1

I have found that Nord VPN is keeping detailed logs on its user's computers.

It stores them in: C:\Users\UserName\AppData\Local\NordVPN\logs Each is labeled by day

I spoke with Nord support and they told me their is no way to stop them from being created. I am not a good programmer, does anyone know of a way to automatically purge/delete the log files?

An auto purging application could also help me clear out the logs of some other pesky programs as well.

Thank you in advance!

migrated from security.stackexchange.com Mar 8 at 17:50

This question came from our site for information security professionals.

  • You could try setting the access control list (ACL) on the directory to disallow file creation by any user except SYSTEM. Might cause Nord to crash though, depending on how it handles errors in logging. – Polynomial Mar 8 at 0:43
  • @Polynomial I like your thinking. If worse comes to worse I will give that a try for sure. In the meantime I hope I can find some automagical program that can regularly cure me off all of these nasty logs. Like CC Cleaner only more competent. – TritiumCat Mar 8 at 0:51
  • From a security perspective, @Polynomial's solution is the best you can get outside of disabling logging all together. With whatever program you want, your logs will still be on the disk (and recoverable if deleted insecurely). You want them to never be written ideally. – Sirens Mar 8 at 3:58
  • @Sirens I can't "disable logging all together" or I would. These logs are generated by Nord VPN itself. Recovering data is not easy, but that's why I used the term purge. Encrypting/Hashing the files then deleting them on a section of the disk that is set to be overwritten would work fine and should not be hard. Most AV have the feature built in. What I am looking to do is some simple automation but hardly anyone saw this post so I guess I'll look for some third party tools then try Polynomial's idea. – TritiumCat Mar 8 at 5:23
0

No need for an application: a simple script can handle this.

If the drive is encrypted, using the native del /q would do. If the drive is not encrypted, you'd need to overwrite the files: I recommend Sysinternals SDelete as it's a command line tool you can use as a replacement in the same script. Keep in mind that SDelete might not work on SSD drives.

This deleteNordVPNlogs.cmd script will loop through the Nord VPN log files and remove every log file except for today's log which may still be in use and possibly cause Nord VPN to crash. You can run this manually or e.g. through the Task Scheduler. Depending on your regional settings you may need to correct the offsets for extracting the year, month and day from %DATE%. Choose between del and sdelete etc.

:: A .cmd script for removing Nord VPN logs.
:: https://security.stackexchange.com/questions/204992/
@echo off

:: Change the offsets (~10, ~4, ~7) depending on your regional settings!
:: You can find the correct positions from 'echo %DATE%'
set year=%date:~10,4%
set month=%date:~4,2%
set day=%date:~7,2%

set logdirpath=%LocalAppData%\NordVPN\logs\

:: Deleting the active log file might cause problems.
set "todayslog=%logdirpath%app-%year%-%month%-%day%.nwl"

echo Removing all Nord VPN log files except %todayslog% ...

:: Loop through the log files
for /r %logdirpath% %%i in ( "app-*.nwl" ) do (
   if not %%i==%todayslog% (
      echo I just copypasted this instead of modifying the script.
      REM Choose one:
      REM del /q "%%i"
      REM "C:\Program Files\SysinternalsSuite\sdelete.exe" -p 7 -r "%%i"
   )
)

This can be modified for any other logs by altering the logdirpath and log file naming pattern.

  • 1
    Perfect, exactly what I was looking for. I know batch but not well enough to write all of this out. Thank you my good sir! I would up vote your post but my account is as fresh as they come so all I can do is up-vote it for later and select this as the solution. Thanks again! – TritiumCat Mar 12 at 2:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.