At least once a week I run across some well-meaning soul who passes along a dubious tip designed to enhance the performance of Windows XP. According to these folks, you should clean out the Windows Prefetch folder regularly to improve your system’s performance. They’re wrong, because they don’t understand how this feature works. Even generally reliable sources like Fred Langa can get tripped up. Here’s what you need to know:
The Prefetch folder is not a cache – at least not in the sense that you normally think of when you use that term. This folder contains trace files and layout files that Windows uses in specific circumstances. Trace files describe the exact order in which segments of programs (executable files and dynamic link libraries, including those that make up Windows itself) load. Windows uses this information to launch Windows and Windows programs in the most efficient way possible. Layout files provide a list of files and directories in the order that they are accessed when you start your computer or run a program. The Windows XP Defrag program uses the layout information to arrange these files in a contiguous region of the hard drive. The “prefetching” doesn’t mean that code is being loaded unnecessarily; it means that code is being loaded in the right way, and only when it’s needed.
Cleaning out the Prefetch folder will not improve performance. I have proved this with a stopwatch repeatedly on multiple test systems, and documented the results in Windows XP Inside Out Second Edition. In fact, emptying the Prefetch folder will actually reduce performance, because Windows has to re-create the trace files the next time you run the program. Windows cleans out old files here automatically, and it uses the current information simply as instructions to help load programs more efficiently. If you delete a program, its layout and trace files go unused and are deleted within weeks.
This isn’t the first time I’ve written about the Prefetch folder. I have a detailed write-up on the subject here. Be sure to follow the links to the excellent article by Mark Russinovitch and David Solomon and scroll down to the section entitled Prefetch, which explains how this feature works in very clear detail.
The next time someone tells you that cleaning out the Prefetch folder is a performance-enhancing measure, tell them it just isn’t so.
Ed Bott 
What do you think about adding /prefetch:1 to shortcuts? Does it make any difference? I’ve read on several forums to use the switch for quicker application launches but I haven’t really noticed any increase in speed.
Not only does prefetching on XP provide a performance boost, but it also greatly enhances the forensics opportunities presented by the system.
H. Carvey
“Windows Forensics and Incident Recovery”
http://windowsir.blogspot.com
Cleaning out the prefetch folder IS a valid performance boost. The prefetch folder, afaik, is limited in size. When you install a new systm, every program run is examined for the prefetch folder. As the folder fills, you begin to accumulate prefetch information for programs you may no longer use. Deleting the folder forces Windows to rebuild, providing a boost by building prefetch data for newer programs and removing older ones. It will not make regularly-used programs run faster unless it’s a program that was kept out of the folder due to size limitations…
Ion, your facts are incorrect.
The Prefetch folder is limited in size to 128 entries. It cleans itself.
I have a heavy spyware/adware problem. It is a spyprotection program that is sitting ont he computer and lets adware and spyware get on the computer (i suspect) and by so intends to force purchace. We put a new antyvirus on the computer, and it did get the viruses and the spy and adwares off, but it isnt able to find the program that starts it all. I was wondering if that program can be lodged in the prefetch?
also, any suggestions will be greatly apresiated…
thank you
My Adaware freezes when it hits the Prefetch folder. Why is that? Is there anything I can do about it?
I added this to my XP Myths article because I was tired of the Malware/Spyware Prefetch nonsense:
http://mywebpages.comcast.net/SupportCD/XPMyths.html
Malware/Viruses – Some people irresponsibly recommend cleaning this folder due to possible Malware/Virus infection. Malware/Viruses can place an infected file(s) in any folder and the Prefetch folder is no different. Do these same people recommend deleting the contents of the Windows folder because it is a popular location to find an infected file(s)? Of course not, you simply clean or delete the infected file(s) not the contents of the folder. This Myth got started due to the indiscriminate nature of the Windows Prefetcher, which will Prefetch any executable file that you load or loads during Windows start up. Thus it is quite common on an infected machine to find a Prefetch (.PF) trace file in the Prefetch folder with the same name as an infected executable. These files are NOT Malware/Viruses. They are there to improve the load time, in this case ironically, of the Malware/Virus but do not contain any infected code. Once the associated infected executable is deleted, these Prefetch (.PF) trace files do nothing and will eventually automatically be cleaned by Windows.
C. Crowe – There can be many reasons why it is “freezing” at that folder. I would suggest running adaware in safe mode. This is recommended to remove complex spyware anyway.
Then how does one get keep programs from installing automatically with Windows? Programs such as Roxio and iTunes that load up into the tray and use RAM. ??
thank you for your energy
Crog,
Those programs are not “installing” automatically, they are LOADING automatically. If you want to disable those from loading use this tool:
http://www.sysinternals.com/Utilities/Autoruns.html
What you are refering to has NOTHING to do with prefetching.
I am curious if one has multiple exe’s of a particular app running in this folder, why is that the case?
If there are muliple instances of the same EXE, this seems to degrade performance rtelated to these apps. Is this an issue with the way the specific app is loading, regarding the trace files?
Most apps or process look to have one instance, thus my question about when one sees say, 15 instances of the same apps. exe in the c:\Windows\prefetch\ folder. This seems to be bad. It seems that one instance is what is needed for a given process/EXE.
Let me know what you think at your leisure,
Regards,
-Fred
Windows Prefetching will only create one .PF trace file per application. These will all have the same .PF extension. They will look like this:
FIREFOX.EXE-XXXXXXXX.pf
NTOSBOOT-B00DFAAD.PF
The only other file with a different extension should be the:
Layout.ini
Any file in their with a .exe extension is not a Prefetch Trace file. Please post the file names of what you are talking about. Also these files are not “running” in this folder. They are REFERENCED when the application with the equivalent name’s load is first initiated for a session.
No one answered Laurent’s question,
“What do you think about adding /prefetch:1 to shortcuts? Does it make any difference? I’ve read on several forums to use the switch for quicker application launches but I haven’t really noticed any increase in speed.”
I have the same question and one more. Does adding /prefetch:1 to programs in the registry help as well? I have been told to add it to explorer.exe because it makes windows run faster.
The “/prefetch:1” switch is a myth. See the full explanation here.
No, no performance gain from using /prefetch: yourself.
/prefetch switch information: http://www.edbott.com/weblog/archives/000621.html
Ed,
One of the reasons your Prefetching articles are getting so much attention lately is this ridiculous post on Digg that now has over 4000 Diggs as mobs of mindless Digg Users slow down their systems:
http://digg.com/software/Why_windows_takes_so_long_to_start_up
OMFG, This just keeps getting worse:
http://www.intelliadmin.com/blog/2006/09/deleting-prefetch-folder-does-improve.html
Cleaning the prefetch folder occasionally is warranted and needed.
I recently had a problem with a program which caused it to crash, and then I couldn’t get it to run again. I couldn’t figure out what was going on until I remembered the info I had run across with the prefetch folder. So I deleted the entry which seemed to correspond with my offending program. I immediately ran the program again, and now it ran perfectly.
I also had some users which were having odd problems with programs which utilized windows ftp services, constantly dropping connections, connections not working anymore, etc.. I thought I’d check the prefetch folder to see if it was prefetching http://ftp.exe, it was, I deleted the ftp prefetch entries and the program started working correctly.
I’m not disputing your information, I agree that the prefetch DOES increase performance, and turning it off is just silly. However, windows being windows, when incorrect information is recorded in the prefetch, that information is used regardless, and windows doesn’t clean out the incorrect information if it’s a program you use on a regular basis. Thus, it would be wise to clean out the prefetch folder occasionally, I’ve set up to do it once a month.
Just my .02 to add some balance.
No it is not “wise” to clean the folder out occassionally or ever. What you are describing is a corrupt prefetch file which is not common. I’ve seen problems like this on systems that are oveclocked, not using NTFS for the file system, have defective memory or other defective hardware. You need to fix whatever is corrupting your files. This should be rare to non existent with NTFS regardless.
But the problem is YOUR SYSTEM not Prefetching.
Does anyone know about the .exe file ‘curb itch’. My desktop was exceedingly slow and after virus and spyware checking/cleaning I ran ‘msconfig’ to see what was being loaded on startup. I saw ‘curf itch’ and it seemed suspicous. I unclicked it as a startup item, applied, and rebooted. It keeps coming back and my computer speed continues to be slow. I finally located the .exe file in the Prefetch folder. I deleted but it has come back.
Does anyone know what program curb itch.exe is a part of?
Is this the likely reason for the computer’s slow speed?
Should I get rid of this, and if so, how!
Any assistance would be greatly appreciated.
Tom
Tom,
No executable filies should be present in the prefetch folder the file you are refering since it is .exe does not belong. I suggest seeking help in a malware removal forum to clean the infection but your problem has nothing to do with Prefetching. That malware is simply using the Prefetch folder to hide that one file as it could use any other folder. The name of the file is probably random.
Tom you can get help at the Safer Networking Forums:
http://forums.spybot.info/index.php
Wow, guys guys guys. I deleted everything in my prefetch folder. My computer went from 4 bars of loading on startup down to 1 and a half. How does that NOT work? I didn’t do ANY other changes or tweaks.
After I saw how well that worked, I went in and disabled access to the prefetch folder both from all users and the SYSTEM itself. It seems to work wonders for me and it prevents the .pf files from EVER being created.
This is the BEST tweak you can do for optimization if you have a fast computer.
For a better explanation, check out this:
http://www.nerdhelp.com/forums/showthread.php?p=43100#post43100
Surge you said BARS!!!!! How many Bars you see is IRRELEVANT!!!! You cannot visually time prefetching!
You must use a timing device like a STOPWATCH and time from pressing your power button until the desktop loads.
If you are not going to properly test this or attempt to understand how it works then don’t misinform others. What you stated and is stated in that forum thread is 100% wrong.
The ignorance regarding Prefetching is absolutely amazing. I have never seen more people blindly follow bad advice like this before in my life!
By bars, I meant time as well. If you look at that post in the forum, I have actually timed it. A whole 15 secs shaved off of the cold boot time.
On top of that, I used BootVis that showed a BIG decrease in boot time in accordance with my personal timing, specifically in the time it takes Windows to prefetch all of it’s files.
It seriously does work. You ppl against it are just scared to actually try it. Or if you tried it, you must have done something wrong, cuz it always, ALWAYS worked for me on ANY computer I have ever done it too.
Surge STOP spreading your misinformation here and READ the sources about how this actually works:
http://msdn.microsoft.com/msdnmag/issues/01/12/XPKernel/default.aspx
http://www.microsoft.com/whdc/driver/kernel/xp_kernel.mspx
http://www.microsoft.com/whdc/system/sysperf/benchmark.mspx
http://www.microsoft.com/technet/prodtechnol/winxppro/evaluate/xpperf.mspx
http://blogs.msdn.com/ryanmy/archive/2005/05/25/421882.aspx
Then time it properly:
Accurately Timing Boot Prefetching:
Setup: Your system must be in proper working order, not overclocked, not infected with Malware/Viruses on a non-nlite install with a lawfully owned original copy of Windows XP.
Confirm that the Task Scheduler Service is set to automatic and the EnablePrefetcher Registry Value is set to 3
([HKLM\SYSTEM\CurrentControlSet\Control\SessionManag er\MemoryManagement\PrefetchParameters] “EnablePrefetcher”) or Run the Prefetcher Fix (http://home.comcast.net/~optimizexp/Files/Prefetcher_Fix.zip). Running the Prefetcher Fix file will set these for you.
Then REBOOT.
Reboot Windows XP and leave the computer alone for over 2 minutes before rebooting again. (this is VERY important)
Reboot Windows XP a second time and leave the computer alone for over 2 minutes. (this is VERY important). Afterward check the C:\Windows\Prefetch folder and make sure the NTOSBOOT-B00DFAAD.pf file exists with a modified date and time from today. (The NTOSBOOT-B00DFAAD.pf is created or updated 1 minute after every boot. This is not idle time dependant)
Go to “Start”, “Run”, Type Rundll32.exe advapi32.dll,ProcessIdleTasks. This can take 10-15 minutes to run but no notification will be given when it is finished. You will notice increased Harddrive activity while it is running wait until this stops. When this is finished in the “Run” box Type defrag c: -b.
Shutdown Windows XP and turn off your computer.
Now using a stopwatch time from when you press the power button to the Windows XP desktop, write that time down. Do NOT look at how long any boot logos ect are on the screen. You must use a timing device.
Disable Prefetching (set enableprefetcher to 0 in the registry), disable the Task Scheduler Service and delete the NTOSBOOT-B00DFAAD.pf file from the c:\windows\prefetch folder.
Then REBOOT
For what it is worth, for the past several weeks when I launch any program, I have waited as long as 30 seconds For OE, Explorer, IE7 or any other program’s window to appear. The system was sluggish and non responsive.
Today, I deleted all 127 files in the prefetch folder which has never been cleaned out before. The only change I have made. The computer is now very responsive again.
Draw your own conclusions…..
Jim, it would have been helpful if you were able to identify what process was causing the slowdown. I am not disputing your account of events, but what you describe simply makes no sense based on how Prefetch works. The Prefetch layout files simply identify the order in which the system should load clusters from the hard disk when starting up a program. So deleting a Prefetch layout file should have no impact, especially in your case when you say it affected ANY program.
I know. I have bought and read your book. I was beginning to think that the fan on the CPU had a bad bearing and was slowing down causing heating problems. Then, I remembered the prefetch and said “what the hell!” and it worked!
I do tech support daily and I am fond of telling customers ” I don’t do why’s. I just do fixes! I get paid extra for the why’s.” This is one of those why’s that just isn’t worth my time to figure out. It worked and that is what I was after. Vista is probably going to change all the rules again anyway so why bother.
I’ve been doing this since 1972 and the part I hate the most about our business is that things don’t stay the same long enough for a dedicated person to really learn his craft inside and out. More often than not you are forced to go with your “best guess”. A good auto mechanic used to be able to fix just about any car. Now he can only fix the most recent model he has received training on.
I wish microsoft would learn a good lesson. “You can embellish what came before but you can’t change it because that destroys hard learned work habits!”. I’m reminded of that every time I add an icon to my desktop and then waste a lot of time just trying to find it! A new icon should always go in the same place like the lower right corner of th screen. Then you can find it easily and move it to where it makes sense to you. Maybe in another life?
Thanks for your reply.
Jim there are many reasons for your problems. Running any tweak programs on your system could have broken the Prefetching component. Your system may not have been going idle. Overclocking can cause file corruption ect… Just because you had 127 prefetch files does not mean the folder was not being cleaned. It does not clean the folder until 128 files are reached. If you noticed that the modified dates and times were not recent on at least some of the files then something is definitely broken with prefetching on your machine. You name the machine I have seen prefetching broken in some way. There are dozens of bad tweak apps and bad scripts that break it.
The only time cleaning the folder can possibly improve performance is if the prefetch files are corrupted which means something is causing them to get corrupted. You need to fix the source of the file corruption which is not prefetching.
Vista still uses prefetching and it works pretty much the same way but it also adds superfetch which actually precaches frequently used apps which is what people think the XP prefetch does.
Thank you and I agree. However, when you have the average customer with problems who may be an “appliance operator”, to tell him to dig through the files to find the bad one can cause more harm than good. It is much more expedient to wipe the pre-fetch and be done with it. Since Windows rebuilds it I can see no harm done. If the problem comes back, then we dig deeper. Like a torn rotator cuff. They make you go through PT for 6 weeks before they waste time and money on an MRI.
Jim, I agree. It doesn’t hurt to clean out the Prefetch folder, except for a minor and temporary performance hit as the PF files get rebuilt, and in rare cases (such as yours) it can help. My objection all along is to the so-called experts who say that you should regularly clean out the Prefetch folder or even disable prefetching.
I agree, my only problem is with people who think that the Prefetching component or windows is causing the file corruption. Which is why on any machine I find a problem like this (corrupt prefetch files I have not) I make sure to thoroughly check out their hardware, Harddrive Diagnostics, Memory Diagnostics, Power Supply tests ect… Because until they fix the problem it will happen again and then you have a new Myth started that something related to Windows causes the Prefetch files to get corrupted.
This comments thread is closed.
I have just paid Dell to sort out my computer. Yes I know it costs nearly 60 quid but I was sick of going through the “processes” and trying to determine out which one was causing the problem.
Dell advised that they sorted the problem out by deleting files in the prefetch folder, temp folder and another that I cannot remember.
Any comments?