What application gernerates this file?

G'Day All,
After sending a PM to our Administrator (Arie) re the problem below, (Why didn't I post it initially I hear you ask? Because I didn't want to appear a dill for not knowing the answer.)

He has suggested I post it here just in case there are some other dills like me who want to know whether this File is a virus/Trojan, as a number of Googled sites suggest, or whether it's something less sinister!

A reply from Arie put my mind at rest and the Program generating these undeletable files is Performance Monitor and apparently can be turned off and a performance gain noticed.

My question now is, how do you turn perfmon off, (as I can't find anything obvious in msconfig etc), and is there any good reason for leaving it running, seeing I don't really don't understand the significance of the information it gathers?

Initial PM to Arie for those who may be wondering like me


Reply from Admin.

Perflib_Perfdata_XXX.dat files are generated by performance monitor.


Makes sense your computer is running a little slower since you have performance monitor running. Stop prefmon!

P.S. You should post this question.

Arie


G'Day Admin,
It maybe my imagination but my web pages seem to take a little longer to open so I decided to have a poke around and see if there was something obvious that was wrong.

I'll a little reluctant to post this immediately as if what I've found is a Windows system file then I'm going to look pretty silly, due to my lack of knowledge.

In my Windows\Temp file I've found a file titled: Perflib_Perfdata_XXX.dat. The reason for the XXX's is that this seems to change each time I boot up.

This file cannot be deleted and I'm concerned after reading conflicting comments on the net, that this might be a virus/trojan of some sort. My virus scanner doesn't alert me of this, if I do an individual scan of the file.

Can you offer some advice please?

Ron

 

Perhaps some relevant information here

 

To disable, go to Start\Run, type in "services.msc" and press Enter.
Locate "Performance Logs and Alerts" and Stop the service. Right click on the entry and select Properties, then set to Disable.

If you would like to read up more on windows services, check this link.
http://www.blackviper.com/

 

Didn't get your head bitten off, did you? People are here to answer questions about possible problems. And how is a person to learn without asking from someone more experienced?

 

Thanks to all who replied, perfmon is now off and I'll see if that affects speed at all, but more importantly I now know that file in the temp folder belongs to a MS application and is not something sinister.

Ron

 

G'Day again,
Just a follow up, with disabling the Performance Logs and Alerts in Services.msc, it's too early to determine a noticable speed change.

However, after making the change and rebooting to ensure that change was active, when you try to delete the "Perflib_Perfdata_XXX.dat" this system still refuses to allow this file to be deleted as again it says it's in use by another application.

I now know it's not a problem file but I'm now curious what other programs would be using this file and if they can be disabled as well for performance improvements?

 

It is an essential part of Windows. It cannot be removed. It is created by the Performance Monitor and without it, how can you tell what causes a crash because it is also tied in with the Event Viewer.

 

I think Diskeeper may generate this file.

 

I hate to pop your bubble surferdude, but it is NOT created by DiskKeeper. Do a Google search and you will find that it is created by the Performance Monitor, which is a vital part of Windows. It CANNOT be deleted and made to stick. Each time something happens on your machine, it gets logged. Those logs are what you see if you look at the Event Viewer.Those logs are where information about BSODs are put. Without them, you couldn't know what happened to your machine.

 

You can use Process Explorer to find what program or process is creating the files. Download it and then in the menus in Process Explorer, click the find menu, then click Find Handle or DLL. In the window that opens, type or copy and paste in the name of the file and click search. I have one too that's always there. In my case, it's put there by LCDClock.exe which is a function of my Logitech keyboard. Killing the process allows the file to be deleted. However, if I want to use the clock on the LCD screen on my keyboard, it's something I have to put up with.

Also, if you try Process Explorer, it will add one of these files itself when you open it. It uses the file for the performance monitor that runs while it's open. When you close Process Explorer, the file will be deleted with no action from you.

 

The Perflib_Perfdata_xxx.dat file is certainly a strange one. I have been running XP since it first came out and that file does not exist on my system. No doubt it depends on what software is installed. I get all normal system reports, including all of the Event Viewer and Performance Log reports so it's evidently not tied to those items. In addition, my Performance Monitor works just fine. It's evidently not necessary for some systems since mine works fine without it.

If it's used by different software, but both using the same file name, that would indicate that it's likely some sort of cache type file that expands to accommodate the need, much like the infamous index.dat file. That is not to say that it couldn't be using different location for each one but I have no way of researching that since it doesn't exist for me.

 

Hey, it's been a while. Anyway, it puts it in the %Temp% folder. So, it would go into whatever folder is designated as the system temp folder. I could be wrong but if memory serves me correctly that would be your "Documents and Settings\Username\Local Settings\Temp" folder if things haven't been changed. I moved mine long ago so I could be wrong but I don't think so.

So, if your system uses Windows\Temp as the system temp folder, it would go there. I built this system and the folder I mentioned above was the system temp folder that XP set up when I installed it. I suppose that could be different on computers built by companies like HP or Dell though.

Process Explorer also uses the %Temp% folder for the one it generates. As for the name thing, yes, it's common that they use the same name with a change at the end of the name. My guess is that the file isn't actually generated by the program itself. Rather the program uses the performance monitor and the performance monitor actually generates the file. Just guessing on that last one.