Solved Windows 7 Advice on Registry Key Removals

[Microbell]

Gents,

In Need of Registry Expert!

Wasn't quite sure which sub-forum this should go under so please move it if need be. I'm a security/anonymity minded PC user so my security is High and I constantly monitor whats connected, what folders are accessed, what new files appeared in the last 30 days and such and clean accordingly. While rummaging through the registry I came across 4 keys that present a problem as I don't know if all of the entries can be removed.

These keys list every folder you ever opened since Windows was installed:

HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagsMRU\

These keys list every Mount Point for each drive and any encrypted volumes.

HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Now what I want to do is delete all the sub keys under Bag\BagsMRU (As I think they are just folder views) and delete all but the HD's/DVD mount points under MountedDevices\MountPoints2

I constantly work with sensitive work related files on encrypted containers and don't need registry entries leaving tracks to files, folders and locations of where I've been, what I've opened, how many times I accessed it.

So my questions are the following:

1. Can I delete the sub key entries under Bags/BagsMRU and MountedDevices\MountPoints2?
2. If so How can I select them all for deletion instead of one at a time?

**note** There's a lot in the Bags keys so I will be making a restore point and backing up the registry before the attempt.


EDIT!!

Might have found part of an answer. Anyone use this tool to clean the Bag entries? "Shellbag Analyzer & Cleaner v1.25" Free PC cleaner - Download

 

[mitchell65]

I can't answer your specific query but I would urge you to make a back up of the registry and store a copy of the backup file on an eternal storage source before taking any action.

 

[Microbell]

I can't answer your specific query but I would urge you to make a back up of the registry and store a copy of the backup file on an eternal storage source before taking any action.

Thanks. I noted that on my previous post already.

**note** There's a lot in the Bags keys so I will be making a restore point and backing up the registry before the attempt.

 

[mitchell65]

Sorry missed that.

 

[townsbg]

Not sure what will happen if you delete the mount point entries-my concern is the inability for you to mount it back. Besides they will only be recreated when you mount the volume back. I can however tell you what will happen if you delete the bags registry. https://support.microsoft.com/en-us/kb/813711 You will lose settings pertaining folder size, location, & view. If you are really worried about security why don't you completely encrypt the system drive?

 

[Lance1]

If your to the extreme with security then PrivaZer v3.0.8 is for you. Here's a quick video on the app by majorgeeks.

​

 

[Callender]

Not sure about the mount points but for selective shell bag cleanup I have always used this:

Shellbag Analyzer & Cleaner v1.25

NOTE: If you select a shell bag for an existing folder you will lose all current view settings for that folder. Only use it to remove traces of deleted folders.

EDIT: Also note this is not the same program as PrivaZer that was linked in Post #6

You have to be very careful if you decide to use PrivaZer (full version)

See: http://www.sevenforums.com/software/316912-privazer-pc-cleaner.html

Even experienced members here have had some issues after running it. There's no problem if you can understand configuration, options and have backups.

EDIT: RE: Mount Points.

Just tried USB Oblivion. I forgot that I had it. Anyway a test clean on my machine shows the following will be removed.

​

Here's a text file that contains registry entries that will be removed if a real clean is performed:

View attachment USBOblivion-64-PC-160904-165813.txt​

 

[TechnoMage2016]

I'm reminded of the little saying, "you're not being paranoid....they really are out to get you!"

I'm always prepared to experiment with my PC, so after reading the OP's post, I went in and deleted that "bags" key and then rebooted.
Here I am, after the reboot, and everything is working properly. OH by the way, Windows just remade that 'Bags' key, with one addition, for the Desktop. But the long list of things in there originally are gone.

If this were something that I felt strongly about and wanted to do on a re-occurring basis, I would just write a little .reg script to delete that one key and then I'd not have to go into the registry at all, just run the script.

I do a lot of tweaks and add-ons to my own registry and the registries of PC's I'm setting up or just working on and I use .reg scripts for all that. I can avoid making mistakes in the registry and possibly creating problems for myself, by just using scripts that I know work and not going into the registry at all.
Every time you enter the registry, there is the likelihood of making a mistake, that could seriously affect the operation of Windows.

For instance, I have one script that forces Windows to make a new Registry Restore Point, (thank you Shawn) and I've put that script in my "Startup" folder, so I get a new Restore Point every time I boot up the PC. Those restore points only build up to the point that I've preset in Windows, then the old ones drop off into the old "Bit Bucket". They cannot overwhelm the HD, like they did in Windows ME.

I would put the deleting "Bags" key in the same category as deleting the contents of the "Prefetch" folder.
Or deleting all your browsing History on a regular basis.

I had one customer who was afraid of the Govt. confiscating his computer to maybe find incriminating files. So I wrote him a Cleanup.bat program to do a massive cleanup on his PC every time he ran the program. He would run it every day just before he would shut down his PC for the day, or he could run it anytime there was an unexpected knock on the door.
Sure enough the day came when the US Marshals came to get his HD.
The report from the Forencic scientist who examined his HD, said that the drive looked like it had just been formatted and Windows re-installed. There was absolutely NO trace of his activity.
That was just another thumb in the eye of Big Brother!
Too bad Hillary was so careless about saving all her emails. Eh?

Cheers Mate!
TechnoMage

 

[Layback Bear]

I just booted up into one of my Clones and will give ( PrivaZer) a run and see what happens.
I will be back hopefully still using my Clone.

 

[Callender]

I just booted up into one of my Clones and will give ( PrivaZer) a run and see what happens.
I will be back hopefully still using my Clone.

You'd need to scan without actually cleaning then inspect the results listed for each item selected in the left pane before going ahead. Then configure options to keep anything that you don't want to remove.

 

[Layback Bear]

I'm back using my Clone.
I ran this (Free PC cleaner - Download) (Shellbag AnalyZer) from post #1 and found a bunch but I did not clean.

I ran the scan with (PrivaZer PC Cleaner) in normal mode and it only took a few minutes.
I let (PrivaZer) have it's way like I believe most new users would. Rebooted.
__________

Then I ran SFC /SCANNOW which found no problems. Rebooted.
Then I ran Ccleaner and it found a old Asus AI suite goodie, which I let Ccleaner take care of.
Then I ran TFC by Old Timer and found a little of it's normal stuff. Rebooted.
Then I ran Disk Clean Up and just found a thumbnail.
Then I checked msconfig for any added little goodies in Startup and Services and found none.
Now I going to run Shellbag AnalyZer again and see what it finds.

Back in a little while. Hopefully still booted into a proper working Clone.

 

[Layback Bear]

It's me again. Still in my properly working Clone.
After running (PrivaZer PC Cleaner) I still got the same results from (Shellbag AnalyZer) "735" items.
I cleaned them and ran (Shellbag AnalyZer) again and the "735" items where there again.
SFC /SCANNOW still finds no problems.

So to me and my little bit of testing (PrivaZer PC Cleaner) works but I would recommend doing more testing.
The (Shellbag AnalyZer) doesn't seem to do anything worth while. Everything it indicates is removed is back after a reboot.

Now I'm going to put my Clone away and go back to using my normal Windows 7.
Jack

Edit:
Please note. I did run all programs as administrator.

 

[Callender]

It's only for removing traces of deleted folders. For any other existing folders new shellbags will be created on reboot but without any previous custom view settings that you might have applied. That's why it's best to only concentrate on deleted folders.

Just tested again and those traces of deleted folders do not reappear after a rescan. In other words the shellbag entries for the selected deleted folders have been removed from the registry.

​

 

[Callender]

I suppose I should add that the program is run "Elevated" with admin rights maybe that makes a differences.

 

[Layback Bear]

You are correct I should of stated that in my post.
I will correct my post.
Thank you.

 

[Callender]

Okay so I just did the full deleted folders cleanup. When it says "100% cleaned" in the top left it's misleading.

​

It's not actually finished until the "Cleanup in progress" vanishes and this pop up appears.

​

Results after cleaning show zero traces of deleted folders. Also I chose to cleanup traces of folders opened on external drives.

​

 

[Layback Bear]

I will go back to my Clone and give it another try.

 

[Layback Bear]

This is what I'm getting. It seem that it did the Clean as it should. Do I understand correctly?

 

[Callender]

This is what I'm getting. It seem that it did the Clean as it should. Do I understand correctly?

View attachment 391391

Well assuming that originally it showed traces of deleted folders (any locations) and first you unchecked everything then filtered the list (use drop down filter) or sort by "Type > Old deleted folder" then checked only deleted folders then it looks like it worked. What you don't want to do is delete anything else especially if you want to keep view settings for each existing folder.

All this program really does is to prevent someone who has access to your machine seeing which folders you deleted, the names of those folders and when you last opened and viewed them. It doesn't prevent recovery of those folders and contents using other methods.

 

[Microbell]

Well,

You guys are awesome for giving the program a try. Now when I read about "PrivaZer PC Cleaner" my understanding was they changed the way it removes the BAG entries. I understand it will remove some things I want to keep so I'll be selecting "ALL" and then remove marks from what I want to keep. That said removing just the deleted folders won't do for me as I need to remove all entries pointing to any folder that I have opened on other drives.

That's why I was going to use "Shellbag AnalyZer" as it's supposed to take out any of the check marked entries but now I'm having second thoughts as "Layback Bear" said it left entries behind after a reboot so it's either not removing those items or Windows is restoring them from another location (Restore Point?) or the wrong settings were used.

@Callender

Recovery of the files/folders on a modern SSD using Trim mode once deleted is as I understand it a moot point as once the cell is deleted the data is unrecoverable. On a standard Hard Drive I use Recuva to secure delete and overwrite and wipe the drives free space. (When needed and not required on SSD)

Anyway do we have a consensus if "Shellbag AnalyZer" deletes everything check marked or just the deleted folders entries?

**note**

As for the mount points and someone correct me if I'm wrong but those registry locations I listed just tells windows what was mounted and in no way effects the mounting of any drive. So for example if I remove them all including dos/C:\ then once Windows reboots and loads C:\ again the entry will reappear in the registry and the other entries won't reappear until that mount point is remounted.

Also note that Microsoft's answer for clearing the Bag folder's is to actually delete the main Key and then add them back and on a 64bit system you have to clean both locations I posted and these ones.

HKEY_CURRENT_USER\Software\Classes\Wow6432Node\LocalSettings\Software\Microsoft\Windows\
Shell\Bags

HKEY_CURRENT_USER\Software\Classes\Wow6432Node\LocalSettings\Software\Microsoft\Windows\
Shell\BagMRU