Removing information about connecting flash drives. How to disable or enable USB ports in Windows. Deny access to removable media through the Group Policy Editor

Good evening dear visitors of my blog!!! I haven't written anything new in a long time. I sat and thought, but remembered an interesting topic that I encountered at the session. Registry topic usb connections-flash drives, in the classroom they considered writing code to extract a flash drive from the system to safe mode Free Pascal tools. The code was properly disassembled and considered within the framework of this topic, I see no reason, but I will tell you how to clean the traces left by the flash drives that you once connected.

How to clean the registry from USB traces?

We will clean up standard tool Regedit. It starts like this: "Start - Run - regedit"

The main Registry Editor window will open. Now you will need to find the following subsections:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USBSTOR
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USBSTOR

Each of these sections stores data about connected flash drives. Recordings with the Disc prefix can be safely deleted. For example, I give screenshots with the contents of these sections in my registry.

This is the content of sections numbered 1 - CurrentControlSet

Here you see the contents of the section - ControlSet001

Well, here, as you probably guessed, the section entries are ControlSet002

Records with the Disc prefix are selected and deleted.

Why clean entries from the registry?

If you connect a lot of flash drives to your computer, then your registry starts to become clogged with this garbage, as a result of which the recognition process will begin to slow down with each new flash drive, but do we need it?

Is it possible to facilitate (speed up) the cleaning procedure?

Yes, it is possible! To do this, you need to use the program, as an example I can give - Usb Oblivion. The program is easy to find on the Internet, it is free, it weighs very little.

We run the program as an administrator, check the box "Perform real cleaning" and click the "Clean" button - it's done.

Now in the forum there was a discussion of how to determine under which account mounted USB, but I have the opposite task. It is necessary, without administrator rights, from under a user with limited rights, to remove information about connected USB devices from Windows.

The task is difficult because there are no rights to change the registry. It also fails to solve the problem by booting the LiveCD.

Irina will “thank you very much” after the users she “draws attention to” take advantage of these tips.

To be honest, they got ahead of me, I myself wanted to continue the topic in this direction)))

I think the initial data is enough, but nevertheless I will give the details.

I’ll make a reservation right away, this is not about a certified object and not about providing information security confidential information (in a sense). The question was "purely for myself." For example, it is undesirable for me to have in the system, on a working computer, data about connected, personal, USB devices.

God protects those who are safe and it is not known how these data may affect the future. You never know who from the management wants to find a scapegoat for leaking non-confidential, but working data. Or hang the responsibility for the spread of the virus in the corporate network. In short, there are many things to think about.

In a word, we will consider my question from the point of view of an attacker who wants to remove compromising information.)))

We consider the experimental computer as: a regular working computer included in the corporate network of the organization; Windows XP OS; authorization through Active Directory, physical access is available; have access to the BIOS; limited user rights; it is possible to boot from any media (for example, from LiveCD).

How to clear data about USB flash drives in the Windows registry.

Comments and reviews: 9

1. Ilya 19.05.2011
>>>Attention! These sections also contain information about the hard drives installed on the computer. Do not delete this information.

Question: If I mistakenly delete data about hard drives along with information about flash drives, what then? Kaput system?

Answer:
Yes you are right. Sometimes, even with full access rights set, it is not possible to delete the specified keys. But there is a way out. You need to run the registry editor with system rights.

How to do this under Windows XP I will write below. Haven't tried it on Vista or Windows 7.

So. In order to run a program with system rights in Windows XP, you need to run it through the "Task Scheduler". Make sure you have this service enabled:

Control Panel - Administrative Tools - Services - Task Scheduler.

If everything is in order, we compose a BAT file with the following content:
at 21:01 /interactive regedit.exe

21:01 is the time (you will have your own value) to start the task. If you have system clock show the time 20.59, then the registry editor (regedit.exe) will be launched at 21:01, after 2 minutes.

Then we run the BAT file.
At 21:01 we admire the registry editor running under system rights.

Now you can edit any data in the registry.

8. Athanasius 08.07.2013
Reply to reply to comment #3
How to do this under Windows XP I will write below. Haven't tried it on Vista or Windows 7.

I tried, in windows 7, but this method no longer works. The registry editor starts and is visible in processes, but the system does not open its windows for security purposes. What it reports when you try to create a task in the task scheduler.

How to remove old usb device drivers from Windows?

Almost every user connects a phone, tablet, reader, flash drives and external HDDs to the computer. When working with these devices, Windows installs their drivers. At the end of operation, they are not deleted from the computer (that is, they gradually accumulate) and, just like temporary files, unnecessary entries in the registry litter the system.

In addition, if devices are disconnected from USB port incorrectly (pulled out without software shutdown by the "Extract" function), then installed drivers not only remain in the system, but also continue to function. Because of this, they often become the cause of a software conflict in the process of connecting another USB device (the system “does not see” the device, gives errors, hangs).

This article will help you avoid all these troubles: it will tell you how to remove the driver of an unused USB drive or gadget from operating system completely how to automatically uninstall all USB drivers.

Removal by regular means

Surface cleaning

1. Open the Start menu.

2. Right-click on the "Computer" panel that appears. Select "Properties" from the list of commands.

3. In the column on the left, click "Device Manager".

4. In the dispatcher window, in the horizontal menu, open the "View" section and click "Show hidden devices".

5. Open the "USB Controllers" directory.

6. Remove the old or unused driver: right-click on its name → click "Delete".

Deep cleaning

1. Hold down the Win key and press the Pause/Break key. Or open: Start → right-click "Computer" → Properties.

2. In the window that opens, in the left panel, click "Advanced system settings".

3. On the Advanced tab, click the Environment Variables button.

4. In the upper block, click "Create".

5. In the "New User Variable" window:

in the line "Variable name" enter - devmgr_show_nonpresent_devices;
in "Variable value" - 1.

6. Click OK in the variable panel and in the Environment Variables window.

7. Return to the system properties window (Win + Break) and click "Device Manager".

8. In the manager, open: View → Show hidden…

9. Click the "Update configuration ..." button (the last one in the panel).

10. The icons of unused drivers in the manager are grayed out (that is, you can delete this driver). Open the following directories one by one and remove unnecessary elements (right-click on the name → Delete):

Non Plug and Play Device Drivers

Advice! In this directory you can also remove old drivers, installed by programs that are already uninstalled from Windows (for example, the Comodo firewall package).

USB controllers

Disk devices

This section of devices displays installed drivers for flash drives, readers, hard drives. Transparent object icons indicate that they are not used (not connected). So, you can safely get rid of them.

11. When cleaning is complete, restart your PC.

Automatic removal by USBDeview utility

1. Copy this link into the address bar of your browser - http://www.nirsoft.net/utils/usb_devices_view.html#DownloadLinks (official website of the utility). And then press "ENTER".

2. On the opened page:

if you have a 32-bit system, click the first link "Download USBDeview";
if 64-x, the second is "... for x64 systems".

3. Unpack the downloaded archive: right-click on it → select "Extract all ..." → in the "Unpacking ..." window, click "Extract".

4. Open the unzipped folder. Run the USBDeview executable with administrator rights.

5. The utility window displays a list of all drivers installed in the system. Disabled elements are marked with red "chips".

To remove a driver from Windows, select it with a mouse click, and then click the Trash icon in the USBDeview panel. Or right-click on it and select "Uninstall Selected Devices" from the context menu.

Note. In addition to the removal function, USBDeview provides the user with the ability to disable / enable the driver, view its properties.

Removing all USB device drivers

Global cleaning of drivers can be done with the DriveCleanup utility (download link - http://uwe-sieber.de/files/drivecleanup.zip).

1. Unzip the archive downloaded to your computer.

2. If you have 32-bit Windows, open the "Win32" folder, if 64, respectively, "x64".

3. Run the "DriveCleanup" file as an administrator.

Once launched, the utility will automatically clean up. At the end of the procedure (when the message “Press any key” appears in the console window), press any key.

Good luck with your system setup!

izbavsa.ru

We cover our tracks. How to force Windows to delete history, logs, caches and forget everything

Lists open files and connected by USB devices, browser history, DNS cache - all this helps to find out what the user was doing. We have compiled step by step instructions how to remove traces of your activities in different versions Windows, Office and popular browsers. At the end of the article, you will find some scripts that will help you keep your machine clean automatically.

1. Clearing lists of recent places and programs

Let's start cleaning with lists of recent places and programs. The list of recent (in Windows 10 - frequently used) programs is in the main menu, and the list of recent places is in File Explorer.

How to turn off this mess? In Windows 7 - right-click on the "Start" button, select "Properties" and in the window that appears, uncheck both checkboxes in the "Privacy" section.

Disable list storage latest programs in Windows 7

To clear the list of recent places and documents, you need to delete the contents of the %appdata%\Microsoft\Windows\Recent directory. To do this, open command line and run two commands:

It also doesn't hurt to delete the contents of the %appdata%\microsoft\windows\recent\automaticdestinations\ directory. It stores the latest files that appear in the jump list:

To have recent files cleared automatically on exit, you need to enable the "Clear recently opened document history on exit" policy, which is located in User Configuration\Administrative Templates\Start Menu and Taskbar.

Now let's move on to Windows 10. You can turn off the list of recently added and frequently used applications through the "Settings" window. Open it and go to the "Personalization" section, the "Start" item. Turn off everything in there.

Disable Program List Storage in Windows 10

It seems that the problem is solved, but, alas, this is not entirely true. If you enable these options again, then all lists in the same composition will appear again. Therefore, you will have to disable this feature through group policy. Open gpedit.msc and navigate to User Configuration\Administrative Templates\Start Menu and Taskbar. Enable the following policies:

"Clearing the list of recently used programs for new users";
"Clear the history of recently opened documents on exit";
"Clear notification log on tile on exit";
"Remove the list of programs pinned to the start menu."

Group Policy

Clearing recent places in Windows 10 is easier than in the "seven". Open File Explorer, go to the "View" tab and click the "Options" button. In the window that appears, turn off the options "Show recently used files in the Quick Access Toolbar" and "Show frequently used folders in the Quick Access Toolbar". Don't forget to click the "Clear" button.

Parameters Windows folders 10

As you can see, a task as simple as clearing the last objects has a rather difficult solution. Without editing group policies - nowhere.

2. Clearing the list of USB drives

At some secure facilities, only flash drives registered in the log are allowed to be connected to the computer. And, as usual, the magazine is the most common - paper. That is, the computer itself does not in any way restrict the connection of unregistered drives. Does not limit, but records! And if during the check they find that the user connected unregistered drives, he will have problems.

By no means do we advise you to try to steal military secrets, but the ability to clear the list of recently connected drives can come in handy in other life situations. To do this, look in the following registry keys:

Here they are - all the drives that you connected to your computer.

Registry key with drive connection history

It would seem that you just need to take it and clean everything. But it was not there! Firstly, the permissions for these registry branches are set in such a way that you won’t delete anything even in the “seven”, not to mention the “ten”.

Secondly, assigning rights and permissions manually takes a long time, especially if there are a lot of drives. Thirdly, admin rights will not help. The screenshot above was created when I performed the delete operation with just admin rights. Fourth, in addition to these two partitions, there is a long list of partitions to clean up. Moreover, they must not only be deleted, but correctly edited.

If for some reason you need to do everything manually, then look for keywords MountPoints, MountedDevices, DeviceClasses, and RemovableMedia. But it's much easier to use finished program who will do everything for you. Some forums recommend USBDeview for this. However, I tested it and declare that it does not clean out information from all the necessary sections. USBSTOR And USB continue to contain information about connected media.

I can recommend USB Oblivion. Run it, check the "Perform a real cleaning" checkbox. You can turn on the “Save .reg-file of the cancellation” parameter or not, but if the goal is not to check the program, but to prepare for the upcoming computer inspection, then it is better to turn it off.

USB Oblivion

The program not only cleans the registry, but also displays a detailed log of its actions (see below). When it finishes, there will be no mention of connecting drives to the computer.

USB Oblivion in action

3. Clear cache and browser history

The third item in our tudu is clearing the cache and browser history. There are no difficulties here - each browser allows you to reset the list of recently visited sites.

Continued available to subscribers only

Option 1. Subscribe to "Hacker" to read all the materials on the site

Subscription will allow you to read ALL paid materials of the site during the specified period. We accept payment bank cards, electronic money and transfers from accounts mobile operators. Subscription Details

Option 2. Buy one material

Interested in information, but there is no way to pay for a subscription? Then this option is for you! Please note that this purchase option is only available for content published more than two months ago.

How to remove traces of a flash drive in windows?

How to remove traces of a flash drive in windows

Flash Drive - Uses flash memory. Convenient and quite common among users of individual computers. In individual cases, there is a need to work with a flash drive, and the traces left on the computer are not needed. This is possible when the employer prohibits the use of any unregistered media. Or in order to preserve the confidentiality of the presence of a flash drive on someone else's computer, in order to avoid leakage of valuable information, theft of intellectual property, trade secrets, maintaining high level information security, or infection of computer networks with malicious computer software, viruses, computer worms. This causes not only material damage, but also damage to the image of the company. There is an option to ban off-duty use computer technology And software employer. Flash drives differ in the amount of information they can hold, manufacturers, design, size, but the principle of storing information about them in the computer's memory is the same.

There are several options for removing traces of a flash drive. Consider the options for removing traces of a flash drive from windows memory using specific examples:

Removing traces of a flash drive manually. After finishing working with the flash drive, and disconnecting it from the computer, do the following:
- Press start,
- Select line execute,
- Type REGedit and click ok

Among the registry branches that appear, select HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\
WINDOWS\setupapi.log

It is in them that the history of connecting flash drives is stored.

In each folder, by successively pressing the right mouse button and choosing "delete", we erase the information about the flash drive.

This option is only possible if you are logged into WINDOWS as an administrator. Under the name user or user, you will not be able to remove traces of the flash drive manually, you need to change the user.

To change the username: click start, select the settings menu bar, control panel, enter the Administrative Tools folder, select Computer Management and change the name from user to administrator. In individual cases, this cannot be done, due to the simplification installed version for users. Then, we advise you to use the second option.

As a result of manual cleaning, invalid links may appear in the registry, so some experts do not welcome its use.

2. Removing traces of a flash drive using a utility program. This method is faster and better. Downloaded programs will repeatedly come to your aid in matters related to cleaning registries. The algorithm of actions, in this case, is as follows. Let's look at a specific example:

The flash drive is finished. Get her out.

Download the USBDeview program from the Internet to your desktop. This is a utility that displays a list of all previously connected to your personal computer: mobile phone, flash drive, etc. Not only the time of the last connection is indicated, but also serial numbers device, its description. You can download the program for free. Designed for Windows 2000/XP/Vista/Server 2003/Seven (operating systems) on English language. Developed - in 2006, Latest updates— in October 2010.

In the folder copied on the desktop, select the compressed zip folder - USBDeview, and extract all the files from it.

Open the newly created folder on the desktop and run the utility program by clicking

Our flash drive was determined to be the second in the list. Copy the program to the desktop from the Internet - the USBOblivion utility. This free program, designed to remove traces of connecting CD-roms and USB drives. Removes from Windows Registry 2000, Windows XP, Windows 2003, Windows Vista, Windows 7. There are both 32 and 64 versions.

The USB Oblivion utility is designed to erase traces of connecting USB drives and CD-ROMs from Windows memory 7, Windows 2000, Windows 2003, Windows XP ,Windows Vista, both 32 and 64 bit versions. There are 4 versions of the program, 1.3.0.0. - the most recent and updated one, automatic disk disconnection has been added. The program is fully automated, more automated, its plus is that it is possible to clean USB Sidi-ROMs.

Disconnect all USB devices from the computer. The program does not erase anything by default, do not forget to check the appropriate box. Reg file is created in the Documents folder, created with a detailed report.

·In the copied folder on the desktop, select USB Oblivion 32 (compressed Zip folder), extract all files from it. They are copied to separate folder which you will find on your desktop.

Open usboblivion folder, open USBOblivion32.exe (cleanup utility).

Select the checkbox: do a real cleanup and click the cleanup button.

Check the result with USBDeview..

Here's what happened in our case:

Traces of our flash drive in windows have been removed. We wish you successful work as well. Dealing with this program is convenient, it is reliable, and, not least, its download is free.

We examined an example of deleting information about a flash drive using a specific program as an example. On the Internet today there is a large selection of programs from different manufacturers. It is possible to use a flash drive so that there is no information about it at all and then it will not have to be deleted. To do this, install a Russian tweaker on a USB flash drive that works without installation. After launching it, in the settings, specify not to save the document history, search history, etc. Select the item: "Cleaning the paging file". Don't forget to disable the Recycle Bin before shutting down or restarting your computer. Before removing the flash drive, you must close the edited or just open files. Otherwise, there will be a lot of temporary files. A good option would be to create a default temporary folder in Word, and clear it from time to time. View the Word settings, document history: click disable. Mouse (right-click) click on My Computer, select Manage, then Device Manager. Turn on Menu View, select: show hidden devices. Remove pale gray devices, i.e. not found in the sections "Storage Volumes" and "Universal Serial Controllers". USB bus. Experiment, choose the option that suits you.

And so we immediately get to the point.

Briefly about the methods of cleaning traces of the USB connection

Registry cleaning- the most affordable way, but for an inexperienced user it may be too difficult to implement, since it will be necessary to go into the registry (in the heart of windows) and delete traces there. For administrators this way acceptable if there are not many computers.
Cleaning with DriveCleanup and USBDeview- the easiest and most convenient way, just run these two utilities and these little programs will do their job. Why did I indicate two programs, because I noticed that individually, each of them does not clean up to the end, and after processing with two traces it is not possible to detect.
H source using fepstools and cleaning utilities- this method is suitable for cleaning traces UBS all computers in the enterprise network. This method uses special program fepstools which allows for stealth mode run other programs, i.e. cleaning utilities.

Let's consider the first way. Registry cleaning

We open Start -> Execute or in search bar command regedit. If you have windows 8.1 then the easiest way is to create special shortcut for running console commands. To do this, on the desktop screen, right-click and select create shortcut, and in the label we write cmd On the created label cmd right click and run as administrator. In the screen that opens, enter the command we need in our case regedit

Information about connected devices is located in the following path

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\UsbEStub

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

An example entry like VID_058F&PID_6366 shows what kind of device was connected. The VID parameter is the serial number of the device, and complete record The serial number can be seen by opening the VID_058F&PID_6366 folder, then we will see this number 058F63666438, this is the serial number of our device.

Lists of open files and USB connected devices, browser history, DNS cache - all this helps to find out what the user was doing. We have compiled step-by-step instructions on how to remove traces of your activities in different Windows versions, Office and popular browsers. At the end of the article, you will find some scripts that will help you keep your machine clean automatically.

1. Clearing lists of recent places and programs

Let's start cleaning with lists of recent places and programs. The list of recent (in Windows 10 - frequently used) programs is in the main menu, and the list of recent places is in File Explorer.

How to turn off this mess? In Windows 7 - right-click on the "Start" button, select "Properties" and in the window that appears, uncheck both checkboxes in the "Privacy" section.

To clear the list of recent places and documents, you need to delete the contents of the %appdata%\Microsoft\Windows\Recent directory. To do this, open a command prompt and run two commands:

Cd %appdata%\Microsoft\Windows\Recent echo y | del *.*

It also doesn't hurt to delete the contents of the %appdata%\microsoft\windows\recent\automaticdestinations\ directory. It stores the latest files that appear in the jump list:

cd %appdata%\microsoft\windows\recent\automaticdestinations\ echo y | del *.*

"Clearing the list of recently used programs for new users";
"Clear the history of recently opened documents on exit";
"Clear notification log on tile on exit";
"Remove the list of programs pinned to the start menu."

As you can see, a task as simple as clearing the last objects has a rather difficult solution. Without editing group policies - nowhere.

2. Clearing the list of USB drives

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR\ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\

Here they are - all the drives that you connected to your computer.

If for some reason you need to do everything manually, then search for the keywords MountPoints, MountedDevices DeviceClasses and RemovableMedia. But it is much easier to use a ready-made program that will do everything for you. Some forums recommend USBDeview for this. However, I tested it and declare that it does not clean out information from all the necessary sections. USBSTOR And USB continue to contain information about connected media.

I can recommend the program. Run it, check the "Perform a real cleaning" checkbox. You can turn on the “Save .reg-file of the cancellation” parameter or not, but if the goal is not to check the program, but to prepare for the upcoming computer inspection, then it is better to turn it off.

The program not only cleans the registry, but also displays a detailed log of its actions (see below). When it finishes, there will be no mention of connecting drives to the computer.

3. Clear cache and browser history

The third item in our tudu is clearing the cache and browser history. There are no difficulties here - each browser allows you to reset the list of recently visited sites.

Continued available to members only

Option 1. Join the "site" community to read all the materials on the site

Membership in the community during the specified period will give you access to ALL Hacker materials, increase your personal cumulative discount and allow you to accumulate a professional Xakep Score rating!

In addition to this, if devices are disconnected from the USB port incorrectly (pulled out without software shutdown by the "Eject" function), then the installed drivers not only remain in the system, but also continue to function. Because of this, they often become the cause of a software conflict in the process of connecting another USB device (the system “does not see” the device, gives errors, hangs).

This article will help you avoid all these troubles: it will tell you how to remove the driver of an unused USB drive or gadget from the operating system completely, how to automatically uninstall all USB drivers.