WebCache ::: File Size

[The-10-Pen]

.

What file sizes are others seeing for the WebCacheV01.dat file present at C:\Users\<username>\AppData\Local\Microsoft\Windows\WebCache?
Basically anything Win7 and higher, especially if "fully updated".

I'm seeing reports of this growing into the double-digit GIGABYTES.

It was 27MB on my install from six months ago.
And 15MB on an install from just shy of two months ago.

Now *disabled*, but I'm curious of what file size others are seeing.

[The-10-Pen]

.

And if you want to witness the file being written to, monitor your processes using something like System Informer.
You will see a dllhost.exe process pop up every once in a while, launched by {3EB3C877-1F16-487C-9050-104DBCD66683}.

It's easy to disable.
Regedit and search for {3EB3C877-1F16-487C-9050-104DBCD66683}.
Take ownership of the key and then delete it. There are three or four of them, didn't really count as I went along, can on the next I deploy.
Common fix posted all over the 'net, Google/DuckDuckGo/Bing anything like "disable webcache" and you'll find 'em.

[Duke]

What file sizes are others seeing for the WebCacheV01.dat file present at C:\Users\<username>\AppData\Local\Microsoft\Windows\WebCache?

Mine is 32 MB.

It's easy to disable.
Regedit and search for {3EB3C877-1F16-487C-9050-104DBCD66683}.
Take ownership of the key and then delete it.

A safer way would be to simply rename {3EB3C877-1F16-487C-9050-104DBCD66683} in HKEY_CLASSES_ROOT\AppID\, just in case.
Putting an underline in front like this: _{3EB3C877-1F16-487C-9050-104DBCD66683} works. That way the other registry entries don't need to be touched.

[The-10-Pen]

.

I did see the underline rename in one of the internet searches.
Being a test-case machine, no loss if I have to reinstall.

The process is now "dead" on one machine and I'm hoping to hex into the .dat file on the other.
I'm kind of curious if I can see what's in there. Bank account web sites? Passwords? Names of Excel and Word files?

I personally try to KILL anything I can find like this!
No, I have nothing to "hide" on my computer, I just have no use in this "AI Data Harvesting".

[The-10-Pen]

.

Any chance of something like a PowerShell script that can perform a registry key take-ownership plus rename?
Just to make it SOOO much easier to deploy on a handful of computers.

[Duke]

I just have no use in this "AI Data Harvesting".

Nothing to do with AI, I have this file on my Windows 8.1 and there is no AI on this OS.

Any chance of something like a PowerShell script that can perform a registry key take-ownership plus rename?

I'm not a PowerShell specialist but I've found that:
https://kak.kornev-online.net/FILES/KAK%20-%20Take%20Ownership%20(Permission)%20of%20Registry%20Keys%20from%20Command%20Line.pdf

SetACL download:
https://helgeklein.com/download/

SubInACL download:
https://github.com/Jackpison/IDM-reset/blob/master/subinacl.msi


And, for the record, here is a tool to make full backups of the registry because the Export item of Regedit.exe won't save it all:
https://www.acelogix.com/download/ → Freeware → RegBak
Direct link:
https://www.acelogix.com/downloads/regbak.zip

[The-10-Pen]

This works to take ownership of the key.
Still looking for a way to rename the key after taking ownership.

Code: Select all

# Get the ID and security principal of the current user account
$myWindowsID = [System.Security.Principal.WindowsIdentity]::GetCurrent();
$myWindowsPrincipal = New-Object System.Security.Principal.WindowsPrincipal($myWindowsID);

# Get the security principal for the administrator role
$adminRole = [System.Security.Principal.WindowsBuiltInRole]::Administrator;

# Check to see if we are currently running as an administrator
if ($myWindowsPrincipal.IsInRole($adminRole))
{
    # We are running as an administrator, so change the title and background colour to indicate this
    $Host.UI.RawUI.WindowTitle = $myInvocation.MyCommand.Definition + "(Elevated)";
    $Host.UI.RawUI.BackgroundColor = "DarkBlue";
    Clear-Host;
}
else {
    # We are not running as an administrator, so relaunch as administrator

    # Create a new process object that starts PowerShell
    $newProcess = New-Object System.Diagnostics.ProcessStartInfo "PowerShell";

    # Specify the current script path and name as a parameter with added scope and support for scripts with spaces in it's path
    $newProcess.Arguments = "& '" + $script:MyInvocation.MyCommand.Path + "'"

    # Indicate that the process should be elevated
    $newProcess.Verb = "runas";

    # Start the new process
    [System.Diagnostics.Process]::Start($newProcess);

    # Exit from the current, unelevated, process
    Exit;
}

# Run your code that needs to be elevated here...

# Write-Host -NoNewLine "Press any key to continue...";
# $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown");


# Your script here

function Enable-Privilege {
 param(
  ## The privilege to adjust. This set is taken from
  ## http://msdn.microsoft.com/en-us/library/bb530716(VS.85).aspx
  [ValidateSet(
   "SeAssignPrimaryTokenPrivilege", "SeAuditPrivilege", "SeBackupPrivilege",
   "SeChangeNotifyPrivilege", "SeCreateGlobalPrivilege", "SeCreatePagefilePrivilege",
   "SeCreatePermanentPrivilege", "SeCreateSymbolicLinkPrivilege", "SeCreateTokenPrivilege",
   "SeDebugPrivilege", "SeEnableDelegationPrivilege", "SeImpersonatePrivilege", "SeIncreaseBasePriorityPrivilege",
   "SeIncreaseQuotaPrivilege", "SeIncreaseWorkingSetPrivilege", "SeLoadDriverPrivilege",
   "SeLockMemoryPrivilege", "SeMachineAccountPrivilege", "SeManageVolumePrivilege",
   "SeProfileSingleProcessPrivilege", "SeRelabelPrivilege", "SeRemoteShutdownPrivilege",
   "SeRestorePrivilege", "SeSecurityPrivilege", "SeShutdownPrivilege", "SeSyncAgentPrivilege",
   "SeSystemEnvironmentPrivilege", "SeSystemProfilePrivilege", "SeSystemtimePrivilege",
   "SeTakeOwnershipPrivilege", "SeTcbPrivilege", "SeTimeZonePrivilege", "SeTrustedCredManAccessPrivilege",
   "SeUndockPrivilege", "SeUnsolicitedInputPrivilege")]
  $Privilege,
  ## The process on which to adjust the privilege. Defaults to the current process.
  $ProcessId = $pid,
  ## Switch to disable the privilege, rather than enable it.
  [Switch] $Disable
 )

 ## Taken from P/Invoke.NET with minor adjustments.
 $definition = @'
 using System;
 using System.Runtime.InteropServices;
  
 public class AdjPriv
 {
  [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
  internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall,
   ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen);
  
  [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
  internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok);
  [DllImport("advapi32.dll", SetLastError = true)]
  internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid);
  [StructLayout(LayoutKind.Sequential, Pack = 1)]
  internal struct TokPriv1Luid
  {
   public int Count;
   public long Luid;
   public int Attr;
  }
  
  internal const int SE_PRIVILEGE_ENABLED = 0x00000002;
  internal const int SE_PRIVILEGE_DISABLED = 0x00000000;
  internal const int TOKEN_QUERY = 0x00000008;
  internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;
  public static bool EnablePrivilege(long processHandle, string privilege, bool disable)
  {
   bool retVal;
   TokPriv1Luid tp;
   IntPtr hproc = new IntPtr(processHandle);
   IntPtr htok = IntPtr.Zero;
   retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok);
   tp.Count = 1;
   tp.Luid = 0;
   if(disable)
   {
    tp.Attr = SE_PRIVILEGE_DISABLED;
   }
   else
   {
    tp.Attr = SE_PRIVILEGE_ENABLED;
   }
   retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid);
   retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);
   return retVal;
  }
 }
'@

 $processHandle = (Get-Process -id $ProcessId).Handle
 $type = Add-Type $definition -PassThru
 $type[0]::EnablePrivilege($processHandle, $Privilege, $Disable)
}

Enable-Privilege SeTakeOwnershipPrivilege 

# Change Owner to the local Administrators group
$regKey = [Microsoft.Win32.Registry]::ClassesRoot.OpenSubKey("AppID\{3eb3c877-1f16-487c-9050-104dbcd66683}",[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,[System.Security.AccessControl.RegistryRights]::TakeOwnership)
$regACL = $regKey.GetAccessControl()
$regACL.SetOwner([System.Security.Principal.NTAccount]"Administrators")
$regKey.SetAccessControl($regACL)
# Change Permissions for the local Administrators group
$regKey = [Microsoft.Win32.Registry]::ClassesRoot.OpenSubKey("AppID\{3eb3c877-1f16-487c-9050-104dbcd66683}",[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,[System.Security.AccessControl.RegistryRights]::ChangePermissions)
$regACL = $regKey.GetAccessControl()
$regRule = New-Object System.Security.AccessControl.RegistryAccessRule ("Administrators","FullControl","ContainerInherit","None","Allow")
$regACL.SetAccessRule($regRule)
$regKey.SetAccessControl($regACL)

[The-10-Pen]

SubInACL download:
https://github.com/Jackpison/IDM-reset/blob/master/subinacl.msi

I tried this. Did not work.

[The-10-Pen]

Nothing to do with AI, I have this file on my Windows 8.1 and there is no AI on this OS.

Noted.
It is not on my Win10 LTSB 2016 machines but it is on my Win10 LTSC 21H2 and Win10 Pro 22H2 machines.

Regardless of not being AI,
I do not want it on my machines, collecting/harvesting whatever, growing in size, with no knowledge of what it is "collecting".

[The-10-Pen]

.

Probably should have known. In order to "rename", I had to copy the old to new, then delete the old. Safe effect.

[The-10-Pen]

A safer way would be to simply rename {3EB3C877-1F16-487C-9050-104DBCD66683} in HKEY_CLASSES_ROOT\AppID\, just in case.
Putting an underline in front like this: _{3EB3C877-1F16-487C-9050-104DBCD66683} works. That way the other registry entries don't need to be touched.

This "by itself" is not sufficient. It's possible that it "is" for Win8/8.1, but I'm showing it insufficient for Win10/11.
For my own computers, I shall be deleting all keys, not renaming them, but DELETING them. This WORKS in preventing this WebCache file.

[Duke]

SubInACL download:
https://github.com/Jackpison/IDM-reset/blob/master/subinacl.msi

I tried this. Did not work.

Maybe more luck with this attached older version ?

[Duke]

I do not want it on my machines, collecting/harvesting whatever, growing in size, with no knowledge of what it is "collecting".

On Windows 8.1 it seems to be run by taskhost.exe (Host Process for Windows Tasks) and linked to the Diagnostic System Host, so it may collect informations about the system when a problem occurs.

[The-10-Pen]

.

Thanks for the older version. Archived for later as I seem to have everything fixed "for now".
It seems added keys need deleted (or renamed if you prefer that route) for x64 (ie, WOW6432Node registry entries).

Can't be "only" Diagnostic System Host, as all "diagnostic" services are intentionally disabled on my systems.
I manually enable them for 'times of need' and prefer they not run 24/7.

[The-10-Pen]

Mine is 32 MB.

I guess you bump into WAY more "diagnostic problems" than I. Waka waka waka.
My brother had one computer with this file at 68 MB and another with this file at 77 MB.
So I guess I should just consider myself lucky that mine were only 15 and 27.

[The-10-Pen]

.

On a test-VM, this file is a colossal "whole lot of nothing".
It's literally ALL ZEROES.

It's a total of 197FFF0 bytes long (26,738,672 decimal).
And *everything* past EE142 (975,170 decimal) is all ZEROES.
And massive chunks of zeroes even before EE142.

That's a whole lot of "disk thrashing" just to write ZEROES and "take up space".

2026-02-26_9-28-00.png (21.8 KiB) Viewed 64 times

2026-02-26_9-25-19.png (36.42 KiB) Viewed 64 times

2026-02-26_9-23-04.png (27.67 KiB) Viewed 64 times

[Duke]

Can't be "only" Diagnostic System Host, as all "diagnostic" services are intentionally disabled on my systems.
I manually enable them for 'times of need' and prefer they not run 24/7.

Same for me, and I didn't say "only". In fact I've just noticed the link after you started this thread but yes, there might some other ones.

I guess you bump into WAY more "diagnostic problems" than I.

I had many graphics card problems and crashes past year after I tried Zen browser. It looks like this thing blindly installed a ring0 DLL and that caused a lot of trouble.