Deleting pagefile.sys at shutdown.

According to
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q314834 (How to
clear the windows pagefile at shutdown) you do this:

1. Start Registry Editor (Regedt32.exe).
2. Change the data value of the ClearPageFileAtShutdown value in the
following registry key to a value of 1:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
Manager\Memory Management
If the value does not exist, add the following value:
Value Name: ClearPageFileAtShutdown
Value Type: REG_DWORD
Value: 1

I have done this, but there is no evidence that anything has happened.
The page file is always the same amount (717MB) although the time when
it was last updated changes on reboot.

Also, looking in explorer it says the file was created back in November
2004, leading me to believe that it cannot possibly be a new pagefile
that has been created on start-up.

Does this make sense or am I missing something here? TIA.

 

No-one <> wrote:

>According to
>http://support.microsoft.com/default.aspx?scid=kb;en-us;Q314834 (How to
>clear the windows pagefile at shutdown) you do this:
>
>1. Start Registry Editor (Regedt32.exe).
>2. Change the data value of the ClearPageFileAtShutdown value in the
>following registry key to a value of 1:
>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
>Manager\Memory Management
>If the value does not exist, add the following value:
>Value Name: ClearPageFileAtShutdown
>Value Type: REG_DWORD
>Value: 1
>
>I have done this, but there is no evidence that anything has happened.
>The page file is always the same amount (717MB) although the time when
>it was last updated changes on reboot.
>
>Also, looking in explorer it says the file was created back in November
>2004, leading me to believe that it cannot possibly be a new pagefile
>that has been created on start-up.
>
>Does this make sense or am I missing something here? TIA.


Insofar as I am aware there is no documented instance of anyone ever
recovering any usable information of any kind from the contents of the
pagefile.

I am at a loss to understand what this apparent extreme paranoia about
the pagefile content is all about.

Good luck


Ron Martell Duncan B.C. Canada
--
Microsoft MVP
On-Line Help Computer Service
http://onlinehelp.bc.ca

In memory of a dear friend Alex Nichol MVP
http://aumha.org/alex.htm

 

On Sat, 07 May 2005 17:28:45 GMT, Ron Martell <>
wrote:

|>Insofar as I am aware there is no documented instance of anyone ever
|>recovering any usable information of any kind from the contents of the
|>pagefile.
|>
|>I am at a loss to understand what this apparent extreme paranoia about
|>the pagefile content is all about.

This was a big deal with PGP users during the transition from DOS to
"multitasking" systems; paranoia just comes with the territory.
http://security.resist.ca/wipeswap.shtml

Or google: pgp windows swap file

--

 

No-one wrote:

> According to
> http://support.microsoft.com/default.aspx?scid=kb;en-us;Q314834 (How to
> clear the windows pagefile at shutdown) you do this:
>
> 1. Start Registry Editor (Regedt32.exe).
> 2. Change the data value of the ClearPageFileAtShutdown value in the
> following registry key to a value of 1:
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
> Manager\Memory Management
> If the value does not exist, add the following value:
> Value Name: ClearPageFileAtShutdown
> Value Type: REG_DWORD
> Value: 1
>
> I have done this, but there is no evidence that anything has happened.
> The page file is always the same amount (717MB) although the time when
> it was last updated changes on reboot.
>
Actually, it does not delete the pagefile and recreate it, because that
would only lead to excessive fragmentation over time, and help nothing
against raw-sector based recovery programs. Instead it "zeroes out" the
file upon shutdown - you notice shutting down windows will take a little
longer and the hd light goes on - but still it doesn't do the "paranoia
type" of deleting, which is overwriting with random data multiple times.

--
Longhorn error#4711: TCPA / NGSCP VIOLATION: Microsoft optical mouse
detected penguin patterns on mousepad. Partition scan in progress
 to remove offending incompatible products.  Reactivate MS software.
Linux woodpecker.homnet.at 2.6.11-mm4[LinuxCounter#295241,ICQ#4918962]

 

deleting pagefile.sys

I have found that this function is still useful. I perform beta testing on new products for my company and deleting the pagefile is required to recover from memory errors caused by bad code. I have not been able to recover any data from the pagefile to support this directly but I have noticed consistent results in my testing with this tweak isolated from any other tweaks. If you are concerned about cached processes or clearing the pagefile to recover from errors, this tweak is a good idea. If you are a general user or if you are not testing new software on your system, it is not necessary.

 

> Insofar as I am aware there is no documented instance
> of anyone ever
>recovering any usable information of any kind
> from the contents of the
> pagefile.

> I am at a loss to understand what this apparent extreme
> paranoia about
> the pagefile content is all about.


Well, in my own case it's not paranoia. It's the simple fact that if I don't redo the pagefile every few days my system gets severe brain damage. Icons are wrong. Right-click menus do random stuff or active all by themselves, I get "Not Enough Memory" errors (I have 2 gigs of RAM!) and every time the computer boots up it takes longer and longer to become ready and gets weirder and weirder.

However, deleting the pagefile (using Linux on my dual-boot system) and letting Windows recreate it or zeroing out the file fixes everything. The system boots up fast and everything works. For a week or so. Then it goes mental and I have to redo the pagefile again.

This has been a problem since the old days of Win98. Now I'm three computers later in my life and running Vista.