Sinister spy file tracks PC users

By MICHAEL FOREMAN

Every time you visit a website, a hidden file embedded in Windows computers records the visit and stores the information, defying almost all efforts to wipe it.

A Herald investigation into the existence of the persistent file on Windows 95 and 98 PCs - a variant of files called index.dat - has turned up alarming results.

While computer enthusiasts have known about index.dat files for some time and debated how to get rid of them, the Herald has proved the presence of a file which logs web use but remains hidden and cannot be opened by Windows programs. Nor can it be removed by Windows 98 commands to clear temporary files.

The file's presence opens questions of whether computer use is private, and what exactly the file is used for.

The web has been abuzz with chat about index.dat files, but few have taken the step of analysing just how deeply embedded or how powerful one of these files can be.

The index.dat file may be found in a folder called Content IE5 within the Temporary Internet Files directory of the Windows folder in drive C.

Outwardly, it resembles identically named temporary files used in Windows to speed up web performance, but on the inside it behaves quite differently. It is persistent and grows every time a user visits a website. One bulletin board user calls it "mysterious, invisible and ever-growing".

Herald IT journalists opening the file on their own and other PCs discovered a huge list of websites visited over a long period and easily browsable records of web-based e-mail messages.

Three journalists were able to open web-based mail files on three PCs running Windows 98, and one reporter was able to read his partner's Hotmail and Yahoo! e-mail messages without the password.

The file can be opened only by using Windows' underlying operating system DOS.

Normal index.dat files were specifically created by Microsoft, the world's largest manufacturer of software, to speed up downloading information from previously visited sites. They also record "cookies" - files planted by a website you visit so the company can monitor information on who hits the site.

Privacy Commissioner Bruce Slane says concern is growing at the covert recording and storing of information about people by the computers they are using.

"We are seeing more lobbying against this sort of thing, and attention to it is leading to some changes overseas."

Mr Slane said that if software was collecting information about a user, the person had to be made aware of it and had to have the capacity to disable the process.

Microsoft New Zealand's Windows platform manager, Jay Templeton, said he had not been aware of the file's existence. But he agreed that files that could not be deleted by computer owners using Windows would raise privacy issues.

He said Microsoft was not accessing these files over the internet.

After consulting head office in the United States, Mr Templeton told the Herald that the file was a "problem" that could occur for several reasons. "It certainly doesn't look like anything malicious or anything that was [put there] by design to stay like that."

The most likely explanation involved the corruption of internet addresses caused by pressing Internet Explorer stop button as an address was being downloaded.

He could not confirm whether the abnormal files would be created by Windows XP - Microsoft's soon-to-be-released new operating system.

But he said Microsoft would help users remove the files from their PCs.