Internet history in...
 
Notifications
Clear all

Internet history in temp files.. Is this normal?

9 Posts
3 Users
0 Likes
254 Views
(@kurt2121)
Posts: 43
Eminent Member
Topic starter
 

I was browsing index.dat files on my computer running XP, and there were a few "duplicate temp files" all with their own index.dat extension. There was a cookie folder, history folder, temporary internet files, etc.

Below is an example.

C\ Documents and Settings\ username\ Local Settings\Temp\History\History.IE5\ index.dat

C\ Documents and Settings\ username\ Local Settings\History\History.IE5\ index.dat

I have past browsing history located in both files, but am unsure how or why this happened. (it currently is not putting any history into the temp file)

Does anybody have any idea why this happened? Is it common? Have any of you ever come across this?

 
Posted : 04/07/2016 6:44 am
(@kurt2121)
Posts: 43
Eminent Member
Topic starter
 

Figured since I never did end up figuring this out that I'll ask again.

Anybody ever come across this or know some possible causes?

 
Posted : 29/10/2016 1:37 pm
(@kurt2121)
Posts: 43
Eminent Member
Topic starter
 

Figured since I never did end up figuring this out that I'll ask again.

Anybody ever come across this or know some possible causes?

 
Posted : 29/10/2016 1:42 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Most probably that (having history and temporary internet files under \Temp\) happened in some multi-user environment, there is a bug in XP that sometimes does not fully changes user, see
https://en.wikipedia.org/wiki/Temporary_Internet_Files

BUT it could be also the result of some malware 😯 , so make sure to double check your system.

jaclaz

 
Posted : 29/10/2016 3:12 pm
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

It is caused by the defined environment variables (most probably the %USERPROFILE%, %TEMP% and %TMP%), check those setting for each user on the system.

 
Posted : 29/10/2016 4:04 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

It is caused by the defined environment variables (most probably the %USERPROFILE%, %TEMP% and %TMP%), check those setting for each user on the system.

NO, it isn't.
For some *strange* reasons (as said a sort of bug) the actual files that should be used can sometimes remain "locked" through a "false/incomplete" user switch and the Internet Explorer uses a "failsafe" path inside \Temp\.
i.e, it tries to write/append to
C\Documents and Settings\username\Local Settings\History\History.IE5\index.dat
BUT since that file is "in use" (even if it isn't), it uses instead
C\Documents and Settings\username\Local Settings\Temp\History\History.IE5\index.dat

jaclaz

 
Posted : 29/10/2016 6:44 pm
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

@jaclaz On XP the right path should be '%USERPROFILE%\Local Settings\Temporary Internet Files', none of the first or second paths posted in the OP.

If the issue is caused by a locked (not writable) index.dat file in multiuser environments involving the second user's '%TEMP%', as it is written on the wikipedia pages, how is that after a reboot (which frees up all the file locks), IE keeps using the wrong path for index.dat ?!

I think more and more of a malware or spyware on that system…

 
Posted : 29/10/2016 11:45 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

@jaclaz On XP the right path should be '%USERPROFILE%\Local Settings\Temporary Internet Files', none of the first or second paths posted in the OP.

If the issue is caused by a locked (not writable) index.dat file in multiuser environments involving the second user's '%TEMP%', as it is written on the wikipedia pages, how is that after a reboot (which frees up all the file locks), IE keeps using the wrong path for index.dat ?!

I think more and more of a malware or spyware on that system…

Actually the given source says the opposite.

I.e. once the file(s) is/are (accidentally) locked the files in \Temp\ are used UNTIL a reboot occurs (and thus after a reboot the "right" path is unlocked and its use is resumed)

Internet Explorer will continue to use the directories under %TEMP% until the files at the original location become writable again.

The above should be read more widely as "if - in any way - you lock the files that should be used a "safeback" path under \temp\ and files in it are used"
If you prefer the issue is in two points
1) *something* is known in some limited, specific case to accidentally lock those files
2) there is a safeback mechanism that in case the files are locked (for whatever reason, not only the *something* in #1 above) will use files in \temp\

Of course the #1 can be either a "failed user switch" (which is the *something* documented) or *anything*else (including malware).

jaclaz

 
Posted : 30/10/2016 12:48 pm
(@kurt2121)
Posts: 43
Eminent Member
Topic starter
 

It is caused by the defined environment variables (most probably the %USERPROFILE%, %TEMP% and %TMP%), check those setting for each user on the system.

NO, it isn't.
For some *strange* reasons (as said a sort of bug) the actual files that should be used can sometimes remain "locked" through a "false/incomplete" user switch and the Internet Explorer uses a "failsafe" path inside \Temp\.
i.e, it tries to write/append to
C\Documents and Settings\username\Local Settings\History\History.IE5\index.dat
BUT since that file is "in use" (even if it isn't), it uses instead
C\Documents and Settings\username\Local Settings\Temp\History\History.IE5\index.dat

jaclaz

The weird part is the history that is included in the temp history.ie5 file is history that I remember making, and I never used the "runas" command or anything like that. Just changed accounts the normal way (although I would shut down the computer improperly without signing out sometimes, but not sure if that would have an impact

There was only about three days worth of browsing in December of 2007 and it skipped and had a day of December 2008. So if that was malware, seems a bit weird to skip a whole year, doesn't it?

 
Posted : 31/10/2016 4:17 am
Share: