Tablacus Explorer (TE)'s software
listing at TPFC indicates that it is stealth.
On my
Win 7 x64, extracting & running the
basic TE package with
default settings,
no additional add-ons &
no user interaction creates & leaves behind the following items upon every run & clean exit.
TE x64 leaves behind:
Code: Select all
%LocalAppData%\Microsoft\Internet Explorer\MSIMGSIZ.DAT
HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication
HKLM\SOFTWARE\Microsoft\Tracing\TE64_RASAPI32
HKLM\SOFTWARE\Microsoft\Tracing\TE64_RASMANCS
while TE x32 leaves behind:
Code: Select all
%LocalAppData%\Microsoft\Internet Explorer\MSIMGSIZ.DAT
HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\TE32_RASAPI32
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\TE32_RASMANCS
I suppose TPFC's current
definition of "Stealth" probably exempts
DirectDraw &
Tracing registry entries. But what about
MSIMGSIZ.DAT in %LocalAppData% ? I first encountered MSIMGSIZ.DAT popping up since TE v16.12.9 (released: 09 Dec 2016).
If MSIMGSIZ.DAT is deleted or moved to either TE's working folder or its
\config\ folder, TE instantly creates a
new MSIMGSIZ.DAT at the same %LocalAppData% location at the next launch. If the DAT file is left alone at %LocalAppData%, TE doesn't try to update it on subsequent runs. The DAT file's timestamp dates back to the first time it was created by TE. (Maybe this is because there are no filesystem changes in between.)
Since there is no apparent performance or functionality impact as to whether MSIMGSIZ.DAT exists or not, I use a custom yaP config to delete the DAT file (as well as TE-related
DirectDraw &
Tracing registry keys) after TE closes.
According to this Microsoft dev
blog, MSIMGSIZ.DAT is a
"cache of image URLs to image dimensions for images that have been previously decoded by MSHTML", & is
created by Internet Explorer.
Note: When TE is in use, Internet Explorer is not running, & the system is also physically disconnected from the internet. The default location that TE opens upon launch (system's Desktop folder) do not contain any image files, only a couple of shortcut LNK files to frequently-used programs.
So I wonder why TE keeps creating that MSIMGSIZ.DAT file (if deleted), & what content it actually caches, esp. if user were to proceed to browse the filesystem extensively & carry out some functions. As such, if I were to use TE on a public computer to view files on my thumbdrive, might leaving behind MSIMGSIZ.DAT on the host computer pose a privacy issue ?