Windows 7 Advice on Registry Key Removals

You are really paranoid you can use Truecrypt or Veracrypt and do a complete system disk encryption. Either will even make a decoy OS that you can keep your activities restricted on. The other remains hidden and is only accessible using a special password. I just tried it today on a test VM with Veracrypt. It's a fork of Truecrypt created after the Truecrypt developers stopped supporting it in 2014. It is more up to date on settings and encryption algorithms but it took incredibly long to validate the password and boot either system and even longer for the hidden one. I'm going to see how Truecrypt does and post back. The short story is that it isn't for the faint of heart. I only tried it on a small partition without any data on it and it took most of the day. It requires a complete reinstall of windows-the decoy system-which I didn't even attempt to update or install too many programs.

townsbg said:

You are really paranoid you can use Truecrypt or Veracrypt and do a complete system disk encryption. Either will even make a decoy OS that you can keep your activities restricted on. The other remains hidden and is only accessible using a special password. I just tried it today on a test VM with Veracrypt. It's a fork of Truecrypt created after the Truecrypt developers stopped supporting it in 2014. It is more up to date on settings and encryption algorithms but it took incredibly long to validate the password and boot either system and even longer for the hidden one. I'm going to see how Truecrypt does and post back. The short story is that it isn't for the faint of heart. I only tried it on a small partition without any data on it and it took most of the day. It requires a complete reinstall of windows-the decoy system-which I didn't even attempt to update or install too many programs.

Point taken but for the system I'm dealing with total encryption is not an option as this PC is used for about 90% home use and 10% work related. As you saw by encryption of the small partition you can really muck up the system and depending on how big a drive your encrypting you have to figure both encrypt-decrypt times which can also effect other things like read/write times for games, limited access to files..etc

So really I'm just dealing with cleaning up leftovers from the 10% of work stuff so once I have those locations tagged I can just include them in my standard clean up to remove them. Most of the programs and files that are work related to that 10% are already protected by encryption on another hard drive.

@Callender

It's not about totally removing everything as I think that's an impossible task but I'm trying to reduce the size of the footprint left in the registry. I do appreciate all of your help and info as I'm continuing to learn new things, tools and such.

As for the webcachev01.dat file it seams that can be disabled so it doesn't run by disabling the task and removing a registry key. I saw a small program that does this for you some time ago and although I'm not positive I think that file relates to IE and since I don't use IE that file is not present on my system or in the hidden AppData folder.


EDIT: Ok.

I pulled the trigger and removed the Bag entries using the program then rebooted and it did remove the 2nd set of sub keys that point to the file/folder locations in these keys:

HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagsMRU\

It did however leave the numbered folder keys under Bags and BagsMRU but the keys contain "NO Data" which I confirmed manually. Not a total success as it still shows something was opened (leaving a numbered folder) but enough that it doesn't show what was opened.

As for the Bag under "Wow6432Node" IDK what the heck is going on as now I don't have that folder listed in the follow keys

HKEY_CURRENT_USER\Software\Classes\Wow6432Node\LocalSettings\Software\Microsoft\Windows\
Shell\Bags

HKEY_CURRENT_USER\Software\Classes\Wow6432Node\LocalSettings\Software\Microsoft\Windows\
Shell\BagMRU

Anyway that's were things stand now so I'll poke around in registry and see if I can locate that Cache key again "Kicking myself in ass for not writing it down at the time"

Microbell said:

Also note that Microsoft's answer for clearing the Bag folder's is to actually delete the main Key and then add them back and on a 64bit system you have to clean both locations I posted and these ones.

HKEY_CURRENT_USER\Software\Classes\Wow6432Node\LocalSettings\Software\Microsoft\Windows\
Shell\Bags

HKEY_CURRENT_USER\Software\Classes\Wow6432Node\LocalSettings\Software\Microsoft\Windows\
Shell\BagMRU

Okay I'm using a different machine (at work) currently and all I see for the above is:

Code:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\66]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\66\ComDlg]
"ScrollPos1280x1024(2).y"=dword:00000009

Just one entry under Bags so it would appear to be of little concern.

townsbg said:

You are really paranoid you can use Truecrypt or Veracrypt

I've got both. I just use encryption for important private stuff as I remember a few years back (using XP) when I saw my entire documents folder got zipped and sent who knows where by some malware!