Jump to content

CCleaner can't delete all traces ?


codon

Recommended Posts

Hello

I thought CCleaner can delete all traces of activity - that seems not true.

I found a long list of all visited files and folders after! running CCleaner since I bought my PC in june up today.

 

A sample:

==================================================

Handlungszeitpunkt: 04.06.2012 06:29:20

Beschreibung : Ordner im Explorer betrachtet

Dateiname : +Java+

Pfad : V:\TWEAKs\+Java+

Zusatzinformationen:

==================================================

 

I used this new tool from NirSoft - LastActivityView

http://www.nirsoft.n...ivity_view.html

to display all those entries.

  • Open file or folder: The user opened the specified filename from Windows Explorer or from another software.
  • View Folder in Explorer: The user viewed the specified folder in Windows Explorer.

How can I delete all this traces - please help - I have no idea where the informations came from - oh and it’s not Rot13-coded

 

P.S. sorry - my English is not the best

Link to comment
Share on other sites

When you open Windows Explorer it will show you files and folders,

and if you select a file and open its Properties you will see three time stamps.

The "Last Accessed" time is when the file was last used before Windows Explorer showed it.

 

At least some if not all of the items shown in that Nirsoft tool are based upon that sort of time stamp,

and the only way to enhance your privacy are :-

to use a tool that can set file time stamps to some fictitious value ;

or to delete the files themselves :rolleyes:

Link to comment
Share on other sites

Thank you for your answer Alan_B

I found out, that NirSoft detects only the first time you open a folder. I renamed one and I got a new entry - then I renamed it again (back to the old name).

==================================================

Handlungszeitpunkt: 28.10.2012 13:05:10

Beschreibung : Ordner im Explorer betrachtet

Dateiname : +CCleaner test

Pfad : D:\+CCleaner test

Zusatzinformationen:

================================================this folder didn’t exist anymore but I have the information in NirSoft - LastActivityView

 

==================================================

Handlungszeitpunkt: 28.10.2012 13:04:16

Beschreibung : Ordner im Explorer betrachtet

Dateiname : CCleaner test

Pfad : D:\CCleaner test

Zusatzinformationen:

==================================================I opend this folder after renaming again ->no other timestamp

 

NirSoft - LastActivityView detects the folders and pathes from extern HDDs and USB-Sticks as well. So where is the memory of all these not existing files and folders?

Link to comment
Share on other sites

You may find wiping "Free Space" and the "MFT Free Space" would probably remove some of those memories.

 

On Windows 7 when I select a file and right click and choose Properties there is a Tab "Previous Versions".

That has a link "How do I use previous versions"

and that will tell you about Windows Backup and System Protection.

 

Microsoft may also capture other information and hide it with something more obscure that Rot13.

Link to comment
Share on other sites

Thank you codon for your post and bug report. :)

 

Until now I simply assumed CCleaner was working but using the tool you linked to I discovered many files and folder names going back to my first install !!

 

I have never had system restore enabled ....not ever ! yet I still find the same privacy leaks you do.

 

I have just performed a full MFT wipe and free space wipe also but Nirsoft still finds these old files and folders. Many of which are to now deleted files, some are from files deleted from external drives which themselves have been wiped.

 

I would love to know how to stop windows (Win7 64bit) from storing this junk in the first place but also is there a temporary workaround until CCleaner is fixed ?

 

I have tried the third party plugins (Winapp2.ini) with all options checked and still it fails to remove this history.

Link to comment
Share on other sites

Codon, I tried the program & it seems tis true.

 

After downloading the latest WinApp2.ini file into my 3.24 version of CCleaner on my 32 Bit 7, I found that even after checking all extra items & running CCleaner, it still showed things that had run in the past.

 

Registry turned up nothing on certain programs when I did a file path search, & minidump directory was clear.

_____

 

Some areas that may contain data that you can try are:

 

- Delete everything inside: -> C:\Windows\Prefetch

- Start/Run & type services.msc & enter. Disable Windows Event Log service, then reboot.

- Delete everything inside: -> C:\Windows\System32\winevt\Logs

_____

 

Re-run Last Activity View to see if it still "finds" these things. I suspect that this is the area they are being culled from.

If this fixes the problem, you can follow the steps above to re-enable event logging if needed.

 

Let me know if your problem still exists after following these steps.

Link to comment
Share on other sites

  • Moderators

Codon, I tried the program & it seems tis true.

 

After downloading the latest WinApp2.ini file into my 3.24 version of CCleaner on my 32 Bit 7, I found that even after checking all extra items & running CCleaner, it still showed things that had run in the past.

 

Registry turned up nothing on certain programs when I did a file path search, & minidump directory was clear.

_____

 

Some areas that may contain data that you can try are:

 

- Delete everything inside: -> C:\Windows\Prefetch

- Start/Run & type services.msc & enter. Disable Windows Event Log service, then reboot.

- Delete everything inside: -> C:\Windows\System32\winevt\Logs

_____

 

Re-run Last Activity View to see if it still "finds" these things. I suspect that this is the area they are being culled from.

If this fixes the problem, you can follow the steps above to re-enable event logging if needed.

 

Let me know if your problem still exists after following these steps.

 

I don't consider it a good idea SuperFast to advise posters to disable a Windows Service and delete all winevt logs.

 

Also please limit discussion of Winapp2 .ini in ccleaner discussion threads.

 

Support contact

https://support.piriform.com/hc/en-us/requests/new

support@ccleaner.com

 

Link to comment
Share on other sites

 

I wonder if this is a bug that has recently been introduced to CCleaner ?

 

I just cannot imagine these areas have been completely missed for 3 years win7 has been out. Surly someone would have noticed CCleaner wasn't working during this time, I just find it too hard to believe.

 

I am considering this is a possibility and thought it may help the developer track the bug down. Has anyone tested CCleaner before and found that it does actually clear out history etc ? If so what was the last version of CCleaner that worked ?

 

 

Link to comment
Share on other sites

Thank you all - thank you hazelnut

 

The informations are not from the registry, any (prefetch-)cache or (event-)logs.

Tools like CCleaner-Enhancer, TuneUp, Glary, Tweakme and Seven Clean 2013 have no effect.

 

Please - is here anybody who can talk/write with the NirSoft-developer to ask where the informations come from?

I’m sitting here with my „Langenscheidt - Großes Schulwörterbuch Deutsch - Englisch | Englisch - Deutsch“ and I have problems to find the suitable words and sentence constructions - it’s so hard.

Feedback-Nirsoft

If you have any problem, suggestion, comment, or you found a bug in my utility, you can send a message to nirsofer@yahoo.com

Edited by codon
Link to comment
Share on other sites

I wonder if this is a bug that has recently been introduced to CCleaner ?

 

I just cannot imagine these areas have been completely missed for 3 years win7 has been out. Surly someone would have noticed CCleaner wasn't working during this time, I just find it too hard to believe.

 

I am considering this is a possibility and thought it may help the developer track the bug down. Has anyone tested CCleaner before and found that it does actually clear out history etc ? If so what was the last version of CCleaner that worked ?

Your concerns do not seem rational.

Other products also do not show these things.

CCleaner is not certified to withstand a forensic examination.

 

I suggest that you should test the old versions yourself if you want to know "what was the last version of CCleaner that worked"

You can find them all at

http://www.filehippo.com/download_ccleaner/history/

That goes all the way back, on page 11, to

CCleaner 1.16.082

Released: 27 Nov 2004 (7 years 10 months ago)

Link to comment
Share on other sites

Not sure I understand "Your concerns do not seem rational." Please elaborate where you believe I was irrational ?

 

 

Other products also do not show these things.

 

I am sorry but I do not see this as relevant, Nirsoft shows them and that's enough surly ?

 

 

CCleaner is not certified to withstand a forensic examination.

 

As far as I am aware a forensic examination was not carried out, codon simply downloaded a publicly available free application and ran it. There was no mention of a forensic examination unless codon is a forensic examiner in which case I apologise. The information codon gave on this thread lead me to believe this was not data residing in the free space or recovered with magnetic force microscopy, it appeared to be just plainly omitted by CCleaner.

 

 

I suggest that you should test the old versions yourself if you want to know "what was the last version of CCleaner that worked"

 

My suggestion was in an effort to help the developer find where the bug was introduced as per my post. I have beta tested many applications in the past and I know just how easy introducing a bug can be when applying new features.

 

 

If you are asking me to do it I suppose I can but I would have thought there was already a beta testing team here isn't there ? I wonder if you would be kind enough to tell me who organises the testing team as I may offer to help.

 

Is there a downloadable list of previous bug reports available with fixes listed for the last 3 years ?

 

Thanks for your help.

Link to comment
Share on other sites

  • Moderators

piriform does not perform public testing on >1.0 version software.

 

ADVICE FOR USING CCleaner'S REGISTRY INTEGRITY SECTION

DON'T JUST CLEAN EVERYTHING THAT'S CHECKED OFF.

Do your Registry Cleaning in small bits (at the very least Check-mark by Check-mark)

ALWAYS BACKUP THE ENTRY, YOU NEVER KNOW WHAT YOU'LL BREAK IF YOU DON'T.

CCLEANER, RECUVA, DEFRAGGLER AND SPECCY DOCUMENTATION CAN BE FOUND AT  https://support.piriform.com/hc/en-us and  https://www.ccleaner.com/docs

Pro users file a PRIORITY SUPPORT request at https://support.piriform.com/hc/en-us/requests/new

link to WINAPP2.INI explanation

Link to comment
Share on other sites

@ Hazel, thanks.

 

@ Codon, thanks for the update. If not the event logs, I am not sure at the moment. It doesn't appear to be stored in the registry, so I am assuming that some area of the disk that is involved in producing logs (but not sure) would be the culprit. I will have to try to further look when I get time someday, but I have been very busy lately.

 

Maybe either someone will post up here that knows more about it for now, else email Nirsoft & let him know how amazed you are that it finds so much stuff.

Then, ask if he will send you a list of all the locations it looks for data in.

 

Perhaps when you find out, you can post here for piquing the curiosity of me & a few others here.

Link to comment
Share on other sites

If the op needs a secure O/S that leaves no traces, then the only solution is a live o/s running on a system with no hdd or other form of storage and logs. Even then the BIOS could contain some traces of power on/off times. But that's really reaching.

 

If a forensic cleaning is needed, well, then you have to use SecureErase or some other form of a 2 pass wipe. With SecureErase being the better choice, because, standard single or multi-pass (no 5th element jokes please) wipes won't get at HPA or other areas of the HDD. For the real paranoid, nothing less than complete media destruction will do.

 

Understand that trying to remove ALL traces of activity on a disk bound modern O/S is a real nightmare. You're welcome to try, but I assure you the deeper you dig, the more info will be revealed.

 

Also understand the the purpose of CCleaner is to serve as a junk remover, not an evidence destroyer.

Link to comment
Share on other sites

piriform does not perform public testing on >1.0 version software.

 

Thank you for this information I hadn't realised CCleaner wasn't open for review. :(

 

I think there is a valuable lesson to be learned from this.

 

 

He only wants to remove the files that show his last access. Nothing wrong with this.

 

 

Exactly :)

 

Especially when reading this statement on the Piriform site.....

 

CCleaner is the number-one tool for cleaning your Windows PC.

 

 

I have been working today but I have managed to test quite a few versions back from the link supplied by Alan_B. It would appear that this is not a recently introduced bug as I first assumed or hoped. It seems to have been a privacy oversight which has passed unnoticed for about 3 years !!!

 

Someone once said about encryption software that there is "no security by obscurity", I think it would be fair to say that statement could be applied to privacy software also.

Link to comment
Share on other sites

Hi

{HEAVILY EDITTED BY NERGAL}While the user was able to learn what it was that needed cleaning through a second cleaning software, they did not report what extra needed cleaning. Regrettably I had to change this post as it did not follow forum rules and standards{END EDIT}

 

Hi

  • my list from LastActivityView is clean - wow :D
  • There is no answer from Nir Sofer (I didn't know that this is his name :unsure:)
  • I've learned many about File-Slacks http://de.wikipedia....wiki/File-Slack - they are not the cause of the entries
  • no forensic-cleaner is needed
  • I tried a 15 days testversion from Jürgen Haage (there is an english version too).
  • just one short click there (Gespeicherte Explorer-Ansicht-Einstellungen) - and aaaahh :ph34r: nodocodon
  • never long lists again

Edited by codon
Link to comment
Share on other sites

  • Moderators

And moderator intervention now. Sorry we don't allow comparison between competing products and we definitely do not allow linked to competing products. If you figure out what the thing cleaned is post it how ever I have edited you last post heavily.

 

ADVICE FOR USING CCleaner'S REGISTRY INTEGRITY SECTION

DON'T JUST CLEAN EVERYTHING THAT'S CHECKED OFF.

Do your Registry Cleaning in small bits (at the very least Check-mark by Check-mark)

ALWAYS BACKUP THE ENTRY, YOU NEVER KNOW WHAT YOU'LL BREAK IF YOU DON'T.

CCLEANER, RECUVA, DEFRAGGLER AND SPECCY DOCUMENTATION CAN BE FOUND AT  https://support.piriform.com/hc/en-us and  https://www.ccleaner.com/docs

Pro users file a PRIORITY SUPPORT request at https://support.piriform.com/hc/en-us/requests/new

link to WINAPP2.INI explanation

Link to comment
Share on other sites

If you figure out what the thing cleaned is post it how ever I have edited you last post heavily.

 

I think he was trying to show us with the highlighted menu selection in the picture he posted. English is not his first language.

 

He was right, that software works and does remove the nessary files.

 

Thanks codon, you found the problem and took the time to come back with a solution ! :)

Link to comment
Share on other sites

  • Moderators

I went back and looked at the images but now tell the actual location of the cleaned items for ccleaner to be made better.

 

One showed the name (in German) of the section (but not the actual files) and the other was just the title bar of the competing program

Remember, when a moderator does what I have done, it is for a reason, it broke standards this forum has.

 

 

 

ADVICE FOR USING CCleaner'S REGISTRY INTEGRITY SECTION

DON'T JUST CLEAN EVERYTHING THAT'S CHECKED OFF.

Do your Registry Cleaning in small bits (at the very least Check-mark by Check-mark)

ALWAYS BACKUP THE ENTRY, YOU NEVER KNOW WHAT YOU'LL BREAK IF YOU DON'T.

CCLEANER, RECUVA, DEFRAGGLER AND SPECCY DOCUMENTATION CAN BE FOUND AT  https://support.piriform.com/hc/en-us and  https://www.ccleaner.com/docs

Pro users file a PRIORITY SUPPORT request at https://support.piriform.com/hc/en-us/requests/new

link to WINAPP2.INI explanation

Link to comment
Share on other sites

  • Moderators

ok, you've lost me. :blink:

did we get a resolution to this or not, the editted stuff makes it hard to determine if a solution was found that we could put into CC.

or was it hush-hush due to forum rules?

Backup now & backup often.
It's your digital life - protect it with a backup.
Three things are certain; Birth, Death and loss of data. You control the last.

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.