This question appeared on a bulletin board recently:
Someone suggested deleting the contents of the Prefetch directory in Windows XP on a weekly basis, to speed up the boot process. Is that good advice?
The Internet has a way of taking questionable facts and giving them a life of their own. Even bad advice about Windows has a way of spreading, just like urban legends. This is one of those “tips” that doesn’t survive even a cursory analysis.
The Prefetch directory serves a valuable purpose by analyzing files that you use at startup and when you run programs. Contrary to what some well-meaning but technically inaccurate articles suggest, this does not copy the files themselves. It creates an index to the location of those files on the hard disk, including the order in which they’re loaded. This allows Windows and Windows programs to start very quickly after the first time you use them.
The Prefetch directory has one additional salutary function when used in conjunction with the built-in defragmenting tool. Every three days, during idle times, this utility rearranges program code, moving it to the outside of the disk to make it more efficient when loading (to force Windows to perform this optimization without having to do a full defragmentation, use the Defrag.exe command with the -b switch. For instance: defrag c: -b).
Carl Siechert, Craig Stinson, and I actually devoted several pages of Windows XP Inside Out to this topic. That was almost two years ago, though, and I’m willing to keep an open mind that we might have missed a great tip. So, just for grins, I got out my stopwatch and clocked my system boot time. Then I cleared out the Prefetch directory and did it again. My system has been running nonstop for 7 months and I have never touched the Prefetch directory. If this “tweak” were going to do any good, surely it would have maximum effect on my computer, right? The results were illuminating.
I timed from power up, starting with the first beep (POST code) to the point where the hourglass cursor disappeared.
With a full Prefetch directory:
… 0:50 to login screen
… 1:08 to desktop
After emptying Prefetch directory:
… 0:58 to login screen
… 1:57 to desktop
In other words, it took me nearly a minute longer to boot after using this “speedup” tip!
When I Googled for this topic, I found tons of examples of people who had simply copied this advice to their list of “tips” without any explanation of why it would be valuable or whether it actually affects performance. Mark Russinovitch and David Solomon, for instance, wrote an excellent article called Windows XP Kernel Improvements Create a More Robust, Powerful, and Scalable OS in the December 2001 issue of MSDN Magazine. Their technical credentials are impeccable, and they speak very highly of this feature.
The few people who did discuss it in those terms were unanimous in recommending that you leave Prefetching on.
Furthermore, why worry about boot times anyway? I recommend that most people avoid restarting their computer except when it’s absolutely required. Windows XP is so stable you can leave it running for weeks at a time and only restart on those rare occasions when you have to do so. If you need to shut down the computer, use the Hibernate option instead, which allows you to resume in seconds, with all your programs loaded just the way they were when you shut down.
If you really want to improve performance, forget bogus tweaks like this one and do the following: increase the amount of RAM in your computer (at least 256MB), get a good defragmenter (Diskeeper is the best), and remove programs you don’t use (or at least configure them so they don’t start automatically).
Update, March 2005: This “tip” just won’t die. It still appears all over the Internet, including at some places that should know better. We revisited the topic for the second edition of Windows XP Inside Out and found that cleaning out the Prefetch folder still does nothing positive for performance. If you think otherwise, get a stopwatch and run your own tests.
Update, May 2005: Microsoft’s Ryan Myers has an excellent blog post on the subject, entitled “Misinformation and the Prefetch Flag.” Here’s the money quote: “[I]t is a bad idea to periodically clean out that folder as some tech sites suggest. For one thing, XP will just re-create that data anyways; secondly, it trims the files anyways if there’s ever more than 128 of them so that it doesn’t needlessly consume space. So not only is deleting the directory totally unnecessary, but you’re also putting a temporary dent in your PC’s performance.”
Be sure to read these follow-up articles as well: Don’t clean out the Prefetch folder, Debunking yet another bogus Windows tip, and One more time: do not clean out your Prefetch folder!
would one of you web masters tell me how to get rid of a preftech file that constantly asks permission to go to the internet. It comes up in a aol privacy box and states the file has changed since last on the internet, it does this every two-three minutes. Very disturbing, the file is MSVTMLER.EXE. I ran every spayware, adware, virus scan and even deleted it in the folder but it keeps comming back, please some one help me!!!!!
there should be no exe’s in the prefetch folder. my opinion: quarantine the file in your Antivirus software, and even upload the file to their labs to investigate whether it is malicious or not.
DV,
Your post from 1.3.2006 is the best and complete answer out of all other posts here.
you seem to be a real master, I’d like to to have you as a teacher
Keep teaching others! Good work.
David, I’m glad you reached my article! It took me about 2 hours to go through the whole thread.
And thanks for the plug. You know, even I am sick and tired of all the complicated explanations out there of very simple concepts; MS topics are usually easy to figure out, lower OSI layer topics (Cisco/Foundry/etc), however, are a whole different story.
Cheers,
DV
this kind of advice(empty prefetch)reminds me of recent advice that was given to my cousin by a supposedly pc savvy person. this guy told my cousin that having too many shortcut icons on your desktop will slow your pc performance..hehehehe…can you believe that?
maybe it was the same guy that wrote the article in support of emptying the prefetch folder.same level of intellect there i think.
My path to prefetch came because my new 3.2 ghz 2 gb ram EE Intel pentium 4 would run warmer running a Radio Control flight simulator at 80 to 90 percent cpu util which was expected running scenery through the processor. Then when the machine was idling after converting it to my production online pc, it was causing temperture warnings on the Intel MB. Found that the processor running close to 100percent and a program called as best I can recall, searchfilter.exe which I found was related to prefetch. I don’t recall seeing this program running on my former HP 1 ghz 512 meg pc. So it seems that XP discovering all this capacity was burning it up prefetching, I think.
WVMMRH…
That is actually partially true.
A clean, one color desktop is faster than an icon filled, wallpapered one, at least on lower memory systems. That tip comes from way back when lower memory/slower video systems were rather common (9x days–early). And a clean, Spartan desktop was…well, rather boring, but kept marignal systems from bogging down.
Roland, that file had nothing to do with the Prefetch folder. Your system was overheating because a process was running in the background and using up the CPU. It could have been started from any of about 20 different places, none of them in the Prefetch folder.
That I knew, but it was the searchfilter.exe that was up there in 80-90% cpu utilization and that seemed to be related to the heating.
Had to reconfigure my fans as both the cpu and adjacent sensor on the motherboard indicated overheating.
Roland, first you say:
Nope. Not so. The Prefetch folder only tells Windows how to load the files that a program uses. It doesn’t contain executable files. So I don’t get your point. If this searchfilter utility was doing bad stuff, mucking with the Prefetch folder wouldn’t fix it at all.
“configure them so they don’t start automatically” – so how to go about this?
1) A Question: How can you tell what program a prefetch file is related to? I have some mysterious prefetch files and I have no clue what program they are related to, and I want to find out if the program is bad news that needs to be taken off the computer.
2) An answer, at least a part of an answer to Rick:
Go to control panel then performance and maintainence then administrative tools then services which will open in a new window. You will see a list of local services. Click on view then customize then click on description bar. Doing so will provide you some information about what a service does when you click on the service.
Click on a service, read the description, then right click on the service and click on properties. Depending on the situation you will see a small window with up to four tabs. The info on the tab that first shows up will tell you whether the service is running or stopped. Above that is a spot called “startup type” that will say automatic, manual,or disabled after it. Before doing anything, click on the tab that says dependencies and it will tell you what programs depend on the service and what programs the service depends on.
If the service is something that you use, but don’t need to load up when starting, go back to the general tab and click on the little arrow by describing the startup type and click on manual. This will keep the service from loading up when you start windows.
If you are absolutely dead certain if the service is something that you don’t use at all, click on disable. If a service is running that you know you don’t need running, click on “stop the service” at the upper left.
IMPORTANT NOTE: Keep track of all changes that you do because you may have to reverse them. I’ve had to a time or two.
Additional and safer routes:
SpyBot is a free antispyware program. In advanced mode under tools there is an option for startup entries. Click on this, and if they know the service they will tell you what it is and what it does. If you don’t think you need it to load when starting windows, uncheck the box and it won’t. It is easy enough to reverse it if you mess up. NOTE: Just because they don’t know what a service is doesn’t mean that you don’t need it. It may be related to a program you have that they are not familiar with. I’ve got a couple like that.
Hope this helps.
Spring
You can prevent unwanted programs from running during Windows Startup using the Autoruns utility:
http://www.sysinternals.com/Utilities/Autoruns.html
Keep in mind you need to be careful not to disable necessary programs like you AntiVirus and Firewall applications.
1) A Question: How can you tell what program a prefetch file is related to? I have some mysterious prefetch files and I have no clue what program they are related to, and I want to find out if the program is bad news that needs to be taken off the computer.
A: It can be difficult to tell based on looking in the Prefetch folder since things like installers can temporarily be located there. So it does not represent everything that is intalled and can lead to wasted time tracking down things that only existed during an install. You have no way of knowing if something is good or bad either by looking at the folder. Use the Add/Remove option in the Control Panel and the Autorun utility in combination with Google to track down more information.
Ok, good work Mr.Edd. I’m partially agreed with you, but i have to ask you a question:
-What do you think about a completely new-installed Windows XP system?
Of course, it’s clear, clean, fast & makes you open-minded as long as it’s new (really fresh).
So what makes a Windows XP system slow & bad?
Surely it’s a mixture of dirty temp, prefetch and the reg keys.
Then, it’s easy to figure it out, WANNA IT AS CLEAR AS THE NEW?! CLEAN IT!!
Ok, right now my eyes are burning from reading all the info but my question is.
-couldn’t prefetch be used to start trojans and such perhaps on lets say IE startup?
I mean there are some crafty little trojans and malware out there. The Subject was lightly commented on and I believe is a big question regarding the removal of SOME prefetch files.
Younose,
Systems slow down due to installed applications that load things into memory at bootup, HD Defragmentation and Malware/Virus infection. Also as time goes by your HD will slowly wear out. Registry Keys have no effect on performance, Temp Files have no effect on performance and Prefetch files only improve performance. Most used systems need to be cleaned but from Malware/Viruses and installed applications and then defragmented.
Here is some more on the Registry Cleaning Myth and all the Prefetch Myths:
http://mywebpages.comcast.net/SupportCD/XPMyths.html
Regardless you can easily bring your system back to it’s original speed by using a guide like this:
http://mywebpages.comcast.net/SupportCD/OptimizeXP.html
Lost A Hour Of My Life,
Prefetch can not start trojans but they can ironically accelerate their loading. That is because the prefetching is indiscriminant. It will accelerate any applications load regardless if it is malicious. There is another Myth I address on my page:
http://mywebpages.comcast.net/SupportCD/XPMyths.html
Malware/Viruses – Some people irresponsibly recommend cleaning this folder due to possible Malware/Virus infection. Malware/Viruses can place an infected file(s) in any folder and the Prefetch folder is no different. Do these same people recommend deleting the contents of the Windows folder because it is a popular location to find an infected file(s)? Of course not, you simply clean or delete the infected file(s) not the contents of the folder. This Myth got started due to the indiscriminate nature of the Windows Prefetcher, which will Prefetch any executable file that you load or loads during Windows start up. Thus it is quite common on an infected machine to find a Prefetch (.PF) trace file in the Prefetch folder with the same name as an infected executable. These files are NOT Malware/Viruses. They are there to improve the load time, in this case ironically, of the Malware/Virus but do not contain any infected code. Once the associated infected executable is deleted, these Prefetch (.PF) trace files do nothing and will eventually automatically be cleaned by Windows.
Good article! I knew about this long before but nevertheless tried it myself how it affects my boot time to clean the prefetch folder.
I first thought that the system boot was much faster, because the black Windows boot screen was there very short. The blue bar just went one time to the right and the desktop began to load. Before, the blue bar was spinning about 20 or 30 times from left to right.
This is highly deceptive, because when I got out my stopwatch I found out that with prefetching my system booted more than 10 seconds faster than with the prefetch folder cleaned.
IMO people believe that cleaning the prefetch folder helps because the boot screen appears for a much shorter time.
Keep the fight going, Ed. There are still lots of “tech sites” that suggest cleaning out prefetch.
As I predicted, after writing up such an articulate explanation of Windows Prefetch and posting it here, there would be some people who will suggest to delete the folder’s contents.
I, personally, won’t worry about them and let them suffer from their own ignorance.
“Only two things are infinite, the universe and human stupidity, and I’m not sure about the former.” Albert Einstein
DV
Ok…why all the interest? Because we all installed windows XP and were happy with boot up times…for a couple of weeks. Now our systems are sluggish. I run a 2.8Ghz P4 with 2GB of RAM and nearly a terrabyte of hard drives. I HATE my boot up times. I have a MAC Mini from Apple. It boots up and shuts down very quickly with 512MB of RAM. I am not a Machead but there is something seriously wrong with Windows that it gets so sluggish that a re-install is necessary to fix its lame boot times. I support a network and my users all complain about the same lousy boot times. Leaving a system on for months at a time is suitable for my servers but would cost my company thousands per year if we left every PC on in the office 24/7/365.
We use diskeeper and windows defrag. We have a minimum of productivity and email apps yet Windows XP boot time s keep gettign longer. To fdate I have read NOTHING that will explain how to get the system running quickly again without reinstalling.
BTW the MacMini continues to be fast to boot as the Mac OS handles apps very differently, much more like DOS. The OS runs a stable platform on which apps open and close withourt embedding code all throughout the OS, so the OS doesn’t have to chug through all sorts of nonsense. When I want to delete an app I trash the directory. No need for an uninstaller to go grab orphaned files scattered through out the OS. Nice.
To clarify I support 6 Windows servers, 2 Unix servers, 45 PCs and 1 Mac. I need answers and am not wanting to start a religious war on why the Mac is superior.
I’ve a question about “defrag c: -b”
The -b switch apparently does an optimization of the prefetch
files. My question is this. Why isn’t it documented
by Microsoft? KB283080, which documents defrag’s
command line switches, makes no mention of it.