Why access using IE browser and access using Windows explorer of INetCache folder shows different folder structure on WIN8.1-IE11? - ruby

When I access C:\Users\shan\AppData\Local\Microsoft\Windows\INetCache using Windows explorer, it shows following folder structure:
But when I access the same using IE11 browser, Tools->Internet Options->General->Browsing history-> Settings(click)->View files(click), I get different folder structure as follows:
Why folder structure differing in above 2 cases, even though both are referring to the same physical location on Windows 8.1, IE11 Browser ?
I need to write a script which clears this INetCache folder contents(Cache). But not able to get the exact content of this folder. Because it always refers to Folder which contains Low(folder), Virtualized(folder) and counters.dat(file). In my script I want to refer the folder which contains favicon.ico files.
The same behavior is observed on IE10-win7 and IE11-win7 as well, while referencing Temporary Internet Files.

There is an internal api in the IE libraries that controls clearing of the 'Internet Cache'....
there are two... one for 'normal' integrity processes (64 bit tab processes and ActiveX (flash)), another for low integrity processes (32 bit tab processes and ActiveX (flash))
Use GPO (Start>Run>gpedit.msc) to configure user profiles on a domain network to empty the TIF(s) on exit from the browser.
For computers on a public access network (library workstations), you can default to inPrivate Mode from a desktop or Taskbar link
iexplore.exe -private
which does not retain any personally identifiable data of the user in history, or cookies or flash cookies.....
questions about GPO management of IE should be posted to the TechNet support forum for IE.
https://social.technet.microsoft.com/Forums/ie/en-US/home?forum=ieitprocurrentver

Related

Reason why folder associated with saved webpage gets deleted when we delete saved page

I have saved a complete webpage and there is also one folder saved with resources but when I delete webpage or move saved webpage to other directory then the folder associated with it also gets deleted or moved. So what is the code written behind it. Because I want to do same with my webpage and folder.
Thanks in advance for you kind help.
This "association" between the HTML file and its resources folder is a behaviour implemented by the Windows operating system.
It has nothing to due with a webpage in particular, with its HTML, JavaScript, or even with a particular browser.
Windows 2000 provides a simple way to connect a primary HTML file to its group of associated files. If Connected Files is enabled, when you perform any of the commands [Copy, Cut, Paste, Move, Delete, Send To] on a file or folder of associated files, the same command is performed on all connected files.
Even though the official page mentions "Windows 2000", the same behaviour is implemented in Windows XP and many (if not all) later versions of Windows.
See these pages:
Removing file / folder link after using “Save As…” then “Web Page, complete”
Operations on an HTML file or folder apply to similarly named folder or HTML file (from Microsoft support)

Getting a Scripting.FileSystemObect error from local VBscript in IE8

I'm currently working on laptops that go in Police Cars. They run an app called IMobile which is an extension of our CAD system, and allows them to do vehicle lookups, get more info on a call, etc.
The IMobile app is basically an IE overlay and it uses htm files that are on the local laptop. We've added in some simple VBScripts that do various tasks. Some common functions that are required for these tasks are in a VBscript called PoliceFunctions.vbs which is included in the same directory as all the other scripts. This method worked fine in previous versions of IE and Windows, however we're getting scripting errors in Windows 7 with IE8, specifically, 'ActiveX component can't create object: "Scripting.FileSystemObject"' and it references the functions script mentioned above.
If I set IE's settings to allow it to run ActiveX controls not marked as safe, the script runs fine, however I don't want do open a large security hole. I've tried adding localhost and the directory to the Trusted Sites list with no effect. I've tried re-registering SCRRUN.dll as mentioned in another post as well as wscript -regserver. And I've changed IE's settings to allow local Active Content with no success.
Anyone have any other ideas of how I can allow this script to run without opening a large security hole or having it nag the end user that his IE settings are going to bring about the apocolypse?
The explanation is long but explains how IE uses security zones to make trust decisions.
The URLAction of interest in this case is:
1201 Initialize and script ActiveX controls not marked as safe(URLACTION_ACTIVEX_OVERRIDE_OBJECT_SAFETY)
The default setting for this URLAction in the Local Machine zone is Prompt, and in all other zones it is Disable. Only if you change that setting to Enable will you bypass the prompt. You cannot use the Internet Control Panel to adjust the security settings for the Local Machine zone because only the other four zones are shown in this UI. To change the setting for the Local Machine zone, you can edit the registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
Change the value for entry 1201 from 1 to 0
Write an ActiveX, implement IObejctSafety and wrap FSO methods in it. Note this is lying about the ActiveX's scripting safety but it is better than open to every unsafe ActiveX.
As the app "uses htm files that are on the local laptop" you could try to switch to a .hta application. For a quick test, just rename the *.html to .hta; if it 'works' add a suitable hta:application tag. To start

Storing settings for Browser Helper Object

I have a browser helper object on IE that have some "clipboard history" functions. I have been storing settings into a file into the directory where the BHO file is (currently "$PROGRAMFILES\Common files\folder\", it was like this when i received the code but i can change it).
In my computer (XP SP3 in virtual machine) I have no problems writing the settings file, but I was wondering it this could cause "writing permission" problems in other computers and if it does what other method should I use to make sure it will work on all Windows computers?
It could definitely have permission problems. I would store the file in an appropriate subfolder under the "Application Data" or "Local Settings\Application Data" in user's profile folder. The user running it should always have write permissions to those folders.

How does folder hiding software work?

Last few days i have been working on building an application to hide folders(thanks to the paid versions of such softwares). After a heavy googling I zeroed into some shell script that would first create a folder and then rename the folder to "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}". It would then hide this folder by using the command attrib -s -h Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}. The funda behind this is to make it a system folder and hide it. But if you would uncheck the Hide sytem folders in Folder option the control panel becomes visible. I would like to make this folder completely invisible as how the other folder protecting softwares do.
Can somebody throw some more light on this?
Thanks a ton...
Most folder hiding software works by implementing either an extension for Windows Explorer or a file system filter driver.
The first method means that certain items will not be visible when browsing folders in Windows via the UI, but will still be visible to other software and via the command prompt. For example, the Recycle Bin and Temporary Internet Files folders work this way.
The file system filter driver method proxies calls between Windows and the underlying file system and only allows certain requests through. This is similar to how virus scanners prevent access to infected files.
The general idea is that you hook the file system API's and filter out the file system entries you want to hide.
But JelloMonkey is right - this is rootkit behavior and you will get flagged as malicious by rootkit detectors for this kind of behavior. That's likely to get your entire directory quarantined or deleted.

Find out who is locking a file on a network share

I want to known who is locking a file on a network share.
Here is the problem : the network share is on a NAS, so I can't log on. I need a tool to find out remotely who is locking the file. It is not practical to reboot the NAS every time, because there are several users.
Handle.exe, Process Explorer and PsFile seems to be limited to files on the local machine, so they don't work for me.
Just in case someone looking for a solution to this for a Windows based system or NAS:
There is a built-in function in Windows that shows you what files on the local computer are open/locked by remote computer (which has the file open through a file share):
Select "Manage Computer" (Open "Computer Management")
click "Shared Folders"
choose "Open Files"
There you can even close the file forcefully.
On Windows 2008 R2 servers you have two means of viewing what files are open and closing those connections.
Via Share and Storage Management
Server Manager > Roles > File Services > Share and Storage Management > right-click on SaSM > Manage Open File
Via OpenFiles
CMD > Openfiles.exe /query /s SERVERNAME
See http://technet.microsoft.com/en-us/library/bb490961.aspx.
PsFile does work on remote machines. If my login account already has access to the remote share, I can just enter:
psfile \\remote-share
(replace "remote-share" with the name of your file server) and it will list every opened document on that share, along with who has it open, and the file ID if I want to force the file closed. For me, this is a really long list, but it can be narrowed down by entering part of a path:
psfile \\remote-share I:\\Human_Resources
This is kind of tricky, since in my case this remote share is mounted as Z: on my local machine, but psfile identifies paths as they are defined on the remote file server, which in my case is I: (yours will be different). I just had to comb through the results of my first psfile run to see some of the paths it returned and then run it again with a partial path to narrow down the results.
Optionally, PsFile will let you specify credentials for the remote share if you need to supply them for access.
Lastly, a little known tip: if someone clicks on a file in Windows Explorer and cuts or copies the file with the intent to paste it somewhere else, that act also places a lock on the file.
If its simply a case of knowing/seeing who is in a file at any particular time (and if you're using windows) just select the file 'view' as 'details', i.e. rather than Thumbnails, tiles or icons etc. Once in 'details' view, by default you will be shown;
- File name
- Size
- Type, and
- Date modified
All you you need to do now is right click anywhere along said toolbar (file name, size, type etc...) and you will be given a list of other options that the toolbar can display.
Select 'Owner' and a new column will show the username of the person using the file or who originally created it if nobody else is using it.
This can be particularly useful when using a shared MS Access database.
The sessions are handled by the NAS device. What you are asking is dependant on the NAS device and nothing to do with windows. You would have to have a look into your NAS firmware to see to what it support. The only other way is sniff the packets and work it out yourself.
Partial answer: With Process Explorer, you can view handles on a network share opened from your machine.
Use the Menu "Find Handle" and then you can type a path like this
\Device\LanmanRedirector\server\share\
sounds like you have the same problem i tried to solve here. in my case, it's a Linux fileserver (running samba, of course), so i can log in and see what process is locking the file; unfortunately, i haven't found how to close it without killing the responsible session. AFAICT, the windows client 'thinks' it's closed; but didn't bother telling the fileserver.
Close the file e:\gestion\yourfile.dat, open by any user (/a *)
openfiles /disconnect /a * /op "e:\gestion\yourfile.dat"
more in:
http://dosprompt.info/commands/openfiles.asp

Resources