How to maintain a safe and secure computer

A reasonably comprehensive guide to making Windows (XP, Vista & 7) as safe as possible.
Windows is as safe as other OS's for using Tor and other stuff. The security exposure and what will get your ass hung out to dry comes from the amount of meta-data and "hidden" data Windows records about what you've been doing.

Windows has many security issues and really shouldn't be used for on-topic material however, I know many people are going to use it anyway. This guide will help in configuring and maintaining your system for secure use.
These guidelines are for Windows XP, Vista and 7. They will work for Windows 8 but, I have no idea what other security backdoors MS has built into 8. I believe 8 is generally safe in spite of all the hype to the contrary but, I haven't worked with it enough to be sure.
Side note - If you happen to be running Windows Server 2003 on up it works with those too
The methods do not address potential exposures that can happen from unsafe programs you might use. It only minimizes forensic analysis threats (there are a few general tips at the end though.)

 - Windows keeps many tracks of data creation, movement, deletion etc. of all user data on your system. Names and date/time stamps of every folder created/viewed is stored in the Registry (ShellBags) as are lists of recently (and not so recently) used files and programs. Some of this is stored elsewhere too by different programs.
 -Information on the contents of removable storage devices that were connected to the computer in the past and the same information of encrypted volumes that were mounted is also stored in Bags.
 -Thumbnail images of every picture you look at or even see only as icon views in explorer are kept in special files (XP and Vista/7/8 do it in different ways)
 - Windows makes shadow copies of files and folders when changes are made (so you can "restore to a previous version".) [does not apply to XP or 8]
 - The pagefile (swap file) may hold partial or complete copies of images
 - Lists of commonly used programs are stored so Windows can preload them in anticipation of you using them (prefetch, superfetch.)
 - Registry backups are made automatically.
 - Remote Assistance keeps some log data.
 - Sleep and hibernation mode create copies of live data (separate from the pagefile.)

I'll cover 3 situations.

PART A: Wiping hard drive and re-installing on an encrypted partition. [Windows 8 not supported, not easily anyway]

1 - Backup all data, programs (install files) and anything else you want to keep.
2 - Use a program such as DBAN (dban.org) or a pgm that uses the SATA zero sector command to erase the drive. [there is no need for ridiculous settings like 35 passes. One pass is completely sufficiant]
3 - Have a copy of Truecrypt 7.1a available.
 (https://www.grc.com/misc/truecrypt/truecrypt.htm; Linux and Mac versions available here also)
4 - Do a fresh install of Windows.
5 - Run Truecrypt according to instructions to encrypt the entire boot partition (this will probably be the whole drive.) [see part B:-1 for picking encryption levels] During setup you will be prompted to restart your system and it will ask for the Truecrypt password to verify everything is good and boot will proceed normally from there.
6 - Restore all your data. You are fully protected from forensic analysis of the hard drive and many precautions outlined for the other methods below are not necessary but, you may want to implement some of them anyway. If you are investigated it will be obvious you're hiding something but, that's just the way it is.
[In some jurisdictions you may be legally required to surrender the Truecrypt password. If you don't you will be tortured]
Truecrypt has the ability to encrypt full partitions without data loss so you could try that (I haven't tested it) but, I'd backup just in case.
Note: It's possible to run Truecrypt before installing Windows and then restore but, it's much easier to do it the other way.

PART B: Starting with a clean operating system (you've never stored or downloaded sensitive materials) and using encrypted containers.

1 - Run Truecrypt and create a standard container according to the instuctions. Choose your encryption and hash algorithm, they are several. The more complex the one you choose the more of a performance hit there will be. Personally I think regular AES or AES-Twofish and Whirlpool hash is plenty. It's up to you.
If you want plausible deniability read about hidden containers and use them.

2 - Install and keep everything sensitive, including the Tor browser folder and programs on the Truecrypt container.

3 - Turn off Most Recently Used lists:
Right click the Task bar and select "Properties > Start Menu". Uncheck the Privacy boxes.

4 - Disable registry Bags updates (this can be done via registry edits but, it's different for XP & 7 and not for someone who isn't comfortable doing edits. You can blow things up badly in this part of the registry (and about a thousand other places too.)
If you are ok with it:
For Windows Vista & 7 (and 8 afaik), these keys:
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags
-- for 64 bit, these also
HKEY_CURRENT_USER\Software\Classes\Wow6432Node\Local Settings\Software\Microsoft\Windows\Shell\Bags
HKEY_CURRENT_USER\Software\Classes\Wow6432Node\Local Settings\Software\Microsoft\Windows\Shell\BagMRU

For Windows XP, these keys:
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags

Open the Registry editor and delete all the subkeys under these keys (they're numbered 1,2,3, etc..)
In the Navigastion Pane right click each Bags & BagsMRU key and set permissions to "Read" for everybody including the System.

Now, if you don't want to go thru all this there is an easier way.
Get Privazsor's "Shellbag Analyzer & Cleaner". It will find and securely clean these dangerous keys
quickly and easily. It can be setup to run automatically. The downside is the data will still get recorded and you'll have to run SbAC frquently. This is not so bad as it only takes at most a couple minutes.
privazer.com/download-shellbag-analyzer-shellbag-cleaner.php

5 - Disable thumbnail generation.
If you don't have Windows Pro or Ultimate you have to edit the registry to fix this. If you do have one of those you can use the Group Policy editor (Google to find out how, if you're a Pro or Ult user you should know about gpedit.msc.)

Manually edit keys:
Change the values of the following keys. If they don't exist create them.
Or, you can copy/paste everything between the lines into a .txt file and rename the file to "thumbs.reg" and just run it. It will set them for you.
 --------------------------------------------------------------------------------------------------------------------------
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoThumbnailCache"=dword:00000001
"DisableThumbnailCache"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoThumbnailCache"=dword:00000001
"DisableThumbnailCache"=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"DisableThumbnailCache"=dword:00000001
"NoThumbnailCache"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"DisableThumbnailCache"=dword:00000001
"NoThumbnailCache"=dword:00000001

---------------------------------------------------------------------------------------------------------------------------

6 - Shadow copies of volumes:
This is pretty easy. In the "Run" box type "services.msc" and hit enter. Scroll down and look for "Volume Shadow Copy". Double click it, stop the service then change "Startup type" to Disabled.
Close the services window.
This will also stop automatic Registry backups. In fact, it will prevent Windows from making registry backups regardless of how hard you try. I suggest you get ERUNT for registry backups and create those backups on your encrypted drive.
www.majorgeeks.com/files/details/erunt.html

7 - Pagefile:
Get enough memory and don't use one! 3 GB for 32 bit or 4 GB for 64 bit. This will actually provide a performance boost too.
In the "run" box type "SystemPropertiesPerformance.exe", hit enter.
On the "Advanced" tab under "Virtual memory" click "Change" then select the C: drive (or whatever your boot partition is) and check the "No paging file" option. Click "OK" then "OK" again on the main Performance options window.
This will not take effect until you reboot the system.
*************************************************************************************
If you must run a pagefile (foolish) run the registry editor and set the following key.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\Memory Management
Right click on "ClearPageFileAtShutdown" and change the value from 0 to 1.
This will overwrite the pagefile with zero's during normal system shutdown.
**************************************************************************************

8 - Disable Prefetch & Superfetch:
You have to do this in the Registry also.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\Memory Management\PrefetchParameters
    Right-click on both EnablePrefetcher and EnableSuperfetch
    Select Modify on each of these to change the value from 1 (or 3) to 0

Change will not take effect until you reboot [Note: for SSD users this is a slight boot-time performance boost]

Or, copy/paste everything between the lines and save it to a .txt file and rename to prefetch.reg and run it.
-------------------------------------------------------------------------------------------------------

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters]

"EnableSuperfetch"=dword:00000000
"EnablePrefetcher"=dword:00000000

----------------------------------------------------------------------------------------------------------
And also, in the "run" box type "services.msc", hit enter.
Scroll down to "Superfetch" and double click it. Stop the service and set "Startup type" to "Disabled".


9 - Disable Windows Search:
Windows creates a hidden index of all files on your system if you leave this on.
In the "run" box type "services.msc", hit enter.
Scroll down to Windows Search and double click it. Stop the service and set "Startup type" to "Disabled".

10 - Disable Remote Assistence:
In the "run" box type "sysdm.cpl", hit enter.
On the "Remote" tab uncheck the "Allow Remote Assistence" box.
Under "Remote Desktop" select "Don't allow..."
Click "OK".

11  -Disable Sleep & Hibernation modes.
In the "run" box type "cmd", hit enter.
At the command prompt, type "powercfg.exe /hibernate off" (without quotes), hit enter.
Type exit and hit enter.

Your system is now pretty good.


PART C: Starting with a "dirty" system.
Ok, you've been storing your personal materials however you want, and are now worried about your data being compromised.
You can't wipe and reinstall everything because you don't really know how or you just can't for whatever reason.
This section is about cleaning everything up and then you would go to Part B:
You will need three software tools:
CCleaner  - www.piriform.com/CCLEANER
Privazor - privazer.com/download.php
Auslogics Disk Defrag - auslogics.com/en/software/disk-defrag/

1 - Securely delete any embarrassing or silly content you currently have on the system (back it up first if you want but, it needs to be cleaned off for now. You can restore it to the encrypted container later.

2 - Go thru every folder you had embarrassing or silly in and securely delete any "thumbs.db" files you find (XP only)

3 - Empty the Recycle bin.

4 - Running CCleaner:
From the main menu go to "Options".
Select; "Secure file deletion", "Simple Overwrite", "Wipe Alternate Data Sreams", "Wipe Cluster Tips".
Set "Wipe Free Space" to your boot partition.
Go to "Cleaner" (left side at top.) Accept the defaults then click "Analyze" then "Run CLeaner" when the analysis is complete.
Go to "Registry". Click "Scan for Issues" then "Fix selected issues". When it asks if you want to backup changes to the registry select "No".
At the next prompt click on "Fix All Selected Issues", then "Close". Exit CCleaner

5 - Run Privazor:
When you install Privazor it will ask if you're a standard user or advanced. Unless you know what you're doing pick standard (or regular, something like that). Run thru the install questions and then review the run parameters and make sure the one to scramble old/unused MFT entries is set. Run a Deep Scan then the clean up option.

6 - Running Auslogic Disk Defrag:
Select your boot partition.
Select "Defrag & Optimize" from the drop down menu. Walk away for awhile until it completes. It will let you work on the system while it's running but, I strongly advise against it.

7 - Run CCleaner again:
Go to "Tools" (left side.) Click on "Drive Wiper" then pick "Free Space Only" from the drop down menu (this should be the default but, MAKE SURE!!)
Select the boot partition. click "Wipe" then walk away again - this is going to take awhile (depending on how much free space there is.)
[A word of caution, don't ever run a disk defrag tool on a Truecrypt partition. You're supposed to be able to but, I blew one up doing it]

You're done here. Now go do everything in Part B:

MAINTAINING YOUR SYSTEM: For users of Truecrypt containers only.
[If your entire system is encrypted you don't need to worry about this.]
Run Privazor on a regular basis. There should be very little, if anything, odd it would find but hey, might as well.
Run Privazser's "Shellbag Analyzer & Cleaner" after every time you have accessed sensitive material. Dismount the Truecrypt encrypted container(s) first (it won't hurt anything if you forget but, it doesn't need to be mounted and, if it is, there's an additional configuration option that must be set.)


*********************************************************************
*********************************************************************
Security precautions for some Windows applications:

Winrar and 7Zip - THIS IS VERY IMPORTANT!

Extracting files from .rar & .7z archives.
It's important to use ONLY the "Extract" function when unpacking Winrar or 7Zip.
If you open an archive and then double-click or drag-and-drop (to the target folder) the encrypted
file a tempory copy will be created (in your default temp directory.)
The application used for the file (image viewer or video player) then opens the temp file or the
temp file is copied to the target folder.
Once the operation (viewing or copying) is complete Winrar/7Zip deletes the temp file but, it is
NOT a secure delete and a potentially recoverable file is left on your system.

7-Zip also keeps a history of the folders you've browsed or used. There is no way to disable this. The only thing you can do is manually clean the registry on a regular basis.
Navigate to the registry binary value values:
HKEY_CURRENT_USER\Software\7-Zip\FM\FolderHistory.
HKEY_CURRENT_USER\Software\7-Zip\PathHistory
HKEY_USERS\ {string value corresponding to your username} \Software\7-Zip\FM\FolderHistory
Right click on the value, select "Modify binary data", highlight all data and delete.
[I'm not certain this is complete, still testing]

VLC Media Player:
Disable recent file history.
Tools > Preferences > Interface > Save recently played items (near the bottom of the parameter
list).

MPC-HC  [Media Player Classic - Home Cinema]
Disable history tracker.
View > Options > Player > uncheck all boxes in "History" (lower right)

GOM Player: - two settings must be changed to disable history.
First:
Preferences > General > uncheck "Add videos with similar names to playlist"
Second: this parameter works "backwards", put a check in the box to turn tracking off.
Preferences > Others > "Don't save/show recently viewed files"

Irfanview Image Viewer
Disable recent file history.
Options > Properties/Settings > Miscellaneous > uncheck all 4 boxes for recent files/folders.

************************************************************************