BleepingComputer.com: A Solution For Perflib_perfdata(various).dat

[I have searched and searched for an answer to what Perflib_Perfdata(various).dat are. At long last I found a KB: 285798 at Microsoft Support. This led me to a site called JSI which the members call themselves Window Techies. Item #3343 says it all. These files are generated by System Monitor and should normally disappear when you reboot. If an Abnormal Shutdown occurs these files may become orphaned. They also can become orphaned for no apparent reason. They show up as a large group of variations of the name above. For instance, Perflib_Perfdata.d0.dat. Trying to delete these temp files were not successful and deleting them in Safe Mode only partially works. JSI says the best procedure for removing these files is to create a COMMAND LOGON SCRIPT AS FOLLOWS: del/q%SystemRoot%\System32\Perflib_Perfdata*dat.

I would like instructions on how to create this COMMAND LOGON SCRIPT. If one of the members knows how to accomplish this, please write back with step by step instructions. I hope that someone can help. Regards,
Chefbigfeet

Hi CHEFBIGFEET.

Quote

Partially correct.
Any app or program that installs a performance monitoring function can create those.
Motherboard Monitor, Nero INCD are a few.

Quote

Even if I could tell you how, that script command wouldn't work anyway because the path is incorrect.
You said the files are in your 'temp" folder. That command points to the system32 folder instead.
I realize all you would need to do is change it but there is more then one way to skin a cat.
The reason you can delete some via safemode and not others is because something is using the ones you can't get rid of. (You should keep in mind that whatever is creating these files is most likely to simply recreate them after you delete them anyway.)
What you need to do is find out which app is doing this.
Go here, download and install the Extensible Performance Counter List (exctrlst.exe).
It will give you a list of everything using performance counters and an option to disable it for each one.
Once the performance counter is disabled for a particular app, it's Perflib files will be deletable and no longer create new ones. I don't think system monitor is creating those files as they are in your temp folder.
It says for Win2k but works fine on XP, just tested it.
BTW, if the Performance logs and Alerts service is running, disable it and see if you can get rid of those perflib files before you do the above.

HitSquad: Thanks for your quick response. These Perflib_Perfdata(various).dat files are located in two areas: 1:C:\Documents & Settings\Marc S Sabshon\LocalSettings\Temp
2:C:\Windows\Temp
How do I disable the Performance Logs and Alerts?
Installed Resource Tool. I unchecked Counter, Service, and Library and the files still appear. Do I have to reboot? Will having these items unchecked cause other problems?
Your assistance is greatlly appreciated. Regards, Chefbigfeet

The utility adds a registry value for each item you select. Yes, you will need to reboot.
To stop your Performance Logs and Alert service, click Start>Run.
Type "services.msc" (no quotes) in the run dialog box and hit your enter key.
Select it from the list and double click it. Click the "Stop" button.
In the "Startup type" dropdown list, if it's set to Automatic, the service starts again at every reboot.
For now, change it to manual, click ok

To HitSquad:

I installed the exctrist.exe utility and under Library, Service, and Counters, I unchecked each and every item in the list and rebooted. The Files are still there. I followed your other set of procedures and under Windows XP Services, I stopped and changed to manual Alerter and Perforance Logs. I Applied and rebooted and the files were still there. Persistant Little Devils aren't they. Could this be the result of one of my programs, rather than a system item? I am running Spyware Doctor, Registry Mechanic. Spybot, Spyware Sweeper, CCleaner, Ewido, Norton Internet Security, Norton Systems Works included Save and Restore and Checkit.
I hope you can help me further with these Perflib_Perfdat(various).dat files. They are located in only two areas, Documents and Settings and Windows Temp. Regards and Thanks, Looking Forward to your reply.

Chefbigfeet

Quote

Just so that we are on the same page, you need to "manually" delete them. They're not going to disappear by themselves. If I'm misunderstanding you, I apologize.
Re-run the exctrist.exe utility (no need to reboot now) and also make sure the Performance Logs and Alert service has not restarted. If it has, stop it again. Do not reboot.
See if you can now remove some or all of the perflib files in either temp directory.

Quote

That's what I referred to in my original reply.
After following the above and there is still no joy, temporarily disable all your apps that are running in the background.
Through the individual programs interface and\or task manger. Just be sure there is nothing other then windows running. See if you can remove some or all of the perflib files now.
I would suggest you do this "off-line".

HitSquad Good Evening:

I did as you ask but, the files can not be deleted. I followed your instructions and then tried to manually delete them and they gave me a message that the file is in use. I click on the file and the Spyware Doctor Start Scan Window appears, but, PCTools tells me that these files are not theirs. I turned off Spyware Doctor completely and the files still show as in use. The Properties show the files as being able to open with Spyware Doctor. I am Confused. If the Files lead to Spyware Doctor and they are not Spyware Doctor's they may be Malware or Spyware or a Rootkit mascarading as Spyware Doctor files. I am lost without a clue. Is there anything else you can suggest? Regards and thanks for your interest and assitance, Chefbigfeet

Go here , download and install MoveOnBoot.
This program's interface will only allow you to add 1 file at a time, then it closes.
Just reopen it and add another file, it keeps track though you cant see it.
On step 2 (action type) of each file you add, choose delete as the action. (bottom option).
Repeat the process until you've added them all.
Reboot your system.

Seems to me to be Spyware Doctor - the file disappears when I shut Spyware Doctor down and reappears again when I start it up.

CHEFBIGFEET, on Jun 5 2006, 10:55 PM, said:

You can stop this nonsense in the startup services start exe services deselect Performance Logs and Alerts

bernardus

hi i tried this program and unchecked all to delete c temp file but still wont delete it any clues

I suggest...that you start a new post and give all pertinent details of what's wrong with your system...including manufacturer and model.

Hardly anyone is likely to read very much on a thread that started years ago, IMO.

It's highly unlikely that anything in that situation...relates to your own today.

Thanks .

FWIW: http://www.bleepingcomputer.com/forums/topic18366.html

Louis

Sorry guys. I'm new, so i dunno if old topics are replied to or not?

But if anyone's interested you might try this http://killbox.net/
It's a utility that will attempt to delete a file which is in use by a process, by first killing the process then deleting the file.

Hope it works for you. :-)

I figured it out, Was having the same problem not being able to delete the preflib folder. In the startup, I removed the Java Quick Start. Was then able to delete that darn temp folder. Hope this helps all who are looking.
When I was using killbox and hit the processes tab and removed jqs.exe from the startup. Frustrating darn folder.

The revival of a 5 year old topic.

Perflib_Perfdata.dat files.

They can be deleted very simply with the Unlocker program.