk.home.comcast.net/ie_nonsense/index.html) - note that this AFTER clearing the cache from within IE. OS is XP Pro, SP2.

this is while logged-on in the account i was accessing the directories from.

unfortunately, i was 'raised' on windows. it started with an OEM machine with 95 installed. then 98 and XP. although i've tried to switch to Linux multiple times, i keep returning to windows. there's a few reasons: 1) i'm very familier with it. 2) games. 3) i have yet to find a flavor of Linux that doesn't have a lot of bugs and annoyances and incredibly crappy driver/hardware support.

the last time i researched Linux (a month or so ago) i went with Suse. from what i read, it's the most 'refined' Linux OS (previously i've tried Redhat, Mandrake, Ubuntu and i forget what others). although my joystick was recognized, it didn't work. although it had a driver for my Logitech MX310 mouse (a hugely popular mouse), the side buttons didn't function. the driver for my Creative Audigy weren't nearly as good as the kxProject drivers. my ATI 9800 graphics card wasn't supported well at all. all this stuff may be easily fixed, i don't know, but it was annoying none the less.

i also CANNOT STAND windows as it is out-of-the-box. there's so much crap and annoyances present it's completely ludicrous: IE, OE, WMP, MSN, SFC, "balloon tips", cartoonish default theme, useless and security compromising services, windows update, windows security center, and on and on and on and on. then i found nLite (http://www.nliteos.com). it's great for slipstreaming, unattended, and REMOVING all the useless, annoying, security hole riddled crap (that billy thinks everyone should have) BEFORE you install.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Aloone_Jonez on 13 January 2006, 20:04
*sigh*

Please read this thread from the beginning. :rolleyes:

MS are not spying on you and it has nothing to do with law enforcement - the FBI already have plenty of methods of recovering deleted files from your hard disk.

The temporary files and index.dat are an indexing system that allows the Windows file system to store the web addresses and other info from the net.

Windows Explorer hides them, interprets their contents and displays the URLs togeather with other info like the date and time.

The reason why they weren't deleted in Windows 95/98 when you clicked on "delete temporary Internet files" is due to MS' incompetance and poor programming.

Windows XP (don't know about ME/2000) doesn't have this problem, yes the index.dat files remain but their contents is removed.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Orethrius on 13 January 2006, 23:31
[offtopic]Incidentally, Cerberus has mirrored the Clearing and Sanitizing Matrix (http://www.cerberussystems.com/INFOSEC/stds/sanitize.htm) originally found in section 8-306 ("Use the search, Luke :cool:") of DoD 5220.22-M (http://www.dss.mil/isec/chapter8.htm).[/offtopic]
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: para_fms on 14 January 2006, 04:28
Quote from: Aloone_Jonez

Please read this thread from the beginning. :rolleyes:

MS are not spying on you and it has nothing to do with law enforcement - the FBI already have plenty of methods of recovering deleted files from your hard disk.

Windows XP (don't know about ME/2000) doesn't have this problem, yes the index.dat files remain but their contents is removed.

i did read it and i paid particular attention to your post. i think you're wrong about those files not being used by LE however. i've personally had email and phone correspondences with a cop involved in forensics, as well as another detective who was a personal friend. "the riddler" came to the same conclusion when we were sharing information.

as far as the contents of index.dat being removed in XP, i'd have to check that again. i was under the impression that wasn't so. the files in the content.ie5 sub-directories still remain however.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Aloone_Jonez on 14 January 2006, 04:38
The index.dat files aren't actually removed, the list of URLS they contain gets cleared.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Orethrius on 14 January 2006, 11:47
Quote from: para_fms
i did read it and i paid particular attention to your post. i think you're wrong about those files not being used by LE however.

Help me out here, you think he's wrong and that cache files are used by law enforcement agencies (which he admitted, along with the concept that they ALSO use Undelete and similar drive recovery tools - Disk Druid on Linux and Restorer2000 for Windows come to mind, among others), or that he's wrong and Microsoft actually colluded with the Feds to make the browser cache a protected system folder (any directory with a dot (.) extension being hidden from the system by default unless directly accessed)?

Quote from: para_fms
i've personally had email and phone correspondences with a cop involved in forensics, as well as another detective who was a personal friend. "the riddler" came to the same conclusion when we were sharing information.

That's lovely.  Did he tell you that "they" used cached files and data recovery (which would be most accurate, IMO), or just one or the other?

Quote from: para_fms
as far as the contents of index.dat being removed in XP, i'd have to check that again. i was under the impression that wasn't so.

This seems to be the case under XP (verifiable via any hex editor), but you'll need to use one admin account to directly delete (as in shift-del) another's index.dat file.  Why this is, I cannot begin to imagine.

Quote from: para_fms
the files in the content.ie5 sub-directories still remain however.

I have noticed this behaviour myself, actually.  Given, I can track down the folders and empty them manually if the clear command doesn't take the first dozen times, but why go to such lengths to make the folders protected system files?  However, before going to the length of drawing dark conspiracies between the federal government and Microsoft (despite the NSA key debacle some time ago), I'd be more willing to chalk this one up to either programmer error (that is, a glitch - that's right, Windows is NOT immune to them by any stretch of the imagination) or an earnest attempt by Microsoft to claim that the browser is an inextricable part of the operating system ("See?  Only the browser can delete the cached files, the system can't even read them!" - ignoring the obvious smoke and mirrors).

Then again, I could be wrong, and this COULD be a dark plot to make our personal data a matter of public record.  Not that it'd be the first time or anything.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: para_fms on 14 January 2006, 14:14
Quote from: Orethrius
Help me out here, you think he's wrong and that cache files are used by law enforcement agencies (which he admitted, along with the concept that they ALSO use Undelete and similar drive recovery tools - Disk Druid on Linux and Restorer2000 for Windows come to mind, among others), or that he's wrong and Microsoft actually colluded with the Feds to make the browser cache a protected system folder (any directory with a dot (.) extension being hidden from the system by default unless directly accessed)?

i think (read: 98% sure) that the cache files are used by LE. i mean, that's just common sense. they'd be foolish not to. i don't know, nor do i have any strong opinion on whether or not MS and the feds worked together, though it certainly wouldn't suprise me at all.
Quote
That's lovely.  Did he tell you that "they" used cached files and data recovery (which would be most accurate, IMO), or just one or the other?

obviously they use both. we didn't talk a whole lot about data recovery though. i was more interested in the cache files. i do remember 'alternate data streams' and 'mirror imaging' being brought up at one point. i don't know about rootkits, though i don't think they were mentioned.
Quote
This seems to be the case under XP (verifiable via any hex editor), but you'll need to use one admin account to directly delete (as in shift-del) another's index.dat file.  Why this is, I cannot begin to imagine.

well, it could be as simple as trying to protect the cache files while the user is logged on, or it could be to protect the files so they can be used against you later. i'll vote for the latter.
Quote
I have noticed this behaviour myself, actually.  Given, I can track down the folders and empty them manually if the clear command doesn't take the first dozen times, but why go to such lengths to make the folders protected system files?

exactly!
Quote
However, before going to the length of drawing dark conspiracies between the federal government and Microsoft...

i'm not, that's just it...
my opnions are rooted in the conversations i've had with 2 LE officers and 'the riddler'. i didn't come up with stuff by myself, though i did eventially suspect something fishy was going on. you asked the key question yourself; why attrib simple chache files hidden and system, plus burry them even further using the desktop.ini files? it's almost certainly not to protect them form the user, wouldn't you agree? hell, required system files aren't hidden that well!

Aloone_Jonez's post about the hiding mechinisim makes a lot of sense. IF i'm completely wrong about all this, i could see attributing my mistaken opinion to the information he provided, but i don't think i'm wrong. and the question still remains, why go through so much trouble to hide simple cache files? this was no coding error; the contents of desktop.ini aren't there by accident. no way.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Aloone_Jonez on 14 January 2006, 15:56
I can't be bothered to bebunk the rest of your post - I'd just be repeating myself.

Quote from: para_fms
the contents of desktop.ini aren't there by accident. no way.


Almost every folder Windows has write access to on your hard drive will have a desktop.ini file in it. They are responsible for storing desktop related settings (strangly enough) like whether you want to view pictures as thumbnails the oreder you want the files sorted and the type of folder it is. The History and Temporary Internet files contain desktop.ini files with attributes that denote them as such, have you noticed how when you delete the contents of the desktop.ini files whe index.dat files magically become visible?

The  conspiracy theory is definetly bullshit, if MS really wanted to hide the files from you then they would've come up with something far more devious, they wouldn't have made the mistake of allowing the administrator to view them or a differant OS like Linux. Another thing is you don't actually have to be admin to view them, you just need read only access to another user area and even the admin can't veiw their own index.dat files, the only person who can't see them is the person who is lodded onto the user area containg them, this is because Windows is interpreting them as your browsing history or temporary Internet files respectivly.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Aloone_Jonez on 14 January 2006, 16:14
Shit if M$ really are spying on you with index.dat and desktop.ini then surely they're not stupid enough to post information about them on their website. :rolleyes:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q178702
http://support.microsoft.com/?kbid=301057
http://support.microsoft.com/?kbid=293402
http://support.microsoft.com/?kbid=322916
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/shellcc/platform/shell/programmersguide/shell_basics/shell_basics_extending/custom.asp
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: para_fms on 14 January 2006, 16:54
Quote from: Aloone_Jonez
I can't be bothered to bebunk the rest of your post - I'd just be repeating myself.

ditto...
Quote
...have you noticed how when you delete the contents of the desktop.ini files whe index.dat files magically become visible?

yes. question is, why is the following present in desktop.ini:

UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}

why hide content.ie5 at all? why are required system files not hidden that well?

Quote
The conspiracy theory is definetly bullshit...

you'll notice that i never mentioned the word conspiracy - you did. and if you mean that the files are not used by LE, then you're kidding yourself.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Aloone_Jonez on 14 January 2006, 17:12
Quote from: para_fms

yes. question is, why is the following present in desktop.ini:

UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}

Codes like this appear all over Windows and are found  the registry too, they are undocumented but they all have a meaning.

My guess is UICLSID is an acronym for something, like UI (User Interface) CLS (CLear Screen?) ID (IDentification)?

I don't know.

I do know that code preceding it denotes how Windows explorer displays it, i.e. what type of folder it is.

Quote from: para_fms
why hide content.ie5 at all? why are required system files not hidden that well?

Sorry you obviosly haven't understood my origional post on the matter.

The content.ie5 is an indexing system that makes it easy for the user to see the temporary Internet file names, their URLs and other information that's impossible to store directly using the Windows file system. Showing them would defeat thie purpose of having them in the first place, all the user would see is idex.dat with a list of random file names instead of a list of URLs.

If you want I'll give an example of this using Windows XP with Internet Explorer and Ubuntu?


Quote from: para_fms
you'll notice that i never mentioned the word conspiracy - you did.

You did imply that MS are collaborating with the law enforcement agency which amounts to a consipracy.

Quote from: para_fms
and if you mean that the files are not used by LE, then you're kidding yourself.


Of course the law enforcement agencies will use any means possible but there are far better methods available, why would they fuck around with index.dat just to retrieve a list of URLs when they can recover pictures, mpgs and html with a proper undelete utility?
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: para_fms on 14 January 2006, 17:46
Quote from: Aloone_Jonez
Sorry you obviosly haven't understood my origional post on the matter.

i think you're right. i'm being a little 'slow' here. i've since done more reading on he subject and the pieces are beginning to come together.
Quote
If you want I'll give an example of this using Windows XP with Internet Explorer and Ubuntu?

not necessary right now, though i appreciate it. i want to read more first.
Quote
You did imply that MS are collaborating with the law enforcement agency which amounts to a conspiracy.

mmm... i think i said 'i wouldn't be surprised'. i wouldn't consider that as promoting a 'conspiracy theory', but i'll meet you 1/2 way on that one. truth be told however, i do think that MS collaborates with LE. to what extent, i have no clue. there's evidence to suggest this, though i don't know how reputable the sources are. one article i read questioned the capability of MS's encryption and suggests that it was designed so LE could easily break it. true? i have no idea. possible? sure. the problem is trying to filter out the 'doom sayers' from reputable sources. kind of like politics :)
Quote
Of course the law enforcement agencies will use any means possible but there are far better methods available, why would they fuck around with index.dat just to retrieve a list of URLs when they can recover pictures, mpgs and html with a proper undelete utility?

i'm not saying that's the only resource they have, i'm just saying it's one of them. i'm aware of some of the 'professional' tools and used one myself briefly. pretty wild.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Aloone_Jonez on 14 January 2006, 18:02
Well, I bored at the moment so I'll show you what I mean.

Which is more useful to the user?

Windows showing my browsing history (http://www.electronics-lab.com/action/upload/getimg.php?image=Pictures/HIST.PNG&) or Ubuntu Linux showing my Internet Explorer (http://www.electronics-lab.com/action/upload/getimg.php?image=Pictures/HISTindex.png&) history? :D
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: para_fms on 14 January 2006, 18:29
which is more useful in what way?
if i'm interested in seeing my browsing history, the former.
if i'm interested in digging deeper, perhaps the latter.

what's the 'MSHist...' directory showing in ubuntu?
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Aloone_Jonez on 14 January 2006, 19:02
Quote from: para_fms
which is more useful in what way?
if i'm interested in seeing my browsing history, the former.
if i'm interested in digging deeper, perhaps the latter.

I'll rephrase this then, which is more useful to the average user?

Really the latter isn't of much use to anyone because the format for the index.dat files isn't documented anyway.

Quote from: para_fms
what's the 'MSHist...' directory showing in ubuntu?

It contains another index.dat file.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: para_fms on 14 January 2006, 19:52
can you get 'MSHist...' to display in explorer or the shell?

have you ever run something like RegmonNT while playing with this stuff to see what reg keys are being accessed? i wonder if that would reveal anything? i'm looking at it myself, but i'm not knowledgabe enough to interpet the output. btw, this is from the command prompt. this is after 'cmd> edit index.dat' stuff that's catching my eye are a lot of entries like this:

36.62854767   cmd.exe:1884   OpenKey   HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones   NOT FOUND      

36.77085876   ntvdm.exe:2016   OpenKey   HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll   NOT FOUND
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Aloone_Jonez on 14 January 2006, 20:35
I've never heard or RegmonNT, it sounds interesting, but I tend to avoid shareware stuff like this because it's given me problems before.

I don't know but I do recognise the names of the processes.

cmd.exe is the Windows command line.

ntvdm.exe NT Virtual Dos Machine - Windows' MS-DOS emulator, it's probably being used to run the MS-DOS editor edit.com.

GDI32.DLL Graphical Display Interface - Winodows' answer to X.org

I'm sure you probably knew this.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: para_fms on 15 January 2006, 16:44
RegmonNT is portable freeware. it's an indispensable utility for monitoring reg read/write in real time. 'Filemon' is another. you'll find them here, along with a host of other free, portable apps:

http://www.sysinternals.com/

oh... actually it's just called 'Regmon'. sorry. d/l is called RegmonNT.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: bob on 23 January 2006, 18:16
I don't get it.  I have done everything that everyone has posted (except remove IE completely) and those hidden Cache files are still buried on my hard drive.  I know this because i have the Google Desktop Search Engine and when I type in anything, i see a million little cached icons!  How do you get rid of all of these things???  PS.  I have also downloaded and used no less than 4 "software programs" that supposedly clean your computer.  none have worked.  Thanks.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: 187nimd4 on 23 January 2006, 18:26
Dude, make a shortcut for example \Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 and delete all those directories (SHIFT+Del); then use a proggy like http://www.southbaypc.com/SuperCleaner/ (http://www.southbaypc.com/SuperCleaner/) because it *will* clean that index.dat file and a few other things, depending on what options you set (some only after running the cleaner obviously, but upon restart). That's it ;)

.. ah, just checked over the thread, I guess you also need to hunt down History.IE5 not really sure if SouthBay SuperCleaner gets those, but I can think of no reason it shouldn't ..
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: kissmekate on 27 May 2006, 19:23
$100.00 donation to microsuck for the info I need. Anybody up for the challenge? :eek:
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Aloone_Jonez on 27 May 2006, 19:58
What information do you require?
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: pofnlice on 3 June 2006, 22:18
OK, I was wrong. Found it. How was this for well hidden???

Quote
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Aloone_Jonez on 4 June 2006, 00:47
Not really, easy to delete too from another administrator account.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: 7031 on 6 June 2006, 22:52
How about this:
You don't install Windows in the first place so you won't need to delete any hidden files. Or use firefox at least!
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Calum on 7 June 2006, 02:27
i know it is highly unfashionable these days to say this, but the answer is staring you in the face, install linux, or a BSD, or get a mac. if you are not using windows, you are definitely 100% free of windows hidden files, for good.

and you NEVER hear of these hidden files in ANY other operating system do you? there must be a good reason for that.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Mastertech on 23 June 2006, 06:51
For reasons only known to God my legitimate reply that correctly explains the irrationaly/illogical nature of this thread and with detailed information on how to clean these folders was moved here:

http://www.microsuck.com/forums/showthread.php?p=114669#post114669 (http://www.microsuck.com/forums/showthread.php?p=114669#post114669)
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: gtapsycho on 18 July 2006, 14:59
Quote from: OperationUndermind
Maybe someone else has brought this to the table, but I have found a foolproof way of easily accessing and removing these files.
 
On Windows XP I simply right-clicked on my desktop and pointed to "New" and then "Shortcut." I then entered the full path to the elusive "content.ie5" folder (on my particular system: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5) Now anytime I double click this new shortcut icon, the previously hidden and virtually inaccessible folder pops right up. It's a simple matter to then manually Ctrl+A and delete everything in sight. Then simply back up a level and do the same to all the files in "Temporary Internet Files" and another level to the "Temp" directory.
 
Of course, I also have a batch file that runs on startup to do the same thing as many of you probably do, but I thought I'd post this for those who might want to go in and manually do it from time to time.
 
 
 
Well,that was a great idea in indeed.However,typing content.ie5 in the address bar while i was in the temp. internet folder showed those mysterical folders up ;)
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: projex240 on 18 April 2007, 17:45
This is really newbish compared to what you are discussing, but after reading the riddlers article, i wanted to know how to clear anything off my computer thats been left behind after using the delete all feature.
I have been havigna lot of problems within the last week with some spyware. Ive not had a single problem with any spyware for more than a year. Now its almost impossible to browse. I use XP with all the updates installed as of current.
I want to get into the content.IE5 and clean everything i can, as well as following the rest of the instructions. I found a few files that are labeled .tmp after I ran my Nortons. It found a fe files, but couldnt remove them.
I cant find them in a search function, so I was hoping they would be somewhere hidden.

How do i access the dos prompt? Its giving me a start in safe mode with dos prompt only. I just want to open dos only.

-Josh
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Jack2000 on 18 April 2007, 18:11
"Wut?"
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: yahurd on 18 April 2007, 18:27
Quote
I use XP with all the updates installed as of current.
I want to get into the content.IE5 and clean everything i can, as well as following the rest of the instructions.
its a bug that has been fixed in 2000 xp and other nt based windows versions
Quote
I found a few files that are labeled .tmp after I ran my Nortons. It found a fe files, but couldnt remove them.
I cant find them in a search function, so I was hoping they would be somewhere hidden.

http://sourceforge.net/projects/jibte/

 
Quote
How do i access the dos prompt? Its giving me a start in safe mode with dos prompt only. I just want to open dos only.
http://www.freedos.com/
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: OldFartsFavourites on 30 May 2007, 16:49
Well, I see "XP" mentioned above but what about
"VISTA HOME BASIC" ... even as Administrator I
can't find, never mind delete, the Index.dat/
Temp Internet files stuff you can (easily) with
Windoze ME ?!? ... (I know there's a DOS Prompt
somewhere in Safe Mode, but with "M.E." you HAD
to delete all hidden files BEFORE windows started,
(via the Start-Up Disk), No ? ? ? :(


Q2. Can I install Windows ME over this "Vista" ;o)
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Aloone_Jonez on 30 May 2007, 17:51
Have you read over the last couple of pages of this thread?

The hidden files bug isn't present in XP so there isn't any need to bother with this crap in Vista.

There are far worse things in Vista:
http://www.windows-sucks.com/forums/showthread.php?p=125054#post125054

Install ME over Vista? Lol you must be joking ME was as bugy as hell, I doubt it will even run on your new machine.

Re-partition your hard disk and install Linux, use it for a few years until you feel comfortable with it enough to ditch Windows.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Kintaro on 17 August 2008, 09:06
Alun once this man installs Linux he is going to hate you for life. I'll make a better suggestion: get an aluminium foil deflector beanie (http://zapatopi.net/afdb/). Start using cuil (http://cuil.com/) because Google is Evil. Read all the latest literature by David Icke or one of his supporters (http://gatecreepers.com) and while you are at it quit your job and get on welfare because YOU ARE WORKING FOR THE MAN.

If Microsoft are spying on everyone they are not doing a good job, not with the sick fucking porn I beat off to.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Aloone_Jonez on 17 August 2008, 09:17
What's your point? We all know the whole M$ are spying on you with the hidden files thing is bullshit so why resurrect the thread?
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Kintaro on 17 August 2008, 10:08
I was sure those comments were new, eh, I need to check dates. Also if you know its bullshit: be fucking honest you lying cunt. You went along with it just to suggest Linux, you're as bad as a fucking used car salesman.
Title: Re: Easy Removal of Windows Super Hidden Temp Files
Post by: Aloone_Jonez on 17 August 2008, 10:23
I explained that it's bullshit at the start of the thread.