Koe chto o chem stoit padumati ;)

Microsoft''s Really Hidden Files: A New Look At Forensics. (v2.5b)By The RiddlerOctober 14, 2001 (v2.0 finished May 16, 2001; v1.0 finished June 11, 2000)Written with Windows 9x in mind, but not limited to.DISCLAIMER:I will not be liable for any damage or lost information, whether due toreader''s error, or any other reason.SUMMARY:There are folders on your computer that Microsoft has tried hard to keepsecret. Within these folders you will find two major things: MicrosoftInternet Explorer has been logging all of the sites you have ever visited --even after you''ve cleared your history, and Microsoft''s Outlook Express hasbeen logging all of your e-mail correspondence -- even after you''ve erasedthem from your Deleted Items bin. (This also includes all incoming andoutgoing file attachments.) And believe me, that''s not even the half of it.When I say these files are hidden well, I really mean it. If you don''t haveany knowledge of DOS then don''t plan on finding these files on your own. Isay this because these files/folders won''t be displayed in Windows Explorer atall -- only DOS. (Even after you have enabled Windows Explorer to "view allfiles.") And to top it off, the only way to find them in DOS is if you knewthe exact location of them. Basically, what I''m saying is if you didn''t knowthe files existed then the chances of you running across them is slim toslimmer.It''s interesting to note that Microsoft does not explain this behavioradequately at all. Just try searching on microsoft.com.FORWARD:I know there are some people out there that are already aware of some of the things I mention. I also know that most people are not. The purpose of this tutorial is teach people what is really going on with Microsoft''s products andhow to take control of their privacy again. This tutorial was written by me,so if you see a mistake somewhere then it is my mistake, and I apologize.Thanks for reading.INDEX:1) DEFINITIONS AND ACRONYMS2) WHY YOU SHOULD ERASE THESE FILES3) HOW TO ERASE THE FILES ASAP 3.1) If You Own Microsoft Internet Explorer 3.2) Clearing Your Registry 3.3) If You Own Outlook Express 3.4) Slack files 3.5) Keeping Microsoft''s Products4) STEP-BY-STEP GUIDE THROUGH YOUR HIDDEN FILES (For the savvy.)5) A LOOK AT OUTLOOK6) HOW MICROSOFT DOES IT7) +S MEANS [S]ECRET NOT [S]YSTEM.8) THE TRUTH ABOUT FIND FAST 8.1) Removing Find Fast9) CONTACT INFORMATION AND PGP BLOCKS 9.1) Recommended reading10) SPECIAL THANKS11) REFERENCESComing Soon:ù pstores.exeù Related Windows Tricks.ù The NSA-Key.ù Researching the [Microsoft Update] button.ù Why the temp folders aren''t intended to be temporary at all.ù What''s with Outlook Express''s .dbx database files?ù Win2k support.1. DEFINITIONS AND ACRONYMSWell, the best definition I have been able to come up with is the following:I) A "really hidden" file/folder is one that cannot be seen in WindowsExplorer after enabling it to "view all files," and cannot be seen in MS-DOSafter receiving a proper directory listing from root. a) There is at least one loophole to enabling Windows Explorer to see them. b) There is at least one loophole to enabling MS-DOS to see them.(Interesting to note that the "Find: Files or Folders" utility cannot evensearch through one of these folders. It doesn''t even exist on the [Browse]menu.)II) Distinguishes "really hidden" file/folders from just plain +h[idden] ones, such as your "MSDOS.SYS" or "Sysbckup" folder.III) Distinguishes from certain "other" intended hidden files, such as a filewith a name with high ascii characters (eg, "Ÿë靖").DOS = Disk Operating SystemMSIE = Microsoft Internet ExplorerTIF = Temporary Internet Files (folder)HD = Hard DriveOS = Operating System2. WHY SHOULD I ERASE THESE FILES?Just from one of these files I would be able to tell you which web sites youpreviously visited, what types of things you search for in search engines, andprobably gather your ethnicity, religion, and sexual preference. Needless tosay, one can build quite a profile on you from these files. It has thepotential to expose and humiliate -- putting your marriage, friendship, andcorporation at risk. Here''s one good example of the forensic capabilities...------------------------------------------------------------------------------"I''ve been reading your article as I have a problem with an employee of mine.He has been using the works pc for the internet and using it to chat and lookat porn sites. He was then deleting the cookies and history in order to coverhis tracks. A friend of mine pointed me in the direction of this site andyour article. I have found it to be incredibly useful,..."--Concerned Boss, 8/24/01------------------------------------------------------------------------------3. HOW TO ERASE THE FILES ASAPStep by step information on how to erase these files as soon as possible.This section is recommended for the non-savvy. Further explanation can befound in Section 4.0. Please note that following these next steps will erase all your cache files and cookies files. If you use the offline contentfeature with MSIE, it will remove this as well. It will not erase yourbookmarks.3.1. IF YOU OWN A COPY OF MICROSOFT INTERNET EXPLORER1) Shut your computer down, and turn it back on.2) While your computer is booting keep pressing the [F8] key until you aregiven an option screen.3) Choose "Command Prompt Only" This will take you to real DOS mode. MEusers must use a bootdisk to get into real DOS mode.4) When your computer is done booting, you will have a C:\> followed by ablinking cursor. Type in this hitting enter after each line (sansparenthesis):C:\WINDOWS\SMARTDRV (Loads smartdrive to speed things up.)CDDELTREE/Y TEMP (this line removes temporary files.)CD WINDOWS DELTREE/Y COOKIES (This line removes cookies.)DELTREE/Y TEMP (This removes temporary files.)DELTREE/Y HISTORY (This line removes your browsing history.)DELTREE/Y TEMPOR~1(If this last line doesn''t work then type this:) CD\WINDOWS\APPLIC~1DELTREE/Y TEMPOR~1 (If this doesn''t work then type this:) CD\WINDOWS\LOCALS~1DELTREE/Y TEMPOR~1(If this still does not work, and you are sure you are using MSIE5.x, thenplease e-mail me. Finding the location of these may be difficult and I''dcertainly like to know where else MSIE likes to hide its cache. I believeolder versions of MSIE keep them under "\windows\content\".)This last one will take a ridiculous amount of time to process. The reason ittakes so incredibly long is because there is a ton of semi-useless cachestored on your HD.3.2. CLEARING YOUR REGISTRYIt was once believed that the registry is the central database of Windows thatstores and maintains the OS configuration information. Well, this is wrong.Apparently it also maintains a bunch of other doo-dah that has absolutelynothing to do with the configuration. I won''t get into the other stuff, butfor one, your Typed URLs are stored in the registry.HKEY_USERS/Default/Software/Microsoft/Internet Explorer/TypedURLs/HKEY_CURRENT_USER/Software/Microsoft/Internet Explorer/TypedURLs/These "Typed URLs" come from MSIE''s autocomplete feature. It records all URLsthat you''ve typed in manually in order to save you some time filling out theaddress field. By typing "ama" the autocomplete feature might bring up"amazon.com" for you. Although, I find it annoying, some people prefer thisfeature. One thing is for sure, however -- it''s an obvious privacy risk. Youwouldn''t want a guest to type "ama" and have it autocomplete"amaturemudwrestlers.com" now would you?You can clear yo