codon Posted October 28, 2012 Share Posted October 28, 2012 Hello I thought CCleaner can delete all traces of activity - that seems not true. I found a long list of all visited files and folders after! running CCleaner since I bought my PC in june up today. A sample: ================================================== Handlungszeitpunkt: 04.06.2012 06:29:20 Beschreibung : Ordner im Explorer betrachtet Dateiname : +Java+ Pfad : V:\TWEAKs\+Java+ Zusatzinformationen: ================================================== I used this new tool from NirSoft - LastActivityView http://www.nirsoft.n...ivity_view.html to display all those entries. Open file or folder: The user opened the specified filename from Windows Explorer or from another software. View Folder in Explorer: The user viewed the specified folder in Windows Explorer. How can I delete all this traces - please help - I have no idea where the informations came from - oh and it’s not Rot13-coded P.S. sorry - my English is not the best Link to comment Share on other sites More sharing options...
Alan_B Posted October 28, 2012 Share Posted October 28, 2012 When you open Windows Explorer it will show you files and folders, and if you select a file and open its Properties you will see three time stamps. The "Last Accessed" time is when the file was last used before Windows Explorer showed it. At least some if not all of the items shown in that Nirsoft tool are based upon that sort of time stamp, and the only way to enhance your privacy are :- to use a tool that can set file time stamps to some fictitious value ; or to delete the files themselves Link to comment Share on other sites More sharing options...
codon Posted October 28, 2012 Author Share Posted October 28, 2012 Thank you for your answer Alan_B I found out, that NirSoft detects only the first time you open a folder. I renamed one and I got a new entry - then I renamed it again (back to the old name). ================================================== Handlungszeitpunkt: 28.10.2012 13:05:10 Beschreibung : Ordner im Explorer betrachtet Dateiname : +CCleaner test Pfad : D:\+CCleaner test Zusatzinformationen: ================================================this folder didn’t exist anymore but I have the information in NirSoft - LastActivityView ================================================== Handlungszeitpunkt: 28.10.2012 13:04:16 Beschreibung : Ordner im Explorer betrachtet Dateiname : CCleaner test Pfad : D:\CCleaner test Zusatzinformationen: ==================================================I opend this folder after renaming again ->no other timestamp NirSoft - LastActivityView detects the folders and pathes from extern HDDs and USB-Sticks as well. So where is the memory of all these not existing files and folders? Link to comment Share on other sites More sharing options...
Alan_B Posted October 28, 2012 Share Posted October 28, 2012 You may find wiping "Free Space" and the "MFT Free Space" would probably remove some of those memories. On Windows 7 when I select a file and right click and choose Properties there is a Tab "Previous Versions". That has a link "How do I use previous versions" and that will tell you about Windows Backup and System Protection. Microsoft may also capture other information and hide it with something more obscure that Rot13. Link to comment Share on other sites More sharing options...
CCman Posted October 28, 2012 Share Posted October 28, 2012 Thank you codon for your post and bug report. Until now I simply assumed CCleaner was working but using the tool you linked to I discovered many files and folder names going back to my first install !! I have never had system restore enabled ....not ever ! yet I still find the same privacy leaks you do. I have just performed a full MFT wipe and free space wipe also but Nirsoft still finds these old files and folders. Many of which are to now deleted files, some are from files deleted from external drives which themselves have been wiped. I would love to know how to stop windows (Win7 64bit) from storing this junk in the first place but also is there a temporary workaround until CCleaner is fixed ? I have tried the third party plugins (Winapp2.ini) with all options checked and still it fails to remove this history. Link to comment Share on other sites More sharing options...
Super Fast Posted October 28, 2012 Share Posted October 28, 2012 Codon, I tried the program & it seems tis true. After downloading the latest WinApp2.ini file into my 3.24 version of CCleaner on my 32 Bit 7, I found that even after checking all extra items & running CCleaner, it still showed things that had run in the past. Registry turned up nothing on certain programs when I did a file path search, & minidump directory was clear. _____ Some areas that may contain data that you can try are: - Delete everything inside: -> C:\Windows\Prefetch - Start/Run & type services.msc & enter. Disable Windows Event Log service, then reboot. - Delete everything inside: -> C:\Windows\System32\winevt\Logs _____ Re-run Last Activity View to see if it still "finds" these things. I suspect that this is the area they are being culled from. If this fixes the problem, you can follow the steps above to re-enable event logging if needed. Let me know if your problem still exists after following these steps. Link to comment Share on other sites More sharing options...
Moderators hazelnut Posted October 28, 2012 Moderators Share Posted October 28, 2012 Codon, I tried the program & it seems tis true. After downloading the latest WinApp2.ini file into my 3.24 version of CCleaner on my 32 Bit 7, I found that even after checking all extra items & running CCleaner, it still showed things that had run in the past. Registry turned up nothing on certain programs when I did a file path search, & minidump directory was clear. _____ Some areas that may contain data that you can try are: - Delete everything inside: -> C:\Windows\Prefetch - Start/Run & type services.msc & enter. Disable Windows Event Log service, then reboot. - Delete everything inside: -> C:\Windows\System32\winevt\Logs _____ Re-run Last Activity View to see if it still "finds" these things. I suspect that this is the area they are being culled from. If this fixes the problem, you can follow the steps above to re-enable event logging if needed. Let me know if your problem still exists after following these steps. I don't consider it a good idea SuperFast to advise posters to disable a Windows Service and delete all winevt logs. Also please limit discussion of Winapp2 .ini in ccleaner discussion threads. Support contact https://support.ccleaner.com/s/contact-form?language=en_US&form=general or support@ccleaner.com Link to comment Share on other sites More sharing options...
CCman Posted October 28, 2012 Share Posted October 28, 2012 I wonder if this is a bug that has recently been introduced to CCleaner ? I just cannot imagine these areas have been completely missed for 3 years win7 has been out. Surly someone would have noticed CCleaner wasn't working during this time, I just find it too hard to believe. I am considering this is a possibility and thought it may help the developer track the bug down. Has anyone tested CCleaner before and found that it does actually clear out history etc ? If so what was the last version of CCleaner that worked ? Link to comment Share on other sites More sharing options...
codon Posted October 28, 2012 Author Share Posted October 28, 2012 (edited) Thank you all - thank you hazelnut The informations are not from the registry, any (prefetch-)cache or (event-)logs. Tools like CCleaner-Enhancer, TuneUp, Glary, Tweakme and Seven Clean 2013 have no effect. Please - is here anybody who can talk/write with the NirSoft-developer to ask where the informations come from? I’m sitting here with my „Langenscheidt - Großes Schulwörterbuch Deutsch - Englisch | Englisch - Deutsch“ and I have problems to find the suitable words and sentence constructions - it’s so hard. Feedback-Nirsoft If you have any problem, suggestion, comment, or you found a bug in my utility, you can send a message to nirsofer@yahoo.com Edited November 3, 2012 by codon Link to comment Share on other sites More sharing options...
Alan_B Posted October 28, 2012 Share Posted October 28, 2012 I wonder if this is a bug that has recently been introduced to CCleaner ? I just cannot imagine these areas have been completely missed for 3 years win7 has been out. Surly someone would have noticed CCleaner wasn't working during this time, I just find it too hard to believe. I am considering this is a possibility and thought it may help the developer track the bug down. Has anyone tested CCleaner before and found that it does actually clear out history etc ? If so what was the last version of CCleaner that worked ? Your concerns do not seem rational. Other products also do not show these things. CCleaner is not certified to withstand a forensic examination. I suggest that you should test the old versions yourself if you want to know "what was the last version of CCleaner that worked" You can find them all at http://www.filehippo.com/download_ccleaner/history/ That goes all the way back, on page 11, to CCleaner 1.16.082 Released: 27 Nov 2004 (7 years 10 months ago) Link to comment Share on other sites More sharing options...
CCman Posted October 28, 2012 Share Posted October 28, 2012 Not sure I understand "Your concerns do not seem rational." Please elaborate where you believe I was irrational ? Other products also do not show these things. I am sorry but I do not see this as relevant, Nirsoft shows them and that's enough surly ? CCleaner is not certified to withstand a forensic examination. As far as I am aware a forensic examination was not carried out, codon simply downloaded a publicly available free application and ran it. There was no mention of a forensic examination unless codon is a forensic examiner in which case I apologise. The information codon gave on this thread lead me to believe this was not data residing in the free space or recovered with magnetic force microscopy, it appeared to be just plainly omitted by CCleaner. I suggest that you should test the old versions yourself if you want to know "what was the last version of CCleaner that worked" My suggestion was in an effort to help the developer find where the bug was introduced as per my post. I have beta tested many applications in the past and I know just how easy introducing a bug can be when applying new features. If you are asking me to do it I suppose I can but I would have thought there was already a beta testing team here isn't there ? I wonder if you would be kind enough to tell me who organises the testing team as I may offer to help. Is there a downloadable list of previous bug reports available with fixes listed for the last 3 years ? Thanks for your help. Link to comment Share on other sites More sharing options...
Moderators Nergal Posted October 28, 2012 Moderators Share Posted October 28, 2012 piriform does not perform public testing on >1.0 version software. ADVICE FOR USING CCleaner'S REGISTRY INTEGRITY SECTION DON'T JUST CLEAN EVERYTHING THAT'S CHECKED OFF. Do your Registry Cleaning in small bits (at the very least Check-mark by Check-mark) ALWAYS BACKUP THE ENTRY, YOU NEVER KNOW WHAT YOU'LL BREAK IF YOU DON'T. Support at https://support.ccleaner.com/s/?language=en_US Pro users file a PRIORITY SUPPORT via email support@ccleaner.com Link to comment Share on other sites More sharing options...
Super Fast Posted October 28, 2012 Share Posted October 28, 2012 @ Hazel, thanks. @ Codon, thanks for the update. If not the event logs, I am not sure at the moment. It doesn't appear to be stored in the registry, so I am assuming that some area of the disk that is involved in producing logs (but not sure) would be the culprit. I will have to try to further look when I get time someday, but I have been very busy lately. Maybe either someone will post up here that knows more about it for now, else email Nirsoft & let him know how amazed you are that it finds so much stuff. Then, ask if he will send you a list of all the locations it looks for data in. Perhaps when you find out, you can post here for piquing the curiosity of me & a few others here. Link to comment Share on other sites More sharing options...
Guest Keatah Posted October 29, 2012 Share Posted October 29, 2012 If the op needs a secure O/S that leaves no traces, then the only solution is a live o/s running on a system with no hdd or other form of storage and logs. Even then the BIOS could contain some traces of power on/off times. But that's really reaching. If a forensic cleaning is needed, well, then you have to use SecureErase or some other form of a 2 pass wipe. With SecureErase being the better choice, because, standard single or multi-pass (no 5th element jokes please) wipes won't get at HPA or other areas of the HDD. For the real paranoid, nothing less than complete media destruction will do. Understand that trying to remove ALL traces of activity on a disk bound modern O/S is a real nightmare. You're welcome to try, but I assure you the deeper you dig, the more info will be revealed. Also understand the the purpose of CCleaner is to serve as a junk remover, not an evidence destroyer. Link to comment Share on other sites More sharing options...
Super Fast Posted October 29, 2012 Share Posted October 29, 2012 Also understand the the purpose of CCleaner is to serve as a junk remover, not an evidence destroyer. He only wants to remove the files that show his last access. Nothing wrong with this. Link to comment Share on other sites More sharing options...
CCman Posted October 29, 2012 Share Posted October 29, 2012 piriform does not perform public testing on >1.0 version software. Thank you for this information I hadn't realised CCleaner wasn't open for review. I think there is a valuable lesson to be learned from this. He only wants to remove the files that show his last access. Nothing wrong with this. Exactly Especially when reading this statement on the Piriform site..... CCleaner is the number-one tool for cleaning your Windows PC. I have been working today but I have managed to test quite a few versions back from the link supplied by Alan_B. It would appear that this is not a recently introduced bug as I first assumed or hoped. It seems to have been a privacy oversight which has passed unnoticed for about 3 years !!! Someone once said about encryption software that there is "no security by obscurity", I think it would be fair to say that statement could be applied to privacy software also. Link to comment Share on other sites More sharing options...
Moderators Andavari Posted October 29, 2012 Moderators Share Posted October 29, 2012 Please - is here anybody who can talk/write with the NirSoft-developer to ask where the informations come from? He has a form on his website! Link to comment Share on other sites More sharing options...
Super Fast Posted October 30, 2012 Share Posted October 30, 2012 CCman, go to: -> http://nirsoft.net/contact-new.html & ask him about it. I am interested, also. Thanks! Link to comment Share on other sites More sharing options...
codon Posted October 30, 2012 Author Share Posted October 30, 2012 (edited) Hi {HEAVILY EDITTED BY NERGAL}While the user was able to learn what it was that needed cleaning through a second cleaning software, they did not report what extra needed cleaning. Regrettably I had to change this post as it did not follow forum rules and standards{END EDIT} Hi my list from LastActivityView is clean - wow There is no answer from Nir Sofer (I didn't know that this is his name ) I've learned many about File-Slacks http://de.wikipedia....wiki/File-Slack - they are not the cause of the entries no forensic-cleaner is needed I tried a 15 days testversion from Jürgen Haage (there is an english version too). just one short click there (Gespeicherte Explorer-Ansicht-Einstellungen) - and aaaahh nodocodon never long lists again Edited November 3, 2012 by codon Link to comment Share on other sites More sharing options...
Alan_B Posted October 30, 2012 Share Posted October 30, 2012 . Link to comment Share on other sites More sharing options...
CCman Posted October 30, 2012 Share Posted October 30, 2012 CCman, go to: -> http://nirsoft.net/contact-new.html & ask him about it. I am interested, also. Ha ha OK, I have done it for you. Why so shy about contacting nirsoft ? The more that do, the better, as it is more likely to inspire Nir to reply or join in here. Link to comment Share on other sites More sharing options...
Moderators Nergal Posted October 30, 2012 Moderators Share Posted October 30, 2012 And moderator intervention now. Sorry we don't allow comparison between competing products and we definitely do not allow linked to competing products. If you figure out what the thing cleaned is post it how ever I have edited you last post heavily. ADVICE FOR USING CCleaner'S REGISTRY INTEGRITY SECTION DON'T JUST CLEAN EVERYTHING THAT'S CHECKED OFF. Do your Registry Cleaning in small bits (at the very least Check-mark by Check-mark) ALWAYS BACKUP THE ENTRY, YOU NEVER KNOW WHAT YOU'LL BREAK IF YOU DON'T. Support at https://support.ccleaner.com/s/?language=en_US Pro users file a PRIORITY SUPPORT via email support@ccleaner.com Link to comment Share on other sites More sharing options...
CCman Posted October 30, 2012 Share Posted October 30, 2012 If you figure out what the thing cleaned is post it how ever I have edited you last post heavily. I think he was trying to show us with the highlighted menu selection in the picture he posted. English is not his first language. He was right, that software works and does remove the nessary files. Thanks codon, you found the problem and took the time to come back with a solution ! Link to comment Share on other sites More sharing options...
Moderators Nergal Posted October 30, 2012 Moderators Share Posted October 30, 2012 I went back and looked at the images but now tell the actual location of the cleaned items for ccleaner to be made better. One showed the name (in German) of the section (but not the actual files) and the other was just the title bar of the competing program Remember, when a moderator does what I have done, it is for a reason, it broke standards this forum has. ADVICE FOR USING CCleaner'S REGISTRY INTEGRITY SECTION DON'T JUST CLEAN EVERYTHING THAT'S CHECKED OFF. Do your Registry Cleaning in small bits (at the very least Check-mark by Check-mark) ALWAYS BACKUP THE ENTRY, YOU NEVER KNOW WHAT YOU'LL BREAK IF YOU DON'T. Support at https://support.ccleaner.com/s/?language=en_US Pro users file a PRIORITY SUPPORT via email support@ccleaner.com Link to comment Share on other sites More sharing options...
Moderators mta Posted October 31, 2012 Moderators Share Posted October 31, 2012 ok, you've lost me. did we get a resolution to this or not, the editted stuff makes it hard to determine if a solution was found that we could put into CC. or was it hush-hush due to forum rules? Backup now & backup often.It's your digital life - protect it with a backup.Three things are certain; Birth, Death and loss of data. You control the last. Link to comment Share on other sites More sharing options...
Recommended Posts