Deleting Webcache Permanently

Discussion in 'privacy technology' started by subhrobhandari, Mar 8, 2017.

  1. subhrobhandari

    subhrobhandari Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    780
    Thanks to tenforums

    Successfully worked here, webcache files can be deleted and they do not generate automagically after this. In my case, deleted the following in registry, of course backed up these entries in a .reg file.

     
  2. guest

    guest Guest

    Right after starting services.msc (Description: Microsoft Management Console) to view my services, i noticed that dllhost.exe (Description: COM Surrogate) was executed
    and i could see the above ID in Process Hacker:
    WebCache_Process-Hacker_dllhost.png
    And it has opened protected handles to "V01.log" and "WebCacheV01.dat" in the WebCache-folder.

    I was curious and wanted to see the content of "WebCacheV01.dat" but the access has been denied.
    At the moment i don't want to disable the task, take ownership, etc. (maybe at a later time)
    So i searched for the file handle "webcachev01.dat" in Processhacker ("Find Handles or DLL's"):
    WebCache_Process-Hacker_find_dlls.png
    It's possible to view or extract it from memory. I selected the handle which has the Section-Type so i could select "Read/Write memory".
    If it is bigger than 32MB, there wil be a small warning message.
    WebCache_Process-Hacker_dump.png
    The section/file is now opened and it can be viewed or saved to disk ("Save...")
    ------

    There can be continuous disk writes if the Webcache is enabled:
     
  3. TairikuOkami

    TairikuOkami Registered Member

    Joined:
    Oct 10, 2005
    Posts:
    3,633
    Location:
    Flat Earth Matrix
    Thanks for info, I used to disable only the task, but it hardly did anything, now it is clean. ;)
     
  4. guest

    guest Guest

    Yes, after a reboot no reference to Webcache-files can be seen in Process Hacker ("Find handles"). And they can be deleted now.
     
  5. guest

    guest Guest

    I noticed again some explorer-crashes (Exception code: 0x80270249), and after some searching, disabling the Webcache might have caused this:
    I have reverted all changes and i keep an eye on it. If explorer.exe doesn't crash again after a startup, then disabling the webcache was definitely the culprit (at least on my system) :doubt:
     
  6. TairikuOkami

    TairikuOkami Registered Member

    Joined:
    Oct 10, 2005
    Posts:
    3,633
    Location:
    Flat Earth Matrix
    Make sure, you have explorer process separated from the rest to avoid interference.

    Code:
    1 - Launch folder windows in a separate process
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "SeparateProcess" /t REG_DWORD /d "1" /f
    
    0 - All of the components of Windows Explorer run a single process / 1 - All instances of Windows Explorer run in one process and the Desktop and Taskbar run in a separate process
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer" /v "DesktopProcess" /t REG_DWORD /d "1" /f
     
  7. guest

    guest Guest

    Thanks :thumb:
    Nice, i didn't know anything about the second one. I have added it to my tweak-collection, and it is set now.
    I'll see the "result" (two explorer.exe-processes) after the next reboot.
    Edit: I guess "DesktopProcess" doesn't work on Windows 8 or a newer OS :doubt:
    But the other registry modification is working: "Launch folder windows in a separate process"
     
    Last edited by a moderator: Apr 9, 2017
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.