Yet another Web site posted yet another “tip” today recommending that you clean out your Prefetch folder to improve performance of Windows. Arrrggghhh! I’ve written about this repeatedly (here and here and here, for instance), but the message doesn’t seem to be spreading very fast. Maybe this quote from “Misinformation and the Prefetch Flag” by Ryan Myers, a developer on Microsoft’s Windows Client Performance Team, will help:
XP systems have a Prefetch directory underneath the windows root directory, full of .pf files — these are lists of pages to load. The file names are generated from hashing the EXE to load — whenever you load the EXE, we hash, see if there’s a matching (exename)-(hash).pf file in the prefetch directory, and if so we load those pages. (If it doesn’t exist, we track what pages it loads, create that file, and pick a handful of them to save to it.) So, first off, it is a bad idea to periodically clean out that folder as some tech sites suggest. For one thing, XP will just re-create that data anyways; secondly, it trims the files anyways if there’s ever more than 128 of them so that it doesn’t needlessly consume space. So not only is deleting the directory totally unnecessary, but you’re also putting a temporary dent in your PC’s performance. [emphasis in original]
Bottom line: You will not improve Windows performance by cleaning out the Prefetch folder. You will, in fact, degrade Windows performance by cleaning out the Prefetch folder. I’ve done performance testing that establishes this definitively. In all the many sites that offer this bogus tip, I have yet to see a single piece of actual performance testing.
Oh, and for anyone who cites this TechRepublic article as a source, let me just say that it contains more serious factual errors than I can count. For instance:
As you boot your workstation or access programs on your workstation, XP’s prefetcher copies portions of those files to the Prefetch area of your hard drive.
That’s completely wrong. The files in the Prefetch folder contain lists of pages that that should be loaded when a program starts. Each file is essentially an index. Windows XP doesn’t copy portions of any files to the Prefetch folder.
When your workstation boots, XP prefetches portions of the files you use most frequently and has any application you’ve recently run waiting and ready to go.
This is equally absurd. If this were true, it would mean that Windows was actually loading into memory every program you’ve ever used, every time you start Windows. That’s not the way it works at all. When your PC starts up, Windows looks in the Prefetch folder to determine how best to load Windows. It doesn’t do a thing with the .pf files for applications (unless, of course, you’ve configured one of those apps to start up with Windows).
If you’re frequently using the same few applications over and over again, prefetching can greatly increase the apparent speed of a system. Rather than waiting for you to click an icon to start a program, and then loading all of the associated files, libraries, and pointers necessary to run the program, XP has all the components of your programs preloaded. When you click an icon to start the program, most of the hard work is already done.
The author just made this up. The .pf files don’t get used at all until you run a program. What actually happens when you click an icon is that Windows uses the information in the Prefetch folder to decide which program segments to load and in what order to load those pages. There’s plenty of documentation for this, including Ryan Myers’ article and this definitive article by Mark Russinovitch and David Solomon, Windows XP Kernel Improvements Create a More Robust, Powerful, and Scalable OS.
The drawback to prefetching is that XP will prefetch a program even if you use it only once or twice. XP will retain a copy of a portion of it in the Prefetch folder. From there, it will prefetch the program, taking resources from your workstation even though you may have no intention of ever using the program again.
Again, the author just pulled this out of who-knows-where. When you run a program, Windows creates a .pf file for it in the Prefetch folder. When you run the program again, Windows looks for this .pf file and uses it to determine how to load the program. The hash doesn’t contain any portion of the original program code. If you never run the program again, that .pf file never gets used, and in fact it gets deleted eventually.
I used to write for TechRepublic. I’ve tried to contact someone there to get them to correct this silly article but have yet to receive a response. It would be really, really great if some of the other sites that have propagated this urban legend would also correct it.
Check this article out:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/xpehelp/html/xetskDisablingPrefetch.asp
“EWF performance can be improved by disabling Prefetch. Prefetch is a utility that loads commonly used applications to RAM when the system starts. This can degrade EWF performance.”
It looks like even MSDN can get it wrong.
Andrew, that reference is for Windows XP Embedded, which is designed for low-resource environments. What applies in XP Embedded is different from the desktop OS!
Even though it is for XP Embedded, I actually think that MSDN article is wrong but I see your point.
Ed, what do you think of this: http://poptech.blogspot.com/2005/10/ccleaner-cripples-application-load.html
Any comments on CCleaner?
I’ve never used CCleaner, but the points in that thread make good sense.
Excellent article! I do have a related problem (yes I know this is not a forum.. but please help if you can)I use Ccleaner, so I checked to see if ‘old prefetch..’ was unchecked.. only to find it missing… and then to discover my prefetch folder is absent… I thought this was impossible.. so I checked the related registry entries.. only to find one missing(layout path),yet the rest all intact, so I replaced it & the prefetch folder.. and even rebuilt a ‘Layout.ini’… and compared all settings/ folders/ registry entries, against another identical XP Pro.. only to find no cure.. as in NO prefetching at all!!!
WAIT.. dont answer my last thread!!! … NIGHTCRAWLER…you are a diamond… your cmd did the job.. THANKYOU!!
Can the prefetch start an application?
Years ago I had to fight a virus on my daughter’s pc. (Not sure that we had XP then.)
I kept cleaning it out and it kept reinstalling on reboot.
The way I finally got rid of it was to shut down each process individually by name, using an AV site for the list, then running the AV, and using a script to empty the prefetch.
All of those steps finally allowed me to get rid of the virus completely by one last AV scan on the next reboot.
I knew I had cleaned out all the startup lists.
I had a theory that prefetch was activating the virus code before I could run the AV.
Possible the virus writer was using the prefetch?
Thanks.
I’ve had knowledgeable people swear to me that they discovered viruses in the Prefetch folder. I’ve never seen it myself, but I’ve heard it enough times from enough people to believe it could be true. Unusual, but possible.
A virus can hide anywhere but any AV scanner will find the file no matter where it hides, especially one with boot time scan like Avast. By default your AV can scan the prefetch folder. What a virus hiding in the Prefetch folder has to do with the regular prefetch files I don’t know.
If you guys are right about not cleaning out Prefetch , then the following gurus are incorrect. I think I am more inclined to buy what you are selling
zzzzzzzz zzzzz zzzzzzzzzzzz zzzzzzzzzz zzzzzzzzz zzzzzzzzzzzzzzzzz zzzzzzzzzz zzzzz zzzzzzzzzzzzz
http://www.langa.com/newsletters/2005/2005-04-07.htm#3
The “Prefetch” is a kind of cache. For any cache to work, it has to contain data: So, over-aggressive cleaning of any cache, including the Prefetch, can be counterproductive because the cache will have to be refilled with data again.
The flip side is that a cache that’s overfilled with more data than is necessary, or that’s filled with old and obsolete data also is bad: That useless data is just so much junk that gets in the way.
So: Cache-cleaning from time to time still makes sense, as long as you don’t over-do it. I clean my browser cache and the temp files areas every night, for example. But I hardly ever touch the prefetch area; I have cleaned it in the past, but it’s been long enough that I can’t remember exactly when the last time was.
What’s right for you? How much cache cleaning is enough? See:
“PreFetch”
http://langa.com/newsletters/2003/2003-09-22.htm#7
Prefetch Pros and Cons
http://langa.com/newsletters/2002/2002-12-12.htm#9
zzzzzzzz zzzzz zzzzzzzzzzzz zzzzzzzzzz zzzzzzzzz zzzzzzzzzzzzzzzzz zzzzzzzzzz zzzzz zzzzzzzzzzzzz
http://www.pcworld.com/howto/article/0,aid,114164,tk,wb020904x,00.asp
PC World, March 2004
Why is my speedy PC s-l-o-w-i-n-g d-o-w-n? (Hardware) Lincoln Spector.
Windows XP’s Prefetch folder: go to C:\Windows\Prefetch and delete all the .pf files. The Prefetch folder was added to XP to improve the operating system’s performance, and over the short term it succeeds. But if the folder gets overloaded, it can stow down your machine.
dear “Lorenzo the next best hope for humanity”…
>> The flip side is that a cache that’s overfilled with more
>> data than is necessary, or that’s filled with old and
>> obsolete data also is bad: That useless data is just so
>> much junk that gets in the way.
Yeah, but as stated in the Ed’s original article at the top of this page (and I guess somewhere on the Microsoft’s site too), the Windows cleans the old/obsolete files in Prefetch folder by itself (after 128 files were/are created); so anyway, why bothering at all with doing the OS’ job ??
Ivan Tadej
The files in my prefetch folder are compressed. Is that the way they should be? If not, what happened there? Should I do anything about it?
Ema,
What do you mean, they’re compressed?
Under the name of each file it says, “Type: Stuffit Compressed File”. When I try to open any of the files, a dialogue box asks: “Would you like to open the archive for Viewing or immediately Expand the contents?”
“Stuffit” is the name of my ‘shrink/expand’ program and the icon next to each file corresponds to this application.
To the best of my knowledge it wasn’t like this before, but I haven’t knowingly done anything to the prefetch folder.
Please advise. Thanks.
P.S. The “layout file” is the only ‘normal’ one.
Ema, those aren’t actually compressed files. It sounds like you or someone tried at one point to open one of the files, Windows asked which program to use, and the PF extension becamse associated with your defautl decompression program, which is Stuffit.
You can fix this, but it’s not really a problem. These files are not designed to be opened directly, so just don’t double-click on them.
I have a winword.exe-23347E4F.pf file that starts running on it’s own, for no particular reason and it freezes up my computer. I found out that it was this file by doing ctrl+alt+delete and clicking on Processes. It took up 60-70%.When I clicked to end process, my computer unfroze.
Can I safely delete this file out of the prefecht folder? And why would it just start running on it’s own, isn’t it a “Word” file thingy?
Michelle,
Those .pf files are not executable. If you see one running as a process, it is behaving in an uncharacteristic and unwelcome way.
Can you tell me what application is associated with .pf files? (Control Panel, Folder Options, File Types tab, scroll down to PF extension.)
Mr. Bott;
I have read over the questions and answers in reference to cleaning or not cleaning out my Prefetch folder, however, my prefetch folder contains viruses (I recognize the names) but I am unable to access my layout.ini file with any of my AV programs because it says it is locked or password protected. I have been fighting these viruses for months now and just today found (again) a virus file that was instantly loaded into my AV program as soon as it was downloaded. I previously used Norton AntiVirus (detected over 11,000 infected files) until I found that a large amount of infected files were in Norton as well by using an additional AV program (AntiVir.) Even though AntiVir was able to detect over 7,000 infected files in my computer and rid the computer of them, I was unable to use the gaurd portion of the program until today when “Ewido” found a file within AntiVir infected with a version of the Trojan Horse. The AntiVir gaurd is now up and running as well as Ewido but I am getting error messages within the scans saying that it is unable to scan C:Windows\Prefetch|layout.ini and over 100 .zip files that again I recognize as virus files such as; CleverIEHookerJeired#.zip files, DSOExploit#.zip files, TotalVelocityMemoryMeter#.zip etc. the scan report says that “The whole archive is password protected on all these zip files and the layout.ini is giving me the following message;
Error! Could not change directory: System Volume Information
C:\WINDOWS\Prefetch
Layout.ini
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
Error! Could not change directory: export
Additionally, I am unable to access my Users folder at all because it just shuts down when I try to load it and I get a consistant error message that my paging file is too small no matter what I set it at because it reverts back to zero.
I know that this is a lot of info, but I’m hoping that you can help me or at least point me in the right direction to help me finally rid my computer of this monster! I use my computer for work and having it continually crash on me is really affecting my livelyhood. Thank you so much for anything you can do for me!
Sweetpea
Pamela,
You should try Castle Cops or Spyware Info. Both have forums that can help you with detailed advice.
Whats the big deal about boot time anyhow I have disabled my task scheduler and now nothing loads into prefetch sure it may take a couple of seconds more to start up. But I only have two things in the start up menu . I never totally shut down my PC and I hybernate it at night . I very seldom restart my computer . I have to wonder about you guys that have nothing better to do than to time your start up times . Gentlemen start your PC’s !!!!