Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

# Dirty Decrypt Infection

20 replies to this topic

### #1 ianlh

ianlh

• Members
• 11 posts
• OFFLINE
•
• Local time:08:15 PM

Posted 09 August 2013 - 05:51 AM

Mod Edit: Moved to Malware Removal ~~ boopme

Hi there, I have obviously picked up malware because when I try to open excel or word files created on my pc by any user then I can't although I can open excel created by others and sent to me.

I run AVG free and yesterday this told me it had stopped a removed a ransomware infection but I assume it didn't stop 100% of the problem. I am not getting a demand for money etc which I see can happen from other posts.

When I started up today a warning notice popped up to tell me thta windows security centre isn't working and can't be switched on

When I  try to open files I get a message telling me that parts of the file are unreadable and when I click yes to recover then I get this message. Obviously I haven't done what it suggests.

I would be very grateful for any ideas. I am not by any means experienced in IT.

File is encrypted
This file can be decrypted using the program DirtyDecrypt.exe
Press CTRL+ALT+D to run DirtyDecrypt.exe

If DirtyDecrypt.exe not opened сheck the paths:
C:\Program Files (x86)\Dirty\DirtyDecrypt.exe
C:\Program Files\Dirty\DirtyDecrypt.exe
C:\Users\[YOUR USER]\AppData\Roaming\Dirty\DirtyDecrypt.exe
C:\Documents and Settings\[YOUR USER]\Application Data\Dirty\DirtyDecrypt.exe
C:\Documents and Settings\[YOUR USER]\Local Settings\Application Data\Dirty\DirtyDecrypt.exe

Edited by boopme, 09 August 2013 - 09:04 AM.

### #2 HelpBot

HelpBot

Bleepin' Binary Bot

• Bots
• 12,696 posts
• OFFLINE
•
• Gender:Male
• Local time:03:15 PM

Posted 14 August 2013 - 05:55 AM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/503779 <<< CLICK THIS LINK

If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

• If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
• A new DDS log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
• Please do this even if you have previously posted logs for us.
• If you were unable to produce the logs originally please try once more.
• If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
• If you are unsure about any of these characteristics just post what you can and we will guide you.
• Please tell us if you have your original Windows CD/DVD available.
• Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

• Download DDS by sUBs from the following link if you no longer have it available and save it to your destop.

DDS.com Download Link
• Double click on the DDS icon, allow it to run.
• A small box will open, with an explanation about the tool. No input is needed, the scan is running.
• Notepad will open with the results.
• Follow the instructions that pop up for posting the results.
• Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control can be found HERE.

As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

### #3 Oh My!

Oh My!

Adware and Spyware and Malware.....

• Malware Response Instructor
• 37,001 posts
• OFFLINE
•
• Gender:Male
• Location:California
• Local time:12:15 PM

Posted 20 August 2013 - 10:33 PM

Greetings ianlh and to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

If you would allow me to call you by your first name I would prefer to do that.

===================================================

Ground Rules:
• First, I would like to inform you that most of us here at Bleeping Computer offer our expert assistance out of the goodness of our hearts. Please try to match our commitment to you with your patience toward us. If this was easy we would never have met.
• Please do not run any tools or take any steps other than those I will provide for you while we work on your computer together. I need to be certain about the state of your computer in order to provide appropriate and effective steps for you to take. Most often "well intentioned" (and usually panic driven!) independent efforts can make things much worse for both of us. If at any point you would prefer to take your own steps please let me know, I will not be offended. I would be happy to focus on the many others who are waiting in line for assistance.
• Please perform all steps in the order they are listed in each set of instructions. Some steps may be a bit complicated. If things are not clear, be sure to stop and let me know. We need to work on this together with confidence.
• Please copy and paste all logs into your post unless directed otherwise. Please do not re-run any programs I suggest. If you encounter problems simply stop and tell me.
• When you post your reply, use the button instead.
• In the upper right hand corner of the topic you will see the button. Click on this then choose Immediate E-Mail notification and then Proceed and you will be sent an email once I have posted a response.
• If you do not reply to your topic after 5 days we assume it has been abandoned and I will close it.
• When your computer is clean I will alert you of such. I will also provide for you detailed information about how you can combat future infections.
• I would like to remind you to make no further changes to your computer unless I direct you to do so.
• Now let's get started
===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and post that information so that I know you are still with me. Unfortunately, there are many people waiting to be assisted and not enough of us at BleepingComputer to go around. I appreciate your understanding and diligence.

Thank you for your patience thus far. I will tell you from the start that the chances of decrypting your files are minimal at best. Often times there is no way to undo the damage that has been done.

While I review what you have posted please do this.

===================================================

Farbar Recovery Scan Tool (FRST)

--------------------
• Download Farbar Recover Scan Tool for either 32 bit or 64 bit systems and save it to your desktop
• If you are unsure if you have 32 bit or 64 bit simply download and try one. If that doesn't run properly the other one should
• Double click the icon
• Click Yes to the disclaimer
• Click Scan and allow the program to run
• Click OK on the Scan complete screen, then OK on the Addition.txt pop up screen
• 2 Notepad documents should now be open on your desktop.
• Please copy and paste the contents of both in your reply
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.
• FRST results
• Addition log

Gary

If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

### #4 ianlh

ianlh
• Topic Starter

• Members
• 11 posts
• OFFLINE
•
• Local time:08:15 PM

Posted 21 August 2013 - 03:57 PM

Gary,

Hello, thanks very much for getting in touch. I have run the farbar scan as requested and copy below the two logs generated. I hope that you can help with the encryted files but if not then so be it I am grateful for the efforts.

Kind regards

Ian

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-08-2013 02
Ran by Ian (administrator) on 21-08-2013 21:49:04
Running from C:\Users\Ian\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NTY0WXWO
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Agere Systems) C:\Windows\system32\agrsmsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
() C:\Program Files\Join MEPlay\JoinMEPlayAssistantServices.exe
(Symantec Corporation) C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgnsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgemcx.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(TOSHIBA CORPORATION) c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgrsx.exe
(Ulead Systems, Inc.) C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcsrvx.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Symantec Corporation) C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynToshiba.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgui.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Spotify Ltd) C:\Users\Ian\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil32_11_7_700_169_ActiveX.exe
(Microsoft Corporation) c:\program files\windows defender\MpCmdRun.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [4349952 2007-01-18] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [898344 2007-07-27] (Synaptics, Inc.)
HKLM\...\Run: [SynTPStart] - C:\Program Files\Synaptics\SynTP\SynTPStart.exe [204800 2007-07-27] (Synaptics, Inc.)
HKLM\...\Run: [Symantec PIF AlertEng] - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [583048 2008-01-29] (Symantec Corporation)
HKLM\...\Run: [NvSvc] - C:\Windows\system32\nvsvc.dll [90191 2007-01-13] (NVIDIA Corporation)
HKLM\...\Run: [NvCplDaemon] - C:\Windows\system32\NvCpl.dll [7766016 2007-01-13] (NVIDIA Corporation)
HKLM\...\Run: [AppleSyncNotifier] - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [47904 2010-12-14] (Apple Inc.)
HKLM\...\Run: [AVG_UI] - C:\Program Files\AVG\AVG2013\avgui.exe [4411440 2013-07-01] (AVG Technologies CZ, s.r.o.)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\Ian\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-08-06] (Spotify Ltd)
HKCU\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [68856 2007-07-01] (Google Inc.)
MountPoints2: {d78bba1d-7e99-11e1-ba6d-0016d4fa0553} - D:\AutoRun.exe
MountPoints2: {d78bba4d-7e99-11e1-ba6d-0016d4fa0553} - D:\AutoRun.exe
HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)
HKU\Default\...\Run: [TOSCDSPD] - C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [ 2006-11-13] (TOSHIBA)
HKU\Default User\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)
HKU\Default User\...\Run: [TOSCDSPD] - C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [ 2006-11-13] (TOSHIBA)
HKU\Elizabeth\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)
HKU\Elizabeth\...\Run: [TOSCDSPD] - C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [ 2006-11-13] (TOSHIBA)
HKU\Elizabeth\...\Run: [msnmsgr] - C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [ 2010-11-10] (Microsoft Corporation)
HKU\Elizabeth\...\Run: [kdx] - C:\Program Files\Kontiki\KHost.exe -all [x]
HKU\Elizabeth\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [ 2008-01-19] (Microsoft Corporation)
HKU\Gill\...\Run: [TOSCDSPD] - C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [ 2006-11-13] (TOSHIBA)
HKU\Gill\...\Run: [msnmsgr] - C:\Program Files\Windows Live\Messenger\msnmsgr.exe [ 2010-11-10] (Microsoft Corporation)
HKU\Gill\...\Run: [kdx] - C:\Program Files\Kontiki\KHost.exe -all [x]
HKU\Gill\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [ 2008-01-19] (Microsoft Corporation)
HKU\Gill\...\Run: [Spotify Web Helper] - C:\Users\Gill\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [ 2013-03-31] (Spotify Ltd)
HKU\Gill\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil32_11_7_700_169_ActiveX.exe [ 2013-04-19] (Adobe Systems Incorporated)
HKU\Jack\...\Run: [TOSCDSPD] - C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [ 2006-11-13] (TOSHIBA)
HKU\Jack\...\Run: [MsnMsgr] - C:\Program Files\Windows Live\Messenger\msnmsgr.exe [ 2010-11-10] (Microsoft Corporation)
HKU\Jack\...\Run: [kdx] - C:\Program Files\Kontiki\KHost.exe -all [x]
HKU\Jack\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [ 2008-01-19] (Microsoft Corporation)
HKU\Katherine\...\Run: [TOSCDSPD] - C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [ 2006-11-13] (TOSHIBA)
HKU\Katherine\...\Run: [msnmsgr] - C:\Program Files\Windows Live\Messenger\msnmsgr.exe [ 2010-11-10] (Microsoft Corporation)
HKU\Katherine\...\Run: [kdx] - C:\Program Files\Kontiki\KHost.exe -all [x]
HKU\Katherine\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [ 2008-01-19] (Microsoft Corporation)
HKU\Katherine\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [ 2008-01-19] (Microsoft Corporation)
HKU\Tony\...\Run: [TOSCDSPD] - TOSCDSPD.EXE [x]
HKU\Tony\...\Run: [msnmsgr] - C:\Program Files\Windows Live\Messenger\msnmsgr.exe [ 2010-11-10] (Microsoft Corporation)
HKU\Tony\...\Run: [kdx] - C:\Program Files\Kontiki\KHost.exe -all [x]
HKU\Tony\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [ 2008-01-19] (Microsoft Corporation)
Startup: C:\Users\Elizabeth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Gill\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Jack\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Katherine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Tony\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

ProxyServer: http=127.0.0.1:23012
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.google.co.uk/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
SearchScopes: HKLM - {56256A51-B582-467e-B8D4-7786EDA79AE0} URL = http://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZJ&fl=0&ptb=ZombiT9IKC1FxMG9A_gwmg&url=http://edits.mywebsearch.com/toolbaredits/barsearch.jhtml&st=sb&searchfor={searchTerms}
SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2442941
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -  No File
BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Skype Plug-In - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -&Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation)
Toolbar: HKCU -No Name - {472734EA-242A-422B-ADF8-83D1E48CC825} -  No File
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -  No File
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Winsock: Catalog9 01 C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll [329656] (PC Tools Research Pty Ltd.)
Winsock: Catalog9 02 C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll [329656] (PC Tools Research Pty Ltd.)
Winsock: Catalog9 03 C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll [329656] (PC Tools Research Pty Ltd.)
Winsock: Catalog9 04 C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll [329656] (PC Tools Research Pty Ltd.)
Winsock: Catalog9 05 C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll [329656] (PC Tools Research Pty Ltd.)
Winsock: Catalog9 06 C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll [329656] (PC Tools Research Pty Ltd.)
Winsock: Catalog9 17 C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll [329656] (PC Tools Research Pty Ltd.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\28.0.1500.71\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\28.0.1500.71\pdf.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\28.0.1500.71\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
CHR Plugin: (AVG Internet Security) - C:\Users\Ian\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.2161_0\plugins/avgnpss.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.160.1) - C:\Program Files\Java\jre6\bin\new_plugin\npdeploytk.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java™ Platform SE 6 U18) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Garmin Communicator Plug-In) - C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
CHR Plugin: (Google Updater) - C:\Program Files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll (Google)
CHR Plugin: (Picasa) - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (BrowserPlus (from Yahoo!) v2.9.8) - C:\Users\Ian\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)
CHR Plugin: (Windows Presentation Foundation) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

========================== Services (Whitelisted) =================

R2 AVGIDSAgent; C:\Program Files\AVG\AVG2013\avgidsagent.exe [4939312 2013-07-04] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2013\avgwdsvc.exe [283136 2013-07-23] (AVG Technologies CZ, s.r.o.)
R2 JoinMEUI Assistant Service; C:\Program Files\Join MEPlay\JoinMEPlayAssistantServices.exe [242176 2010-12-09] ()
R2 LiveUpdate Notice Service; C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll [537992 2008-04-10] (Symantec Corporation)
S3 sdAuxService; C:\Program Files\PC Tools Security\pctsAuxs.exe [402336 2011-11-22] (PC Tools)
S3 sdCoreService; C:\Program Files\PC Tools Security\pctsSvc.exe [1117624 2011-11-22] (PC Tools)
S3 TuneUp.Defrag; C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe [435008 2012-01-06] (TuneUp Software)
R2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [1052480 2011-11-15] (TuneUp Software)
R2 UleadBurningHelper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [49152 2006-08-23] (Ulead Systems, Inc.)
S3 usprserv; C:\Windows\System32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
S2 CLTNetCnService; "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [x]
S2 LiveUpdate Notice Ex; "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [x]

==================== Drivers (Whitelisted) ====================

R2 AegisP; C:\Windows\System32\DRIVERS\AegisP.sys [17801 2007-07-01] (Meetinghouse Data Communications)
S3 AR5523; C:\Windows\System32\DRIVERS\WG11TND5.sys [362944 2005-09-05] (NETGEAR, Inc.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [208184 2013-07-20] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [60216 2013-07-20] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [22328 2013-03-01] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [171320 2013-07-20] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [246072 2013-07-20] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [96568 2013-07-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [39224 2013-07-10] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [182072 2013-03-21] (AVG Technologies CZ, s.r.o.)
R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-11] (Microsoft Corporation)
S3 CoachUsb; C:\Windows\System32\DRIVERS\CoachUsb.sys [46368 2003-04-18] (Accapella Ltd.)
R0 LPCFilter; C:\Windows\System32\DRIVERS\LPCFilter.sys [19456 2006-07-28] (COMPAL ELECTRONIC INC.)
S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [9216 2010-12-09] (HandSet Incorporated)
R0 PCTCore; C:\Windows\System32\drivers\PCTCore.sys [331880 2011-11-14] (PC Tools)
R0 pctDS; C:\Windows\System32\drivers\pctDS.sys [341656 2011-12-10] (PC Tools)
R0 pctEFA; C:\Windows\System32\drivers\pctEFA.sys [660992 2011-10-07] (PC Tools)
S4 pctgntdi; C:\Windows\System32\drivers\pctgntdi.sys [253096 2011-11-22] (PC Tools)
S4 pctplsg; C:\Windows\System32\drivers\pctplsg.sys [70536 2011-11-22] (PC Tools)
R1 PCTSD; C:\Windows\System32\Drivers\PCTSD.sys [185560 2011-11-22] (PC Tools)
S3 RTL8187; C:\Windows\System32\DRIVERS\wg111v2.sys [213216 2007-02-09] (Realtek Semiconductor Corporation                           )
R0 SCMNdisP; C:\Windows\System32\DRIVERS\scmndisp.sys [21728 2007-01-19] (Windows ® Codename Longhorn DDK provider)
S3 SmartUSB; C:\Windows\System32\DRIVERS\SmartUSB.sys [17792 2007-02-21] (ActivCard S.A.)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2008-12-08] ()
R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [10064 2010-02-24] (TuneUp Software)
R3 UVCFTR; C:\Windows\System32\DRIVERS\UVCFTR_S.SYS [17712 2007-01-26] (Chicony Electronics Co., Ltd.)
S3 zgwhsdiag; C:\Windows\System32\DRIVERS\zgwhsdiag.sys [106752 2010-12-09] (ZTE Incorporated)
S3 zgwhsmdm; C:\Windows\System32\DRIVERS\zgwhsmdm.sys [106752 2010-12-09] (ZTE Incorporated)
S3 zgwhsnmea; C:\Windows\System32\DRIVERS\zgwhsnmea.sys [106752 2010-12-09] (ZTE Incorporated)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 cpuz134; \??\C:\Users\Ian\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 rm; \??\C:\Windows\system32\drivers\rm.sys [x]
S3 Tosrfcom; No ImagePath
S3 TpChoice; system32\DRIVERS\TpChoice.sys [x]
S3 usbbus; system32\DRIVERS\lgusbbus.sys [x]
S3 UsbDiag; system32\DRIVERS\lgusbdiag.sys [x]
S3 USBModem; system32\DRIVERS\lgusbmodem.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-08-17 09:03 - 2013-08-17 09:03 - 00000000 ____D C:\Users\Gill\AppData\Local\{65B52D75-DB39-4A45-AA1B-95CF21A3ED24}
2013-08-15 23:34 - 2013-07-25 03:32 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-15 23:34 - 2013-07-25 03:30 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-15 23:34 - 2013-07-25 03:26 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-15 23:34 - 2013-07-25 03:26 - 01104384 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-15 23:34 - 2013-07-25 03:25 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-15 23:34 - 2013-07-25 03:24 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-15 23:34 - 2013-07-25 03:24 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-15 23:34 - 2013-07-25 03:23 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-15 23:34 - 2013-07-25 03:23 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-15 23:34 - 2013-07-25 03:23 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-15 23:34 - 2013-07-25 03:23 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-15 23:34 - 2013-07-25 03:23 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-15 23:34 - 2013-07-25 03:22 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-15 23:34 - 2013-07-25 03:22 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-15 23:34 - 2013-07-25 03:22 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-15 23:33 - 2013-07-25 03:40 - 12334080 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-15 22:52 - 2013-06-15 14:22 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2013-08-15 22:52 - 2013-06-15 12:23 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-15 22:51 - 2013-07-05 05:53 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-15 22:50 - 2013-07-17 20:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-15 22:48 - 2013-07-10 10:47 - 00783360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-15 22:46 - 2013-07-09 13:10 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-15 22:46 - 2013-07-08 05:55 - 03603904 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-08-15 22:46 - 2013-07-08 05:55 - 03551680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-15 22:45 - 2013-07-08 05:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-15 22:45 - 2013-07-08 05:16 - 00992768 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-15 22:45 - 2013-07-08 05:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-15 22:45 - 2013-07-08 05:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 22:35 - 2013-08-15 23:45 - 00000000 ____D C:\Windows\system32\MRT
2013-08-11 21:32 - 2013-08-11 21:32 - 00008189 _____ C:\Users\Ian\Documents\llllllllll.xlsx
2013-08-09 17:05 - 2013-08-09 17:08 - 00000162 _____ C:\Windows\Reimage.ini
2013-08-08 23:55 - 2013-08-08 23:56 - 00000000 ____D C:\{CDCBD65D-3E65-AF00-109A-82357758E1BB}
2013-08-08 23:55 - 2013-08-08 23:55 - 00000000 ____D C:\Users\Ian\AppData\Roaming\Dirty
2013-08-08 23:55 - 2013-08-08 23:55 - 00000000 ____D C:\Users\Ian\AppData\Local\SPIkefRu
2013-08-08 23:55 - 2013-08-08 23:55 - 00000000 ____D C:\Users\Ian\AppData\Local\Dirty
2013-08-08 23:55 - 2013-08-08 23:55 - 00000000 ____D C:\Users\Ian\AppData\Local\azFqMKpc
2013-07-29 15:18 - 2013-07-29 15:18 - 00000000 ____D C:\Windows\system32\SupportAppCB
2013-07-29 15:18 - 2010-12-09 10:28 - 00106752 _____ (ZTE Incorporated) C:\Windows\system32\Drivers\zgwhsnmea.sys
2013-07-29 15:18 - 2010-12-09 10:28 - 00106752 _____ (ZTE Incorporated) C:\Windows\system32\Drivers\zgwhsmdm.sys
2013-07-29 15:18 - 2010-12-09 10:28 - 00106752 _____ (ZTE Incorporated) C:\Windows\system32\Drivers\zgwhsdiag.sys
2013-07-29 15:18 - 2010-12-09 10:28 - 00009216 _____ (HandSet Incorporated) C:\Windows\system32\Drivers\massfilter_hs.sys
2013-07-29 15:17 - 2013-07-29 15:28 - 00000000 ____D C:\Program Files\Join MEPlay
2013-07-29 15:17 - 2013-07-29 15:17 - 00001471 _____ C:\Users\Public\Desktop\Join ME.lnk
2013-07-29 14:07 - 2013-07-29 14:08 - 00000000 ____D C:\Users\Gill\AppData\Local\{73252D2F-13AB-4790-8E79-5F99F0BDBFFC}
2013-07-23 12:54 - 2013-07-23 12:54 - 00000000 ____D C:\Users\Gill\AppData\Local\{18FA65A3-D60E-4BD8-984A-0DD57331FDF5}

==================== One Month Modified Files and Folders =======

2013-08-21 21:48 - 2013-08-21 21:48 - 00000000 ____D C:\FRST
2013-08-21 21:39 - 2010-01-31 21:46 - 00000886 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-21 21:35 - 2007-07-01 19:00 - 01210949 _____ C:\Windows\WindowsUpdate.log
2013-08-21 21:20 - 2012-03-24 14:57 - 00000000 ____D C:\ProgramData\MFAData
2013-08-21 21:16 - 2007-07-01 20:37 - 00024981 _____ C:\Users\Ian\AppData\Roaming\nvModes.001
2013-08-21 21:15 - 2012-10-20 11:44 - 00000430 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-08-21 21:15 - 2010-01-31 21:46 - 00000882 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-21 21:15 - 2006-11-02 13:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-21 21:15 - 2006-11-02 13:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-21 21:14 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-20 23:11 - 2006-11-02 14:01 - 00032622 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-20 09:33 - 2009-12-23 23:02 - 00000000 ____D C:\Users\Gill\Tracing
2013-08-20 09:33 - 2007-07-03 21:06 - 00012978 _____ C:\Users\Gill\AppData\Roaming\nvModes.001
2013-08-18 23:20 - 2007-07-01 20:18 - 00024981 _____ C:\Users\Ian\AppData\Roaming\nvModes.dat
2013-08-17 19:01 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-08-17 09:03 - 2013-08-17 09:03 - 00000000 ____D C:\Users\Gill\AppData\Local\{65B52D75-DB39-4A45-AA1B-95CF21A3ED24}
2013-08-16 00:43 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\rescache
2013-08-16 00:25 - 2007-09-02 12:25 - 00000000 ____D C:\Users\Ian\Documents\Budget
2013-08-15 23:49 - 2013-08-14 22:35 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 23:45 - 2006-11-02 11:24 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-08-15 23:43 - 2007-03-12 12:22 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-15 23:38 - 2006-11-02 11:33 - 00722958 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-15 23:34 - 2011-03-12 22:21 - 02763606 _____ C:\Windows\system32\Drivers\Cat.DB
2013-08-15 19:11 - 2006-11-02 11:22 - 54263808 _____ C:\Windows\system32\config\software_previous
2013-08-15 19:11 - 2006-11-02 11:22 - 104071168 _____ C:\Windows\system32\config\system_previous
2013-08-15 19:10 - 2007-07-04 16:57 - 00000000 ____D C:\Users\Katherine
2013-08-15 19:10 - 2007-07-03 11:30 - 00000000 ____D C:\Users\Tony
2013-08-15 19:10 - 2007-07-02 19:11 - 00000000 ____D C:\Users\Gill
2013-08-15 19:10 - 2007-07-02 16:36 - 00000000 ____D C:\Users\Elizabeth
2013-08-15 19:10 - 2007-07-02 00:38 - 00000000 ____D C:\Users\Jack
2013-08-15 19:10 - 2007-07-01 19:17 - 00000000 ____D C:\Users\Ian
2013-08-15 19:10 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\spool
2013-08-15 19:10 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\Msdtc
2013-08-15 19:09 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\registration
2013-08-15 19:02 - 2006-11-02 11:22 - 45350912 _____ C:\Windows\system32\config\components_previous
2013-08-15 19:02 - 2006-11-02 11:22 - 00262144 _____ C:\Windows\system32\config\sam_previous
2013-08-15 09:56 - 2006-11-02 11:22 - 00524288 _____ C:\Windows\system32\config\default_previous
2013-08-15 09:56 - 2006-11-02 11:22 - 00262144 _____ C:\Windows\system32\config\security_previous
2013-08-11 21:32 - 2013-08-11 21:32 - 00008189 _____ C:\Users\Ian\Documents\llllllllll.xlsx
2013-08-09 17:08 - 2013-08-09 17:05 - 00000162 _____ C:\Windows\Reimage.ini
2013-08-08 23:56 - 2013-08-08 23:55 - 00000000 ____D C:\Users\Ian\AppData\Local\Dirty
2013-08-08 23:56 - 2013-08-08 23:55 - 00000000 ____D C:\{CDCBD65D-3E65-AF00-109A-82357758E1BB}
2013-08-08 23:56 - 2013-01-03 23:21 - 00000000 ____D C:\Program Files\iPod
2013-08-08 23:56 - 2011-01-11 21:50 - 00000000 ____D C:\Program Files\FunWebProducts
2013-08-08 23:56 - 2009-12-23 22:55 - 00000000 ____D C:\Program Files\Microsoft SQL Server Compact Edition
2013-08-08 23:56 - 2009-11-17 14:39 - 00000000 ____D C:\Program Files\Windows Portable Devices
2013-08-08 23:56 - 2009-09-01 22:50 - 00000000 ____D C:\Program Files\OpenOffice.org 3
2013-08-08 23:56 - 2008-10-05 15:14 - 00000000 ____D C:\Program Files\Games-Masters.com
2013-08-08 23:56 - 2008-09-07 20:20 - 00000000 ____D C:\Program Files\Hewlett-Packard
2013-08-08 23:56 - 2008-09-07 20:15 - 00000000 ____D C:\Program Files\HP
2013-08-08 23:56 - 2008-03-04 17:59 - 00000000 ____D C:\Program Files\Windows Live
2013-08-08 23:56 - 2007-12-27 20:27 - 00000000 ____D C:\Program Files\MSN Games
2013-08-08 23:56 - 2007-07-01 21:06 - 00000000 ____D C:\Program Files\NETGEAR
2013-08-08 23:56 - 2007-07-01 21:01 - 00000000 ____D C:\Program Files\Microsoft CAPICOM 2.1.0.2
2013-08-08 23:56 - 2007-07-01 19:27 - 00000000 ____D C:\Program Files\Camera Assistant Software for Toshiba
2013-08-08 23:56 - 2007-07-01 19:22 - 00000000 ____D C:\Users\Ian\AppData\Local\Toshiba
2013-08-08 23:56 - 2007-03-12 12:28 - 00000000 ____D C:\Program Files\Microsoft Digital Image 2006
2013-08-08 23:56 - 2007-03-12 12:24 - 00000000 ____D C:\Program Files\Microsoft.NET
2013-08-08 23:56 - 2006-11-02 13:37 - 00000000 ____D C:\Program Files\Reference Assemblies
2013-08-08 23:55 - 2013-08-08 23:55 - 00000000 ____D C:\Users\Ian\AppData\Roaming\Dirty
2013-08-08 23:55 - 2013-08-08 23:55 - 00000000 ____D C:\Users\Ian\AppData\Local\SPIkefRu
2013-08-08 23:55 - 2013-08-08 23:55 - 00000000 ____D C:\Users\Ian\AppData\Local\azFqMKpc
2013-08-08 20:07 - 2013-04-18 21:30 - 00047914 ____R C:\Users\Ian\Documents\Posted Budget.xlsx
2013-08-06 21:09 - 2009-07-31 21:57 - 00000000 ____D C:\Users\Ian\AppData\Roaming\Spotify
2013-08-06 21:09 - 2009-07-31 21:57 - 00000000 ____D C:\Users\Ian\AppData\Local\Spotify
2013-08-01 19:48 - 2010-12-10 19:11 - 00001976 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-01 19:41 - 2007-07-01 23:21 - 00000000 ____D C:\Program Files\Google
2013-07-30 19:29 - 2012-12-11 21:00 - 00000847 _____ C:\Users\Public\Desktop\AVG 2013.lnk
2013-07-29 15:28 - 2013-07-29 15:17 - 00000000 ____D C:\Program Files\Join MEPlay
2013-07-29 15:18 - 2013-07-29 15:18 - 00000000 ____D C:\Windows\system32\SupportAppCB
2013-07-29 15:17 - 2013-07-29 15:17 - 00001471 _____ C:\Users\Public\Desktop\Join ME.lnk
2013-07-29 15:17 - 2007-03-07 17:39 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-07-29 14:08 - 2013-07-29 14:07 - 00000000 ____D C:\Users\Gill\AppData\Local\{73252D2F-13AB-4790-8E79-5F99F0BDBFFC}
2013-07-29 14:08 - 2010-10-31 17:40 - 00000000 ____D C:\Users\Gill\AppData\Local\Windows Live
2013-07-25 03:40 - 2013-08-15 23:33 - 12334080 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-25 03:32 - 2013-08-15 23:34 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-25 03:30 - 2013-08-15 23:34 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-25 03:26 - 2013-08-15 23:34 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-25 03:26 - 2013-08-15 23:34 - 01104384 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-25 03:25 - 2013-08-15 23:34 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-25 03:24 - 2013-08-15 23:34 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-25 03:24 - 2013-08-15 23:34 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-25 03:23 - 2013-08-15 23:34 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-25 03:23 - 2013-08-15 23:34 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-25 03:23 - 2013-08-15 23:34 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-25 03:23 - 2013-08-15 23:34 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-25 03:23 - 2013-08-15 23:34 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-25 03:22 - 2013-08-15 23:34 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-25 03:22 - 2013-08-15 23:34 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-25 03:22 - 2013-08-15 23:34 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-07-23 12:54 - 2013-07-23 12:54 - 00000000 ____D C:\Users\Gill\AppData\Local\{18FA65A3-D60E-4BD8-984A-0DD57331FDF5}

Files to move or delete:
====================
C:\ProgramData\dsgsdgdsgdsgw.pad
C:\Users\Ian\setup_reminder18_en.exe
C:\Users\Ian\AppData\Roaming\skype.dat
C:\Users\Ian\AppData\Roaming\skype.ini

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2013-08-21 21:24

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 21-08-2013 02
Ran by Ian at 2013-08-21 21:52:58
Running from C:\Users\Ian\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NTY0WXWO
Boot Mode: Normal
==========================================================

==================== Installed Programs =======================

Update for Microsoft Office 2007 (KB2508958)
1400 (Version: 82.0.242.000)
1400_Help (Version: 82.0.242.000)
1400Trb (Version: 82.0.242.000)
32 Bit HP CIO Components Installer (Version: 2.1.5)
Acrobat.com (Version: 0.0.0)
Activation Assistant for the 2007 Microsoft Office suites
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0)
Adobe Flash Player 10 Plugin (Version: 10.0.45.2)
Adobe Flash Player 11 ActiveX (Version: 11.7.700.169)
Adobe Reader 8.3.1 (Version: 8.3.1)
AIO_CDB_ProductContext (Version: 82.0.242.000)
AIO_CDB_Software (Version: 82.0.242.000)
AIO_Scan (Version: 82.0.173.000)
Apple Application Support (Version: 2.3.2)
Apple Mobile Device Support (Version: 6.0.1.3)
Apple Software Update (Version: 2.1.3.127)
AVG 2013 (Version: 13.0.3211)
AVG 2013 (Version: 13.0.3392)
AVG 2013 (Version: 2013.0.3392)
AVG PC Tuneup (Version: 10.0.0.27)
Bluetooth Stack for Windows by Toshiba (Version: v5.10.04(T))
Bonjour (Version: 3.0.0.10)
BufferChm (Version: 82.0.173.000)
Camera Assistant Software for Toshiba (Version: 1.7.115.0213)
CD/DVD Drive Acoustic Silencer (Version: 2.00.02)
CustomerResearchQFolder (Version: 1.00.0000)
D3DX10 (Version: 15.4.2368.0902)
DeviceManagementQFolder (Version: 1.00.0000)
DocProc (Version: 8.1.0.0)
DocProcQFolder (Version: 1.00.0000)
DVD MovieFactory for TOSHIBA (Version: 5.3)
eSupportQFolder (Version: 1.00.0000)
Fax (Version: 82.0.188.000)
Garmin Communicator Plugin (Version: 2.9.2)
Garmin USB Drivers (Version: 2.3.0.0)
Google Chrome (Version: 28.0.1500.95)
Google Earth Plug-in (Version: 7.1.1.1888)
Google Toolbar for Firefox (Version: 6.1.20091019)
Google Toolbar for Internet Explorer (Version: 1.0.0)
Google Toolbar for Internet Explorer (Version: 7.5.4209.2358)
Google Update Helper (Version: 1.3.21.153)
Google Updater (Version: 2.4.1536.6592)
HP Customer Participation Program 8.0 (Version: 8.0)
HP OCR Software 8.0 (Version: 8.0)
HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B (Version: 8.0)
HP Product Assistant (Version: 100.000.001.000)
HP Solution Center 8.0 (Version: 8.0)
HP Update (Version: 4.000.012.001)
HPProductAssistant (Version: 82.0.173.000)
HPSSupply (Version: 2.1.3.0000)
iTunes (Version: 11.0.1.12)
Java Auto Updater (Version: 2.0.1.2)
Java™ 6 Update 18 (Version: 6.0.180)
Java™ SE Runtime Environment 6 (Version: 1.6.0.0)
Join ME (Version: 2.0.3.0)
Junk Mail filter update (Version: 15.4.3502.0922)
LiveUpdate Notice (Symantec Corporation) (Version: 1.4.5)
MarketResearch (Version: 82.0.174.000)
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 1.1 Security Update (KB2698023)
Microsoft .NET Framework 1.1 Security Update (KB2833941)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Digital Image Library 9 - Blocker (Version: 9.00.0000)
Microsoft Digital Image Starter Edition 2006 (Version: 11.0.2018)
Microsoft Digital Image Starter Edition 2006 Editor (Version: 11.0.2018)
Microsoft Digital Image Starter Edition 2006 Library (Version: 11.0.2018)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Search Enhancement Pack (Version: 3.0.133.0)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Text-to-Speech Engine 4.0 (English)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Works (Version: 08.05.0818)
Microsoft XML Parser (Version: 8.20.8730.4)
MobileMe Control Panel (Version: 3.1.5.0)
MSVCRT (Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB927978) (Version: 4.20.9841.0)
MSXML 4.0 SP2 (KB936181) (Version: 4.20.9848.0)
MSXML 4.0 SP2 (KB941833) (Version: 4.20.9849.0)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
myphotobook 3.1 (Version: 3.1)
NETGEAR WG111T 108Mbps Wireless USB2.0 Adapter
NETGEAR WG111v2 wireless USB 2.0 adapter (Version: 160136)
Nokia Connectivity Cable Driver (Version: 7.1.32.69)
Norton 360 (Version: 1.0.0.184)
NVIDIA Drivers
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0)
PC Tools Spyware Doctor with AntiVirus 9.0 (Version: 9.0)
Picasa 3 (Version: 3.6)
QuickTime (Version: 7.73.80.64)
Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista (Version: 1.00.0000)
Realtek High Definition Audio Driver (Version: 6.0.1.5361)
SA31xx Device Manager & Media Converter (Version: 0.3)
Safari (Version: 5.34.57.2)
Scan (Version: 8.1.0.0)
Segoe UI (Version: 15.4.2271.0615)
Sky Go Desktop
Skype Toolbars (Version: 5.0.4126)
Skype™ 5.10 (Version: 5.10.116)
SolutionCenter (Version: 82.0.188.000)
Spotify (HKCU Version: 0.8.3.222.g317ab79d)
Spotify (Version: 0.3.18)
Synaptics Pointing Device Driver (Version: 10.0.9.0)
Texas Instruments PCIxx21/x515/xx12 drivers. (Version: 1.22.0000)
TIPCI (Version: 1.22.0000)
Toolbox (Version: 82.0.173.000)
TOSHIBA ConfigFree (Version: 7.00.24)
TOSHIBA Disc Creator (Version: 2.0.0.7)
TOSHIBA Extended Tiles for Windows Mobility Center (Version: 1.01.00)
TOSHIBA Flash Cards Support Utility (Version: 1.49.0.2C)
TOSHIBA Hardware Setup (Version: 1.49.0.3C)
Toshiba Online Product Information (Version: 1.00.0008)
TOSHIBA SD Memory Utilities (Version: 1.7)
TOSHIBA Software Modem (Version: 2.1.77 (SM2177ALD03))
TOSHIBA Supervisor Password (Version: 1.49.0.2C)
TOSHIBA Value Added Package (Version: 1.0.11)
TuneUp Utilities (Version: 9.0.6020.7)
TuneUp Utilities Language Pack (en-GB) (Version: 9.0.6020.7)
UnloadSupport (Version: 1.00.0000)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Utility Common Driver (Version: 0.0.50.7C)
Virtual Earth 3D (Beta) (Version: 1.1.703.22001)
WebReg (Version: 82.0.173.000)
Westwood Shared Internet Components
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (06/03/2009 2.3.0.0) (Version: 06/03/2009 2.3.0.0)
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Family Safety (Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Mail (Version: 15.4.3502.0922)
Windows Live Messenger (Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (Version: 15.4.3502.0922)
Windows Live OneCare safety scanner (Version: 1.0.0.0)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live Photo Gallery (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3502.0922)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live Sync (Version: 14.0.8089.726)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3502.0922)
Windows Live Writer (Version: 15.4.3502.0922)
Windows Live Writer Resources (Version: 15.4.3502.0922)
Windows Media Encoder 9 Series
Windows Media Encoder 9 Series (Version: 9.00.3374)
WinDVD for TOSHIBA (Version: 8.0-B6.108)
Yahoo! BrowserPlus 2.9.8

==================== Restore Points  =========================

08-08-2013 20:27:38 Scheduled Checkpoint
11-08-2013 21:27:42 Windows Update
14-08-2013 21:19:20 Windows Update
15-08-2013 21:46:01 Windows Update
15-08-2013 22:32:22 Windows Update
17-08-2013 19:38:13 Scheduled Checkpoint
19-08-2013 21:42:47 Scheduled Checkpoint
20-08-2013 20:17:08 Windows Update

==================== Hosts content: ==========================

2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {0083E3E9-F029-47D9-A4CD-BD6D55286D96} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {0200C8A6-E4EB-4C3D-8057-1D03F230711F} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\schtasks.exe [2008-01-19] (Microsoft Corporation)
Task: {05315DD6-307A-46BA-AFAD-1BA570FBB72C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-31] (Google Inc.)
Task: {10A28C36-772F-4A3A-BABC-3DC34F4E65CD} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {2C9A8A10-5A2B-43B4-81FF-913ACB907DDD} - System32\Tasks\WPD\SqmUpload_S-1-5-21-1166914808-1665196605-4163458617-1002 => C:\Windows\system32\rundll32.exe [2006-11-02] (Microsoft Corporation)
Task: {2F4DEA45-F3CF-4330-B792-8C41B7DE59AA} - System32\Tasks\WPD\SqmUpload_S-1-5-21-1166914808-1665196605-4163458617-1005 => C:\Windows\system32\rundll32.exe [2006-11-02] (Microsoft Corporation)
Task: {30229196-33A5-4382-844C-2462FF66EBDB} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2008-01-19] (Microsoft Corporation)
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {3BE51C49-B1D1-4B86-AE0C-307676710D50} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-31] (Google Inc.)
Task: {4398B0E4-F04D-4AAF-A7E1-E4268B58C774} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Ian => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-11] (Microsoft Corporation)
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-19] (Microsoft Corporation)
Task: {6364B13C-7A11-4C5D-AF06-EBEC14D2DE2D} - System32\Tasks\User_Feed_Synchronization-{5EF62006-74D3-4284-B9EA-9069B2E8A146} => C:\Windows\system32\msfeedssync.exe [2011-05-22] (Microsoft Corporation)
Task: {7F72B6A3-5DB6-46A7-AD8D-BF4BEDCBFF3B} - System32\Tasks\WPD\SqmUpload_S-1-5-21-1166914808-1665196605-4163458617-1004 => C:\Windows\system32\rundll32.exe [2006-11-02] (Microsoft Corporation)
Task: {83485494-F41A-4A95-B551-8AA33F10DAFD} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Tony => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-11] (Microsoft Corporation)
Task: {850002B6-D7AC-40FC-9690-49C8F7296177} - System32\Tasks\Microsoft\Windows\RestartManager\{08962A0C-458D-43ec-BCA9-AB0B67D62AC7} => C:\Windows\system32\rmclient.exe [2006-11-02] (Microsoft Corporation)
Task: {89256609-69E1-4D54-8D07-6C0695A20009} - System32\Tasks\ROC_REG_JAN_DELETE => C:\ProgramData\AVG January 2013 Campaign\ROC.exe [2013-01-16] ()
Task: {A61555D3-7840-45C1-A5A9-0D49851DE37A} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\OptinNotification => C:\Windows\System32\wsqmcons.exe [2008-01-19] (Microsoft Corporation)
Task: {ABB21F7E-4352-4A5F-BDBD-690E64BC1076} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-12] (Microsoft Corporation)
Task: {B461F10A-DF43-4186-976E-44EEAAC01128} - System32\Tasks\Adobe Reader and Acrobat Manager => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-03-29] (Adobe Systems Incorporated)
Task: {B4B9F9E8-7508-477D-995D-E7C60961ECA5} - System32\Tasks\User_Feed_Synchronization-{72433F22-333E-4F22-8F5D-198A102B0B8C} => C:\Windows\system32\msfeedssync.exe [2011-05-22] (Microsoft Corporation)
Task: {CB1FEEF2-4D24-488F-82BF-025F339F9C90} - System32\Tasks\WPD\SqmUpload_S-1-5-21-1166914808-1665196605-4163458617-1003 => C:\Windows\system32\rundll32.exe [2006-11-02] (Microsoft Corporation)
Task: {CFE6F6DA-210D-4F58-97E4-1DF8AEBA654C} - System32\Tasks\HP online update program => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-12-10] (Hewlett-Packard Co.)
Task: {D0286AC2-1C30-47C9-8532-1C77E60F25E6} - System32\Tasks\Microsoft\Windows\Defrag\ManualDefrag => C:\Windows\system32\defrag.exe [2008-01-19] (Microsoft Corp.)
Task: {D872512D-6177-47F4-B090-6130915156B7} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {DE9E9103-75F7-4D6F-8552-2291747309AE} - System32\Tasks\{480E6392-EC78-4940-B832-EEB815F42442} => C:\Program Files\Skype\\Phone\Skype.exe [2012-07-13] (Skype Technologies S.A.)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-05] ()
Task: {F023827C-BE30-4926-AF6B-4E60AA6FDF4D} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance => C:\Program Files\TuneUp Utilities 2010\OneClick.exe [2011-11-15] (TuneUp Software)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\ROC_REG_JAN_DELETE.job => C:\ProgramData\AVG January 2013 Campaign\ROC.exe

==================== Faulty Device Manager Devices =============

Name: Microsoft ISATAP Adapter #8
Description: Microsoft ISATAP Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft ISATAP Adapter #9
Description: Microsoft ISATAP Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Chicony USB 2.0 Camera
Description:
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Chicony
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Chicony USB 2.0 Camera
Description:
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Chicony
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

==================== Event log errors: =========================

Application errors:
==================
Error: (08/18/2013 11:20:46 PM) (Source: Application Hang) (User: )
Description: The program iexplore.exe version 9.0.8112.16502 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel.
Process ID: 68c
Start Time: 01ce9c5fc79b79b4
Termination Time: 13

Error: (08/18/2013 11:19:59 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 44850

Error: (08/18/2013 11:19:59 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 44850

Error: (08/18/2013 11:19:59 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/18/2013 11:19:58 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 43696

Error: (08/18/2013 11:19:58 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 43696

Error: (08/18/2013 11:19:58 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/18/2013 11:19:57 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 42557

Error: (08/18/2013 11:19:57 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 42557

Error: (08/18/2013 11:19:57 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

System errors:
=============
Error: (08/21/2013 09:20:58 PM) (Source: Service Control Manager) (User: )
Description: Windows Update

Error: (08/20/2013 11:11:00 PM) (Source: Service Control Manager) (User: )
Description: ScRegSetValueExWFailureActions%%5

Error: (08/20/2013 06:40:56 PM) (Source: Service Control Manager) (User: )
Description: ScRegSetValueExWFailureActions%%5

Error: (08/20/2013 09:48:28 AM) (Source: Service Control Manager) (User: )
Description: ScRegSetValueExWFailureActions%%5

Error: (08/19/2013 10:55:48 PM) (Source: Service Control Manager) (User: )
Description: ScRegSetValueExWFailureActions%%5

Error: (08/19/2013 09:31:55 PM) (Source: Service Control Manager) (User: )
Description: Windows Media Player Network Sharing Service%%1053

Error: (08/19/2013 09:31:55 PM) (Source: Service Control Manager) (User: )
Description: 30000Windows Media Player Network Sharing Service

Error: (08/18/2013 11:54:30 PM) (Source: Service Control Manager) (User: )
Description: ScRegSetValueExWFailureActions%%5

Error: (08/18/2013 10:22:40 PM) (Source: ipnathlp) (User: )
Description: The DNS proxy agent was unable to allocate 0 bytes of memory. This may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error.

Error: (08/17/2013 10:55:55 PM) (Source: Service Control Manager) (User: )
Description: ScRegSetValueExWFailureActions%%5

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
Date: 2013-08-21 21:49:35.852
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgidshx.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-08-21 21:49:35.448
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgidshx.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-08-21 21:49:35.085
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgidshx.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-08-21 21:49:34.720
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgidshx.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-08-21 21:49:34.109
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgidsdriverx.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-08-21 21:49:33.697
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgidsdriverx.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-08-21 21:49:33.232
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgidsdriverx.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-08-21 21:49:32.835
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgidsdriverx.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-08-09 17:13:42.635
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgidshx.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-08-09 17:13:42.156
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\avgidshx.sys because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Percentage of memory in use: 65%
Total physical RAM: 2045.38 MB
Available physical RAM: 702.11 MB
Total Pagefile: 4327.97 MB
Available Pagefile: 2930.04 MB
Total Virtual: 2047.88 MB
Available Virtual: 1892.68 MB

==================== Drives ================================

Drive c: (Vista) (Fixed) (Total:93.16 GB) (Free:18.53 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (Data) (Fixed) (Total:91.69 GB) (Free:90.24 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 186 GB) (Disk ID: 64D63C35)
Partition 1: (Not Active) - (Size=1 GB) - (Type=27)
Partition 2: (Active) - (Size=93 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=92 GB) - (Type=07 NTFS)

==================== End Of Log ============================

### #5 Oh My!

Oh My!

Adware and Spyware and Malware.....

• Malware Response Instructor
• 37,001 posts
• OFFLINE
•
• Gender:Male
• Location:California
• Local time:12:15 PM

Posted 21 August 2013 - 05:30 PM

Hi Ian,

Would you run the following programs for me please.

===================================================

AdwCleaner by Xplode - Delete Adware

-------------------
• Please download AdwCleaner by Xplode onto your desktop.
• Close all open programs and internet browser
• Double click on AdwCleaner.exe, select OK, then Run
• Click on Delete
• Confirm each time with OK
• Your computer will be rebooted automatically. A text file will open after the restart
• Copy and paste the contents in your reply
• You can find the logfile at C:\AdwCleaner[S1].txt
===================================================

Junkware Removal Tool by thisisu

-------------------
• Please download Junkware Removal Tool and save it to your desktop.
• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
• Right-mouse click JRT.exe and select Run as administrator (Windows XP double click the icon)
• Please allow the program time to run
• Once completed a Notepad document will open on your desktop
• Copy and paste the contents in your reply
===================================================

Farbar's Recovery Scan Tool - Run Fix in Normal or Safe Mode

--------------------
• Press the windows key + r on your keyboard at the same time. Type in notepad and press Enter
• Please copy and paste the contents of the below code box into the open notepad and save it to your desktop (<<<Important) as fixlist.txt
MountPoints2: {d78bba1d-7e99-11e1-ba6d-0016d4fa0553} - D:\AutoRun.exe
MountPoints2: {d78bba4d-7e99-11e1-ba6d-0016d4fa0553} - D:\AutoRun.exe
ProxyServer: http=127.0.0.1:23012
SearchScopes: HKLM - {56256A51-B582-467e-B8D4-7786EDA79AE0} URL = http://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZJ&fl=0&ptb=ZombiT9IKC1FxMG9A_gwmg&url=http://edits.mywebsearch.com/toolbaredits/barsearch.jhtml&st=sb&searchfor={searchTerms}
SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2442941
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -  No File
Toolbar: HKCU -No Name - {472734EA-242A-422B-ADF8-83D1E48CC825} -  No File
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -  No File
S3 rm; \??\C:\Windows\system32\drivers\rm.sys [x]
2013-08-08 23:55 - 2013-08-08 23:56 - 00000000 ____D C:\{CDCBD65D-3E65-AF00-109A-82357758E1BB}
2013-08-08 23:55 - 2013-08-08 23:55 - 00000000 ____D C:\Users\Ian\AppData\Roaming\Dirty
2013-08-08 23:55 - 2013-08-08 23:55 - 00000000 ____D C:\Users\Ian\AppData\Local\SPIkefRu
2013-08-08 23:55 - 2013-08-08 23:55 - 00000000 ____D C:\Users\Ian\AppData\Local\Dirty
2013-08-08 23:55 - 2013-08-08 23:55 - 00000000 ____D C:\Users\Ian\AppData\Local\azFqMKpc
C:\ProgramData\dsgsdgdsgdsgw.pad
C:\Users\Ian\setup_reminder18_en.exe
C:\Users\Ian\AppData\Roaming\skype.dat
C:\Users\Ian\AppData\Roaming\skype.ini

• Launch FRST and press the Fix button just once and wait, the program will automatically launch fixlist.txt.
• The tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
===================================================

Farbar's MiniRegTool

--------------------
• Please download MiniRegTool.zip (for 32 bit systems) or MiniRegTool64.zip (for 64 bit systems) and save it to your desktop
• Unzip the folder and double click the icon
• When you run the tool this is what you will see

• Copy and paste the following into the edit box:

Dirty
Decrypt

• Check the Search radio button.
• Press the Go button and post the result.
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.
• AdwCleaner log
• Junkware log
• fixlist log
• MiniRegTool log
• How is your computer running?

Edited by Oh My, 21 August 2013 - 07:17 PM.

Gary

If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

### #6 ianlh

ianlh
• Topic Starter

• Members
• 11 posts
• OFFLINE
•
• Local time:08:15 PM

Posted 22 August 2013 - 04:38 PM

Gary,

First part Adwcleaner log below: Others to follow

Thanks

Ian

# AdwCleaner v3.000 - Report created 22/08/2013 at 22:25:21
# Updated 20/08/2013 by Xplode
# Operating System : Windows Vista ™ Home Premium Service Pack 2 (32 bits)
# Username : Ian - NEWPC
# Running from : C:\Users\Ian\Downloads\adwcleaner.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files\FunWebProducts
Folder Deleted : C:\Users\Ian\AppData\LocalLow\FunWebProducts
Folder Deleted : C:\Users\Ian\AppData\LocalLow\MyWebSearch
Folder Deleted : C:\Users\Gill\AppData\LocalLow\FunWebProducts
Folder Deleted : C:\Users\Gill\AppData\LocalLow\MyWebSearch
Folder Deleted : C:\Users\Tony\AppData\LocalLow\FunWebProducts
Folder Deleted : C:\Users\Tony\AppData\LocalLow\MyWebSearch
Folder Deleted : C:\Users\Elizabeth\AppData\LocalLow\FunWebProducts
Folder Deleted : C:\Users\Elizabeth\AppData\LocalLow\MyWebSearch
Folder Deleted : C:\Users\Katherine\AppData\LocalLow\FunWebProducts
Folder Deleted : C:\Users\Katherine\AppData\LocalLow\MyWebSearch
Folder Deleted : C:\Users\Tony\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll
Key Deleted : HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467E-B8D4-7786EDA79AE0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\FocusInteractive
Key Deleted : HKLM\Software\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16502

-\\ Google Chrome v28.0.1500.95

[ File : C:\Users\Ian\AppData\Local\Google\Chrome\User Data\Default\preferences ]

[ File : C:\Users\Gill\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted : search_url
Deleted : keyword

[ File : C:\Users\Tony\AppData\Local\Google\Chrome\User Data\Default\preferences ]

[ File : C:\Users\Jack\AppData\Local\Google\Chrome\User Data\Default\preferences ]

[ File : C:\Users\Elizabeth\AppData\Local\Google\Chrome\User Data\Default\preferences ]

[ File : C:\Users\Katherine\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [4440 octets] - [22/08/2013 22:21:37]
AdwCleaner[S0].txt - [4426 octets] - [22/08/2013 22:25:21]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4486 octets] ##########

### #7 Oh My!

Oh My!

Adware and Spyware and Malware.....

• Malware Response Instructor
• 37,001 posts
• OFFLINE
•
• Gender:Male
• Location:California
• Local time:12:15 PM

Posted 25 August 2013 - 08:25 AM

Hi Ian,

How are we doing?
Gary

If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

### #8 ianlh

ianlh
• Topic Starter

• Members
• 11 posts
• OFFLINE
•
• Local time:08:15 PM

Posted 26 August 2013 - 04:06 PM

Gary,

Struggling to get these logs back to you, trying again #3

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.4 (08.22.2013:1)
OS: Windows Vista ™ Home Premium x86
Ran by Ian on 26/08/2013 at 20:59:48.17
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

~~~ Event Viewer Logs were cleared

Hope this gets to you

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 26-08-2013
Ran by Ian at 2013-08-26 21:09:13 Run:1
Running from C:\Users\Ian\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
MountPoints2: {d78bba1d-7e99-11e1-ba6d-0016d4fa0553} - D:\AutoRun.exe
MountPoints2: {d78bba4d-7e99-11e1-ba6d-0016d4fa0553} - D:\AutoRun.exe
ProxyServer: http=127.0.0.1:23012
SearchScopes: HKLM - {56256A51-B582-467e-B8D4-7786EDA79AE0} URL = http://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZJ&fl=0&ptb=ZombiT9IKC1FxMG9A_gwmg&url=http://edits.mywebsearch.com/toolbaredits/barsearch.jhtml&st=sb&searchfor={searchTerms}
SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2442941
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -  No File
Toolbar: HKCU -No Name - {472734EA-242A-422B-ADF8-83D1E48CC825} -  No File
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -  No File
S3 rm; \??\C:\Windows\system32\drivers\rm.sys [x]
2013-08-08 23:55 - 2013-08-08 23:56 - 00000000 ____D C:\{CDCBD65D-3E65-AF00-109A-82357758E1BB}
2013-08-08 23:55 - 2013-08-08 23:55 - 00000000 ____D C:\Users\Ian\AppData\Roaming\Dirty
2013-08-08 23:55 - 2013-08-08 23:55 - 00000000 ____D C:\Users\Ian\AppData\Local\SPIkefRu
2013-08-08 23:55 - 2013-08-08 23:55 - 00000000 ____D C:\Users\Ian\AppData\Local\Dirty
2013-08-08 23:55 - 2013-08-08 23:55 - 00000000 ____D C:\Users\Ian\AppData\Local\azFqMKpc
C:\ProgramData\dsgsdgdsgdsgw.pad
C:\Users\Ian\setup_reminder18_en.exe
C:\Users\Ian\AppData\Roaming\skype.dat
C:\Users\Ian\AppData\Roaming\skype.ini
*****************

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d78bba1d-7e99-11e1-ba6d-0016d4fa0553} => Key deleted successfully.
HKCR\CLSID\{d78bba1d-7e99-11e1-ba6d-0016d4fa0553} => Key not found.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d78bba4d-7e99-11e1-ba6d-0016d4fa0553} => Key deleted successfully.
HKCR\CLSID\{d78bba4d-7e99-11e1-ba6d-0016d4fa0553} => Key not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => Value deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} => Key not found.
HKCR\Wow6432Node\CLSID\{56256A51-B582-467e-B8D4-7786EDA79AE0} => Key not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b} => Key not found.
HKCR\Wow6432Node\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} => Key not found.
HKCR\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{472734EA-242A-422B-ADF8-83D1E48CC825} => Value deleted successfully.
HKCR\CLSID\{472734EA-242A-422B-ADF8-83D1E48CC825} => Key not found.
HKCR\PROTOCOLS\Handler\linkscanner => Key deleted successfully.
HKCR\CLSID\{F274614C-63F8-47D5-A4D1-FBDDE494F8D1} => Key not found.
rm => Service deleted successfully.
C:\{CDCBD65D-3E65-AF00-109A-82357758E1BB} => Moved successfully.
C:\Users\Ian\AppData\Roaming\Dirty => Moved successfully.
C:\Users\Ian\AppData\Local\SPIkefRu => Moved successfully.
C:\Users\Ian\AppData\Local\Dirty => Moved successfully.
C:\Users\Ian\AppData\Local\azFqMKpc => Moved successfully.
C:\ProgramData\dsgsdgdsgdsgw.pad => Moved successfully.
C:\Users\Ian\setup_reminder18_en.exe => Moved successfully.
C:\Users\Ian\AppData\Roaming\skype.dat => Moved successfully.
C:\Users\Ian\AppData\Roaming\skype.ini => Moved successfully.

==== End of Fixlog ====

### #9 ianlh

ianlh
• Topic Starter

• Members
• 11 posts
• OFFLINE
•
• Local time:08:15 PM

Posted 26 August 2013 - 04:12 PM

Gary,

The minireg log is too big to send, I think that has been the problem so I am going to have to split it into 3 parts:

(#1)

MiniRegTool by Farbar Version:29-11-2012
Ran by Ian (administrator) on 2013-08-26 at 21:12:14

==========================================
Search Result For: "Dirty"

[HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Voice\TextToSpeech\Engine\{E0725551-286F-11d0-8E73-00A0C9083363}]
"Dirty"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.Document.TotalEditingTime;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.PageCount;System.Document.WordCount;System.Document.CharacterCount;System.Document.LineCount;System.Document.ParagraphCount;System.Document.Template;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.docm]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.Document.TotalEditingTime;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.PageCount;System.Document.WordCount;System.Document.CharacterCount;System.Document.LineCount;System.Document.ParagraphCount;System.Document.Template;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.DisplayName;System.CanonicalType;System.DisplayFolder;System.Size;System.DateCreated;System.DateModified;System.DateAccessed;System.Attributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.File.Owner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.docx]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.Document.TotalEditingTime;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.PageCount;System.Document.WordCount;System.Document.CharacterCount;System.Document.LineCount;System.Document.ParagraphCount;System.Document.Template;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.DisplayName;System.CanonicalType;System.DisplayFolder;System.Size;System.DateCreated;System.DateModified;System.DateAccessed;System.Attributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.File.Owner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dotm]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.Document.TotalEditingTime;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.PageCount;System.Document.WordCount;System.Document.CharacterCount;System.Document.LineCount;System.Document.ParagraphCount;System.Document.Template;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.DisplayName;System.CanonicalType;System.DisplayFolder;System.Size;System.DateCreated;System.DateModified;System.DateAccessed;System.Attributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.File.Owner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dotx]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.Document.TotalEditingTime;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.PageCount;System.Document.WordCount;System.Document.CharacterCount;System.Document.LineCount;System.Document.ParagraphCount;System.Document.Template;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.DisplayName;System.CanonicalType;System.DisplayFolder;System.Size;System.DateCreated;System.DateModified;System.DateAccessed;System.Attributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.File.Owner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.pot]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.Document.TotalEditingTime;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.WordCount;System.Document.LineCount;System.Document.ParagraphCount;System.Document.SlideCount;System.Document.NoteCount;System.Document.HiddenSlideCount;System.Document.MultimediaClipCount;System.Document.PresentationFormat;System.Document.Template;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.potm]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.Document.TotalEditingTime;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.WordCount;System.Document.LineCount;System.Document.ParagraphCount;System.Document.SlideCount;System.Document.NoteCount;System.Document.HiddenSlideCount;System.Document.MultimediaClipCount;System.Document.PresentationFormat;System.Document.Template;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.DisplayName;System.CanonicalType;System.DisplayFolder;System.Size;System.DateCreated;System.DateModified;System.DateAccessed;System.Attributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.File.Owner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.potx]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.Document.TotalEditingTime;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.WordCount;System.Document.LineCount;System.Document.ParagraphCount;System.Document.SlideCount;System.Document.NoteCount;System.Document.HiddenSlideCount;System.Document.MultimediaClipCount;System.Document.PresentationFormat;System.Document.Template;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.DisplayName;System.CanonicalType;System.DisplayFolder;System.Size;System.DateCreated;System.DateModified;System.DateAccessed;System.Attributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.File.Owner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ppam]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.Document.TotalEditingTime;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.WordCount;System.Document.LineCount;System.Document.ParagraphCount;System.Document.SlideCount;System.Document.NoteCount;System.Document.HiddenSlideCount;System.Document.MultimediaClipCount;System.Document.PresentationFormat;System.Document.Template;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.DisplayName;System.CanonicalType;System.DisplayFolder;System.Size;System.DateCreated;System.DateModified;System.DateAccessed;System.Attributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.File.Owner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ppsm]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.Document.TotalEditingTime;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.WordCount;System.Document.LineCount;System.Document.ParagraphCount;System.Document.SlideCount;System.Document.NoteCount;System.Document.HiddenSlideCount;System.Document.MultimediaClipCount;System.Document.PresentationFormat;System.Document.Template;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.DisplayName;System.CanonicalType;System.DisplayFolder;System.Size;System.DateCreated;System.DateModified;System.DateAccessed;System.Attributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.File.Owner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ppsx]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.Document.TotalEditingTime;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.WordCount;System.Document.LineCount;System.Document.ParagraphCount;System.Document.SlideCount;System.Document.NoteCount;System.Document.HiddenSlideCount;System.Document.MultimediaClipCount;System.Document.PresentationFormat;System.Document.Template;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.DisplayName;System.CanonicalType;System.DisplayFolder;System.Size;System.DateCreated;System.DateModified;System.DateAccessed;System.Attributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.File.Owner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ppt]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.Document.TotalEditingTime;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.WordCount;System.Document.LineCount;System.Document.ParagraphCount;System.Document.SlideCount;System.Document.NoteCount;System.Document.HiddenSlideCount;System.Document.MultimediaClipCount;System.Document.PresentationFormat;System.Document.Template;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.pptm]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.Document.TotalEditingTime;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.WordCount;System.Document.LineCount;System.Document.ParagraphCount;System.Document.SlideCount;System.Document.NoteCount;System.Document.HiddenSlideCount;System.Document.MultimediaClipCount;System.Document.PresentationFormat;System.Document.Template;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.DisplayName;System.CanonicalType;System.DisplayFolder;System.Size;System.DateCreated;System.DateModified;System.DateAccessed;System.Attributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.File.Owner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.pptx]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.Document.TotalEditingTime;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.WordCount;System.Document.LineCount;System.Document.ParagraphCount;System.Document.SlideCount;System.Document.NoteCount;System.Document.HiddenSlideCount;System.Document.MultimediaClipCount;System.Document.PresentationFormat;System.Document.Template;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.DisplayName;System.CanonicalType;System.DisplayFolder;System.Size;System.DateCreated;System.DateModified;System.DateAccessed;System.Attributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.File.Owner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.sldm]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.Document.TotalEditingTime;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.WordCount;System.Document.LineCount;System.Document.ParagraphCount;System.Document.SlideCount;System.Document.NoteCount;System.Document.HiddenSlideCount;System.Document.MultimediaClipCount;System.Document.PresentationFormat;System.Document.Template;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.DisplayName;System.CanonicalType;System.DisplayFolder;System.Size;System.DateCreated;System.DateModified;System.DateAccessed;System.Attributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.File.Owner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.sldx]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.Document.TotalEditingTime;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.WordCount;System.Document.LineCount;System.Document.ParagraphCount;System.Document.SlideCount;System.Document.NoteCount;System.Document.HiddenSlideCount;System.Document.MultimediaClipCount;System.Document.PresentationFormat;System.Document.Template;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.DisplayName;System.CanonicalType;System.DisplayFolder;System.Size;System.DateCreated;System.DateModified;System.DateAccessed;System.Attributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.File.Owner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.xlam]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.DisplayName;System.CanonicalType;System.DisplayFolder;System.Size;System.DateCreated;System.DateModified;System.DateAccessed;System.Attributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.File.Owner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.xls]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.xlsb]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.DisplayName;System.CanonicalType;System.DisplayFolder;System.Size;System.DateCreated;System.DateModified;System.DateAccessed;System.Attributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.File.Owner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.xlsm]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.DisplayName;System.CanonicalType;System.DisplayFolder;System.Size;System.DateCreated;System.DateModified;System.DateAccessed;System.Attributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.File.Owner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.xlsx]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.DisplayName;System.CanonicalType;System.DisplayFolder;System.Size;System.DateCreated;System.DateModified;System.DateAccessed;System.Attributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.File.Owner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.xlt]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.xltm]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.DisplayName;System.CanonicalType;System.DisplayFolder;System.Size;System.DateCreated;System.DateModified;System.DateAccessed;System.Attributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.File.Owner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.xltx]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.DisplayName;System.CanonicalType;System.DisplayFolder;System.Size;System.DateCreated;System.DateModified;System.DateAccessed;System.Attributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.File.Owner;System.ComputerName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Backup.8\shell\Print\ddeexec]
""="[REM _DDE_Minimize][FileOpen("%1")][t=IsDocumentDirty()][FilePrint 0][SetDocumentDirty t][DocClose]"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\HTML Handler\shell\PrintWithOptions\ddeexec]
""="[Dim dlg as FilePrint][FileOpen("%1")][t=IsDocumentDirty()][GetCurValues dlg][n = Dialog dlg][if n = -1 then FilePrint dlg][SetDocumentDirty t][DocClose]"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\shell\Print\ddeexec]
""="[REM _DDE_Minimize][FileOpen("%1")][t=IsDocumentDirty()][FilePrint 0][SetDocumentDirty t][DocClose]"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\shell\Print\ddeexec]
""="[REM _DDE_Minimize][FileOpen("%1")][t=IsDocumentDirty()][FilePrint 0][SetDocumentDirty t][DocClose]"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.DocumentMacroEnabled.12\shell\Print\ddeexec]
""="[REM _DDE_Minimize][FileOpen("%1")][t=IsDocumentDirty()][FilePrint 0][SetDocumentDirty t][DocClose]"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.OpenDocumentText.12\shell\print\ddeexec]
""="[REM _DDE_Minimize][FileOpen("%1")][t=IsDocumentDirty()][FilePrint 0][SetDocumentDirty t][DocClose]"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.RTF.8\shell\Print\ddeexec]
""="[REM _DDE_Minimize][FileOpen("%1")][t=IsDocumentDirty()][FilePrint 0][SetDocumentDirty t][DocClose]"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.12\shell\Print\ddeexec]
""="[REM _DDE_Minimize][FileOpen("%1")][t=IsDocumentDirty()][FilePrint 0][SetDocumentDirty t][DocClose]"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8\shell\Print\ddeexec]
""="[REM _DDE_Minimize][FileOpen("%1")][t=IsDocumentDirty()][FilePrint 0][SetDocumentDirty t][DocClose]"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.TemplateMacroEnabled.12\shell\Print\ddeexec]
""="[REM _DDE_Minimize][FileOpen("%1")][t=IsDocumentDirty()][FilePrint 0][SetDocumentDirty t][DocClose]"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGENService\ListenedState]
"RootstoreDirty"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared\MHTML\Default Editor\shell\Print\ddeexec]
""="[REM _DDE_Minimize][FileOpen("%1")][t=IsDocumentDirty()][FilePrint 0][SetDocumentDirty t][DocClose]"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM]
"ConfigValueCoreDatabaseDirty"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability]
"DirtyShutdown"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability]
"DirtyShutdownTime"="0xDD07050006001900120032003B008C02"

### #10 ianlh

ianlh
• Topic Starter

• Members
• 11 posts
• OFFLINE
•
• Local time:08:15 PM

Posted 26 August 2013 - 04:17 PM

minireg #2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009]
"Counter"="1
1847
2
System
4
Memory
6
% Processor Time
10
File Read Operations/sec
12
File Write Operations/sec
14
File Control Operations/sec
16
File Read Bytes/sec
18
File Write Bytes/sec
20
File Control Bytes/sec
24
Available Bytes
26
Committed Bytes
28
Page Faults/sec
30
Commit Limit
32
Write Copies/sec
34
Transition Faults/sec
36
Cache Faults/sec
38
Demand Zero Faults/sec
40
Pages/sec
42
Page Reads/sec
44
Processor Queue Length
46
Thread State
48
Pages Output/sec
50
Page Writes/sec
52
Browser
54
Announcements Server/sec
56
Pool Paged Bytes
58
Pool Nonpaged Bytes
60
Pool Paged Allocs
64
Pool Nonpaged Allocs
66
Pool Paged Resident Bytes
68
System Code Total Bytes
70
System Code Resident Bytes
72
System Driver Total Bytes
74
System Driver Resident Bytes
76
System Cache Resident Bytes
78
Announcements Domain/sec
80
Election Packets/sec
82
Mailslot Writes/sec
84
Server List Requests/sec
86
Cache
88
Data Maps/sec
90
Sync Data Maps/sec
92
Async Data Maps/sec
94
Data Map Hits %
96
Data Map Pins/sec
98
Pin Reads/sec
100
Sync Pin Reads/sec
102
Async Pin Reads/sec
104
Pin Read Hits %
106
Copy Reads/sec
108
Sync Copy Reads/sec
110
Async Copy Reads/sec
112
Copy Read Hits %
114
MDL Reads/sec
116
Sync MDL Reads/sec
118
Async MDL Reads/sec
120
MDL Read Hits %
122
Read Aheads/sec
124
Fast Reads/sec
126
Sync Fast Reads/sec
128
Async Fast Reads/sec
130
Fast Read Resource Misses/sec
132
Fast Read Not Possibles/sec
134
Lazy Write Flushes/sec
136
Lazy Write Pages/sec
138
Data Flushes/sec
140
Data Flush Pages/sec
142
% User Time
144
% Privileged Time
146
Context Switches/sec
148
Interrupts/sec
150
System Calls/sec
152
Level 1 TLB Fills/sec
154
Level 2 TLB Fills/sec
156
Enumerations Server/sec
158
Enumerations Domain/sec
160
Enumerations Other/sec
162
Missed Server Announcements
164
Missed Mailslot Datagrams
166
Missed Server List Requests
168
Server Announce Allocations Failed/sec
170
Mailslot Allocations Failed
172
Virtual Bytes Peak
174
Virtual Bytes
178
Working Set Peak
180
Working Set
182
Page File Bytes Peak
184
Page File Bytes
186
Private Bytes
188
Announcements Total/sec
190
Enumerations Total/sec
198
Current Disk Queue Length
200
% Disk Time
202
% Disk Read Time
204
% Disk Write Time
206
Avg. Disk sec/Transfer
208
Avg. Disk sec/Read
210
Avg. Disk sec/Write
212
Disk Transfers/sec
214
Disk Reads/sec
216
Disk Writes/sec
218
Disk Bytes/sec
220
Disk Read Bytes/sec
222
Disk Write Bytes/sec
224
Avg. Disk Bytes/Transfer
226
Avg. Disk Bytes/Read
228
Avg. Disk Bytes/Write
230
Process
232
Thread
234
PhysicalDisk
236
LogicalDisk
238
Processor
240
% Total Processor Time
242
% Total User Time
244
% Total Privileged Time
246
Total Interrupts/sec
248
Processes
250
Threads
252
Events
254
Semaphores
256
Mutexes
258
Sections
260
Objects
262
Redirector
264
Bytes Received/sec
266
Packets Received/sec
268
Read Bytes Paging/sec
270
Read Bytes Non-Paging/sec
272
Read Bytes Cache/sec
274
Read Bytes Network/sec
276
Bytes Transmitted/sec
278
Packets Transmitted/sec
280
Write Bytes Paging/sec
282
Write Bytes Non-Paging/sec
284
Write Bytes Cache/sec
286
Write Bytes Network/sec
288
Read Operations/sec
290
Read Operations Random/sec
292
Read Packets/sec
294
Reads Large/sec
296
Read Packets Small/sec
298
Write Operations/sec
300
Write Operations Random/sec
302
Write Packets/sec
304
Writes Large/sec
306
Write Packets Small/sec
308
Reads Denied/sec
310
Writes Denied/sec
312
Network Errors/sec
314
Server Sessions
316
Server Reconnects
318
Connects Core
320
Connects Lan Manager 2.0
322
Connects Lan Manager 2.1
324
Connects Windows NT
326
Server Disconnects
328
Server Sessions Hung
330
Server
336
Thread Wait Reason
340
Sessions Timed Out
342
Sessions Errored Out
344
Sessions Logged Off
346
Sessions Forced Off
348
Errors Logon
350
Errors Access Permissions
352
Errors Granted Access
354
Errors System
356
Blocking Requests Rejected
358
Work Item Shortages
360
Files Opened Total
362
Files Open
366
File Directory Searches
370
Pool Nonpaged Failures
372
Pool Nonpaged Peak
376
Pool Paged Failures
378
Pool Paged Peak
388
Bytes Total/sec
392
Current Commands
398
NWLink NetBIOS
400
Packets/sec
404
Context Blocks Queued/sec
406
File Data Operations/sec
408
% Free Space
410
Free Megabytes
412
Connections Open
414
Connections No Retries
416
Connections With Retries
418
Disconnects Local
420
Disconnects Remote
422
Failures Link
424
Failures Adapter
426
Connection Session Timeouts
428
Connections Canceled
430
Failures Resource Remote
432
Failures Resource Local
434
Failures Not Found
436
Failures No Listen
438
Datagrams/sec
440
Datagram Bytes/sec
442
Datagrams Sent/sec
444
Datagram Bytes Sent/sec
446
Datagrams Received/sec
448
Datagram Bytes Received/sec
452
Packets Sent/sec
456
Frames/sec
458
Frame Bytes/sec
460
Frames Sent/sec
462
Frame Bytes Sent/sec
464
Frames Received/sec
466
Frame Bytes Received/sec
468
Frames Re-Sent/sec
470
Frame Bytes Re-Sent/sec
472
Frames Rejected/sec
474
Frame Bytes Rejected/sec
476
Expirations Response
478
Expirations Ack
480
Window Send Maximum
482
Window Send Average
484
Piggyback Ack Queued/sec
486
Piggyback Ack Timeouts
488
NWLink IPX
490
NWLink SPX
492
NetBEUI
494
NetBEUI Resource
496
Used Maximum
498
Used Average
500
Times Exhausted
502
NBT Connection
506
Bytes Sent/sec
508
Total Bytes/sec
510
Network Interface
512
Bytes/sec
520
Current Bandwidth
524
Packets Received Unicast/sec
526
Packets Received Non-Unicast/sec
528
Packets Received Discarded
530
Packets Received Errors
532
Packets Received Unknown
536
Packets Sent Unicast/sec
538
Packets Sent Non-Unicast/sec
540
Packets Outbound Discarded
542
Packets Outbound Errors
544
Output Queue Length
546
IPv4
548
IPv6
552
Datagrams Received Header Errors
554
Datagrams Received Address Errors
556
Datagrams Forwarded/sec
558
Datagrams Received Unknown Protocol
560
Datagrams Received Discarded
562
Datagrams Received Delivered/sec
566
Datagrams Outbound Discarded
568
Datagrams Outbound No Route
570
Fragments Received/sec
572
Fragments Re-assembled/sec
574
Fragment Re-assembly Failures
576
Fragmented Datagrams/sec
578
Fragmentation Failures
580
Fragments Created/sec
582
ICMP
584
Messages/sec
586
Messages Received/sec
588
Messages Received Errors
590
Received Dest. Unreachable
592
Received Time Exceeded
594
Received Parameter Problem
596
Received Source Quench
598
Received Redirect/sec
600
Received Echo/sec
602
Received Echo Reply/sec
604
Received Timestamp/sec
606
Received Timestamp Reply/sec
608
Received Address Mask
610
Received Address Mask Reply
612
Messages Sent/sec
614
Messages Outbound Errors
616
Sent Destination Unreachable
618
Sent Time Exceeded
620
Sent Parameter Problem
622
Sent Source Quench
624
Sent Redirect/sec
626
Sent Echo/sec
628
Sent Echo Reply/sec
630
Sent Timestamp/sec
632
Sent Timestamp Reply/sec
634
Sent Address Mask
636
Sent Address Mask Reply
638
TCPv4
640
Segments/sec
642
Connections Established
644
Connections Active
646
Connections Passive
648
Connection Failures
650
Connections Reset
652
Segments Received/sec
654
Segments Sent/sec
656
Segments Retransmitted/sec
658
UDPv4
660
% Total DPC Time
662
% Total Interrupt Time
664
Datagrams No Port/sec
666
Datagrams Received Errors
670
Disk Storage Unit
672
Allocation Failures
674
System Up Time
676
System Handle Count
678
Free System Page Table Entries
680
Thread Count
682
Priority Base
684
Elapsed Time
686
Alignment Fixups/sec
688
Exception Dispatches/sec
690
Floating Emulations/sec
692
Logon/sec
694
Priority Current
696
% DPC Time
698
% Interrupt Time
700
Paging File
702
% Usage
704
% Usage Peak
706
Start Address
708
User PC
710
Mapped Space No Access
712
Mapped Space Read Only
714
Mapped Space Read/Write
716
Mapped Space Write Copy
718
Mapped Space Executable
720
Mapped Space Exec Read Only
722
Mapped Space Exec Read/Write
724
Mapped Space Exec Write Copy
726
Reserved Space No Access
728
Reserved Space Read Only
730
Reserved Space Read/Write
732
Reserved Space Write Copy
734
Reserved Space Executable
736
Reserved Space Exec Read Only
738
Reserved Space Exec Read/Write
740
Image
742
Reserved Space Exec Write Copy
744
Unassigned Space No Access
746
Unassigned Space Read Only
748
Unassigned Space Read/Write
750
Unassigned Space Write Copy
752
Unassigned Space Executable
754
Unassigned Space Exec Read Only
756
Unassigned Space Exec Read/Write
758
Unassigned Space Exec Write Copy
760
Image Space No Access
762
Image Space Read Only
764
Image Space Read/Write
766
Image Space Write Copy
768
Image Space Executable
770
Image Space Exec Read Only
772
Image Space Exec Read/Write
774
Image Space Exec Write Copy
776
Bytes Image Reserved
778
Bytes Image Free
780
Bytes Reserved
782
Bytes Free
784
ID Process
786
Process Address Space
788
No Access
790
Read Only
792
Read/Write
794
Write Copy
796
Executable
798
Exec Read Only
800
Exec Read/Write
802
Exec Write Copy
804
ID Thread
806
Mailslot Receives Failed
808
Mailslot Writes Failed
810
Mailslot Opens Failed/sec
812
Duplicate Master Announcements
814
Illegal Datagrams/sec
816
Thread Details
818
Cache Bytes
820
Cache Bytes Peak
822
Pages Input/sec
824
Transition Pages RePurposed/sec
872
Bytes Transmitted
874
Bytes Received
876
Frames Transmitted
878
Frames Received.
880
Percent Compression Out
882
Percent Compression In
884
CRC Errors
886
Timeout Errors
888
Serial Overrun Errors
890
Alignment Errors
892
Buffer Overrun Errors
894
Total Errors
896
Bytes Transmitted/Sec
898
Bytes Received/Sec
900
Frames Transmitted/Sec
902
Frames Received/Sec
904
Total Errors/Sec
908
Total Connections
920
WINS Server
922
Unique Registrations/sec
924
Group Registrations/sec
926
Total Number of Registrations/sec
928
Unique Renewals/sec
930
Group Renewals/sec
932
Total Number of Renewals/sec
934
Releases/sec
936
Queries/sec
938
Unique Conflicts/sec
940
Group Conflicts/sec
942
Total Number of Conflicts/sec
944
Successful Releases/sec
946
Failed Releases/sec
948
Successful Queries/sec
950
Failed Queries/sec
952
Handle Count
1000
MacFile Server
1002
Max Paged Memory
1004
Current Paged Memory
1006
Max NonPaged Memory
1008
Current NonPaged memory
1010
Current Sessions
1012
Maximum Sessions
1014
Current Files Open
1016
Maximum Files Open
1018
Failed Logons
1020
Data Read/sec
1022
Data Written/sec
1024
Data Received/sec
1026
Data Transmitted/sec
1028
Current Queue Length
1030
Maximum Queue Length
1032
Current Threads
1034
Maximum Threads
1050
AppleTalk
1052
Packets In/sec
1054
Packets Out/sec
1056
Bytes In/sec
1058
Bytes Out/sec
1060
Average Time/DDP Packet
1062
DDP Packets/sec
1064
Average Time/AARP Packet
1066
AARP Packets/sec
1068
Average Time/ATP Packet
1070
ATP Packets/sec
1072
Average Time/NBP Packet
1074
NBP Packets/sec
1076
Average Time/ZIP Packet
1078
ZIP Packets/sec
1080
Average Time/RTMP Packet
1082
RTMP Packets/sec
1084
ATP Retries Local
1086
ATP Response Timouts
1088
ATP XO Response/Sec
1090
ATP ALO Response/Sec
1092
ATP Recvd Release/Sec
1094
Current NonPaged Pool
1096
Packets Routed In/Sec
1098
Packets dropped
1100
ATP Retries Remote
1102
Packets Routed Out/Sec
1110
Network Segment
1112
Total frames received/second
1114
Total bytes received/second
1116
Broadcast frames received/second
1118
Multicast frames received/second
1120
% Network utilization
1124
% Broadcast Frames
1126
% Multicast Frames
1150
Telephony
1152
Lines
1154
Telephone Devices
1156
Active Lines
1158
Active Telephones
1160
Outgoing Calls/sec
1162
Incoming Calls/sec
1164
Client Apps
1166
Current Outgoing Calls
1168
Current Incoming Calls
1232
Packet Burst Read NCP Count/sec
1234
Packet Burst Read Timeouts/sec
1236
Packet Burst Write NCP Count/sec
1238
Packet Burst Write Timeouts/sec
1240
Packet Burst IO/sec
1260
Logon Total
1300
Server Work Queues
1302
Queue Length
1304
Active Threads
1306
Available Threads
1308
Available Work Items
1310
Borrowed Work Items
1312
Work Item Shortages
1314
Current Clients
1320
Bytes Transferred/sec
1324
Read Bytes/sec
1328
Write Bytes/sec
1332
Total Operations/sec
1334
DPCs Queued/sec
1336
DPC Rate
1342
Total DPCs Queued/sec
1344
Total DPC Rate
1350
% Registry Quota In Use
1360
VL Memory
1362
VLM % Virtual Size In Use
1364
VLM Virtual Size
1366
VLM Virtual Size Peak
1368
VLM Virtual Size Available
1370
VLM Commit Charge
1372
VLM Commit Charge Peak
1374
System VLM Commit Charge
1376
System VLM Commit Charge Peak
1378
System VLM Shared Commit Charge
1380
Available KBytes
1382
Available MBytes
1400
Avg. Disk Queue Length
1402
Avg. Disk Read Queue Length
1404
Avg. Disk Write Queue Length
1406
% Committed Bytes In Use
1408
Full Image
1410
Creating Process ID
1412
IO Read Operations/sec
1414
IO Write Operations/sec
1416
IO Data Operations/sec
1418
IO Other Operations/sec
1420
IO Read Bytes/sec
1422
IO Write Bytes/sec
1424
IO Data Bytes/sec
1426
IO Other Bytes/sec
1450
Print Queue
1452
Total Jobs Printed
1454
Bytes Printed/sec
1456
Total Pages Printed
1458
Jobs
1460
References
1462
Max References
1464
Jobs Spooling
1466
Max Jobs Spooling
1468
Out of Paper Errors
1470
Not Ready Errors
1472
Job Errors
1474
Enumerate Network Printer Calls
1476
Add Network Printer Calls
1478
Working Set - Private
1480
Working Set - Shared
1482
% Idle Time
1484
Split IO/Sec
1500
Job Object
1502
Current % Processor Time
1504
Current % User Mode Time
1506
Current % Kernel Mode Time
1508
This Period mSec - Processor
1510
This Period mSec - User Mode
1512
This Period mSec - Kernel Mode
1514
Pages/Sec
1516
Process Count - Total
1518
Process Count - Active
1520
Process Count - Terminated
1522
Total mSec - Processor
1524
Total mSec - User Mode
1526
Total mSec - Kernel Mode
1530
TCPv6
1532
UDPv6
1534
ICMPv6
1536
Received Packet Too Big
1538
Received Membership Query
1540
Received Membership Report
1542
Received Membership Reduction
1544
Received Router Solicit
1546
Received Router Advert
1548
Job Object Details
1550
Received Neighbor Solicit
1552
Received Neighbor Advert
1554
Sent Packet Too Big
1556
Sent Membership Query
1558
Sent Membership Report
1560
Sent Membership Reduction
1562
Sent Router Solicit
1564
Sent Router Advert
1566
Sent Neighbor Solicit
1568
Sent Neighbor Advert
1570
Security System-Wide Statistics
1572
NTLM Authentications
1574
Kerberos Authentications
1576
KDC AS Requests
1578
KDC TGS Requests
1580
Schannel Session Cache Entries
1582
Active Schannel Session Cache Entries
1584
SSL Client-Side Full Handshakes
1586
SSL Client-Side Reconnect Handshakes
1588
SSL Server-Side Full Handshakes
1590
SSL Server-Side Reconnect Handshakes
1592
Digest Authentications
1670
Security Per-Process Statistics
1672
Credential Handles
1674
Context Handles
1676
Free & Zero Page List Bytes
1678
Modified Page List Bytes
1680
Standby Cache Reserve Bytes
1682
Standby Cache Normal Priority Bytes
1684
Standby Cache Core Bytes
1746
% Idle Time
1748
% C1 Time
1750
% C2 Time
1752
% C3 Time
1754
C1 Transitions/sec
1756
C2 Transitions/sec
1758
C3 Transitions/sec
1760
Heap
1762
Committed Bytes
1764
Reserved Bytes
1766
Virtual Bytes
1768
Free Bytes
1770
Free List Length
1772
Avg. alloc rate
1774
Avg. free rate
1776
Uncommitted Ranges Length
1778
Allocs - Frees
1780
Cached Allocs/sec
1782
Cached Frees/sec
1784
Allocs <1K/sec
1786
Frees <1K/sec
1788
Allocs 1-8K/sec
1790
Frees 1-8K/sec
1792
Allocs over 8K/sec
1794
Frees over 8K/sec
1796
Total Allocs/sec
1798
Total Frees/sec
1800
Blocks in Heap Cache
1802
Largest Cache Depth
1804
% Fragmentation
1806
% VAFragmentation
1808
Heap Lock contention
1846
End Marker
1848
Telephony
1850
Number of Lines
1852
Number of Telephone devices
1854
Number of Active Lines
1856
Number of Active Telephones
1858
Outgoing calls/sec
1860
Incoming calls/sec
1862
Number of Client Apps
1864
Current Outgoing Calls
1866
Current Incoming Calls
1868
RAS Port
1870
Bytes Transmitted
1872
Bytes Received
1874
Frames Transmitted
1876
Frames Received
1878
Percent Compression Out
1880
Percent Compression In
1882
CRC Errors
1884
Timeout Errors
1886
Serial Overrun Errors
1888
Alignment Errors
1890
Buffer Overrun Errors
1892
Total Errors
1894
Bytes Transmitted/Sec
1896
Bytes Received/Sec
1898
Frames Transmitted/Sec
1900
Frames Received/Sec
1902
Total Errors/Sec
1904
RAS Total
1906
Total Connections
1908
BITS Net Utilization
1910
Remote Server Speed (Bits/Sec)
1912
Netcard Speed (Bits/Sec)
1914
Percent Netcard Free
1916
IGD Speed (Bits/Sec)
1918
Percent IGD Free
1920
BITS Download BlockSize (Bytes)
1922
BITS Download Response Interval (msec)
1924
Estimated bandwidth available to the remote system (Bits/sec)
2246
Database
2248
Pages Converted/sec
2250
Pages Converted
2252
Records Converted/sec
2254
Records Converted
2256
Heap Allocs/sec
2258
Heap Frees/sec
2260
Heap Allocations
2262
Heap Bytes Allocated
2264
Page Bytes Reserved
2266
Page Bytes Committed
2268
FCB Asynchronous Scan/sec
2270
FCB Asynchronous Purge/sec
2272
FCB Asynchronous Threshold-Scan/sec
2274
FCB Asynchronous Threshold-Purge/sec
2276
FCB Asynchronous Purge Conflicts/sec
2278
FCB Synchronous Purge/sec
2280
FCB Synchronous Purge Stalls/sec
2282
FCB Allocations Wait For Version Cleanup/sec
2284
FCB Purge On Cursor Close/sec
2286
FCB Cache % Hit
2288
No name
2290
FCB Cache Stalls/sec
2292
FCB Cache Maximum
2294
FCB Cache Preferred
2296
FCB Cache Allocated
2298
FCB Cache Available
2300
Sessions In Use
2302
Sessions % Used
2304
No name
2306
Table Open Cache % Hit
2308
No name
2310
Table Open Cache Hits/sec
2312
Table Open Cache Misses/sec
2314
Table Opens/sec
2316
Log Bytes Write/sec
2318
Log Buffer Bytes Used
2320
Log Buffer Bytes Free
2322
Log Threads Waiting
2324
Log Checkpoint Depth
2326
Log Generation Checkpoint Depth
2328
User Read Only Transaction Commits to Level 0/sec
2330
User Read/Write Transaction Commits to Level 0/sec
2332
User Transaction Commits to Level 0/sec
2334
User Read Only Transaction Rollbacks to Level 0/sec
2336
User Read/Write Transaction Rollbacks to Level 0/sec
2338
User Transaction Rollbacks to Level 0/sec
2340
System Read Only Transaction Commits to Level 0/sec
2342
System Read/Write Transaction Commits to Level 0/sec
2344
System Transaction Commits to Level 0/sec
2346
System Read Only Transaction Rollbacks to Level 0/sec
2348
System Read/Write Transaction Rollbacks to Level 0/sec
2350
System Transaction Rollbacks to Level 0/sec
2352
Database Page Allocation File Extension Async Consumed/sec
2354
Database Page Allocation File Extension Stalls/sec
2356
Log Records/sec
2358
Log Buffer Capacity Flushes/sec
2360
Log Buffer Commit Flushes/sec
2362
Log Buffer Flushes/sec
2364
Log Writes/sec
2366
Log Record Stalls/sec
2368
Version buckets allocated
2370
Version buckets allocated for deletes
2372
VER Bucket Allocations Wait For Version Cleanup/sec
2374
Version store average RCE bookmark length
2376
Version store unnecessary calls/sec
2378
Version store cleanup tasks asynchronously dispatched/sec
2380
Version store cleanup tasks synchronously dispatched/sec
2382
Version store cleanup tasks discarded/sec
2384
Version store cleanup tasks failures/sec
2386
Record Inserts/sec
2388
Record Deletes/sec
2390
Record Replaces/sec
2392
Record Unnecessary Replaces/sec
2394
Record Redundant Replaces/sec
2396
Record Escrow-Updates/sec
2398
Secondary Index Inserts/sec
2400
Secondary Index Deletes/sec
2402
False Index Column Updates/sec
2404
False Tuple Index Column Updates/sec
2406
Record Intrinsic Long-Values Updated/sec
2408
Record Separated Long-Values Added/sec
2410
Record Separated Long-Values Forced/sec
2412
Record Separated Long-Values All Forced/sec
2414
Record Separated Long-Values Reference All/sec
2416
Record Separated Long-Values Dereference All/sec
2418
Separated Long-Value Seeks/sec
2420
Separated Long-Value Retrieves/sec
2422
Separated Long-Value Creates/sec
2424
Separated Long-Value Updates/sec
2426
Separated Long-Value Deletes/sec
2428
Separated Long-Value Copies/sec
2430
Separated Long-Value Chunk Seeks/sec
2432
Separated Long-Value Chunk Retrieves/sec
2434
Separated Long-Value Chunk Appends/sec
2436
Separated Long-Value Chunk Replaces/sec
2438
Separated Long-Value Chunk Deletes/sec
2440
Separated Long-Value Chunk Copies/sec
2442
B+ Tree Append Splits/sec
2444
B+ Tree Right Splits/sec
2446
B+ Tree Right Hotpoint Splits/sec
2448
B+ Tree Vertical Splits/sec
2450
B+ Tree Splits/sec
2452
B+ Tree Empty Page Merges/sec
2454
B+ Tree Right Merges/sec
2456
B+ Tree Partial Merges/sec
2458
B+ Tree Merges/sec
2460
B+ Tree Failed Simple Page Cleanup Attempts/sec
2462
B+ Tree Seek Short Circuits/sec
2464
B+ Tree Unnecessary Sibling Latches/sec
2466
B+ Tree Move Nexts/sec
2468
B+ Tree Move Nexts (Non-Visible Nodes Skipped)/sec
2470
B+ Tree Move Prevs/sec
2472
B+ Tree Move Prevs (Non-Visible Nodes Skipped)/sec
2474
B+ Tree Seeks/sec
2476
B+ Tree Inserts/sec
2478
B+ Tree Replaces/sec
2480
B+ Tree Flag Deletes/sec
2482
B+ Tree Deletes/sec
2484
B+ Tree Appends/sec
2486
B+ Tree Creates/sec
2488
B+ Tree Creates (Total)
2490
B+ Tree Destroys/sec
2492
B+ Tree Destroys (Total)
2494
Database Cache % Hit
2496
No name
2498
Database Cache % Clean
2500
No name
2502
Database Pages Read Async/sec
2504
Database Pages Read Sync/sec
2506
Database Pages Written/sec
2508
Database Pages Transferred/sec
2510
Database Page Latches/sec
2512
Database Page Fast Latches/sec
2514
Database Page Bad Latch Hints/sec
2516
Database Cache % Fast Latch
2518
No name
2520
Database Page Latch Conflicts/sec
2522
Database Page Latch Stalls/sec
2524
Database Cache % Available
2526
No name
2528
Database Page Faults/sec
2530
Database Page Evictions/sec
2532
Database Page Fault Stalls/sec
2534
Database Cache Size (MB)
2536
Database Cache Size
2538
Database Cache Size Min
2540
Database Cache Size Max
2542
Database Cache % Available Min
2544
No name
2546
Database Cache % Available Max
2548
No name
2550
Database Pages Preread/sec
2552
Database Cached Pages Preread/sec
2554
Database Pages Preread Untouched/sec
2556
Database Pages Versioned / sec
2558
Database Cache % Versioned
2560
No name
2562
Database Pages Ordinarily Written/sec
2564
Database Pages Anomalously Written/sec
2566
Database Pages Opportunely Written/sec
2568
Database Pages Repeatedly Written/sec
2570
Database Pages Idly Written/sec
2572
Database Pages Coalesced Written/sec
2574
Database Pages Coalesced Read/sec
2576
Database Page History Records
2578
Database Page History % Hit
2580
No name
2582
Database Page Scans/sec
2584
Database Page Scans Out-of-order/sec
2586
No name
2588
Streaming Backup Pages Read/sec
2590
Online Defrag Pages Referenced/sec
2592
Online Defrag Pages Read/sec
2594
Online Defrag Pages Preread/sec
2596
Online Defrag Pages Dirtied/sec
2598
Online Defrag Pages Re-Dirtied/sec
2600
Online Defrag Log Records/sec
2602
Online Defrag Average Log Bytes
2604
No name
2606
Database Tasks Pages Referenced/sec
2608
Database Tasks Pages Read/sec
2610
Database Tasks Pages Preread/sec
2612
Database Tasks Pages Dirtied/sec
2614
Database Tasks Pages Re-Dirtied/sec
2616
Database Tasks Log Records/sec
2618
Database Tasks Average Log Bytes
2620
No name
2622
I/O Database Reads/sec
2624
I/O Database Reads Average Latency
2626
No name
2628
I/O Database Reads Average Bytes
2630
No name
2632
I/O Database Reads In Heap
2634
I/O Database Reads Async Pending
2636
I/O Database Reads Abnormal Latency/sec
2638
I/O Log Reads/sec
2640
I/O Log Reads Average Latency
2642
No name
2644
I/O Log Reads Average Bytes
2646
No name
2648
I/O Log Reads In Heap
2650
I/O Log Reads Async Pending
2652
I/O Log Reads Abnormal Latency/sec
2654
I/O Database Writes/sec
2656
I/O Database Writes Average Latency
2658
No name
2660
I/O Database Writes Average Bytes
2662
No name
2664
I/O Database Writes In Heap
2666
I/O Database Writes Async Pending
2668
I/O Database Writes Abnormal Latency/sec
2670
I/O Log Writes/sec
2672
I/O Log Writes Average Latency
2674
No name
2676
I/O Log Writes Average Bytes
2678
No name
2680
I/O Log Writes In Heap
2682
I/O Log Writes Async Pending
2684
I/O Log Writes Abnormal Latency/sec
2686
SLV File Table Inserts/sec
2688
SLV File Table Cleans/sec
2690
SLV File Table Deletes/sec
2692
SLV File Table Entries
2694
Threads Blocked/sec
2696
Threads Blocked
2698
Database ==> TableClasses
2700
Record Inserts/sec
2702
Record Deletes/sec
2704
Record Replaces/sec
2706
Record Unnecessary Replaces/sec
2708
Record Redundant Replaces/sec
2710
Record Escrow-Updates/sec
2712
Secondary Index Inserts/sec
2714
Secondary Index Deletes/sec
2716
False Index Column Updates/sec
2718
False Tuple Index Column Updates/sec
2720
Record Intrinsic Long-Values Updated/sec
2722
Record Separated Long-Values Added/sec
2724
Record Separated Long-Values Forced/sec
2726
Record Separated Long-Values All Forced/sec
2728
Record Separated Long-Values Reference All/sec
2730
Record Separated Long-Values Dereference All/sec
2732
Separated Long-Value Seeks/sec
2734
Separated Long-Value Retrieves/sec
2736
Separated Long-Value Creates/sec
2738
Separated Long-Value Updates/sec
2740
Separated Long-Value Deletes/sec
2742
Separated Long-Value Copies/sec
2744
Separated Long-Value Chunk Seeks/sec
2746
Separated Long-Value Chunk Retrieves/sec
2748
Separated Long-Value Chunk Appends/sec
2750
Separated Long-Value Chunk Replaces/sec
2752
Separated Long-Value Chunk Deletes/sec
2754
Separated Long-Value Chunk Copies/sec
2756
B+ Tree Append Splits/sec
2758
B+ Tree Right Splits/sec
2760
B+ Tree Right Hotpoint Splits/sec
2762
B+ Tree Vertical Splits/sec
2764
B+ Tree Splits/sec
2766
B+ Tree Empty Page Merges/sec
2768
B+ Tree Right Merges/sec
2770
B+ Tree Partial Merges/sec
2772
B+ Tree Merges/sec
2774
B+ Tree Failed Simple Page Cleanup Attempts/sec
2776
B+ Tree Seek Short Circuits/sec
2778
B+ Tree Unnecessary Sibling Latches/sec
2780
B+ Tree Move Nexts/sec
2782
B+ Tree Move Nexts (Non-Visible Nodes Skipped)/sec
2784
B+ Tree Move Prevs/sec
2786
B+ Tree Move Prevs (Non-Visible Nodes Skipped)/sec
2788
B+ Tree Seeks/sec
2790
B+ Tree Inserts/sec
2792
B+ Tree Replaces/sec
2794
B+ Tree Flag Deletes/sec
2796
B+ Tree Deletes/sec
2798
B+ Tree Appends/sec
2800
B+ Tree Creates/sec
2802
B+ Tree Creates (Total)
2804
B+ Tree Destroys/sec
2806
B+ Tree Destroys (Total)
2808
Database Cache Size (MB)
2810
Database Pages Read Async/sec
2812
Database Pages Read Sync/sec
2814
Database Pages Written/sec
2816
Database Pages Transferred/sec
2818
Database Pages Preread/sec
2820
Database Cached Pages Preread/sec
2822
Database Pages Preread Untouched/sec
2824
Database Pages Versioned / sec
2826
Database Pages Ordinarily Written/sec
2828
Database Pages Anomalously Written/sec
2830
Database Pages Opportunely Written/sec
2832
Database Pages Repeatedly Written/sec
2834
Database Pages Idly Written/sec
2836
Database Pages Coalesced Written/sec
2838
Database Pages Coalesced Read/sec
2840
Database ==> Instances
2842
Pages Converted/sec
2844
Pages Converted
2846
Records Converted/sec
2848
Records Converted
2850
FCB Asynchronous Scan/sec
2852
FCB Asynchronous Purge/sec
2854
FCB Asynchronous Threshold-Scan/sec
2856
FCB Asynchronous Threshold-Purge/sec
2858
FCB Asynchronous Purge Conflicts/sec
2860
FCB Synchronous Purge/sec
2862
FCB Synchronous Purge Stalls/sec
2864
FCB Allocations Wait For Version Cleanup/sec
2866
FCB Purge On Cursor Close/sec
2868
FCB Cache % Hit
2870
No name
2872
FCB Cache Stalls/sec
2874
FCB Cache Maximum
2876
FCB Cache Preferred
2878
FCB Cache Allocated
2880
FCB Cache Available
2882
Sessions In Use
2884
Sessions % Used
2886
No name
2888
Table Open Cache % Hit
2890
No name
2892
Table Open Cache Hits/sec
2894
Table Open Cache Misses/sec
2896
Table Opens/sec
2898
Log Bytes Write/sec
2900
Log Buffer Size
2902
Log Buffer Bytes Used
2904
Log Buffer Bytes Free
2906
Log Threads Waiting
2908
Log File Size
2910
Log Checkpoint Depth
2912
Log Generation Checkpoint Depth
2914
User Read Only Transaction Commits to Level 0/sec
2916
User Read/Write Transaction Commits to Level 0/sec
2918
User Transaction Commits to Level 0/sec
2920
User Read Only Transaction Rollbacks to Level 0/sec
2922
User Read/Write Transaction Rollbacks to Level 0/sec
2924
User Transaction Rollbacks to Level 0/sec
2926
System Read Only Transaction Commits to Level 0/sec
2928
System Read/Write Transaction Commits to Level 0/sec
2930
System Transaction Commits to Level 0/sec
2932
System Read Only Transaction Rollbacks to Level 0/sec
2934
System Read/Write Transaction Rollbacks to Level 0/sec
2936
System Transaction Rollbacks to Level 0/sec
2938
Database Page Allocation File Extension Async Consumed/sec
2940
Database Page Allocation File Extension Stalls/sec
2942
Log Records/sec
2944
Log Buffer Capacity Flushes/sec
2946
Log Buffer Commit Flushes/sec
2948
Log Buffer Flushes/sec
2950
Log Writes/sec
2952
Log Record Stalls/sec
2954
Version buckets allocated
2956
Version buckets allocated for deletes
2958
VER Bucket Allocations Wait For Version Cleanup/sec
2960
Version store average RCE bookmark length
2962
Version store unnecessary calls/sec
2964
Version store cleanup tasks asynchronously dispatched/sec
2966
Version store cleanup tasks synchronously dispatched/sec
2968
Version store cleanup tasks discarded/sec
2970
Version store cleanup tasks failures/sec
2972
Record Inserts/sec
2974
Record Deletes/sec
2976
Record Replaces/sec
2978
Record Unnecessary Replaces/sec
2980
Record Redundant Replaces/sec
2982
Record Escrow-Updates/sec
2984
Secondary Index Inserts/sec
2986
Secondary Index Deletes/sec
2988
False Index Column Updates/sec
2990
False Tuple Index Column Updates/sec
2992
Record Intrinsic Long-Values Updated/sec
2994
Record Separated Long-Values Added/sec
2996
Record Separated Long-Values Forced/sec
2998
Record Separated Long-Values All Forced/sec
3000
Record Separated Long-Values Reference All/sec
3002
Record Separated Long-Values Dereference All/sec
3004
Separated Long-Value Seeks/sec
3006
Separated Long-Value Retrieves/sec
3008
Separated Long-Value Creates/sec
3010
Separated Long-Value Updates/sec
3012
Separated Long-Value Deletes/sec
3014
Separated Long-Value Copies/sec
3016
Separated Long-Value Chunk Seeks/sec
3018
Separated Long-Value Chunk Retrieves/sec
3020
Separated Long-Value Chunk Appends/sec
3022
Separated Long-Value Chunk Replaces/sec
3024
Separated Long-Value Chunk Deletes/sec
3026
Separated Long-Value Chunk Copies/sec
3028
B+ Tree Append Splits/sec
3030
B+ Tree Right Splits/sec
3032
B+ Tree Right Hotpoint Splits/sec
3034
B+ Tree Vertical Splits/sec
3036
B+ Tree Splits/sec
3038
B+ Tree Empty Page Merges/sec
3040
B+ Tree Right Merges/sec
3042
B+ Tree Partial Merges/sec
3044
B+ Tree Merges/sec
3046
B+ Tree Failed Simple Page Cleanup Attempts/sec
3048
B+ Tree Seek Short Circuits/sec
3050
B+ Tree Unnecessary Sibling Latches/sec
3052
B+ Tree Move Nexts/sec
3054
B+ Tree Move Nexts (Non-Visible Nodes Skipped)/sec
3056
B+ Tree Move Prevs/sec
3058
B+ Tree Move Prevs (Non-Visible Nodes Skipped)/sec
3060
B+ Tree Seeks/sec
3062
B+ Tree Inserts/sec
3064
B+ Tree Replaces/sec
3066
B+ Tree Flag Deletes/sec
3068
B+ Tree Deletes/sec
3070
B+ Tree Appends/sec
3072
B+ Tree Creates/sec
3074
B+ Tree Creates (Total)
3076
B+ Tree Destroys/sec
3078
B+ Tree Destroys (Total)
3080
Database Pages Read Async/sec
3082
Database Pages Read Sync/sec
3084
Database Pages Written/sec
3086
Database Pages Transferred/sec
3088
Database Pages Preread/sec
3090
Database Cached Pages Preread/sec
3092
Database Pages Preread Untouched/sec
3094
Database Pages Versioned / sec
3096
Database Pages Ordinarily Written/sec
3098
Database Pages Anomalously Written/sec
3100
Database Pages Opportunely Written/sec
3102
Database Pages Repeatedly Written/sec
3104
Database Pages Idly Written/sec
3106
Database Pages Coalesced Written/sec
3108
Database Pages Coalesced Read/sec
3110
Streaming Backup Pages Read/sec
3112
Online Defrag Pages Referenced/sec
3114
Online Defrag Pages Read/sec
3116
Online Defrag Pages Preread/sec
3118
Online Defrag Pages Dirtied/sec
3120
Online Defrag Pages Re-Dirtied/sec
3122
Online Defrag Log Records/sec
3124
Online Defrag Average Log Bytes
3126
No name
3128
Database Tasks Pages Referenced/sec
3130
Database Tasks Pages Read/sec
3132
Database Tasks Pages Preread/sec
3134
Database Tasks Pages Dirtied/sec
3136
Database Tasks Pages Re-Dirtied/sec
3138
Database Tasks Log Records/sec
3140
Database Tasks Average Log Bytes
3142
No name
3144
I/O Database Reads/sec
3146
I/O Database Reads Average Latency
3148
No name
3150
I/O Database Reads Average Bytes
3152
No name
3154
I/O Database Reads In Heap
3156
I/O Database Reads Async Pending
3158
I/O Database Reads Abnormal Latency/sec
3160
I/O Log Reads/sec
3162
I/O Log Reads Average Latency
3164
No name
3166
I/O Log Reads Average Bytes
3168
No name
3170
I/O Log Reads In Heap
3172
I/O Log Reads Async Pending
3174
I/O Log Reads Abnormal Latency/sec
3176
I/O Database Writes/sec
3178
I/O Database Writes Average Latency
3180
No name
3182
I/O Database Writes Average Bytes
3184
No name
3186
I/O Database Writes In Heap
3188
I/O Database Writes Async Pending
3190
I/O Database Writes Abnormal Latency/sec
3192
I/O Log Writes/sec
3194
I/O Log Writes Average Latency
3196
No name
3198
I/O Log Writes Average Bytes
3200
No name
3202
I/O Log Writes In Heap
3204
I/O Log Writes Async Pending
3206
I/O Log Writes Abnormal Latency/sec
3208
Distributed Transaction Coordinator
3210
Active Transactions
3212
Committed Transactions
3214
Aborted Transactions
3216
In Doubt Transactions
3218
Active Transactions Maximum
3220
Force Committed Transactions
3222
Force Aborted Transactions
3224
Response Time -- Minimum
3226
Response Time -- Average
3228
Response Time -- Maximum
3230
Transactions/sec
3232
Committed Transactions/sec
3234
Aborted Transactions/sec
3424
Bulk Bytes/Sec
3426
Isochronous Bytes/Sec
3428
Interrupt Bytes/Sec
3430
Control Data Bytes/Sec
3432
Controller PCI Interrupts/Sec
3434
Controller WorkSignals/Sec
3436
% Total Bandwidth Used for Interrupt
3438
% Total Bandwidth Used for Iso
3440
USB
3442
Avg. Bytes/Transfer
3444
Iso Packet Errors/Sec
3446
Avg ms latency for ISO transfers
3448
Transfer Errors/Sec
3450
Host Controller Idle
3452
Host Controller Async Idle
3454
Host Controller Async Cache Flush Count
3456
Host Controller Perdiodic Idle
3458
Host Controller Periodic Cache Flush Count
3460
.NET CLR Networking
3462
Connections Established
3464
Bytes Received
3466
Bytes Sent
3468
Datagrams Received
3470
Datagrams Sent
3472
.NET Data Provider for SqlServer
3474
HardConnectsPerSecond
3476
HardDisconnectsPerSecond
3478
SoftConnectsPerSecond
3480
SoftDisconnectsPerSecond
3482
NumberOfNonPooledConnections
3484
NumberOfPooledConnections
3486
NumberOfActiveConnectionPoolGroups
3488
NumberOfInactiveConnectionPoolGroups
3490
NumberOfActiveConnectionPools
3492
NumberOfInactiveConnectionPools
3494
NumberOfActiveConnections
3496
NumberOfFreeConnections
3498
NumberOfStasisConnections
3500
NumberOfReclaimedConnections
3502
.NET CLR Data
3504
SqlClient: Current # pooled and nonpooled connections
3506
SqlClient: Current # pooled connections
3508
SqlClient: Current # connection pools
3510
SqlClient: Peak # pooled connections
3512
SqlClient: Total # failed connects
3514
SqlClient: Total # failed commands
3516
.NET CLR Memory
3518
# Gen 0 Collections
3520
# Gen 1 Collections
3522
# Gen 2 Collections
3524
Promoted Memory from Gen 0
3526
Promoted Memory from Gen 1
3528
Gen 0 Promoted Bytes/Sec
3530
Gen 1 Promoted Bytes/Sec
3532
Promoted Finalization-Memory from Gen 0
3534
Process ID
3536
Gen 0 heap size
3538
Gen 1 heap size
3540
Gen 2 heap size
3542
Large Object Heap size
3544
Finalization Survivors
3546
# GC Handles
3548
Allocated Bytes/sec
3550
# Induced GC
3552
% Time in GC
3554
Not Displayed
3556
# Bytes in all Heaps
3558
# Total committed Bytes
3560
# Total reserved Bytes
3562
# of Pinned Objects
3564
# of Sink Blocks in use
3566
.NET CLR Loading
3568
Total Classes Loaded
3570
% Time Loading
3572
Assembly Search Length
3574
Total # of Load Failures
3576
Rate of Load Failures
3578
Bytes in Loader Heap
3580
Total appdomains unloaded
3582
Rate of appdomains unloaded
3584
Current Classes Loaded
3586
Rate of Classes Loaded
3588
Current appdomains
3590
Total Appdomains
3592
Rate of appdomains
3594
Current Assemblies
3596
Total Assemblies
3598
Rate of Assemblies
3600
.NET CLR Jit
3602
# of Methods Jitted
3604
# of IL Bytes Jitted
3606
Total # of IL Bytes Jitted
3608
IL Bytes Jitted / sec
3610
Standard Jit Failures
3612
% Time in Jit
3614
Not Displayed
3616
.NET CLR Interop
3618
# of CCWs
3620
# of Stubs
3622
# of marshalling
3624
# of TLB imports / sec
3626
# of TLB exports / sec
3628
.NET CLR LocksAndThreads
3630
Total # of Contentions
3632
Contention Rate / sec
3634
Current Queue Length
3636
Queue Length Peak
3638
Queue Length / sec
3640
# of current logical Threads
3642
# of current physical Threads
3644
# of current recognized threads
3646
# of total recognized threads
3648
rate of recognized threads / sec
3650
.NET CLR Security
3652
Total Runtime Checks
3654
% Time Sig. Authenticating
3656
# Link Time Checks
3658
% Time in RT checks
3660
Not Displayed
3662
Stack Walk Depth
3664
.NET CLR Remoting
3666
Remote Calls/sec
3668
Channels
3670
Context Proxies
3672
Context-Bound Classes Loaded
3674
Context-Bound Objects Alloc / sec
3676
Contexts
3678
Total Remote Calls
3680
.NET CLR Exceptions
3682
# of Exceps Thrown
3684
# of Exceps Thrown / sec
3686
# of Filters / sec
3688
# of Finallys / sec
3690
Throw To Catch Depth / sec
3692
.NET Data Provider for Oracle
3694
HardConnectsPerSecond
3696
HardDisconnectsPerSecond
3698
SoftConnectsPerSecond
3700
SoftDisconnectsPerSecond
3702
NumberOfNonPooledConnections
3704
NumberOfPooledConnections
3706
NumberOfActiveConnectionPoolGroups
3708
NumberOfInactiveConnectionPoolGroups
3710
NumberOfActiveConnectionPools
3712
NumberOfInactiveConnectionPools
3714
NumberOfActiveConnections
3716
NumberOfFreeConnections
3718
NumberOfStasisConnections
3720
NumberOfReclaimedConnections
3722
Search Gatherer Projects
3724
Document Additions
3726
Document Add Rate
3728
Document Deletes
3730
Document Delete Rate
3732
Document Modifies
3734
Document Modifies Rate
3736
Waiting Documents
3738
Documents In Progress
3740
Documents On Hold
3742
Delayed Documents
3744
URLs in History
3746
Processed Documents
3748
Processed Documents Rate
3750
Status Success
3752
Success Rate
3754
Status Error
3756
Error Rate
3762
File Errors
3764
File Errors Rate
3770
Accessed Files
3772
Accessed File Rate
3778
Filtered Office
3780
Filtered Office Rate
3782
Filtered Text
3784
Filtered Text Rate
3786
Crawls in progress
3788
Gatherer Paused Flag
3790
Recovery In Progress Flag
3792
Not Modified
3794
Iterating History In Progress Flag
3796
Incremental Crawls
3798
Filtering Documents
3800
Started Documents
3802
Retries
3804
Retries Rate
3812
Adaptive Crawl Errors
3818
Changed Documents
3820
Document Moves/Renames
3822
Document Move and Rename Rate
3824
Unique Documents
3826
History Recovery Progress
3828
Search Gatherer
3830
Notification Sources
3832
Ext. Notifications Received
3834
Ext. Notifications Rate
3836
Admin Clients
3838
Heartbeats
3840
Heartbeats Rate
3842
Filtering Threads
3844
Idle Threads
3846
Document Entries
3848
Performance Level
3850
Active Queue Length
3852
Filter Processes
3854
Filter Processes Max
3856
Filter Process Created
3858
Delayed Documents
3860
Server Objects
3862
Server Objects Created
3864
Filter Objects
3866
Documents Filtered
3868
Documents Filtered Rate
3870
Time Outs
3872
Servers Currently Unavailable
3874
Servers Unavailable
3876
Threads Accessing Network
3878
Threads In Plug-ins
3880
Documents Successfully Filtered
3882
Documents Successfully Filtered Rate
3884
Documents Delayed Retry
3886
Word Breakers Cached
3888
Stemmers Cached
3890
All Notifications Received
3892
Notifications Rate
3894
System IO traffic rate
3896
Reason to back off
3898
Threads blocked due to back off
3900
Search Indexer
3902
Master Index Level.
3904
Master Merges to Date
3906
Master Merge Progress
3908
Shadow Merge Levels
3910
Shadow Merge Levels Threshold
3912
Persistent Indexes
3914
Index Size
3916
Unique Keys
3918
Documents Filtered
3920
Work Items Created
3922
Work Items Deleted
3924
Clean WidSets
3926
Dirty WidSets
3928
Master Merges Now.
3930
Active Connections
3932
Queries
3934
Queries Failed
3936
Queries Succeeded
3938
L0 Indexes (Wordlists)
3940
L0 Merges (flushes) Now.
3942
L0 Merge (Flush) Speed - Average
3944
L0 Merge (Flush) - Count
3946
L0 Merge (Flush) Speed - Last
3948
Persistent Indexes L1
3950
L1 Merges Now.
3952
L1 Merge Speed - average
3954
L1 Merge - Count
3956
L1 Merge Speed - last
3958
Persistent Indexes L2
3960
L2 Merges Now.
3962
L2 Merge Speed - average
3964
L2 Merge - Count
3966
L2 Merge Speed - last
3968
Persistent Indexes L3
3970
L3 Merges Now.
3972
L3 Merge Speed - average
3974
L3 Merge - Count
3976
L3 Merge Speed - last
3978
Persistent Indexes L4
3980
L4 Merges Now.
3982
L4 Merge Speed - average
3984
L4 Merge - Count
3986
L4 Merge Speed - last
3988
Persistent Indexes L5
3990
L5 Merges Now.
3992
L5 Merge Speed - average
3994
L5 Merge - Count
3996
L5 Merge Speed - last
3998
Persistent Indexes L6
4000
L6 Merges Now.
4002
L6 Merge Speed - average
4004
L6 Merge - Count
4006
L6 Merge Speed - last
4008
Persistent Indexes L7
4010
L7 Merges Now.
4012
L7 Merge Speed - average
4014
L7 Merge - Count
4016
L7 Merge Speed - last
4018
Persistent Indexes L8
4020
L8 Merges Now.
4022
L8 Merge Speed - average
4024
L8 Merge - Count
4026
L8 Merge Speed - last
4028
Peer Networking Resolution Protocol
4030
Number of IDs registered
4032
Number of resolves
4034
bytes sent/sec
4036
bytes received/sec
4038
Stale cache entry hits
4040
ServiceModelOperation 3.0.0.0
4042
Calls
4044
Calls Per Second
4046
Calls Outstanding
4048
Calls Failed
4050
Call Failed Per Second
4052
Calls Faulted
4054
Calls Faulted Per Second
4056
Calls Duration
4058
Calls Duration Base
4060
Transactions Flowed
4062
Transactions Flowed Per Second
4064
Security Validation and Authentication Failures
4066
Security Validation and Authentication Failures Per Second
4068
Security Calls Not Authorized
4070
Security Calls Not Authorized Per Second
4072
ReadyBoost Cache
4074
Hit read bytes/sec
4076
Total read bytes/sec
4078
Total write bytes/sec
4080
Update buffer read bytes/sec
4082
Bytes cached
4084
Invalidated update buffer bytes/sec
4086
Cache reads/sec
4088
Compression Ratio
4090
Sequential IOs bailed/sec
4092
Read-Size-Max IOs bailed/sec
4094
No-regions reschedules/sec
4096
No-update-buffers reschedules/sec
4098
Invalidated update buffer blocks/sec
4100
ServiceModelService 3.0.0.0
4102
Calls
4104
Calls Per Second
4106
Calls Outstanding
4108
Calls Failed
4110
Calls Failed Per Second
4112
Calls Faulted
4114
Calls Faulted Per Second
4116
Calls Duration
4118
Calls Duration Base
4120
Transactions Flowed
4122
Transactions Flowed Per Second
4124
Transacted Operations Committed
4126
Transacted Operations Committed Per Second
4128
Transacted Operations Aborted
4130
Transacted Operations Aborted Per Second
4132
Transacted Operations In Doubt
4134
Transacted Operations In Doubt Per Second
4136
Security Validation and Authentication Failures
4138
Security Validation and Authentication Failures Per Second
4140
Security Calls Not Authorized
4142
Security Calls Not Authorized Per Second
4144
Instances
4146
Instances Created Per Second
4148
Reliable Messaging Sessions Faulted
4150
Reliable Messaging Sessions Faulted Per Second
4152
Reliable Messaging Messages Dropped
4154
Reliable Messaging Messages Dropped Per Second
4156
Queued Poison Messages
4158
Queued Poison Messages Per Second
4160
Queued Messages Rejected
4162
Queued Messages Rejected Per Second
4164
Queued Messages Dropped
4166
Queued Messages Dropped Per Second
4168
MSDTC Bridge 3.0.0.0
4170
Message send failures/sec
4172
Prepare retry count/sec
4174
Commit retry count/sec
4176
Prepared retry count/sec
4178
Replay retry count/sec
4180
Faults received count/sec
4182
Faults sent count/sec
4184
Average participant prepare response time
4186
Average participant prepare response time Base
4188
Average participant commit response time
4190
Average participant commit response time Base
4272
SMSvcHost 3.0.0.0
4274
Protocol Failures over net.tcp
4276
Protocol Failures over net.pipe
4278
Dispatch Failures over net.tcp
4280
Dispatch Failures over net.pipe
4282
Connections Dispatched over net.tcp
4284
Connections Dispatched over net.pipe
4286
Connections Accepted over net.tcp
4288
Connections Accepted over net.pipe
4290
Registrations Active for net.tcp
4292
Registrations Active for net.pipe
4294
Uris Registered for net.tcp
4296
Uris Registered for net.pipe
4298
Uris Unregistered for net.tcp
4300
Uris Unregistered for net.pipe
4302
ServiceModelEndpoint 3.0.0.0
4304
Calls
4306
Calls Per Second
4308
Calls Outstanding
4310
Calls Failed
4312
Calls Failed Per Second
4314
Calls Faulted
4316
Calls Faulted Per Second
4318
Calls Duration
4320
Calls Duration Base
4322
Transactions Flowed
4324
Transactions Flowed Per Second
4326
Security Validation and Authentication Failures
4328
Security Validation and Authentication Failures Per Second
4330
Security Calls Not Authorized
4332
Security Calls Not Authorized Per Second
4334
Reliable Messaging Sessions Faulted
4336
Reliable Messaging Sessions Faulted Per Second
4338
Reliable Messaging Messages Dropped
4340
Reliable Messaging Messages Dropped Per Second
4342
Windows Workflow Foundation
4344
Workflows Created
4346
Workflows Created/sec
4348
Workflows Unloaded
4350
Workflows Unloaded/sec
4352
Workflows Loaded
4354
Workflows Loaded/sec
4356
Workflows Completed
4358
Workflows Completed/sec
4360
Workflows Suspended
4362
Workflows Suspended/sec
4364
Workflows Terminated
4366
Workflows Terminated/sec
4368
Workflows In Memory
4370
Workflows Aborted
4372
Workflows Aborted/sec
4374
Workflows Persisted
4376
Workflows Persisted/sec
4378
Workflows Executing
4380
Workflows Idle/sec
4382
Workflows Runnable
4384
Workflows Pending
4386
Pacer Flow
4388
Pacer Pipe
4390
Packets dropped
4392
Packets scheduled
4394
Packets transmitted
4396
Average packets in shaper
4398
Max packets in shaper
4400
Average packets in sequencer
4402
Max packets in sequencer
4404
Bytes scheduled
4406
Bytes transmitted
4408
Bytes transmitted/sec
4410
Bytes scheduled/sec
4412
Packets transmitted/sec
4414
Packets scheduled/sec
4416
Packets dropped/sec
4418
Nonconforming packets scheduled
4420
Nonconforming packets scheduled/sec
4422
Nonconforming packets transmitted
4424
Nonconforming packets transmitted/sec
4426
Maximum Packets in netcard
4428
Average Packets in netcard
4430
Out of packets
4432
Flows opened
4434
Flows closed
4436
Flows rejected
4438
Flows modified
4440
Flow mods rejected
4442
Max simultaneous flows
4444
Nonconforming packets scheduled
4446
Nonconforming packets scheduled/sec
4448
Nonconforming packets transmitted
4450
Nonconforming packets transmitted/sec
4452
Average packets in shaper
4454
Max packets in shaper
4456
Average packets in sequencer
4458
Max packets in sequencer
4460
Max packets in netcard
4462
Average packets in netcard
4992
ASP.NET v1.1.4322
4994
ASP.NET Apps v1.1.4322
4996
Application Restarts
4998
Applications Running
5000
Requests Disconnected
5002
Request Execution Time
5004
Requests Rejected
5006
Requests Queued
5008
Worker Processes Running
5010
Worker Process Restarts
5012
Request Wait Time
5014
State Server Sessions Active
5016
State Server Sessions Abandoned
5018
State Server Sessions Timed Out
5020
State Server Sessions Total
5022
Requests Current
5024
Anonymous Requests
5026
Anonymous Requests/Sec
5028
Cache Total Entries
5030
Cache Total Turnover Rate
5032
Cache Total Hits
5034
Cache Total Misses
5036
Cache Total Hit Ratio
5038
Cache Total Hit Ratio Base
5040
Cache API Entries
5042
Cache API Turnover Rate
5044
Cache API Hits
5046
Cache API Misses
5048
Cache API Hit Ratio
5050
Cache API Hit Ratio Base
5052
Output Cache Entries
5054
Output Cache Turnover Rate
5056
Output Cache Hits
5058
Output Cache Misses
5060
Output Cache Hit Ratio
5062
Output Cache Hit Ratio Base
5064
Compilations Total
5066
Debugging Requests
5068
Errors During Preprocessing
5070
Errors During Compilation
5072
Errors During Execution
5074
Errors Unhandled During Execution
5076
Errors Unhandled During Execution/Sec
5078
Errors Total
5080
Errors Total/Sec
5082
Pipeline Instance Count
5084
Request Bytes In Total
5086
Request Bytes Out Total
5088
Requests Executing
5090
Requests Failed
5092
Requests Not Found
5094
Requests Not Authorized
5096
Requests In Application Queue
5098
Requests Timed Out
5100
Requests Succeeded
5102
Requests Total
5104
Requests/Sec
5106
Sessions Active
5108
Sessions Abandoned
5110
Sessions Timed Out
5112
Sessions Total
5114
Transactions Aborted
5116
Transactions Committed
5118
Transactions Pending
5120
Transactions Total
5122
Transactions/Sec
5124
Session State Server connections total
5126
Session SQL Server connections total
5404
Terminal Services Session
5406
Input WdBytes
5408
Input WdFrames
5410
Input WaitForOutBuf
5412
Input Frames
5414
Input Bytes
5416
Input Compressed Bytes
5418
Input Compress Flushes
5420
Input Errors
5422
Input Timeouts
5424
Input Async Frame Error
5426
Input Async Overrun
5428
Input Async Overflow
5430
Input Async Parity Error
5432
Input Transport Errors
5434
Output WdBytes
5436
Output WdFrames
5438
Output WaitForOutBuf
5440
Output Frames
5442
Output Bytes
5444
Output Compressed Bytes
5446
Output Compress Flushes
5448
Output Errors
5450
Output Timeouts
5452
Output Async Frame Error
5454
Output Async Overrun
5456
Output Async Overflow
5458
Output Async Parity Error
5460
Output Transport Errors
5462
Total WdBytes
5464
Total WdFrames
5466
Total WaitForOutBuf
5468
Total Frames
5470
Total Bytes
5472
Total Compressed Bytes
5474
Total Compress Flushes
5476
Total Errors
5478
Total Timeouts
5480
Total Async Frame Error
5482
Total Async Overrun
5484
Total Async Overflow
5486
Total Async Parity Error
5488
Total Transport Errors
5490
Total Protocol Cache Reads
5492
Total Protocol Cache Hits
5494
Total Protocol Cache Hit Ratio
5496
Protocol Bitmap Cache Reads
5498
Protocol Bitmap Cache Hits
5500
Protocol Bitmap Cache Hit Ratio
5502
Protocol Glyph Cache Reads
5504
Protocol Glyph Cache Hits
5506
Protocol Glyph Cache Hit Ratio
5508
Protocol Brush Cache Reads
5510
Protocol Brush Cache Hits
5512
Protocol Brush Cache Hit Ratio
5514
Protocol Save Screen Bitmap Cache Reads
5516
Protocol Save Screen Bitmap Cache Hits
5518
Protocol Save Screen Bitmap Cache Hit Ratio
5520
Input Compression Ratio
5522
Output Compression Ratio
5524
Total Compression Ratio
6008
.NET CLR Networking 4.0.0.0
6010
Connections Established
6012
Bytes Received
6014
Bytes Sent
6016
Datagrams Received
6018
Datagrams Sent
6020
HttpWebRequests Created/Sec
6022
HttpWebRequests Average Lifetime
6024
HttpWebRequests Average Lifetime Base
6026
HttpWebRequests Queued/Sec
6028
HttpWebRequests Average Queue Time
6030
HttpWebRequests Average Queue Time Base
6032
HttpWebRequests Aborted/Sec
6034
HttpWebRequests Failed/Sec
11874
WMI Objects
11876
HiPerf Classes
11878
HiPerf Validity
11880
BatteryStatus
11882
ChargeRate
11884
DischargeRate
11886
RemainingCapacity
11888
Tag
11890
Voltage
11892
MSiSCSI_ConnectionStatistics
11894
BytesReceived
11896
BytesSent
11898
PDUCommandsSent
11900
PDUResponsesReceived
11902
MSiSCSI_InitiatorInstanceStatistics
11904
SessionConnectionTimeoutErrorCount
11906
SessionDigestErrorCount
11908
SessionFailureCount
11910
SessionFormatErrorCount
11912
MSiSCSI_InitiatorLoginStatistics
11914
LoginAcceptRsps
11916
LoginAuthenticateFails
11918
LoginAuthFailRsps
11920
LoginFailures
11922
LoginNegotiateFails
11924
LoginOtherFailRsps
11926
LoginRedirectRsps
11928
LogoutNormals
11930
LogoutOtherCodes
11932
MSiSCSI_MMIPSECStats
11934
AcquireFailures
11936
AcquireHeapSize
11938
ActiveAcquire
11940
ActiveReceive
11942
AuthenticationFailures
11944
ConnectionListSize
11946
GetSPIFailures
11948
InvalidCookiesReceived
11950
InvalidPackets
11952
KeyAdditionFailures
11954
KeyAdditions
11956
KeyUpdateFailures
11958
KeyUpdates
11960
NegotiationFailures
11962
OakleyMainMode
11964
OakleyQuickMode
11966
ReceiveFailures
11968
ReceiveHeapSize
11970
SendFailures
11972
SoftAssociations
11974
TotalGetSPI
11976
MSiSCSI_NICPerformance
11978
BytesReceived
11980
BytesTransmitted
11982
PDUReceived
11984
PDUTransmitted
11986
MSiSCSI_QMIPSECStats
11988
ActiveSA
11990
ActiveTunnels
11992
AuthenticatedBytesReceived
11994
AuthenticatedBytesSent
11996
BadSPIPackets
11998
ConfidentialBytesReceived
12000
ConfidentialBytesSent
12002
KeyAdditions
12004
KeyDeletions
12006
PacketsNotAuthenticated
12008
PacketsNotDecrypted
12010
PacketsWithReplayDetection
12012
PendingKeyOperations
12014
ReKeys
12016
TransportBytesReceived
12018
TransportBytesSent
12020
TunnelBytesReceived
12022
TunnelBytesSent
12024
MSiSCSI_RequestTimeStatistics
12026
AverageProcessingTime
12028
MaximumProcessingTime
12030
MSiSCSI_SessionStatistics
12032
BytesReceived
12034
BytesSent
12036
ConnectionTimeoutErrors
12038
DigestErrors
12040
FormatErrors
12042
PDUCommandsSent
12044
PDUResponsesReceived
12046
ProcessorPerformance
12048
frequency
12050
percentage
12052
power
12054
Video_Scheduler_Statistics
12056
WmiCompletedDMABufferCount
12058
WmiGPUBusy
12060
WmiGPUContext
12062
WmiGPUContextSwitch
12064
WmiPreemptedDMABufferCount
12066
WmiPresentCount
12068
WmiSubmitDMABufferCount
12222
SMSvcHost 4.0.0.0
12224
Protocol Failures over net.tcp
12226
Protocol Failures over net.pipe
12228
Dispatch Failures over net.tcp
12230
Dispatch Failures over net.pipe
12232
Connections Dispatched over net.tcp
12234
Connections Dispatched over net.pipe
12236
Connections Accepted over net.tcp
12238
Connections Accepted over net.pipe
12240
Registrations Active for net.tcp
12242
Registrations Active for net.pipe
12244
Uris Registered for net.tcp
12246
Uris Registered for net.pipe
12248
Uris Unregistered for net.tcp
12250
Uris Unregistered for net.pipe
12252
MSDTC Bridge 4.0.0.0
12254
Message send failures/sec
12256
Prepare retry count/sec
12258
Commit retry count/sec
12260
Prepared retry count/sec
12262
Replay retry count/sec
12264
Faults received count/sec
12266
Faults sent count/sec
12268
Average participant prepare response time
12270
Average participant prepare response time Base
12272
Average participant commit response time
12274
Average participant commit response time Base
5390
Terminal Services
5392
Active Sessions
5394
Inactive Sessions
5396
Total Sessions
1926
WFPv4
1928
Inbound Packets Discarded/sec
1930
Outbound Packets Discarded/sec
1932
Packets Discarded/sec
1934
Blocked Binds
1936
Inbound Connections Blocked/sec
1938
Outbound Connections Blocked/sec
1940
Inbound Connections Allowed/sec
1942
Outbound Connections Allowed/sec
1944
Inbound Connections
1946
Outbound Connections
1948
Active Inbound Connections
1950
Active Outbound Connections
1952
Allowed Classifies/sec
1986
IPsec Driver
1988
Active Security Associations
1990
Pending Security Associations
1992
Incorrect SPI Packets
1994
Bytes Received in Tunnel Mode/sec
1996
Bytes Sent in Tunnel Mode/sec
1998
Bytes Received in Transport Mode/sec
2000
Bytes Sent in Transport Mode/sec
2002
Offloaded Security Associations
2004
Offloaded Bytes Received/sec
2006
Offloaded Bytes Sent/sec
2008
Packets That Failed Replay Detection
2010
Packets Not Authenticated
2012
Packets Not Decrypted
2014
SA Rekeys
2016
Security Associations Added
2018
Packets That Failed ESP Validation
2020
Packets That Failed UDP-ESP Validation
2022
Packets Received Over Wrong SA
2024
Plaintext Packets Received
1982
WFP
1984
Provider Count
1954
WFPv6
1956
Inbound Packets Discarded/sec
1958
Outbound Packets Discarded/sec
1960
Packets Discarded/sec
1962
Blocked Binds
1964
Inbound Connections Blocked/sec
1966
Outbound Connections Blocked/sec
1968
Inbound Connections Allowed/sec
1970
Outbound Connections Allowed/sec
1972
Inbound Connections
1974
Outbound Connections
1976
Active Inbound Connections
1978
Active Outbound Connections
1980
Allowed Classifies/sec
5398
Authorization Manager Applications
5400
Total number of scopes
5402
Number of Scopes loaded in memory
5538
DFS Replicated Folders
5540
Conflict Files Generated
5542
Conflict Bytes Generated
5544
Conflict Files Cleaned up
5546
Conflict Bytes Cleaned up
5548
Conflict Space In Use
5550
Conflict Folder Cleanups Completed
5552
File Installs Succeeded
5554
File Installs Retried
5556
Updates Dropped
5558
Deleted Files Generated
5560
Deleted Bytes Generated
5562
Deleted Files Cleaned up
5564
Deleted Bytes Cleaned up
5566
Deleted Space In Use
5568
Total Files Received
5570
Size of Files Received
5572
Compressed Size of Files Received
5574
RDC Number of Files Received
5576
RDC Size of Files Received
5578
RDC Compressed Size of Files Received
5580
RDC Bytes Received
5582
Bandwidth Savings Using DFS Replication
5584
DFS Replication Connections
5586
Total Bytes Received
5588
Total Files Received
5590
Size of Files Received
5592
Compressed Size of Files Received
5594
Bytes Received Per Second
5596
RDC Number of Files Received
5598
RDC Size of Files Received
5600
RDC Compressed Size of Files Received
5602
RDC Bytes Received
5604
Bandwidth Savings Using DFS Replication
5526
DFS Replication Service Volumes
5528
USN Journal Records Read
5530
USN Journal Records Accepted
5532
USN Journal Unread Percentage
5534
Database Commits
5536
Database Lookups
2222
Generic IKE and AuthIP
2224
IKE Main Mode Negotiation Time
2226
AuthIP Main Mode Negotiation Time
2228
IKE Quick Mode Negotiation Time
2230
AuthIP Quick Mode Negotiation Time
2232
Extended Mode Negotiation Time
2234
Packets Received/sec
2236
Invalid Packets Received/sec
2238
Successful Negotiations
2240
Successful Negotiations/sec
2242
Failed Negotiations
2244
Failed Negotiations/sec
2102
IPsec AuthIPv4
2104
Active Main Mode SAs
2106
Pending Main Mode Negotiations
2108
Main Mode Negotiations
2110
Main Mode Negotiations/sec
2112
Successful Main Mode Negotiations
2114
Successful Main Mode Negotiations/sec
2116
Failed Main Mode Negotiations
2118
Failed Main Mode Negotiations/sec
2120
Main Mode Negotiation Requests Received
2122
Main Mode Negotiation Requests Received/sec
2124
Main Mode SAs That Used Impersonation
2126
Main Mode SAs That Used Impersonation/sec
2128
Active Quick Mode SAs
2130
Pending Quick Mode Negotiations
2132
Quick Mode Negotiations
2134
Quick Mode Negotiations/sec
2136
Successful Quick Mode Negotiations
2138
Successful Quick Mode Negotiations/sec
2140
Failed Quick Mode Negotiations
2142
Failed Quick Mode Negotiations/sec
2144
Active Extended Mode SAs
2146
Pending Extended Mode Negotiations
2148
Extended Mode Negotiations
2150
Extended Mode Negotiations/sec
2152
Successful Extended Mode Negotiations
2154
Successful Extended Mode Negotiations/sec
2156
Failed Extended Mode Negotiations
2158
Failed Extended Mode Negotiations/sec
2160
Extended Mode SAs That Used Impersonation
2162
IPsec AuthIPv6
2164
Active Main Mode SAs
2166
Pending Main Mode Negotiations
2168
Main Mode Negotiations
2170
Main Mode Negotiations/sec
2172
Successful Main Mode Negotiations
2174
Successful Main Mode Negotiations/sec
2176
Failed Main Mode Negotiations
2178
Failed Main Mode Negotiations/sec
2180
Main Mode Negotiation Requests Received
2182
Main Mode Negotiation Requests Received/sec
2184
Main Mode SAs That Used Impersonation
2186
Main Mode SAs That Used Impersonation/sec
2188
Active Quick Mode SAs
2190
Pending Quick Mode Negotiations
2192
Quick Mode Negotiations
2194
Quick Mode Negotiations/sec
2196
Successful Quick Mode Negotiations
2198
Successful Quick Mode Negotiations/sec
2200
Failed Quick Mode Negotiations
2202
Failed Quick Mode Negotiations/sec
2204
Active Extended Mode SAs
2206
Pending Extended Mode Negotiations
2208
Extended Mode Negotiations
2210
Extended Mode Negotiations/sec
2212
Successful Extended Mode Negotiations
2214
Successful Extended Mode Negotiations/sec
2216
Failed Extended Mode Negotiations
2218
Failed Extended Mode Negotiations/sec
2220
Extended Mode SAs That Used Impersonation
2026
IPsec IKEv4
2028
Active Main Mode SAs
2030
Pending Main Mode Negotiations
2032
Main Mode Negotiations
2034
Main Mode Negotiations/sec
2036
Successful Main Mode Negotiations
2038
Successful Main Mode Negotiations/sec
2040
Failed Main Mode Negotiations
2042
Failed Main Mode Negotiations/sec
2044
Main Mode Negotiation Requests Received
2046
Main Mode Negotiation Requests Received/sec
2048
Active Quick Mode SAs
2050
Pending Quick Mode Negotiations
2052
Quick Mode Negotiations
2054
Quick Mode Negotiations/sec
2056
Successful Quick Mode Negotiations
2058
Successful Quick Mode Negotiations/sec
2060
Failed Quick Mode Negotiations
2062
Failed Quick Mode Negotiations/sec
2064
IPsec IKEv6
2066
Active Main Mode SAs
2068
Pending Main Mode Negotiations
2070
Main Mode Negotiations
2072
Main Mode Negotiations/sec
2074
Successful Main Mode Negotiations
2076
Successful Main Mode Negotiations/sec
2078
Failed Main Mode Negotiations
2080
Failed Main Mode Negotiations/sec
2082
Main Mode Negotiation Requests Received
2084
Main Mode Negotiation Requests Received/sec
2086
Active Quick Mode SAs
2088
Pending Quick Mode Negotiations
2090
Quick Mode Negotiations
2092
Quick Mode Negotiations/sec
2094
Successful Quick Mode Negotiations
2096
Successful Quick Mode Negotiations/sec
2098
Failed Quick Mode Negotiations
2100
Failed Quick Mode Negotiations/sec
12070
ServiceModelService 4.0.0.0
12072
Calls
12074
Calls Per Second
12076
Calls Outstanding
12078
Calls Failed
12080
Calls Failed Per Second
12082
Calls Faulted
12084
Calls Faulted Per Second
12086
Calls Duration
12088
Security Validation and Authentication Failures
12090
Security Validation and Authentication Failures Per Second
12092
Security Calls Not Authorized
12094
Security Calls Not Authorized Per Second
12096
Instances
12098
Instances Created Per Second
12100
Reliable Messaging Sessions Faulted
12102
Reliable Messaging Sessions Faulted Per Second
12104
Reliable Messaging Messages Dropped
12106
Reliable Messaging Messages Dropped Per Second
12108
Transactions Flowed
12110
Transactions Flowed Per Second
12112
Transacted Operations Committed
12114
Transacted Operations Committed Per Second
12116
Transacted Operations Aborted
12118
Transacted Operations Aborted Per Second
12120
Transacted Operations In Doubt
12122
Transacted Operations In Doubt Per Second
12124
Queued Poison Messages
12126
Queued Poison Messages Per Second
12128
Queued Messages Rejected
12130
Queued Messages Rejected Per Second
12132
Queued Messages Dropped
12134
Queued Messages Dropped Per Second
12136
Percent Of Max Concurrent Calls
12138
Percent Of Max Concurrent Instances
12140
Percent Of Max Concurrent Sessions
12142
CallDurationBase
12144
CallsPercentMaxConcurrentCallsBase
12146
InstancesPercentMaxConcurrentInstancesBase
12148
SessionsPercentMaxConcurrentSessionsBase
12190
ServiceModelOperation 4.0.0.0
12192
Calls
12194
Calls Per Second
12196
Calls Outstanding
12198
Calls Failed
12200
Call Failed Per Second
12202
Calls Faulted
12204
Calls Faulted Per Second
12206
Calls Duration
12208
Security Validation and Authentication Failures
12210
Security Validation and Authentication Failures Per Second
12212
Security Calls Not Authorized
12214
Security Calls Not Authorized Per Second
12216
Transactions Flowed
12218
Transactions Flowed Per Second
12220
CallsDurationBase
12150
ServiceModelEndpoint 4.0.0.0
12152
Calls
12154
Calls Per Second
12156
Calls Outstanding
12158
Calls Failed
12160
Calls Failed Per Second
12162
Calls Faulted
12164
Calls Faulted Per Second
12166
Calls Duration
12168
Security Validation and Authentication Failures
12170
Security Validation and Authentication Failures Per Second
12172
Security Calls Not Authorized
12174
Security Calls Not Authorized Per Second
12176
Reliable Messaging Sessions Faulted
12178
Reliable Messaging Sessions Faulted Per Second
12180
Reliable Messaging Messages Dropped
12182
Reliable Messaging Messages Dropped Per Second
12184
Transactions Flowed
12186
Transactions Flowed Per Second
12188
CallDurationBase
5372
HTTP Service Request Queues
5374
CurrentQueueSize
5376
MaxQueueItemAge
5378
ArrivalRate
5380
RejectionRate
5382
RejectedRequests
5384
CacheHitRate
5352
HTTP Service Url Groups
5354
BytesSentRate
5356
BytesReceivedRate
5358
BytesTransferredRate
5360
CurrentConnections
5362
MaxConnections
5364
ConnectionAttempts
5366
GetRequests
5368
HeadRequests
5370
AllRequests
5338
HTTP Service
5340
CurrentUrisCached
5342
TotalUrisCached
5344
UriCacheHits
5346
UriCacheMisses
5348
UriCacheFlushes
5350
TotalFlushedUris
5324
Netlogon
5326
Semaphore Waiters
5328
Semaphore Holders
5330
Semaphore Acquires
5332
Semaphore Timeouts
5334
Average Semaphore Hold Time
5336
Semaphore Hold Time Base
6232
WSMan Quota Statistics
6234
Total Requests/Second
6236
User Quota Violations/Second
6238
System Quota Violations/Second
6240
Active Shells
6242
Active Operations
6244
Active Users
3418
TBS counters
3420
CurrentContexts
3422
CurrentResources
"

### #11 ianlh

ianlh
• Topic Starter

• Members
• 11 posts
• OFFLINE
•
• Local time:08:15 PM

Posted 26 August 2013 - 04:18 PM

minireg #3 ( there may be as many as 5)

_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009]
"Help"="3
The System performance object consists of counters that apply to more than one instance of a component processors on the computer.
5
The Memory performance object  consists of counters that describe the behavior of physical and virtual memory on the computer.  Physical memory is the amount of random access memory on the computer.  Virtual memory consists of the space in physical memory and on disk.  Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory.  Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes.
7
% Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idle thread that consumes cycles when no other threads are ready to run). This counter is the primary indicator of processor activity, and displays the average percentage of busy time observed during the sample interval. It should be noted that the accounting calculation of whether the processor is idle is performed at an internal sampling interval of the system clock (10ms). On todays fast processors, % Processor Time can therefore underestimate the processor utilization as the processor may be spending a lot of time servicing threads between the system clock sampling interval. Workload based timer applications are one example  of applications  which are more likely to be measured inaccurately as timers are signaled just after the sample is taken.
9
% Total DPC Time is the average percentage of time that all processors spend receiving and servicing deferred procedure calls (DPCs).  (DPCs are interrupts that run at a lower priority than the standard interrupts). It is the sum of Processor: % DPC Time for all processors on the computer, divided by the number of processors.  System: % Total DPC Time is a component of System: % Total Privileged Time because DPCs are executed in privileged mode.  DPCs are counted separately and are not a component of the interrupt count.  This counter displays the average busy time as a percentage of the sample time.
11
File Read Operations/sec is the combined rate of file system read requests to all devices on the computer, including requests to read from the file system cache.  It is measured in numbers of reads.  This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.
13
File Write Operations/sec is the combined rate of the file system write requests to all devices on the computer, including requests to write to data in the file system cache.  It is measured in numbers of writes. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.
15
File Control Operations/sec is the combined rate of file system operations that are neither reads nor writes, such as file system control requests and requests for information about device characteristics or status.  This is the inverse of System: File Data Operations/sec and is measured in number of operations perf second.  This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.
17
File Read Bytes/sec is the overall rate at which bytes are read to satisfy  file system read requests to all devices on the computer, including reads from the file system cache.  It is measured in number of bytes per second.  This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.
19
File Write Bytes/sec is the overall rate at which bytes are written to satisfy file system write requests to all devices on the computer, including writes to the file system cache.  It is measured in number of bytes per second.  This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.
21
File Control Bytes/sec is the overall rate at which bytes are transferred for all file system operations that are neither reads nor writes, including file system control requests and requests for information about device characteristics or status.  It is measured in numbers of bytes.  This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.
23
% Total Interrupt Time is the average percentage of time that all processors spend receiving and servicing hardware interrupts during sample intervals, where the value is an indirect indicator of the activity of devices that generate interrupts. It is the sum of Processor: % Interrupt Time for of all processors on the computer, divided by the number of processors.  DPCs are counted separately and are not a component of the interrupt count.  This value is an indirect indicator of the activity of devices that generate interrupts, such as the system timer, the mouse, disk drivers, data communication lines, network interface cards and other peripheral devices.
25
Available Bytes is the amount of physical memory, in bytes, immediately available for allocation to a process or for system use. It is equal to the sum of memory assigned to the standby (cached), free and zero page lists. For a full explanation of the memory manager, refer to MSDN and/or the System Performance and Troubleshooting Guide chapter in the Windows Server 2003 Resource Kit.
27
Committed Bytes is the amount of committed virtual memory, in bytes. Committed memory is the physical memory which has space reserved on the disk paging file(s). There can be one or more paging files on each physical drive. This counter displays the last observed value only; it is not an average.
29
Page Faults/sec is the average number of pages faulted per second. It is measured in number of pages faulted per second because only one page is faulted in each fault operation, hence this is also equal to the number of page fault operations. This counter includes both hard faults (those that require disk access) and soft faults (where the faulted page is found elsewhere in physical memory.) Most processors can handle large numbers of soft faults without significant consequence. However, hard faults, which require disk access, can cause significant delays.
31
Commit Limit is the amount of virtual memory that can be committed without having to extend the paging file(s).  It is measured in bytes. Committed memory is the physical memory which has space reserved on the disk paging files. There can be one paging file on each logical drive). If the paging file(s) are be expanded, this limit increases accordingly.  This counter displays the last observed value only; it is not an average.
33
Write Copies/sec is the rate at which page faults are caused by attempts to write that have been satisfied by coping of the page from elsewhere in physical memory. This is an economical way of sharing data since pages are only copied when they are written to; otherwise, the page is shared. This counter shows the number of copies, without regard for the number of pages copied in each operation.
35
Transition Faults/sec is the rate at which page faults are resolved by recovering pages that were being used by another process sharing the page, or were on the modified page list or the standby list, or were being written to disk at the time of the page fault. The pages were recovered without additional disk activity. Transition faults are counted in numbers of faults; because only one page is faulted in each operation, it is also equal to the number of pages faulted.
37
Cache Faults/sec is the rate at which faults occur when a page sought in the file system cache is not found and must be retrieved from elsewhere in memory (a soft fault) or from disk (a hard fault). The file system cache is an area of physical memory that stores recently used pages of data for applications. Cache activity is a reliable indicator of most application I/O operations. This counter shows the number of faults, without regard for the number of pages faulted in each operation.
39
Demand Zero Faults/sec is the rate at which a zeroed page is required to satisfy the fault.  Zeroed pages, pages emptied of previously stored data and filled with zeros, are a security feature of Windows that prevent processes from seeing data stored by earlier processes that used the memory space. Windows maintains a list of zeroed pages to accelerate this process. This counter shows the number of faults, without regard to the number of pages retrieved to satisfy the fault. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.
41
Pages/sec is the rate at which pages are read from or written to disk to resolve hard page faults. This counter is a primary indicator of the kinds of faults that cause system-wide delays.  It is the sum of Memory\\Pages Input/sec and Memory\\Pages Output/sec.  It is counted in numbers of pages, so it can be compared to other counts of pages, such as Memory\\Page Faults/sec, without conversion. It includes pages retrieved to satisfy faults in the file system cache (usually requested by applications) non-cached mapped memory files.
43
Page Reads/sec is the rate at which the disk was read to resolve hard page faults. It shows the number of reads operations, without regard to the number of pages retrieved in each operation. Hard page faults occur when a process references a page in virtual memory that is not in working set or elsewhere in physical memory, and must be retrieved from disk. This counter is a primary indicator of the kinds of faults that cause system-wide delays. It includes read operations to satisfy faults in the file system cache (usually requested by applications) and in non-cached mapped memory files. Compare the value of Memory\\Pages Reads/sec to the value of Memory\\Pages Input/sec to determine the average number of pages read during each operation.
45
Processor Queue Length is the number of threads in the processor queue.  Unlike the disk counters, this counter counters, this counter shows ready threads only, not threads that are running.  There is a single queue for processor time even on computers with multiple processors. Therefore, if a computer has multiple processors, you need to divide this value by the number of processors servicing the workload. A sustained processor queue of less than 10 threads per processor is normally acceptable, dependent of the workload.
47
Thread State is the current state of the thread.  It is 0 for Initialized, 1 for Ready, 2 for Running, 3 for Standby, 4 for Terminated, 5 for Wait, 6 for Transition, 7 for Unknown.  A Running thread is using a processor; a Standby thread is about to use one.  A Ready thread wants to use a processor, but is waiting for a processor because none are free.  A thread in Transition is waiting for a resource in order to execute, such as waiting for its execution stack to be paged in from disk.  A Waiting thread has no use for the processor because it is waiting for a peripheral operation to complete or a resource to become free.
49
Pages Output/sec is the rate at which pages are written to disk to free up space in physical memory. Pages are written back to disk only if they are changed in physical memory, so they are likely to hold data, not code. A high rate of pages output might indicate a memory shortage. Windows writes more pages back to disk to free up space when physical memory is in short supply.  This counter shows the number of pages, and can be compared to other counts of pages, without conversion.
51
Page Writes/sec is the rate at which pages are written to disk to free up space in physical memory. Pages are written to disk only if they are changed while in physical memory, so they are likely to hold data, not code.  This counter shows write operations, without regard to the number of pages written in each operation.  This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.
53
The Browser performance object consists of counters that measure the rates of announcements, enumerations, and other Browser transmissions.
55
Announcements Server/sec is the rate at which the servers in this domain have announced themselves to this server.
57
Pool Paged Bytes is the size, in bytes, of the paged pool, an area of system memory (physical memory used by the operating system) for objects that can be written to disk when they are not being used.  Memory\\Pool Paged Bytes is calculated differently than Process\\Pool Paged Bytes, so it might not equal Process\\Pool Paged Bytes\\_Total. This counter displays the last observed value only; it is not an average.
59
Pool Nonpaged Bytes is the size, in bytes, of the nonpaged pool, an area of system memory (physical memory used by the operating system) for objects that cannot be written to disk, but must remain in physical memory as long as they are allocated.  Memory\\Pool Nonpaged Bytes is calculated differently than Process\\Pool Nonpaged Bytes, so it might not equal Process\\Pool Nonpaged Bytes\\_Total.  This counter displays the last observed value only; it is not an average.
61
Pool Paged Allocs is the number of calls to allocate space in the paged pool. The paged pool is an area of system memory (physical memory used by the operating system) for objects that can be written to disk when they are not being used. It is measured in numbers of calls to allocate space, regardless of the amount of space allocated in each call.  This counter displays the last observed value only; it is not an average.
63
Pool Paged Resident Bytes is the current size, in bytes, of the paged pool. The paged pool is an area of system memory (physical memory used by the operating system) for objects that can be written to disk when they are not being used. Space used by the paged and nonpaged pools are taken from physical memory, so a pool that is too large denies memory space to processes. This counter displays the last observed value only; it is not an average.
65
Pool Nonpaged Allocs is the number of calls to allocate space in the nonpaged pool. The nonpaged pool is an area of system memory area for objects that cannot be written to disk, and must remain in physical memory as long as they are allocated.  It is measured in numbers of calls to allocate space, regardless of the amount of space allocated in each call.  This counter displays the last observed value only; it is not an average.
67
Bytes Total/sec is the total rate of bytes sent to or received from the network by the protocol, but only for the frames (packets) which carry data. This is the sum of Frame Bytes/sec and Datagram Bytes/sec.
69
System Code Total Bytes is the size, in bytes, of the pageable operating system code currently in virtual memory. It is a measure of the amount of physical memory being used by the operating system that can be written to disk when not in use. This value is calculated by summing the bytes in Ntoskrnl.exe, Hal.dll, the boot drivers, and file systems loaded by Ntldr/osloader.  This counter does not include code that must remain in physical memory and cannot be written to disk. This counter displays the last observed value only; it is not an average.
71
System Code Resident Bytes is the size, in bytes of the operating system code currently in physical memory that can be written to disk when not in use. This value is a component of Memory\\System Code Total Bytes, which also includes operating system code on disk. Memory\\System Code Resident Bytes (and Memory\\System Code Total Bytes) does not include code that must remain in physical memory and cannot be written to disk. This counter displays the last observed value only; it is not an average.
73
System Driver Total Bytes is the size, in bytes, of the pageable virtual memory currently being used by device drivers. Pageable memory can be written to disk when it is not being used. It includes physical memory (Memory\\System Driver Resident Bytes) and code and data paged to disk. It is a component of Memory\\System Code Total Bytes. This counter displays the last observed value only; it is not an average.
75
System Driver Resident Bytes is the size, in bytes, of the pageable physical memory being used by device drivers. It is the working set (physical memory area) of the drivers. This value is a component of Memory\\System Driver Total Bytes, which also includes driver memory that has been written to disk. Neither Memory\\System Driver Resident Bytes nor Memory\\System Driver Total Bytes includes memory that cannot be written to disk.
77
System Cache Resident Bytes is the size, in bytes, of the pageable operating system code in the file system cache. This value includes only current physical pages and does not include any virtual memory pages not currently resident. It does equal the System Cache value shown in Task Manager. As a result, this value may be smaller than the actual amount of virtual memory in use by the file system cache. This value is a component of Memory\\System Code Resident Bytes which represents all pageable operating system code that is currently in physical memory. This counter displays the last observed value only; it is not an average.
79
Announcements Domain/sec is the rate at which a domain has announced itself to the network.
81
Election Packets/sec is the rate at which browser election packets have been received by this workstation.
83
Mailslot Writes/sec is the rate at which mailslot messages have been successfully received.
85
Server List Requests/sec is the rate at which requests to retrieve a list of browser servers have been processed by this workstation.
87
The Cache performance object  consists of counters that monitor the file system cache, an area of physical memory that stores recently used data as long as possible to permit access to the data without having to read from the disk.  Because applications typically use the cache, the cache is monitored as an indicator of application I/O operations.  When memory is plentiful, the cache can grow, but when memory is scarce, the cache can become too small to be effective.
89
Data Maps/sec is the frequency that a file system such as NTFS, maps a page of a file into the file system cache to read the page.
91
Sync Data Maps/sec counts the frequency that a file system, such as NTFS, maps a page of a file into the file system cache to read the page, and wishes to wait for the page to be retrieved if it is not in main memory.
93
Async Data Maps/sec is the frequency that an application using a file system, such as NTFS, to map a page of a file into the file system cache to read the page, and does not wait for the page to be retrieved if it is not in main memory.
95
Data Map Hits is the percentage of data maps in the file system cache that could be resolved without having to retrieve a page from the disk, because the page was already in physical memory.
97
Data Map Pins/sec is the frequency of data maps in the file system cache that resulted in pinning a page in main memory, an action usually preparatory to writing to the file on disk.   While pinned, a page's physical address in main memory and virtual address in the file system cache will not be altered.
99
Pin Reads/sec is the frequency of reading data into the file system cache preparatory to writing the data back to disk.  Pages read in this fashion are pinned in memory at the completion of the read.  While pinned, a page's physical address in the file system cache will not be altered.
101
Sync Pin Reads/sec is the frequency of reading data into the file system cache preparatory to writing the data back to disk.  Pages read in this fashion are pinned in memory at the completion of the read.  The file system will not regain control until the page is pinned in the file system cache, in particular if the disk must be accessed to retrieve the page.  While pinned, a page's physical address in the file system cache will not be altered.
103
Async Pin Reads/sec is the frequency of reading data into the file system cache preparatory to writing the data back to disk.  Pages read in this fashion are pinned in memory at the completion of the read.  The file system will regain control immediately even if the disk must be accessed to retrieve the page.  While pinned, a page's physical address will not be altered.
105
Pin Read Hits is the percentage of pin read requests that hit the file system cache, i.e., did not require a disk read in order to provide access to the page in the file system cache.  While pinned, a page's physical address in the file system cache will not be altered.  The LAN Redirector uses this method for retrieving data from the cache, as does the LAN Server for small transfers.  This is usually the method used by the disk file systems as well.
107
Copy Reads/sec is the frequency of reads from pages of the file system cache that involve a memory copy of the data from the cache to the application's buffer.  The LAN Redirector uses this method for retrieving information from the file system cache, as does the LAN Server for small transfers.  This is a method used by the disk file systems as well.
109
Sync Copy Reads/sec is the frequency of reads from pages of the file system cache that involve a memory copy of the data from the cache to the application's buffer.  The file system will not regain control until the copy operation is complete, even if the disk must be accessed to retrieve the page.
111
Async Copy Reads/sec is the frequency of reads from pages of the file system cache that involve a memory copy of the data from the cache to the application's buffer.  The application will regain control immediately even if the disk must be accessed to retrieve the page.
113
Copy Read Hits is the percentage of cache copy read requests that hit the cache, that is, they did not require a disk read in order to provide access to the page in the cache.  A copy read is a file read operation that is satisfied by a memory copy from a page in the cache to the application's buffer.  The LAN Redirector uses this method for retrieving information from the cache, as does the LAN Server for small transfers.  This is a method used by the disk file systems as well.
115
MDL Reads/sec is the frequency of reads from the file system cache that use a Memory Descriptor List (MDL) to access the data.  The MDL contains the physical address of each page involved in the transfer, and thus can employ a hardware Direct Memory Access (DMA) device to effect the copy.  The LAN Server uses this method for large transfers out of the server.
117
Sync MDL Reads/sec is the frequency of reads from the file system cache that use a Memory Descriptor List (MDL) to access the pages.  The MDL contains the physical address of each page in the transfer, thus permitting Direct Memory Access (DMA) of the pages.  If the accessed page(s) are not in main memory, the caller will wait for the pages to fault in from the disk.
119
Async MDL Reads/sec is the frequency of reads from the file system cache that use a Memory Descriptor List (MDL) to access the pages.  The MDL contains the physical address of each page in the transfer, thus permitting Direct Memory Access (DMA) of the pages.  If the accessed page(s) are not in main memory, the calling application program will not wait for the pages to fault in from disk.
121
MDL Read Hits is the percentage of Memory Descriptor List (MDL) Read requests to the file system cache that hit the cache, i.e., did not require disk accesses in order to provide memory access to the page(s) in the cache.
123
Read Aheads/sec is the frequency of reads from the file system cache in which the Cache detects sequential access to a file.  The read aheads permit the data to be transferred in larger blocks than those being requested by the application, reducing the overhead per access.
125
Fast Reads/sec is the frequency of reads from the file system cache that bypass the installed file system and retrieve the data directly from the cache.  Normally, file I/O requests invoke the appropriate file system to retrieve data from a file, but this path permits direct retrieval of data from the cache without file system involvement if the data is in the cache.  Even if the data is not in the cache, one invocation of the file system is avoided.
127
Sync Fast Reads/sec is the frequency of reads from the file system cache that bypass the installed file system and retrieve the data directly from the cache.  Normally, file I/O requests invoke the appropriate file system to retrieve data from a file, but this path permits direct retrieval of data from the cache without file system involvement if the data is in the cache.  Even if the data is not in the cache, one invocation of the file system is avoided.  If the data is not in the cache, the request (application program call) will wait until the data has been retrieved from disk.
129
Async Fast Reads/sec is the frequency of reads from the file system cache that bypass the installed file system and retrieve the data directly from the cache.  Normally, file I/O requests will invoke the appropriate file system to retrieve data from a file, but this path permits data to be retrieved from the cache directly (without file system involvement) if the data is in the cache.  Even if the data is not in the cache, one invocation of the file system is avoided.  If the data is not in the cache, the request (application program call) will not wait until the data has been retrieved from disk, but will get control immediately.
131
Fast Read Resource Misses/sec is the frequency of cache misses necessitated by the lack of available resources to satisfy the request.
133
Fast Read Not Possibles/sec is the frequency of attempts by an Application Program Interface (API) function call to bypass the file system to get to data in the file system cache that could not be honored without invoking the file system.
135
Lazy Write Flushes/sec is the rate at which the Lazy Writer thread has written to disk.  Lazy Writing is the process of updating the disk after the page has been changed in memory, so that the application that changed the file does not have to wait for the disk write to be complete before proceeding.  More than one page can be transferred by each write operation.
137
Lazy Write Pages/sec is the rate at which the Lazy Writer thread has written to disk.  Lazy Writing is the process of updating the disk after the page has been changed in memory, so that the application that changed the file does not have to wait for the disk write to be complete before proceeding.  More than one page can be transferred on a single disk write operation.
139
Data Flushes/sec is the rate at which the file system cache has flushed its contents to disk as the result of a request to flush or to satisfy a write-through file write request.  More than one page can be transferred on each flush operation.
141
Data Flush Pages/sec is the number of pages the file system cache has flushed to disk as a result of a request to flush or to satisfy a write-through file write request.  More than one page can be transferred on each flush operation.
143
% User Time is the percentage of elapsed time the processor spends in the user mode. User mode is a restricted processing mode designed for applications, environment subsystems, and integral subsystems.  The alternative, privileged mode, is designed for operating system components and allows direct access to hardware and all memory.  The operating system switches application threads to privileged mode to access operating system services. This counter displays the average busy time as a percentage of the sample time.
145
% Privileged Time is the percentage of elapsed time that the process threads spent executing code in privileged mode.  When a Windows system service in called, the service will often run in privileged mode to gain access to system-private data. Such data is protected from access by threads executing in user mode. Calls to the system can be explicit or implicit, such as page faults or interrupts. Unlike some early operating systems, Windows uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes. Some work done by Windows on behalf of the application might appear in other subsystem processes in addition to the privileged time in the process.
147
Context Switches/sec is the combined rate at which all processors on the computer are switched from one thread to another.  Context switches occur when a running thread voluntarily relinquishes the processor, is preempted by a higher priority ready thread, or switches between user-mode and privileged (kernel) mode to use an Executive or subsystem service.  It is the sum of Thread\\Context Switches/sec for all threads running on all processors in the computer and is measured in numbers of switches.  There are context switch counters on the System and Thread objects. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.
149
Interrupts/sec is the average rate, in incidents per second, at which the processor received and serviced hardware interrupts. It does not include deferred procedure calls (DPCs), which are counted separately. This value is an indirect indicator of the activity of devices that generate interrupts, such as the system clock, the mouse, disk drivers, data communication lines, network interface cards, and other peripheral devices. These devices normally interrupt the processor when they have completed a task or require attention. Normal thread execution is suspended. The system clock typically interrupts the processor every 10 milliseconds, creating a background of interrupt activity. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.
151
System Calls/sec is the combined rate of calls to operating system service routines by all processes running on the computer. These routines perform all of the basic scheduling and synchronization of activities on the computer, and provide access to non-graphic devices, memory management, and name space management. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.
153
Level 1 TLB Fills/sec is the frequency of faults that occur when reference is made to memory whose Page Table Entry (PTE) is not in the Translation Lookaside Buffer (TLB).  On some computers this fault is handled by software loading the PTE into the TLB, and this counter is incremented.
155
Level 2 TLB Fills/sec is the frequency of faults that occur when reference is made to memory whose Page Table Entry (PTE) is not in the Translation Lookaside Buffer (TLB), nor is the page containing the PTE.  On some computers this fault is handled by software loading the PTE into the TLB, and this counter is incremented.
157
% User Time is the percentage of elapsed time that the process threads spent executing code in user mode. Applications, environment subsystems, and integral subsystems execute in user mode. Code executing in user mode cannot damage the integrity of the Windows executive, kernel, and device drivers. Unlike some early operating systems, Windows uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes. Some work done by Windows on behalf of the application might appear in other subsystem processes in addition to the privileged time in the process.
159
% Privileged Time is the percentage of elapsed time that the process threads spent executing code in privileged mode. When a Windows system service is called, the service will often run in privileged mode to gain access to system-private data. Such data is protected from access by threads executing in user mode. Calls to the system can be explicit or implicit, such as page faults or interrupts. Unlike some early operating systems, Windows uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes. Some work done by Windows on behalf of the application might appear in other subsystem processes in addition to the privileged time in the process.
161
Enumerations Server/sec is the rate at which server browse requests have been processed by this workstation.
163
Enumerations Domain/sec is the rate at which domain browse requests have been processed by this workstation.
165
Enumerations Other/sec is the rate at which browse requests processed by this workstation are not domain or server browse requests.
167
Missed Server Announcements is the number of server announcements that have been missed due to configuration or allocation limits.
169
Missed Mailslot Datagrams is the number of Mailslot Datagrams that have been discarded due to configuration or allocation limits.
171
Missed Server List Requests is the number of requests to retrieve a list of browser servers that were received by this workstation, but could not be processed.
173
Virtual Bytes Peak is the maximum size, in bytes, of virtual address space the process has used at any one time. Use of virtual address space does not necessarily imply corresponding use of either disk or main memory pages. However, virtual space is finite, and the process might limit its ability to load libraries.
175
Virtual Bytes is the current size, in bytes, of the virtual address space the process is using. Use of virtual address space does not necessarily imply corresponding use of either disk or main memory pages. Virtual space is finite, and the process can limit its ability to load libraries.
177
Page Faults/sec is the rate at which page faults by the threads executing in this process are occurring.  A page fault occurs when a thread refers to a virtual memory page that is not in its working set in main memory. This may not cause the page to be fetched from disk if it is on the standby list and hence already in main memory, or if it is in use by another process with whom the page is shared.
179
Working Set Peak is the maximum size, in bytes, of the Working Set of this process at any point in time. The Working Set is the set of memory pages touched recently by the threads in the process. If free memory in the computer is above a threshold, pages are left in the Working Set of a process even if they are not in use. When free memory falls below a threshold, pages are trimmed from Working Sets. If they are needed they will then be soft-faulted back into the Working Set before they leave main memory.
181
Working Set is the current size, in bytes, of the Working Set of this process. The Working Set is the set of memory pages touched recently by the threads in the process. If free memory in the computer is above a threshold, pages are left in the Working Set of a process even if they are not in use.  When free memory falls below a threshold, pages are trimmed from Working Sets. If they are needed they will then be soft-faulted back into the Working Set before leaving main memory.
183
Page File Bytes Peak is the maximum amount of virtual memory, in bytes, that this process has reserved for use in the paging file(s). Paging files are used to store pages of memory used by the process that are not contained in other files.  Paging files are shared by all processes, and the lack of space in paging files can prevent other processes from allocating memory. If there is no paging file, this counter reflects the maximum amount of virtual memory that the process has reserved for use in physical memory.
185
Page File Bytes is the current amount of virtual memory, in bytes, that this process has reserved for use in the paging file(s). Paging files are used to store pages of memory used by the process that are not contained in other files. Paging files are shared by all processes, and the lack of space in paging files can prevent other processes from allocating memory. If there is no paging file, this counter reflects the current amount of virtual memory that the process has reserved for use in physical memory.
187
Private Bytes is the current size, in bytes, of memory that this process has allocated that cannot be shared with other processes.
189
% Processor Time is the percentage of elapsed time that all of process threads used the processor to execution instructions. An instruction is the basic unit of execution in a computer, a thread is the object that executes instructions, and a process is the object created when a program is run. Code executed to handle some hardware interrupts and trap conditions are included in this count.
191
% Processor Time is the percentage of elapsed time that all of process threads used the processor to execution instructions. An instruction is the basic unit of execution in a computer, a thread is the object that executes instructions, and a process is the object created when a program is run. Code executed to handle some hardware interrupts and trap conditions are included in this count.
193
% User Time is the percentage of elapsed time that this thread has spent executing code in user mode.  Applications, environment subsystems, and integral subsystems execute in user mode.  Code executing in user mode cannot damage the integrity of the Windows NT Executive, Kernel, and device drivers.  Unlike some early operating systems, Windows NT uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes.  These subsystem processes provide additional protection.  Therefore, some work done by Windows NT on behalf of your application might appear in other subsystem processes in addition to the privileged time in your process.
195
% Privileged Time is the percentage of elapsed time that the process threads spent executing code in privileged mode.  When a Windows system service in called, the service will often run in privileged mode to gain access to system-private data. Such data is protected from access by threads executing in user mode. Calls to the system can be explicit or implicit, such as page faults or interrupts. Unlike some early operating systems, Windows uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes. Some work done by Windows on behalf of the application might appear in other subsystem processes in addition to the privileged time in the process.
197
Context Switches/sec is the rate of switches from one thread to another.  Thread switches can occur either inside of a single process or across processes.  A thread switch can be caused either by one thread asking another for information, or by a thread being preempted by another, higher priority thread becoming ready to run.  Unlike some early operating systems, Windows NT uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes.  These subsystem processes provide additional protection.  Therefore, some work done by Windows NT on behalf of an application  appear in other subsystem processes in addition to the privileged time in the application.  Switching to the subsystem process causes one Context Switch in the application thread.  Switching back causes another Context Switch in the subsystem thread.
199
Current Disk Queue Length is the number of requests outstanding on the disk at the time the performance data is collected. It also includes requests in service at the time of the collection. This is a instantaneous snapshot, not an average over the time interval. Multi-spindle disk devices can have multiple requests that are active at one time, but other concurrent requests are awaiting service. This counter might reflect a transitory high or low queue length, but if there is a sustained load on the disk drive, it is likely that this will be consistently high. Requests experience delays proportional to the length of this queue minus the number of spindles on the disks. For good performance, this difference should average less than two.
201
% Disk Time is the percentage of elapsed time that the selected disk drive was busy servicing read or write requests.
203
% Disk Read Time is the percentage of elapsed time that the selected disk drive was busy servicing read requests.
205
% Disk Write Time is the percentage of elapsed time that the selected disk drive was busy servicing write requests.
207
Avg. Disk sec/Transfer is the time, in seconds, of the average disk transfer.
209
Avg. Disk sec/Read is the average time, in seconds, of a read of data from the disk.
211
Avg. Disk sec/Write is the average time, in seconds, of a write of data to the disk.
213
Disk Transfers/sec is the rate of read and write operations on the disk.
215
Disk Reads/sec is the rate of read operations on the disk.
217
Disk Writes/sec is the rate of write operations on the disk.
219
Disk Bytes/sec is the rate bytes are transferred to or from the disk during write or read operations.
221
Disk Read Bytes/sec is the rate at which bytes are transferred from the disk during read operations.
223
Disk Write Bytes/sec is rate at which bytes are transferred to the disk during write operations.
225
Avg. Disk Bytes/Transfer is the average number of bytes transferred to or from the disk during write or read operations.
227
Avg. Disk Bytes/Read is the average number of bytes transferred from the disk during read operations.
229
Avg. Disk Bytes/Write is the average number of bytes transferred to the disk during write operations.
231
The Process performance object consists of counters that monitor running application program and system processes.  All the threads in a process share the same address space and have access to the same data.
233
The Thread performance object consists of counters that measure aspects of thread behavior.  A thread is the basic object that executes instructions on a processor.  All running processes have at least one thread.
235
The Physical Disk performance object consists of counters that monitor hard or fixed disk drive on a computer.  Disks are used to store file, program, and paging data and are read to retrieve these items, and written to record changes to them.  The values of physical disk counters are sums of the values of the logical disks (or partitions) into which they are divided.
237
The Logical Disk performance object consists of counters that monitor logical partitions of a hard or fixed disk drives.  Performance Monitor identifies logical disks by their a drive letter, such as C.
239
The Processor performance object consists of counters that measure aspects of processor activity The processor is the part of the computer that performs arithmetic and logical computations, initiates operations on peripherals, and runs the threads of processes.  A computer can have multiple processors.  The processor object represents each processor as an instance of the object.
241
% Total Processor Time is the average percentage of time that all processors on the computer are executing non-idle threads.   This counter was designed as the primary indicator of processor activity on multiprocessor computers.  It is equal to the sum of Process: % Processor Time for all processors, divided by the number of processors.  It is calculated by summing the time that all processors spend executing the thread of the Idle process in each sample interval, subtracting that value from 100%, and dividing the difference by the number of processors on the computer.  (Each processor has an Idle thread which consumes cycles when no other threads are ready to run). For example, on a multiprocessor computer, a value of 50% means that all processors are busy for half of the sample interval, or that half of the processors are busy for all of the sample interval.  This counter displays the average percentage of busy time observed during the sample interval.  It is calculated by monitoring the time the service was inactive, and then subtracting that value from 100%.
243
% Total User Time is the average percentage of non-idle time all processors spend in user mode.  It is the sum of Processor: % User Time for all processors on the computer, divided by the number of processors.  System: % Total User Time and System: % Total Privileged Time sum to % Total Processor Time, but not always to 100%.  (User mode is a restricted processing mode designed for applications, environment subsystems, and integral subsystems.  The alternative, privileged mode, is designed for operating system components and allows direct access to hardware and all memory.  The operating system switches application threads to privileged mode to access operating system services). This counter displays the average busy time as a percentage of the sample time.
245
% Total Privileged Time is the average percentage of non-idle time all processors spend in privileged (kernel) mode.  It is the sum of Processor: % Privileged Time for all processors on the computer, divided by the number of processors.  System: % Total User Time and System: % Total Privileged Time sum to % Total Processor Time, but not always to 100%.  (Privileged mode is an processing mode designed for operating system components which allows direct access to hardware and all memory.  The operating system switches application threads to privileged mode to access operating system services.  The alternative, user mode, is a restricted processing mode designed for applications and environment subsystems). This counter displays the average busy time as a percentage of the sample time.
247
Total Interrupts/sec is the combined rate of hardware interrupts received and serviced by all processors on the computer It is the sum of Processor: Interrupts/sec for all processors, and divided by the number of processors, and is measured in numbers of interrupts.  It does not include DPCs, which are counted separately.  This value is an indirect indicator of the activity of devices that generate interrupts, such as the system timer, the mouse, disk drivers, data communication lines, network interface cards and other peripheral devices.  These devices normally interrupt the processor when they have completed a task or require attention.  Normal thread execution is suspended during interrupts.  Most system clocks interrupt the processor every 10 milliseconds, creating a background of interrupt activity.  This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.
249
Processes is the number of processes in the computer at the time of data collection. This is an instantaneous count, not an average over the time interval.  Each process represents the running of a program.
251
Threads is the number of threads in the computer at the time of data collection. This is an instantaneous count, not an average over the time interval.  A thread is the basic executable entity that can execute instructions in a processor.
253
Events is the number of events in the computer at the time of data collection. This is an instantaneous count, not an average over the time interval.  An event is used when two or more threads try to synchronize execution.
255
Semaphores is the number of semaphores in the computer at the time of data collection. This is an instantaneous count, not an average over the time interval.  Threads use semaphores to obtain exclusive access to data structures that they share with other threads.
257
Mutexes counts the number of mutexes in the computer at the time of data collection. This is an instantaneous count, not an average over the time interval.  Mutexes are used by threads to assure only one thread is executing a particular section of code.
259
Sections is the number of sections in the computer at the time of data collection. This is an instantaneous count, not an average over the time interval.  A section is a portion of virtual memory created by a process for storing data. A process can share sections with other processes.
261
The Object performance object consists of counters that monitor  logical objects in the system, such as processes, threads, mutexes, and semaphores.  This information can be used to detect the unnecessary consumption of computer resources.  Each object requires memory to store basic information about the object.
263
The Redirector performance object consists of counter that monitor network connections originating at the local computer.
265
Bytes Received/sec is the rate of bytes coming in to the Redirector from the network.  It includes all application data as well as network protocol information (such as packet headers).
267
Packets Received/sec is the rate at which the Redirector is receiving packets (also called SMBs or Server Message Blocks).  Network transmissions are divided into packets.  The average number of bytes received in a packet can be obtained by dividing Bytes Received/sec by this counter.  Some packets received might not contain incoming data (for example an acknowledgment to a write made by the Redirector would count as an incoming packet).
269
Read Bytes Paging/sec is the rate at which the Redirector is attempting to read bytes in response to page faults.  Page faults are caused by loading of modules (such as programs and libraries), by a miss in the Cache (see Read Bytes Cache/sec), or by files directly mapped into the address space of applications (a high-performance feature of Windows NT).
271
Read Bytes Non-Paging/sec are those bytes read by the Redirector in response to normal file requests by an application when they are redirected to come from another computer.  In addition to file requests, this counter includes other methods of reading across the network such as Named Pipes and Transactions.  This counter does not count network protocol information, just application data.
273
Read Bytes Cache/sec is the rate at which applications are accessing the file system cache by using the Redirector.  Some of these data requests are satisfied by retrieving the data from the cache.  Requests that miss the Cache cause a page fault (see Read Bytes Paging/sec).
275
Read Bytes Network/sec is the rate at which applications are reading data across the network. This occurs when data sought in the file system cache is not found there and must be retrieved from the network.  Dividing this value by Bytes Received/sec indicates the proportion of application data traveling across the network. (see Bytes Received/sec).
277
Bytes Transmitted/sec is the rate at which bytes are leaving the Redirector to the network.  It includes all application data as well as network protocol information (such as packet headers and the like).
279
Packets Transmitted/sec is the rate at which the Redirector is sending packets (also called SMBs or Server Message Blocks).  Network transmissions are divided into packets.  The average number of bytes transmitted in a packet can be obtained by dividing Bytes Transmitted/sec by this counter.
281
Write Bytes Paging/sec is the rate at which the Redirector is attempting to write bytes changed in the pages being used by applications.  The program data changed by modules (such as programs and libraries) that were loaded over the network are 'paged out' when no longer needed.  Other output pages come from the file system cache (see Write Bytes Cache/sec).
283
Write Bytes Non-Paging/sec is the rate at which bytes are written by the Redirector in response to normal file outputs by an application when they are redirected to another computer.  In addition to file requests, this count includes other methods of writing across the network, such as Named Pipes and Transactions.  This counter does not count network protocol information, just application data.
285
Write Bytes Cache/sec is the rate at which applications on your computer are writing to the file system cache by using the Redirector.  The data might not leave your computer immediately; it can be retained in the cache for further modification before being written to the network.  This saves network traffic.  Each write of a byte into the cache is counted here.
287
Write Bytes Network/sec is the rate at which applications are writing data across the network. This occurs when the file system cache is bypassed, such as for Named Pipes or Transactions, or when the cache writes the bytes to disk to make room for other data.  Dividing this counter by Bytes Transmitted/sec will indicate the proportion of application data being to the network (see Transmitted Bytes/sec).
289
File Read Operations/sec is the rate at which applications are asking the Redirector for data. Each call to a file system or similar Application Program Interface (API) call counts as one operation.
291
Read Operations Random/sec counts the rate at which, on a file-by-file basis, reads are made that are not sequential.  If a read is made using a particular file handle, and then is followed by another read that is not immediately the contiguous next byte, this counter is incremented by one.
293
Read Packets/sec is the rate at which read packets are being placed on the network.  Each time a single packet is sent with a request to read data remotely, this counter is incremented by one.
295
Reads Large/sec is the rate at which reads over 2 times the server's negotiated buffer size are made by applications.  Too many of these could place a strain on server resources.  This counter is incremented once for each read. It does not count packets.
297
Read Packets Small/sec is the rate at which reads less than one-fourth of the server's negotiated buffer size are made by applications.  Too many of these could indicate a waste of buffers on the server.  This counter is incremented once for each read. It does not count packets.
299
File Write Operations/sec is the rate at which applications are sending data to the Redirector. Each call to a file system or similar Application Program Interface (API) call counts as one operation.
301
Write Operations Random/sec is the rate at which, on a file-by-file basis, writes are made that are not sequential.  If a write is made using a particular file handle, and then is followed by another write that is not immediately the next contiguous byte, this counter is incremented by one.
303
Write Packets/sec is the rate at which writes are being sent to the network.  Each time a single packet is sent with a request to write remote data, this counter is incremented by one.
305
Writes Large/sec is the rate at which writes are made by applications that are over 2 times the server's negotiated buffer size.  Too many of these could place a strain on server resources.  This counter is incremented once for each write: it counts writes, not packets.
307
Write Packets Small/sec is the rate at which writes are made by applications that are less than one-fourth of the server's negotiated buffer size.  Too many of these could indicate a waste of buffers on the server.  This counter is incremented once for each write: it counts writes, not packets.
309
Reads Denied/sec is the rate at which the server is unable to accommodate requests for Raw Reads.  When a read is much larger than the server's negotiated buffer size, the Redirector requests a Raw Read which, if granted, would permit the transfer of the data without lots of protocol overhead on each packet.  To accomplish this the server must lock out other requests, so the request is denied if the server is really busy.
311
Writes Denied/sec is the rate at which the server is unable to accommodate requests for Raw Writes.  When a write is much larger than the server's negotiated buffer size, the Redirector requests a Raw Write which, if granted, would permit the transfer of the data without lots of protocol overhead on each packet.  To accomplish this the server must lock out other requests, so the request is denied if the server is really busy.
313
Network Errors/sec is the rate at which serious unexpected errors are occurring. Such errors generally indicate that the Redirector and one or more Servers are having serious communication difficulties. For example an SMB (Server Manager Block) protocol error is a Network Error. An entry is written to the System Event Log and provide details.
315
Server Sessions counts the total number of security objects the Redirector has managed.  For example, a logon to a server followed by a network access to the same server will establish one connection, but two sessions.
317
Server Reconnects counts the number of times your Redirector has had to reconnect to a server in order to complete a new active request.  You can be disconnected by the Server if you remain inactive for too long.  Locally even if all your remote files are closed, the Redirector will keep your connections intact for (nominally) ten minutes.  Such inactive connections are called Dormant Connections.  Reconnecting is expensive in time.
319
Connects Core counts the number of connections you have to servers running the original MS-Net SMB protocol, including MS-Net itself and Xenix and VAX's.
321
Connects LAN Manager 2.0 counts connections to LAN Manager 2.0 servers, including LMX servers.
323
Connects LAN Manager 2.1 counts connections to LAN Manager 2.1 servers, including LMX servers.
325
Connects Windows NT counts the connections to Windows 2000 or earlier computers.
327
Server Disconnects counts the number of times a Server has disconnected your Redirector.  See also Server Reconnects.
329
Server Sessions Hung counts the number of active sessions that are timed out and unable to proceed due to a lack of response from the remote server.
331
The Server performance object consists of counters that measure communication between the  local computer and the network.
333
The number of bytes the server has received from the network.  Indicates how busy the server is.
335
The number of bytes the server has sent on the network.  Indicates how busy the server is.
337
Thread Wait Reason is only applicable when the thread is in the Wait state (see Thread State).  It is 0 or 7 when the thread is waiting for the Executive, 1 or 8 for a Free Page, 2 or 9 for a Page In, 3 or 10 for a Pool Allocation, 4 or 11 for an Execution Delay, 5 or 12 for a Suspended condition, 6 or 13 for a User Request, 14 for an Event Pair High, 15 for an Event Pair Low, 16 for an LPC Receive, 17 for an LPC Reply, 18 for Virtual Memory, 19 for a Page Out; 20 and higher are not assigned at the time of this writing.  Event Pairs are used to communicate with protected subsystems (see Context Switches).
339
% DPC Time is the percentage of time that the processor spent receiving and servicing deferred procedure calls (DPCs) during the sample interval. DPCs are interrupts that run at a lower priority than standard interrupts. % DPC Time is a component of % Privileged Time because DPCs are executed in privileged mode. They are counted separately and are not a component of the interrupt counters. This counter displays the average busy time as a percentage of the sample time.
341
The number of sessions that have been closed due to their idle time exceeding the AutoDisconnect parameter for the server.  Shows whether the AutoDisconnect setting is helping to conserve resources.
343
The number of sessions that have been closed due to unexpected error conditions or sessions that have reached the autodisconnect timeout and have been disconnected normally.
345
The number of sessions that have terminated normally.  Useful in interpreting the Sessions Times Out and Sessions Errored Out statistics--allows percentage calculations.
347
The number of sessions that have been forced to logoff.  Can indicate how many sessions were forced to logoff due to logon time constraints.
349
The number of failed logon attempts to the server.  Can indicate whether password guessing programs are being used to crack the security on the server.
351
The number of times opens on behalf of clients have failed with STATUS_ACCESS_DENIED.  Can indicate whether somebody is randomly attempting to access files in hopes of getting at something that was not properly protected.
353
The number of times accesses to files opened successfully were denied.  Can indicate attempts to access files without proper access authorization.
355
The number of times an internal Server Error was detected.  Unexpected errors usually indicate a problem with the Server.
357
The number of times the server has rejected blocking SMBs due to insufficient count of free work items.  Indicates whether the MaxWorkItem or MinFreeWorkItems server parameters might need to be adjusted.
359
The number of times STATUS_DATA_NOT_ACCEPTED was returned at receive indication time.  This occurs when no work item is available or can be allocated to service the incoming request.  Indicates whether the InitWorkItems or MaxWorkItems parameters might need to be adjusted.
361
The number of successful open attempts performed by the server of behalf of clients.  Useful in determining the amount of file I/O, determining overhead for path-based operations, and for determining the effectiveness of open locks.
363
The number of files currently opened in the server.  Indicates current server activity.
365
The number of sessions currently active in the server.  Indicates current server activity.
367
The number of searches for files currently active in the server.  Indicates current server activity.
369
The number of bytes of non-pageable computer memory the server is using.  This value is useful for determining the values of the MaxNonpagedMemoryUsage value entry in the Windows NT Registry.
371
The number of times allocations from nonpaged pool have failed.  Indicates that the computer's physical memory is too small.
373
The maximum number of bytes of nonpaged pool the server has had in use at any one point.  Indicates how much physical memory the computer should have.
375
The number of bytes of pageable computer memory the server is currently using.  Can help in determining good values for the MaxPagedMemoryUsage parameter.
377
The number of times allocations from paged pool have failed.  Indicates that the computer's physical memory or paging file are too small.
379
The maximum number of bytes of paged pool the server has had allocated.  Indicates the proper sizes of the Page File(s) and physical memory.
381
Server Announce Allocations Failed/sec is the rate at which server (or domain) announcements have failed due to lack of memory.
383
Mailslot Allocations Failed is the number of times the datagram receiver has failed to allocate a buffer to hold a user mailslot write.
385
Mailslot Receives Failed indicates the number of mailslot messages that could not be received due to transport failures.
387
Mailslot Writes Failed is the total number of mailslot messages that have been successfully received, but that could not be written to the mailslot.
389
Bytes Total/sec is the rate the Redirector is processing data bytes.  This includes all application and file data in addition to protocol information such as packet headers.
391
File Data Operations/sec is the rate at which the Redirector is processing data operations. One operation should include many bytes, since each operation has overhead. The efficiency of this path can be determined by dividing the Bytes/sec by this counter to obtain the average number of bytes transferred per operation.
393
Current Commands counter indicates the number of pending commands from the local computer to all destination servers.  If the Current Commands counter shows a high number and the local computer is idle, this may indicate a network-related problem or a redirector bottleneck on the local computer.
395
The number of bytes the server has sent to and received from the network.  This value provides an overall indication of how busy the server is.
397
% Interrupt Time is the time the processor spends receiving and servicing hardware interrupts during sample intervals. This value is an indirect indicator of the activity of devices that generate interrupts, such as the system clock, the mouse, disk drivers, data communication lines, network interface cards and other peripheral devices. These devices normally interrupt the processor when they have completed a task or require attention. Normal thread execution is suspended during interrupts. Most system clocks interrupt the processor every 10 milliseconds, creating a background of interrupt activity. suspends normal thread execution during interrupts. This counter displays the average busy time as a percentage of the sample time.
399
The NWLink NetBIOS performance object consists of counters that monitor IPX transport rates and connections.
401
Packets/sec is the rate the Redirector is processing data packets.  One packet includes (hopefully) many bytes.  We say hopefully here because each packet has protocol overhead.  You can determine the efficiency of this path by dividing the Bytes/sec by this counter to determine the average number of bytes transferred/packet.  You can also divide this counter by Operations/sec to determine the average number of packets per operation, another measure of efficiency.
405
Context Blocks Queued per second is the rate at which work context blocks had to be placed on the server's FSP queue to await server action.
407
File Data Operations/ sec is the combined rate of read and write operations on all logical disks on the computer.  This is the inverse of System: File Control Operations/sec.  This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.
409
% Free Space is the percentage of total usable space on the selected logical disk drive that was free.
411
Free Megabytes displays the unallocated space, in megabytes, on the disk drive in megabytes. One megabyte is equal to 1,048,576 bytes.
413
Connections Open is the number of connections currently open for this protocol.  This counter shows the current count only and does not accumulate over time.
415
Connections No Retries is the total count of connections that were successfully made on the first try.  This number is an accumulator and shows a running total.
417
Connections With Retries is the total count of connections that were made after retrying the attempt.  A retry occurs when the first connection attempt failed.  This number is an accumulator and shows a running total.
419
Disconnects Local is the number of session disconnections that were initiated by the local computer.  This number is an accumulator and shows a running total.
421
Disconnects Remote is the number of session disconnections that were initiated by the remote computer.  This number is an accumulator and shows a running total.
423
Failures Link is the number of connections that were dropped due to a link failure.  This number is an accumulator and shows a running total.
425
Failures Adapter is the number of connections that were dropped due to an adapter failure.  This number is an accumulator and shows a running total.
427
Connection Session Timeouts is the number of connections that were dropped due to a session timeout.  This number is an accumulator and shows a running total.
429
Connections Canceled is the number of connections that were canceled.  This number is an accumulator and shows a running total.
431
Failures Resource Remote is the number of connections that failed because of resource problems or shortages on the remote computer.  This number is an accumulator and shows a running total.
433
Failures Resource Local is the number of connections that failed because of resource problems or shortages on the local computer.  This number is an accumulator and shows a running total.
435
Failures Not Found is the number of connection attempts that failed because the remote computer could not be found.  This number is an accumulator and shows a running total.
437
Failures No Listen is the number of connections that were rejected because the remote computer was not listening for connection requests.
439
Datagrams/sec is the rate at which datagrams are processed by the computer.  This counter displays the sum of datagrams sent and datagrams received.  A datagram is a connectionless packet whose delivery to a remote is not guaranteed.
441
Datagram Bytes/sec is the rate at which datagram bytes are processed by the computer.  This counter is the sum of datagram bytes that are sent as well as received.  A datagram is a connectionless packet whose delivery to a remote is not guaranteed.
443
Datagrams Sent/sec is the rate at which datagrams are sent from the computer.  A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
445
Datagram Bytes Sent/sec is the rate at which datagram bytes are sent from the computer.  A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
447
Datagrams Received/sec is the rate at which datagrams are received by the computer.  A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
449
Datagram Bytes Received/sec is the rate at which datagram bytes are received by the computer.  A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
451
Packets/sec is the rate at which packets are processed by the computer.  This count is the sum of Packets Sent and Packets Received per second.  This counter includes all packets processed: control as well as data packets.
453
Packets Sent/sec is the rate at which packets are sent by the computer.  This counter counts all packets sent by the computer, i.e. control as well as data packets.
455
Packets Received/sec is the rate at which packets are received by the computer.  This counter counts all packets processed: control as well as data packets.
457
Frames/sec is the rate at which data frames (or packets) are processed by the computer.  This counter is the sum of data frames sent and data frames received.  This counter only counts those frames (packets) that carry data.
459
Frame Bytes/sec is the rate at which data bytes are processed by the computer.  This counter is the sum of data frame bytes sent and received.  This counter only counts the byte in frames (packets) that carry data.
461
Frames Sent/sec is the rate at which data frames are sent by the computer.  This counter only counts the frames (packets) that carry data.
463
Frame Bytes Sent/sec is the rate at which data bytes are sent by the computer.  This counter only counts the bytes in frames (packets) that carry data.
465
Frames Received/sec is the rate at which data frames are received by the computer.  This counter only counts the frames (packets) that carry data.
467
Frame Bytes Received/sec is the rate at which data bytes are received by the computer.  This counter only counts the frames (packets) that carry data.
469
Frames Re-Sent/sec is the rate at which data frames (packets) are re-sent by the computer.  This counter only counts the frames or packets that carry data.
471
Frame Bytes Re-Sent/sec is the rate at which data bytes are re-sent by the computer.  This counter only counts the bytes in frames that carry data.
473
Frames Rejected/sec is the rate at which data frames are rejected.  This counter only counts the frames (packets) that carry data.
475
Frame Bytes Rejected/sec is the rate at which data bytes are rejected.  This counter only counts the bytes in data frames (packets) that carry data.
477
Expirations Response is the count of T1 timer expirations.
479
Expirations Ack is the count of T2 timer expirations.
481
Window Send Maximum is the maximum number of bytes of data that will be sent before waiting for an acknowledgment from the remote computer.
483
Window Send Average is the running average number of data bytes that were sent before waiting for an acknowledgment from the remote computer.
485
Piggyback Ack Queued/sec is the rate at which piggybacked acknowledgments are queued. Piggyback acknowledgments are acknowledgments to received packets that are to be included in the next outgoing packet to the remote computer.
487
Piggyback Ack Timeouts is the number of times that a piggyback acknowledgment could not be sent because there was no outgoing packet to the remote on which to piggyback.  A piggyback ack is an acknowledgment to a received packet that is sent along in an outgoing data packet to the remote computer.  If no outgoing packet is sent within the timeout period, then an ack packet is sent and this counter is incremented.
489
The NWLink IPX performance object consists of counters that measure datagram transmission to and from computers using the IPX protocol.
491
The NWLink SPX performance object consist of counters that measure data transmission and session connections for computers using the SPX protocol.
493
The NetBEUI performance object consists of counters that measure data transmission for network activity which conforms to the NetBIOS End User Interface standard.
495
The NetBEUI Resource performance object consists of counters that track the use of buffers by the NetBEUI protocol.
497
Used Maximum is the maximum number of NetBEUI resources (buffers) in use at any point in time.  This value is useful in sizing the maximum resources provided.  The number in parentheses following the resource name is used to identify the resource in Event Log messages.
499
Used Average is the current number of resources (buffers) in use at this time.  The number in parentheses following the resource name is used to identify the resource in Event Log messages.
501
Times Exhausted is the number of times all the resources (buffers) were in use.  The number in parentheses following the resource name is used to identify the resource in Event Log messages.
503
The NBT Connection performance object consists of counters that measure the rates at which bytes are sent and received over the NBT connection between the local computer and a remote computer.  The connection is identified by the name of the remote computer.
505
Bytes Received/sec is the rate at which bytes are received by the local computer over an NBT connection to some remote computer.  All the bytes received by the local computer over the particular NBT connection are counted.
507
Bytes Sent/sec is the rate at which bytes are sent by the local computer over an NBT connection to some remote computer.  All the bytes sent by the local computer over the particular NBT connection are counted.
509
Bytes Total/sec is the rate at which bytes are sent or received by the local computer over an NBT connection to some remote computer.  All the bytes sent or received by the local computer over the particular NBT connection are counted.
511
The Network Interface performance object consists of counters that measure the rates at which bytes and packets are sent and received over a TCP/IP network connection.  It includes counters that monitor connection errors.
513
Bytes Total/sec is the rate at which bytes are sent and received over each network adapter, including framing characters. Network Interface\Bytes Total/sec is a sum of Network Interface\Bytes Received/sec and Network Interface\Bytes Sent/sec.
515
Packets/sec is the rate at which packets are sent and received on the network interface.
517
Packets Received/sec is the rate at which packets are received on the network interface.
519
Packets Sent/sec is the rate at which packets are sent on the network interface.
521
Current Bandwidth is an estimate of the current bandwidth of the network interface in bits per second (BPS).  For interfaces that do not vary in bandwidth or for those where no accurate estimation can be made, this value is the nominal bandwidth.
523
Bytes Received/sec is the rate at which bytes are received over each network adapter, including framing characters. Network Interface\Bytes Received/sec is a subset of Network Interface\Bytes Total/sec.
525
Packets Received Unicast/sec is the rate at which (subnet) unicast packets are delivered to a higher-layer protocol.
527
Packets Received Non-Unicast/sec is the rate at which non-unicast (subnet broadcast or subnet multicast) packets are delivered to a higher-layer protocol.
529
Packets Received Discarded is the number of inbound packets that were chosen to be discarded even though no errors had been detected to prevent their delivery to a higher-layer protocol.  One possible reason for discarding packets could be to free up buffer space.
531
Packets Received Errors is the number of inbound packets that contained errors preventing them from being deliverable to a higher-layer protocol.
533
Packets Received Unknown is the number of packets received through the interface that were discarded because of an unknown or unsupported protocol.
535
Bytes Sent/sec is the rate at which bytes are sent over each network adapter, including framing characters. Network Interface\Bytes Sent/sec is a subset of Network Interface\Bytes Total/sec.
537
Packets Sent Unicast/sec is the rate at which packets are requested to be transmitted to subnet-unicast addresses by higher-level protocols.  The rate includes the packets that were discarded or not sent.
539
Packets Sent Non-Unicast/sec is the rate at which packets are requested to be transmitted to non-unicast (subnet broadcast or subnet multicast) addresses by higher-level protocols.  The rate includes the packets that were discarded or not sent.
541
Packets Outbound Discarded is the number of outbound packets that were chosen to be discarded even though no errors had been detected to prevent transmission. One possible reason for discarding packets could be to free up buffer space.
543
Packets Outbound Errors is the number of outbound packets that could not be transmitted because of errors.
545
Output Queue Length is the length of the output packet queue (in packets). If this is longer than two, there are delays and the bottleneck should be found and eliminated, if possible. Since the requests are queued by the Network Driver Interface Specification (NDIS) in this implementation, this will always be 0.
547
The IP performance object consists of counters that measure the rates at which IP datagrams are sent and received by using IP protocols.  It also includes counters that monitor IP protocol errors.
549
Datagrams/sec is the rate, in incidents per second, at which IP datagrams were received from or sent to the interfaces, including those in error. Forwarded datagrams are not included in this rate.
551
Datagrams Received/sec is the rate, in incidents per second, at which IP datagrams are received from the interfaces, including those in error. Datagrams Received/sec is a subset of Datagrams/sec.
553
Datagrams Received Header Errors is the number of input datagrams that were discarded due to errors in the IP headers, including bad checksums, version number mismatch, other format errors, time-to-live exceeded, errors discovered in processing their IP options, etc.
555
Datagrams Received Address Errors is the number of input datagrams that were discarded because the IP address in their IP header destination field was not valid for the computer. This count includes invalid addresses (for example, 0.0.  0.0) and addresses of unsupported Classes (for example, Class E). For entities that are not IP gateways and do not forward datagrams, this counter includes datagrams that were discarded because the destination address was not a local address.
557
Datagrams Forwarded/sec is the rate, in incidents per second, at which attemps were made to find routes to forward input datagrams their final destination, because the local server was not the final IP destination. In servers that do not act as IP Gateways, this rate includes only packets that were source-routed via this entity, where the source-route option processing was successful.
559
Datagrams Received Unknown Protocol is the number of locally-addressed datagrams that were successfully received but were discarded because of an unknown or unsupported protocol.
561
Datagrams Received Discarded is the number of input IP datagrams that were discarded even though problems prevented their continued processing (for example, lack of buffer space). This counter does not include any datagrams discarded while awaiting re-assembly.
563
Datagrams Received Delivered/sec is the rate, in incidents per second, at which input datagrams were successfully delivered to IP user-protocols, including Internet Control Message Protocol (ICMP).
565
Datagrams Sent/sec is the rate, in incidents per second, at which IP datagrams were supplied for transmission by local IP user-protocols (including ICMP). This counter does not include any datagrams counted in Datagrams Forwarded/sec. Datagrams Sent/sec is a subset of Datagrams/sec.
567
Datagrams Outbound Discarded is the number of output IP datagrams that were discarded even though no problems were encountered to prevent their transmission to their destination (for example, lack of buffer space). This counter includes datagrams counted in Datagrams Forwarded/sec that meet this criterion.
569
Datagrams Outbound No Route is the number of IP datagrams that were discarded because no route could be found to transmit them to their destination.  This counter includes any packets counted in Datagrams Forwarded/sec that meet this no route' criterion.
571
Fragments Received/sec is the rate, in incidents per second, at which IP fragments that need to be reassembled at this entity are received.
573
Fragments Re-assembled/sec is the rate, in incidents per second, at which IP fragments were successfully reassembled.
575
Fragment Re-assembly Failures is the number of failures detected by the IP reassembly algorithm, such as time outs, errors, etc.  This is not necessarily a count of discarded IP fragments since some algorithms (notably RFC 815) lose track of the number of fragments by combining them as they are received.
577
Fragmented Datagrams/sec is the rate, in incidents per second, at which datagrams are successfully fragmented.
579
Fragmentation Failures is the number of IP datagrams that were discarded because they needed to be fragmented at but could not be (for example, because the Don't Fragment' flag was set).
581
Fragments Created/sec is the rate, in incidents per second, at which IP datagram fragments were generated as a result of fragmentation.
583
The ICMP performance object consists of counters that measure the rates at which messages are sent and received by using ICMP protocols.  It also includes counters that monitor ICMP protocol errors.
585
Messages/sec is the total rate, in incidents per second, at which ICMP messages were sent and received by the entity. The rate includes messages received or sent in error.
587
Messages Received/sec is the rate, in incidents per second at which ICMP messages were received. The rate includes messages received in error.
589
Messages Received Errors is the number of ICMP messages that the entity received but had errors, such as bad ICMP checksums, bad length, etc.
591
Received Destination Unreachable is the number of ICMP Destination Unreachable messages received.
593
Received Time Exceeded is the number of ICMP Time Exceeded messages received.
595
Received Parameter Problem is the number of ICMP Parameter Problem messages received.
597
Received Source Quench is the number of ICMP Source Quench messages received.
599
Received Redirect/sec is the rate, in incidents per second, at which ICMP Redirect messages were received.
601
Received Echo/sec is the rate, in incidents per second, at which ICMP Echo messages were received.
603
Received Echo Reply/sec is the rate, in incidents per second, at which ICMP Echo Reply messages were received.
605
Received Timestamp/sec is the rate, in incidents per second at which ICMP Timestamp Request messages were received.
607
Received Timestamp Reply/sec is the rate of ICMP Timestamp Reply messages received.
609
Received Address Mask is the number of ICMP Address Mask Request messages received.
611
Received Address Mask Reply is the number of ICMP Address Mask Reply messages received.
613
Messages Sent/sec is the rate, in incidents per second, at which the server attempted to send. The rate includes those messages sent in error.
615
Messages Outbound Errors is the number of ICMP messages that were not send due to problems within ICMP, such as lack of buffers.  This value does not include errors discovered outside the ICMP layer, such as those recording the failure of IP to route the resultant datagram.  In some implementations, none of the error types are included in the value of this counter.
617
Sent Destination Unreachable is the number of ICMP Destination Unreachable messages sent.
619
Sent Time Exceeded is the number of ICMP Time Exceeded messages sent.
621
Sent Parameter Problem is the number of ICMP Parameter Problem messages sent.
623
Sent Source Quench is the number of ICMP Source Quench messages sent.
625
Sent Redirect/sec is the rate, in incidents per second, at which ICMP Redirect messages were sent.
627
Sent Echo/sec is the rate of ICMP Echo messages sent.
629
Sent Echo Reply/sec is the rate, in incidents per second, at which ICMP Echo Reply messages were sent.
631
Sent Timestamp/sec is the rate, in incidents per second, at which ICMP Timestamp Request messages were sent.
633
Sent Timestamp Reply/sec is the rate, in incidents per second,  at which ICMP Timestamp Reply messages were sent.
635
Sent Address Mask is the number of ICMP Address Mask Request messages sent.
637
Sent Address Mask Reply is the number of ICMP Address Mask Reply messages sent.
639
The TCP performance object consists of counters that measure the rates at which TCP Segments are sent and received by using the TCP protocol.  It includes counters that monitor the number of TCP connections in each TCP connection state.
641
Segments/sec is the rate at which TCP segments are sent or received using the TCP protocol.
643
Connections Established is the number of TCP connections for which the current state is either ESTABLISHED or CLOSE-WAIT.
645
Connections Active is the number of times TCP connections have made a direct transition to the SYN-SENT state from the CLOSED state. In other words, it shows a number of connections which are initiated by the local computer. The value is a cumulative total.
647
Connections Passive is the number of times TCP connections have made a direct transition to the SYN-RCVD state from the LISTEN state. In other words, it shows a number of connections to the local computer, which are initiated by remote computers. The value is a cumulative total.
649
Connection Failures is the number of times TCP connections have made a direct transition to the CLOSED state from the SYN-SENT state or the SYN-RCVD state, plus the number of times TCP connections have made a direct transition to the LISTEN state from the SYN-RCVD state.
651
Connections Reset is the number of times TCP connections have made a direct transition to the CLOSED state from either the ESTABLISHED state or the CLOSE-WAIT state.
653
Segments Received/sec is the rate at which segments are received, including those received in error.  This count includes segments received on currently established connections.
655
Segments Sent/sec is the rate at which segments are sent, including those on current connections, but excluding those containing only retransmitted bytes.
657
Segments Retransmitted/sec is the rate at which segments are retransmitted, that is, segments transmitted containing one or more previously transmitted bytes.
659
The UDP performance object consists of counters that measure the rates at which UDP datagrams are sent and received by using the UDP protocol.  It includes counters that monitor UDP protocol errors.
661
Datagrams/sec is the rate at which UDP datagrams are sent or received by the entity.
663
Datagrams Received/sec is the rate at which UDP datagrams are delivered to UDP users.
665
Datagrams No Port/sec is the rate of received UDP datagrams for which there was no application at the destination port.
667
Datagrams Received Errors is the number of received UDP datagrams that could not be delivered for reasons other than the lack of an application at the destination port.
669
Datagrams Sent/sec is the rate at which UDP datagrams are sent from the entity.
671
Disk Storage device statistics from the foreign computer
673
The number of allocation failures reported by the disk storage device
675
System Up Time is the elapsed time (in seconds) that the computer has been running since it was last started.  This counter displays the difference between the start time and the current time.
677
The current number of system handles in use.
679
Free System Page Table Entries is the number of page table entries not currently in used by the system.  This counter displays the last observed value only; it is not an average.
681
The number of threads currently active in this process. An instruction is the basic unit of execution in a processor, and a thread is the object that executes instructions. Every running process has at least one thread.
683
The current base priority of this process. Threads within a process can raise and lower their own base priority relative to the process' base priority.
685
The total elapsed time, in seconds, that this process has been running.
687
Alignment Fixups/sec is the rate, in incidents per seconds, at alignment faults were fixed by the system.
689
Exception Dispatches/sec is the rate, in incidents per second, at which exceptions were dispatched by the system.
691
Floating Emulations/sec is the rate of floating emulations performed by the system.  This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.
693
Logon/sec is the rate of all server logons.
695
The current dynamic priority of this thread.  The system can raise the thread's dynamic priority above the base priority if the thread is handling user input, or lower it towards the base priority if the thread becomes compute bound.
697
The current base priority of this thread.  The system can raise the thread's dynamic priority above the base priority if the thread is handling user input, or lower it towards the base priority if the thread becomes compute bound.
699
The total elapsed time (in seconds) this thread has been running.
701
The Paging File performance object consists of counters that monitor the paging file(s) on the computer.  The paging file is a reserved space on disk that backs up committed physical memory on the computer.
703
The amount of the Page File instance in use in percent.  See also Process\\Page File Bytes.
705
The peak usage of the Page File instance in percent.  See also Process\\Page File Bytes Peak.
707
Starting virtual address for this thread.
709
Current User Program Counter for this thread.
711
Mapped Space is virtual memory that has been mapped  to a specific virtual address (or range of virtual addresses) in the process' virtual address space.  No Access protection prevents a process from writing to or reading from these pages and will generate an access violation if either is attempted.
713
Mapped Space is virtual memory that has been mapped  to a specific virtual address (or range of virtual addresses) in the process' virtual address space.  Read Only protection prevents the contents of these pages from being modified.  Any attempts to write or modify these pages will generate an access violation.
715
Mapped Space is virtual memory that has been mapped  to a specific virtual address (or range of virtual addresses) in the process' virtual address space.  Read/Write protection allows a process to read, modify and write to these pages.
717
Mapped Space is virtual memory that has been mapped  to a specific virtual address (or range of virtual addresses) in the process' virtual address space.  Write Copy protection is used when memory is shared for reading but not for writing.  When processes are reading this memory, they can share the same memory, however, when a sharing process wants to have write access to this shared memory, a copy of that memory is made.
719
Mapped Space is virtual memory that has been mapped  to a specific virtual address (or range of virtual addresses) in the process' virtual address space.  Executable memory is memory that can be executed by programs, but cannot be read or written.  This type of protection is not supported by all processor types.
721
Mapped Space is virtual memory that has been mapped  to a specific virtual address (or range of virtual addresses) in the process' virtual address space.  Execute/Read Only memory is memory that can be executed as well as read.
723
Mapped Space is virtual memory that has been mapped  to a specific virtual address (or range of virtual addresses) in the process' virtual address space.  Execute/Read/Write memory is memory that can be executed by programs as well as read and modified.
725
Mapped Space is virtual memory that has been mapped  to a specific virtual address (or range of virtual addresses) in the process' virtual address space.  Execute Write Copy is memory that can be executed by programs as well as read and written.  This type of protection is used when memory needs to be shared between processes.  If the sharing processes only read the memory, then they will all use the same memory.  If a sharing process desires write access, then a copy of this memory will be made for that process.
727
Reserved Space is virtual memory that has been reserved for future use by a process, but has not been mapped or committed.  No Access protection prevents a process from writing to or reading from these pages and will generate an access violation if either is attempted.
729
Reserved Space is virtual memory that has been reserved for future use by a process, but has not been mapped or committed.  Read Only protection prevents the contents of these pages from being modified.  Any attempts to write or modify these pages will generate an access violation.
731
Reserved Space is virtual memory that has been reserved for future use by a process, but has not been mapped or committed.  Read/Write protection allows a process to read, modify and write to these pages.
733
Reserved Space is virtual memory that has been reserved for future use by a process, but has not been mapped or committed.  Write Copy protection is used when memory is shared for reading but not for writing.  When processes are reading this memory, they can share the same memory, however, when a sharing process wants to have read/write access to this shared memory, a copy of that memory is made.
735
Reserved Space is virtual memory that has been reserved for future use by a process, but has not been mapped or committed.  Executable memory is memory that can be executed by programs, but cannot be read or written.  This type of protection is not supported by all processor types.
737
Reserved Space is virtual memory that has been reserved for future use by a process, but has not been mapped or committed.  Execute/Read Only memory is memory that can be executed as well as read.
739
Reserved Space is virtual memory that has been reserved for future use by a process, but has not been mapped or committed.  Execute/Read/Write memory is memory that can be executed by programs as well as read and modified.
741
The Image performance object consists of counters that monitor the virtual address usage of images executed by processes on the computer.
743
Reserved Space is virtual memory that has been reserved for future use by a process, but has not been mapped or committed.  Execute Write Copy is memory that can be executed by programs as well as read and written.  This type of protection is used when memory needs to be shared between processes.  If the sharing processes only read the memory, then they will all use the same memory.  If a sharing process desires write access, then a copy of this memory will be made for that process.
745
Unassigned Space is mapped and committed virtual memory in use by the process that is not attributable to any particular image being executed by that process.  No Access protection prevents a process from writing to or reading from these pages and will generate an access violation if either is attempted.
747
Unassigned Space is mapped and committed virtual memory in use by the process that is not attributable to any particular image being executed by that process.  Read Only protection prevents the contents of these pages from being modified.  Any attempts to write or modify these pages will generate an access violation.
749
Unassigned Space is mapped and committed virtual memory in use by the process that is not attributable to any particular image being executed by that process.  Read/Write protection allows a process to read, modify and write to these pages.
751
Unassigned Space is mapped and committed virtual memory in use by the process that is not attributable to any particular image being executed by that process.  Write Copy protection is used when memory is shared for reading but not for writing.  When processes are reading this memory, they can share the same memory, however, when a sharing process wants to have read/write access to this shared memory, a copy of that memory is made for writing to.
753
Unassigned Space is mapped and committed virtual memory in use by the process that is not attributable to any particular image being executed by that process.  Executable memory is memory that can be executed by programs, but cannot be read or written.  This type of protection is not supported by all processor types.
755
Unassigned Space is mapped and committed virtual memory in use by the process that is not attributable to any particular image being executed by that process.  Execute/Read Only memory is memory that can be executed as well as read.
757
Unassigned Space is mapped and committed virtual memory in use by the process that is not attributable to any particular image being executed by that process.  Execute/Read/Write memory is memory that can be executed by programs as well as read and written.
759
Unassigned Space is mapped and committed virtual memory in use by the process that is not attributable to any particular image being executed by that process.  Execute Write Copy is memory that can be executed by programs as well as read and written.  This type of protection is used when memory needs to be shared between processes.  If the sharing processes only read the memory, then they will all use the same memory.  If a sharing process desires write access, then a copy of this memory will be made for that process.
761
Image Space is the virtual address space in use by the images being executed by the process.  This is the sum of all the address space with this protection allocated by images run by the selected process  No Access protection prevents a process from writing to or reading from these pages and will generate an access violation if either is attempted.
763
Image Space is the virtual address space in use by the images being executed by the process.  This is the sum of all the address space with this protection allocated by images run by the selected process  Read Only protection prevents the contents of these pages from being modified.  Any attempts to write or modify these pages will generate an access violation.
765
Image Space is the virtual address space in use by the images being executed by the process.  This is the sum of all the address space with this protection allocated by images run by the selected process  Read/Write protection allows a process to read, modify and write to these pages.
767
Image Space is the virtual address space in use by the images being executed by the process.  This is the sum of all the address space with this protection allocated by images run by the selected process  Write Copy protection is used when memory is shared for reading but not for writing.  When processes are reading this memory, they can share the same memory, however, when a sharing process wants to have read/write access to this shared memory, a copy of that memory is made for writing to.
769
Image Space is the virtual address space in use by the images being executed by the process.  This is the sum of all the address space with this protection allocated by images run by the selected process  Executable memory is memory that can be executed by programs, but cannot be read or written.  This type of protection is not supported by all processor types.
771
Image Space is the virtual address space in use by the images being executed by the process.  This is the sum of all the address space with this protection allocated by images run by the selected process  Execute/Read-Only memory is memory that can be executed as well as read.
773
Image Space is the virtual address space in use by the images being executed by the process.  This is the sum of all the address space with this protection allocated by images run by the selected process  Execute/Read/Write memory is memory that can be executed by programs as well as read and written and modified.
775
Image Space is the virtual address space in use by the images being executed by the process.  This is the sum of all the address space with this protection allocated by images run by the selected process  Execute Write Copy is memory that can be executed by programs as well as read and written.  This type of protection is used when memory needs to be shared between processes.  If the sharing processes only read the memory, then they will all use the same memory.  If a sharing process desires write access, then a copy of this memory will be made for that process.
777
Bytes Image Reserved is the sum of all virtual memory reserved by images within this process.
779
Bytes Image Free is the amount of virtual address space that is not in use or reserved by images within this process.
781
Bytes Reserved is the total amount of virtual memory reserved for future use by this process.
783
Bytes Free is the total unused virtual address space of this process.
785
ID Process is the unique identifier of this process. ID Process numbers are reused, so they only identify a process for the lifetime of that process.
787
The Process Address Space performance object consists of counters that monitor memory allocation and use  for a selected process.
789
Image Space is the virtual address space in use by the selected image with this protection.  No Access protection prevents a process from writing or reading these pages and will generate an access violation if either is attempted.
791
Image Space is the virtual address space in use by the selected image with this protection.  Read Only protection prevents the contents of these pages from being modified.  Any attempts to write or modify these pages will generate an access violation.
793
Image Space is the virtual address space in use by the selected image with this protection.  Read/Write protection allows a process to read, modify and write to these pages.
795
Image Space is the virtual address space in use by the selected image with this protection.  Write Copy protection is used when memory is shared for reading but not for writing.  When processes are reading this memory, they can share the same memory, however, when a sharing process wants to have read/write access to this shared memory, a copy of that memory is made for writing to.
797
Image Space is the virtual address space in use by the selected image with this protection.  Executable memory is memory that can be executed by programs, but cannot be read or written.  This type of protection is not supported by all processor types.
799
Image Space is the virtual address space in use by the selected image with this protection.  Execute/Read Only memory is memory that can be executed as well as read.
801
Image Space is the virtual address space in use by the selected image with this protection.  Execute/Read/Write memory is memory that can be executed by programs as well as read and written.
803
Image Space is the virtual address space in use by the selected image with this protection.  Execute Write Copy is memory that can be executed by programs as well as read and written.  This type of protection is used when memory needs to be shared between processes.  If the sharing processes only read the memory, then they will all use the same memory.  If a sharing process desires write access, then a copy of this memory will be made for that process.
805
ID Thread is the unique identifier of this thread.  ID Thread numbers are reused, so they only identify a thread for the lifetime of that thread.
807
Mailslot Opens Failed/sec indicates the rate at which mailslot messages to be delivered to mailslots that are not present are received by this workstation.
809
Duplicate Master Announcements indicates the number of times that the master browser has detected another master browser on the same domain.
811
Illegal Datagrams/sec is the rate at which incorrectly formatted datagrams have been received by the workstation.
813
Announcements Total/sec is the sum of Announcements Server/sec and Announcements Domain/sec.
815
Enumerations Total/sec is the rate at which browse requests have been processed by this workstation.  This is the sum of Enumerations Server/sec, Enumerations Domain/sec, and Enumerations Other/sec.
817
The Thread Details performance object  consists of counters that measure aspects of thread behavior that are difficult or time-consuming or collect.  These counters are distinguished from those in the Thread object by their high overhead.
819
Cache Bytes is the sum of the Memory\\System Cache Resident Bytes, Memory\\System Driver Resident Bytes, Memory\\System Code Resident Bytes, and Memory\\Pool Paged Resident Bytes counters.  This counter displays the last observed value only; it is not an average.
821
Cache Bytes Peak is the maximum number of bytes used by the file system cache since the system was last restarted. This might be larger than the current size of the cache. This counter displays the last observed value only; it is not an average.
823
Pages Input/sec is the rate at which pages are read from disk to resolve hard page faults. Hard page faults occur when a process refers to a page in virtual memory that is not in its working set or elsewhere in physical memory, and must be retrieved from disk. When a page is faulted, the system tries to read multiple contiguous pages into memory to maximize the benefit of the read operation. Compare the value of Memory\\Pages Input/sec to the value of  Memory\\Page Reads/sec to determine the average number of pages read into memory during each read operation.
825
Transition Pages RePurposed is the rate at which the number of transition cache pages were reused for a different purpose.  These pages would have otherwise remained in the page cache to provide a (fast) soft fault (instead of retrieving it from backing store) in the event the page was accessed in the future.  Note these pages can contain private or sharable memory.
873
The number of bytes transmitted total for this connection.
875
The number of bytes received total for this connection.
877
The number of data frames transmitted total for this connection.
879
The number of data frames received total for this connection.
881
The compression ratio for bytes being transmitted.
883
The compression ratio for bytes being received.
885
The total number of CRC Errors for this connection.  CRC Errors occur when the frame received contains erroneous data.
887
The total number of Timeout Errors for this connection.  Timeout Errors occur when an expected is not received in time.
889
The total number of Serial Overrun Errors for this connection.  Serial Overrun Errors occur when the hardware cannot handle the rate at which data is received.
891
The total number of Alignment Errors for this connection.  Alignment Errors occur when a byte received is different from the byte expected.
893
The total number of Buffer Overrun Errors for this connection.  Buffer Overrun Errors when the software cannot handle the rate at which data is received.
895
The total number of CRC, Timeout, Serial Overrun, Alignment, and Buffer Overrun Errors for this connection.
897
The number of bytes transmitted per second.
899
The number of bytes received per second.
901
The number of frames transmitted per second.
903
The number of frames received per second.
905
The total number of CRC, Timeout, Serial Overrun, Alignment, and Buffer Overrun Errors per second.
909
The total number of Remote Access connections.
921
The WINS Server performance object consists of counters that monitor communications using the WINS Server service.
923
Unique Registrations/sec is the rate at which unique registration are received by the WINS server.
925
Group Registrations/sec is the rate at which group registration are received by the WINS server.
927
Total Number of Registrations/sec is the sum of the Unique and Group registrations per sec.  This is the total rate at which registration are received by the WINS server.
929
Unique Renewals/sec is the rate at which unique renewals are received by the WINS server.
931
Group Renewals/sec is the rate at which group renewals are received by the WINS server.
933
Total Number of Renewals/sec is the sum of the Unique and Group renewals per sec.  This is the total rate at which renewals are received by the WINS server.
935
Total Number of Releases/sec is the rate at which releases are received by the WINS server.
937
Total Number of Queries/sec is the rate at which queries are received by the WINS server.
939
Unique Conflicts/sec is the rate at which unique registrations/renewals received by the WINS server resulted in conflicts with records in the database.
941
Group Conflicts/sec is the rate at which group registration received by the WINS server resulted in conflicts with records in the database.
943
Total Number of Conflicts/sec is the sum of the Unique and Group conflicts per sec.  This is the total rate at which conflicts were seen by the WINS server.
945
Total Number of Successful Releases/sec
947
Total Number of Failed Releases/sec
949
Total Number of Successful Queries/sec
951
Total Number of Failed Queries/sec
953
The total number of handles currently open by this process. This number is equal to the sum of the handles currently open by each thread in this process.
1001
Services for Macintosh AFP File Server.
1003
The maximum amount of paged memory resources used by the MacFile Server.
1005
The current amount of paged memory resources used by the MacFile Server.
1007
The maximum amount of nonpaged memory resources use by the MacFile Server.
1009
The current amount of nonpaged memory resources used by the MacFile Server.
1011
The number of sessions currently connected to the MacFile server.  Indicates current server activity.
1013
The maximum number of sessions connected at one time to the MacFile server.  Indicates usage level of server.
1015
The number of internal files currently open in the MacFile server.  This count does not include files opened on behalf of Macintosh clients.
1017
The maximum number of internal files open at one time in the MacFile server.  This count does not include files opened on behalf of Macintosh clients.
1019
The number of failed logon attempts to the MacFile server.  Can indicate whether password guessing programs are being used to crack the security on the server.
1021
The number of bytes read from disk per second.
1023
The number of bytes written to disk per second.
1025
The number of bytes received from the network per second.  Indicates how busy the server is.
1027
The number of bytes sent on the network per second.  Indicates how busy the server is.
1029
The number of outstanding work items waiting to be processed.
1031
The maximum number of outstanding work items waiting at one time.
1033
The current number of threads used by MacFile server.  Indicates how busy the server is.
1035
The maximum number of threads used by MacFile server.  Indicates peak usage level of server.
1051
AppleTalk Protocol
1053
Number of packets received per second by Appletalk on this port.
1055
Number of packets sent per second by Appletalk on this port.
1057
Number of bytes received per second by Appletalk on this port.
1059
Number of bytes sent per second by Appletalk on this port.
1061
Average time in milliseconds to process a DDP packet on this port.
1063
Number of DDP packets per second received by Appletalk on this port.
1065
Average time in milliseconds to process an AARP packet on this port.
1067
Number of AARP packets per second received by Appletalk on this port.
1069
Average time in milliseconds to process an ATP packet on this port.
1071
Number of ATP packets per second received by Appletalk on this port.
1073
Average time in milliseconds to process an NBP packet on this port.
1075
Number of NBP packets per second received by Appletalk on this port.
1077
Average time in milliseconds to process a ZIP packet on this port.
1079
Number of ZIP packets per second received by Appletalk on this port.
1081
Average time in milliseconds to process an RTMP packet on this port.
1083
Number of RTMP packets per second received by Appletalk on this port.
1085
Number of ATP requests retransmitted on this port.
1087
Number of ATP release timers that have expired on this port.
1089
Number of ATP Exactly-once transaction responses per second on this port.
1091
Number of ATP At-least-once transaction responses per second on this port.
1093
Number of ATP transaction release packets per second received on this port.
1095
The current amount of nonpaged memory resources used by AppleTalk.
1097
Number of packets routed in on this port.
1099
Number of packets dropped due to resource limitations on this port.
1101
Number of ATP requests retransmitted to this port.
1103
Number of packets routed out on this port.
1111
Provides Network Statistics for the local network segment via the Network Monitor Service.
1113
The total number of frames received per second on this network segment.
1115
The number of bytes received per second on this network segment.
1117
The number of Broadcast frames received per second on this network segment.
1119
The number of Multicast frames received per second on this network segment.
1121
Percentage of network bandwidth in use on this network segment.
1125
Percentage of network bandwidth which is made up of broadcast traffic on this network segment.
1127
Percentage of network bandwidth which is made up of multicast traffic on this network segment.
1151
The Telephony System
1153
The number of telephone lines serviced by this computer.
1155
The number of telephone devices serviced by this computer.
1157
The number of telephone lines serviced by this computer that are currently active.
1159
The number of telephone devices that are currently being monitored.
1161
The rate of outgoing calls made by this computer.
1163
The rate of incoming calls answered by this computer.
1165
The number of applications that are currently using telephony services.
1167
Current outgoing calls being serviced by this computer.
1169
Current incoming calls being serviced by this computer.
1233
Packet Burst Read NCP Count/sec is the rate of NetWare Core Protocol requests for Packet Burst Read.  Packet Burst is a windowing protocol that improves performance.
1235
Packet Burst Read Timeouts/sec is the rate the NetWare Service needs to retransmit a Burst Read Request because the NetWare server took too long to respond.
1237
Packet Burst Write NCP Count/sec is the rate of NetWare Core Protocol requests for Packet Burst Write.  Packet Burst is a windowing protocol that improves performance.
1239
Packet Burst Write Timeouts/sec is the rate the NetWare Service needs to retransmit a Burst Write Request because the NetWare server took too long to respond.
1241
Packet Burst IO/sec is the sum of Packet Burst Read NCPs/sec and Packet Burst Write NCPs/sec.
1261
Logon Total includes all interactive logons, network logons, service logons, successful logon, and failed logons since the machine is last rebooted.
1301
The Server Work Queues performance object consists of counters that monitor the length of the queues and objects in the queues.
1303
Queue Length is the current length of the server work queue for this CPU.  A sustained queue length greater than four might indicate processor congestion.  This is an instantaneous count, not an average over time.
1305
Active Threads is the number of threads currently working on a request from the server client for this CPU.  The system keeps this number as low as possible to minimize unnecessary context switching.  This is an instantaneous count for the CPU, not an average over time.
1307
Available Threads is the number of server threads on this CPU not currently working on requests from a client.  The server dynamically adjusts the number of threads to maximize server performance.
1309
Every request from a client is represented in the server as a 'work item,' and the server maintains a pool of available work items per CPU to speed processing.  This is the instantaneous number of available work items for this CPU.  A sustained near-zero value indicates the need to increase the MinFreeWorkItems registry value for the Server service.  This value will always be 0 in the Blocking Queue instance.
1311
Every request from a client is represented in the server as a 'work item,' and the server maintains a pool of available work items per CPU to speed processing.  When a CPU runs out of work items, it borrows a free work item from another CPU.  An increasing value of this running counter might indicate the need to increase the 'MaxWorkItems' or 'MinFreeWorkItems' registry values for the Server service.  This value will always be 0 in the Blocking Queue instance.
1313
Every request from a client is represented in the server as a 'work item,' and the server maintains a pool of available work items per CPU to speed processing.  A sustained value greater than zero indicates the need to increase the 'MaxWorkItems' registry value for the Server service.  This value will always be 0 in the Blocking Queue instance.
1315
Current Clients is the instantaneous count of the clients being serviced by this CPU.  The server actively balances the client load across all of the CPU's in the system.  This value will always be 0 in the Blocking Queue instance.
1317
The rate at which the Server is receiving bytes from the network clients on this CPU.  This value is a measure of how busy the Server is.
1319
The rate at which the Server is sending bytes to the network clients on this CPU.  This value is a measure of how busy the Server is.
1321
The rate at which the Server is sending and receiving bytes with the network clients on this CPU.  This value is a measure of how busy the Server is.
1323
Read Operations/sec is the rate the server is performing file read operations for the clients on this CPU.  This value is a measure of how busy the Server is.  This value will always be 0 in the Blocking Queue instance.
1325
Read Bytes/sec is the rate the server is reading data from files for the clients on this CPU.  This value is a measure of how busy the Server is.
1327
Write Operations/sec is the rate the server is performing file write operations for the clients on this CPU.  This value is a measure of how busy the Server is.  This value will always be 0 in the Blocking Queue instance.
1329
Write Bytes/sec is the rate the server is writing data to files for the clients on this CPU.  This value is a measure of how busy the Server is.
1331
Total Bytes/sec is the rate the Server is reading and writing data to and from the files for the clients on this CPU.  This value is a measure of how busy the Server is.
1333
Total Operations/sec is the rate the Server is performing file read and file write operations for the clients on this CPU.  This value is a measure of how busy the Server is.  This value will always be 0 in the Blocking Queue instance.
1335
DPCs Queued/sec is the average rate, in incidents per second, at which deferred procedure calls (DPCs) were added to the processor's DPC queue. DPCs are interrupts that run at a lower priority than standard interrupts.  Each processor has its own DPC queue. This counter measures the rate that DPCs are added to the queue, not the number of DPCs in the queue.  This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.
1337
DPC Rate is the rate at which deferred procedure calls (DPCs) were added to the processors DPC queues between the timer ticks of the processor clock. DPCs are interrupts that run at alower priority than standard interrupts.  Each processor has its own DPC queue. This counter measures the rate that DPCs were added to the queue, not the number of DPCs in the queue. This counter displays the last observed value only; it is not an average.
1343
Total DPCs Queued/sec is the combined rate at which deferred procedure calls (DPCs) are added to the DPC queue of all processors on the computer.  (DPCs are interrupts that run at a lower priority than standard interrupts). Each processor has its own DPC queue.  This counter measures the rate at which DPCs are added to the queue, not the number of DPCs in the queue.  It is the sum of Processor: DPCs Queued/sec for all processors on the computer, divided by the number of processors.  This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.
1345
Total DPC Rate is the combined rate at which deferred procedure calls (DPCs) are added to the DPC queues of all processors between timer ticks of each processor's system clock.  (DPCs are interrupts that run at a lower priority than standard interrupts). Each processor has its own DPC queue.  This counter measures the rate at which DPCs are added to the queue, not the number of DPCs in the queue.  It is the sum of Processor: DPC Rate for all processors on the computer, divided by the number of processors.  This counter displays the last observed value only; it is not an average.
1351
% Registry Quota In Use is the percentage of the Total Registry Quota Allowed that is currently being used by the system.  This counter displays the current percentage value only; it is not an average.
1361
Counters that indicate the status of local and system Very Large memory allocations.
1363
VLM % Virtual Size In Use
1365
Current size of the process VLM Virtual memory space in bytes.
1367
The peak size of the process VLM virtual memory space in bytes.  This value indicates the maximum size of the process VLM virtual memory since the process started.
1369
The current size of the process VLM virtual memory space in bytes that may be allocated.  Note that the maximum allocation allowed may be smaller than this value due to fragmentation of the memory space.
1371
The current size of committed VLM memory space for the current process in bytes.
1373
The peak size of the committed VLM memory space in bytes for the current process since the process started.
1375
The current size of all committed VLM memory space in bytes for the system.
1377
The peak size of all committed VLM memory space in bytes since the system was started.
1379
The current size of all committed shared VLM memory space in bytes for the system.
1381
Available KBytes is the amount of physical memory, in Kilobytes, immediately available for allocation to a process or for system use. It is equal to the sum of memory assigned to the standby (cached), free and zero page lists. For a full explanation of the memory manager, refer to MSDN and/or the System Performance and Troubleshooting Guide chapter in the Windows Server 2003 Resource Kit.
1383
Available MBytes is the amount of physical memory, in Megabytes, immediately available for allocation to a process or for system use. It is equal to the sum of memory assigned to the standby (cached), free and zero page lists. For a full explanation of the memory manager, refer to MSDN and/or the System Performance and Troubleshooting Guide chapter in the Windows Server 2003 Resource Kit.
1401
Avg. Disk Queue Length is the average number of both read and write requests that were queued for the selected disk during the sample interval.
1403
Avg. Disk Read Queue Length is the average number of read requests that were queued for the selected disk during the sample interval.
1405
Avg. Disk Write Queue Length is the average number of write requests that were queued for the selected disk during the sample interval.
1407
% Committed Bytes In Use is the ratio of Memory\\Committed Bytes to the Memory\\Commit Limit. Committed memory is the physical memory in use for which space has been reserved in the paging file should it need to be written to disk. The commit limit is determined by the size of the paging file.  If the paging file is enlarged, the commit limit increases, and the ratio is reduced). This counter displays the current percentage value only; it is not an average.
1409
The Full Image performance object consists of counters that monitor the virtual address usage of images executed by processes on the computer.  Full Image counters are the same counters as contained in Image object with the only difference being the instance name.  In the Full Image object, the instance name includes the full file path name of the loaded modules, while in the Image object only the filename is displayed.
1411
The Creating Process ID value is the Process ID of the process that created the process. The creating process may have terminated, so this value may no longer identify a running process.
1413
The rate at which the process is issuing read I/O operations. This counter counts all I/O activity generated by the process to include file, network and device I/Os.
1415
The rate at which the process is issuing write I/O operations. This counter counts all I/O activity generated by the process to include file, network and device I/Os.
1417
The rate at which the process is issuing read and write I/O operations. This counter counts all I/O activity generated by the process to include file, network and device I/Os.
1419
The rate at which the process is issuing I/O operations that are neither read nor write operations (for example, a control function). This counter counts all I/O activity generated by the process to include file, network and device I/Os.
1421
The rate at which the process is reading bytes from I/O operations. This counter counts all I/O activity generated by the process to include file, network and device I/Os.
1423
The rate at which the process is writing bytes to I/O operations. This counter counts all I/O activity generated by the process to include file, network and device I/Os.
1425
The rate at which the process is reading and writing bytes in I/O operations. This counter counts all I/O activity generated by the process to include file, network and device I/Os.
1427
The rate at which the process is issuing bytes to I/O operations that do not involve data such as control operations. This counter counts all I/O activity generated by the process to include file, network and device I/Os.
1451
Displays performance statistics about a Print Queue.
1453
Total number of jobs printed on a print queue since the last restart.
1455
Number of bytes per second printed on a print queue.
1457
Total number of pages printed through GDI on a print queue since the last restart.
1459
Current number of jobs in a print queue.
1461
Current number of references (open handles) to this printer.
1463
Peak number of references (open handles) to this printer.
1465
Current number of spooling jobs in a print queue.
1467
Maximum number of spooling jobs in a print queue since last restart.
1469
Total number of out of paper errors in a print queue since the last restart.
1471
Total number of printer not ready errors in a print queue since the last restart.
1473
Total number of job errors in a print queue since last restart.
1475
Total number of calls from browse clients to this print server to request network browse lists since last restart.
1477
Total number of calls from other print servers to add shared network printers to this server since last restart.
1479
Working Set - Private displays the size of the working set, in bytes, that is use for this process only and not shared nor sharable by other processes.
1481
Working Set - Shared displays the size of the working set, in bytes, that is sharable and may be used by other processes.  Because a portion of a process' working set is shareable, does not necessarily mean that other processes are using it.
1483
% Idle Time reports the percentage of time during the sample interval that the disk was idle.
1485
Split IO/Sec reports the rate at which I/Os to the disk were split into multiple I/Os. A split I/O may result from requesting data of a size that is too large to fit into a single I/O or that the disk is fragmented.
1501
Reports the accounting and processor usage data collected by each active named Job object.
1503
Current % Processor Time shows the percentage of the sample interval that the processes in the Job object spent executing code.
1505
Current % User mode Time shows the percentage of the sample interval that the processes in the Job object spent executing code in user mode.
1507
Current % Kernel mode Time shows the percentage of the sample interval that the processes in the Job object spent executing code in kernel or privileged mode.
1509
This Period mSec - Processor shows the time, in milliseconds, of processor time used by all the processes in the Job object, including those that have terminated or that are no longer associated with the Job object, since a time limit on the Job was established.
1511
This Period mSec - User mode shows the time, in milliseconds, of user mode processor time used by all the processes in the Job object, including those that have terminated or that are no longer associated with the Job object, since a time limit on the Job was established.
1513
This Period mSec - Kernel mode shows the time, in milliseconds, of kernel mode processor time used by all the processes in the Job object, including those that have terminated or that are no longer associated with the Job object, since a time limit on the Job was established.
1515
Pages/Sec shows the page fault rate of all the processes in the Job object.
1517
Process Count - Total shows the number of processes, both active and terminated, that are or have been associated with the Job object.
1519
Process Count - Active shows the number of processes that are currently associated with the Job object.
1521
Process Count - Terminated shows the number of processes that have been terminated because of a limit violation.
1523
Total mSec - Processor shows the time, in milliseconds, of processor time used by all the processes in the Job object, including those that have terminated or that are no longer associated with the Job object, since the Job object was created.
1525
Total mSec - User mode shows the time, in milliseconds, of user mode processor time used by all the processes in the Job object, including those that have terminated or that are no longer associated with the Job object, since the Job object was created.
1527
Total mSec - Kernel mode shows the time, in milliseconds, of kernel mode processor time used by all the processes in the Job object, including those that have terminated or that are no longer associated with the Job object, since the Job object was created.
1537
Received Packet Too Big is the number of received packets thatare larger than anticipated.
1539
Received Membership Query is the number of packets received thatquery their membership to a group.
1541
Received Membership Report is the number of packets received thatreport their membership to a group.
1543
Received Membership Reduction is the number of packets received thatcancelled their membership to a group.
1545
Received Router Solicit is the number of packets received thatsolicit the router.
1547
Received Router Advert is the number of packets received thatadvert the router.
1549
% Job object Details shows detailed performance information about the active processes that make up a Job object.
1551
Received Neighbor Solicit is the number of packets received thatsolicit a neighbor.
1553
Received Neighbor Advert is the number of packets received thatadvert a neighbor.
1555
Sent Packet Too Big is the number of sent packets thatare larger than anticipated.
1557
Sent Membership Query is the number of packets sent thatquery their membership to a group.
1559
Sent Membership Report is the number of packets sent thatreport their membership to a group.
1561
Sent Membership Reduction is the number of packets sent thatcancelled their membership to a group.
1563
Sent Router Solicit is the number of packets sent thatsolicit the router.
1565
Sent Router Advert is the number of packets sent thatadvert the router.
1567
Sent Neighbor Solicit is the number of packets sent thatsolicit a neighbor.
1569
Sent Neighbor Advert is the number of packets sent thatadvert a neighbor.
1571
These counters track authentication performance on a per second basis.
1573
This counter tracks the number of NTLM authentications processed by this computer per second.
1575
This counter tracks the number of times that clients use a ticket to authenticate to this computer per second.

### #12 ianlh

ianlh
• Topic Starter

• Members
• 11 posts
• OFFLINE
•
• Local time:08:15 PM

Posted 26 August 2013 - 04:20 PM

minireg #4

1577
This counter tracks the number of Autonomous System (AS) requests that are being processed by the Key Distribution Center (KDC) per second. Clients use AS requests to obtain a ticket-granting ticket.
1579
This counter tracks the number of ticket-granting service (TGS) requests that are being processed by the Key Distribution Center (KDC) per second. Clients use these TGS requests to obtain a service ticket, which allows a client to access resources on other computers.
1581
This counter tracks the number of Secure Sockets Layer (SSL) entries that are currently stored in the secure channel (Schannel) session cache.  The Schannel session cache stores information about successfully established sessions, such as SSL session IDs.  Clients can use this information to reconnect to a server without performing a full SSL handshake.
1583
This counter tracks the number of Secure Sockets Layer (SSL) entries that are currently stored in the secure channel (Schannel) session cache and that are currently in use.  The Schannel session cache stores information about successfully established sessions, such as SSL session IDs.  Clients can use this information to reconnect to a server without performaing a full SSL handshake.
1585
This counter tracks the number of Secure Sockets Layer (SSL) full client-side handshakes that are being processed per second.  During a handshake, signals are exchanged to acknowledge that communication can occur between computers or other devices.
1587
This counter tracks the number of Secure Sockets Layer (SSL) client-side reconnect handshakes that are being processed per second.  Reconnect handshakes allow session keys from previous SSL sessions to be used to resume a client/server connection, and they require less memory to process than full handshakes.
1589
This counter tracks the number of Secure Sockets Layer (SSL) full server-side handshakes that are being processed per second.  During a handshake, signals are exchanged to acknowledge that communication can occur between computers or other devices.
1591
This counter tracks the number of Secure Sockets Layer (SSL) server-side reconnect handshakes that are being processed per second.  Reconnect handshakes allow session keys from previous SSL sessions to be used to resume a client/server connection, and they require less memory to process than full handshakes.
1593
This counter tracks the number of Digest authentications that are being processed per second.
1671
These counters track the number of security resources and handles used per process.
1673
This counter tracks the number of credential handles in use by a given process.  Credential handles are handles to pre-existing credentials, such as a password, that are associated with a user and are established through a system logon.
1675
This counter tracks the number of context handles in use by a given process.  Context handles are associated with security contexts established between a client application and a remote peer.
1677
Free & Zero Page List Bytes is the amount of physical memory, in bytes, that is assigned to the free and zero page lists. This memory does not contain cached data. It is immediately available for allocation to a process or for system use. For a full explanation of the memory manager, refer to MSDN and/or the System Performance and Troubleshooting Guide chapter in the Windows Server 2003 Resource Kit.
1679
Modified Page List Bytes is the amount of physical memory, in bytes, that is assigned to the modified page list. This memory contains cached data and code that is not actively in use by processes, the system and the system cache. This memory needs to be written out before it will be available for allocation to a process or for system use. For a full explanation of the memory manager, refer to MSDN and/or the System Performance and Troubleshooting Guide chapter in the Windows Server 2003 Resource Kit.
1681
Standby Cache Reserve Bytes is the amount of physical memory, in bytes, that is assigned to the reserve standby cache page lists. This memory contains cached data and code that is not actively in use by processes, the system and the system cache. It is immediately available for allocation to a process or for system use. If the system runs out of available free and zero memory, memory on lower priority standby cache page lists will be repurposed before memory on higher priority standby cache page lists. For a full explanation of the memory manager, refer to MSDN and/or the System Performance and Troubleshooting Guide chapter in the Windows Server 2003 Resource Kit.
1683
Standby Cache Normal Priority Bytes is the amount of physical memory, in bytes, that is assigned to the normal priority standby cache page lists. This memory contains cached data and code that is not actively in use by processes, the system and the system cache. It is immediately available for allocation to a process or for system use. If the system runs out of available free and zero memory, memory on lower priority standby cache page lists will be repurposed before memory on higher priority standby cache page lists. For a full explanation of the memory manager, refer to MSDN and/or the System Performance and Troubleshooting Guide chapter in the Windows Server 2003 Resource Kit.
1685
Standby Cache Core Bytes is the amount of physical memory, in bytes, that is assigned to the core standby cache page lists. This memory contains cached data and code that is not actively in use by processes, the system and the system cache. It is immediately available for allocation to a process or for system use. If the system runs out of available free and zero memory, memory on lower priority standby cache page lists will be repurposed before memory on higher priority standby cache page lists. For a full explanation of the memory manager, refer to MSDN and/or the System Performance and Troubleshooting Guide chapter in the Windows Server 2003 Resource Kit.
1747
% Idle Time is the percentage of time the processor is idle during the sample interval
1749
% C1 Time is the percentage of time the processor spends in the C1 low-power idle state. % C1 Time is a subset of the total processor idle time. C1 low-power idle state enables the processor to maintain its entire context and quickly return to the running state. Not all systems support the % C1 state.
1751
% C2 Time is the percentage of time the processor spends in the C2 low-power idle state. % C2 Time is a subset of the total processor idle time. C2 low-power idle state enables the processor to maintain the context of the system caches. The C2 power state is a lower power and higher exit latency state than C1. Not all systems support the C2 state.
1753
% C3 Time is the percentage of time the processor spends in the C3 low-power idle state. % C3 Time is a subset of the total processor idle time. When the processor is in the C3 low-power idle state it is unable to maintain the coherency of its caches. The C3 power state is a lower power and higher exit latency state than C2. Not all systems support the C3 state.
1755
C1 Transitions/sec is the rate that the CPU enters the C1 low-power idle state. The CPU enters the C1 state when it is sufficiently idle and exits this state on any interrupt. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.
1757
C2 Transitions/sec is the rate that the CPU enters the C2 low-power idle state. The CPU enters the C2 state when it is sufficiently idle and exits this state on any interrupt. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.
1759
C3 Transitions/sec is the rate that the CPU enters the C3 low-power idle state. The CPU enters the C3 state when it is sufficiently idle and exits this state on any interrupt. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.
1761
Heap performance counters for must used heaps
1763
Memory actively used by this heap (FreeBytes + AllocatedBytes)
1765
Total virtual address space reserved for this heap (includes uncommitted ranges)
1767
ReservedBytes minus last uncommitted range in each segment
1769
Memory on freelists in this heap (does not include uncommitted ranges or blocks in heap cache)
1771
Number of blocks on the list of free blocks >1k in size
1773
1/Average time per allocation (excluding allocs from heap cache)
1775
1/Average time per free (excluding frees to heap cache)
1777
Number of uncommitted ranges in the reserved virtual address
1779
Difference between number of allocations and frees (for leak detection)
1781
Allocations/sec from heap cache
1783
Frees/sec from heap cache
1785
Allocations/sec of size <1k bytes (including heap cache)
1787
Frees/sec of size <1k bytes (including heap cache)
1789
Allocations/sec of size 1-8k bytes
1791
Frees/sec of size 1-8k bytes
1793
Allocations/sec of size over 8k bytes
1795
Frees/sec of size over 8k bytes
1797
Allocations/sec (including from heap cache)
1799
Frees/sec (including to heap cache)
1801
Total number of blocks in the heap cache
1803
Largest number of blocks of any one size in the heap cache
1805
(FreeBytes / CommittedBytes) *100
1807
(VirtualBytes / ReservedBytes) * 100
1809
Collisions/sec on the heap lock
1847
End Marker
1849
The Telphony System
1851
The number of telephone lines serviced by this computer.
1853
The number of telephone devices serviced by this computer.
1855
the number of telephone lines serviced by this computer that are currently active.
1857
The number of telephone devices that are currently being monitored.
1859
The rate of outgoing calls made by this computer.
1861
The rate of incoming calls answered by this computer.
1863
The number of applications that are currently using telephony services.
1865
Current outgoing calls being serviced by this computer.
1867
Current incoming calls being serviced by this computer.
1869
The RAS Object Type handles individual ports of the RAS device on your system.
1871
The number of bytes transmitted total for this connection.
1873
The number of bytes received total for this connection.
1875
The number of data frames transmitted total for this connection.
1877
The number of data frames received total for this connection.
1879
The compression ratio for bytes being transmitted.
1881
The compression ratio for bytes being received.
1883
The total number of CRC Errors for this connection.  CRC Errors occur when the frame received contains erroneous data.
1885
The total number of Timeout Errors for this connection.  Timeout Errors occur when an expected is not received in time.
1887
The total number of Serial Overrun Errors for this connection.  Serial Overrun Errors occur when the hardware cannot handle the rate at which data is received.
1889
The total number of Alignment Errors for this connection.  Alignment Errors occur when a byte received is different from the byte expected.
1891
The total number of Buffer Overrun Errors for this connection.  Buffer Overrun Errors when the software cannot handle the rate at which data is received.
1893
The total number of CRC, Timeout, Serial Overrun, Alignment, and Buffer Overrun Errors for this connection.
1895
The number of bytes transmitted per second.
1897
The number of bytes received per second.
1899
The number of frames transmitted per second.
1901
The number of frames received per second.
1903
The total number of CRC, Timeout, Serial Overrun, Alignment, and Buffer Overrun Errors per second.
1905
The RAS Object Type handles all combined ports of the RAS device on your system.
1907
The total number of Remote Access connections.
1909
BITS Per Job Network Utilization
1911
Estimate of Remote Server Speed (Bits/Sec)
1913
Estimate of the local netcard's speed (Bits/Sec)
1915
Estimate of most recent percent network interface utilization
1917
Estimate of the IGD's Internet connection speed (Bits/Sec)
1919
Estimate of most recent percent IGD Internet connection utilization
1921
Size of the next download block for BITS
1923
BITS download response interval (msec)
1925
Estimated bandwidth available to the remote system (Bits/sec)
2247
Database provides performance statistics for each process using the ESE high performance embedded database management system.
2249
Pages Converted/sec is the count of times per second a database page is converted from an older database format
2251
Pages Converted is the count of database pages that have been converted from an older format
2253
Records Converted/sec is the count of times per second a database record is converted from an older database format
2255
Records Converted is the count of database records that have been converted from an older format
2257
Heap Allocs/sec is the number of memory allocations from the MP Heaps per second.  [Dev Only]
2259
Heap Frees/sec is the number of memory frees to the MP Heaps per second.  [Dev Only]
2261
Heap Allocations is the current number of memory allocations in the MP Heaps.  [Dev Only]
2263
Heap Bytes Allocated is the size of all memory allocations in the MP Heaps discounting heap managemnt overhead.  [Dev Only]
2265
Page Bytes Reserved is the size of all explicitly reserved virtual address space.  [Dev Only]
2267
Page Bytes Committed is the size of all explicitly committed virtual memory backing store (page file and physical memory).  [Dev Only]
2269
FCB Asynchronous Scan/sec is the number of cached schema records (FCBs) scanned during asynchronous schema record cleanup. These records are scanned to age out older schema definitions. [Dev Only]
2271
FCB Asynchronous Purge/sec is the number of cached schema records (FCBs) purged during asynchronous schema record cleanup. These records are purged to age out older schema definitions. [Dev Only]
2273
FCB Asynchronous Threshold-Scan/sec is the number of cached schema records (FCBs) scanned during asynchronous schema record cleanup.  Cleanup was triggered by a large number of schema records above the preferred limit.  These records are aggressively scanned to age out older schema definitions.  [Dev Only]
2275
FCB Asynchronous Threshold-Purge/sec is the number of cached schema records (FCBs) purged during asynchronous schema record cleanup.  Cleanup was triggered by a large number of schema records above the preferred limit.  These records are aggressively purged to age out older schema definitions.  [Dev Only]
2277
FCB Asynchronous Purge Conflicts/sec is the number of failed purge attempts on cached schema records (FCBs) during asynchronous schema record cleanup.  The purge operation failed because exclusive ownership of the schema record could not be obtained.  [Dev Only]
2279
FCB Synchronous Purge/sec is the number of cached schema records (FCBs) being synchronously purged each second.  [Dev Only]
2281
FCB Synchronous Purge Stalls/sec is the number of stalls encountered while waiting for exclusive ownership of cached schema records (FCBs) in order to synchronously purge them.  [Dev Only]
2283
FCB Allocations Wait For Version Cleanup/sec is the number FCB allocations that must first wait for version cleanup in an attempt to free used FCBs for re-use. [Dev Only]
2285
FCB Purge On Cursor Close/sec is the number of cached schema records (FCBs) being synchronously purged when the cursor is closed (instead of leaving the schema record cached) each second.  [Dev Only]
2287
FCB Cache % Hit is the percentage of schema records (FCBs) opened directly from the schema record cache.  No file operations were required.  [Dev Only]
2289
No text
2291
FCB Cache Stalls/sec is the number of stalls encountered while waiting for exclusive ownership of cached schema records (FCBs) in order to update their reference count.  [Dev Only]
2293
FCB Cache Maximum is the absolute maximum number of the schema records (FCBs) that can exist in the cache.  [Dev Only]
2295
FCB Cache Preferred is the preferred maximum number of the schema records (FCBs) that should exist in the cache.  [Dev Only]
2297
FCB Cache Allocated is the number of cached schema records (FCBs) currently allocated and in use.  [Dev Only]
2299
FCB Cache Available is the number of cached schema records (FCBs) currently allocated but not in use.  These records will be used and/or purged as required.  [Dev Only]
2301
Sessions In Use is the number of database sessions currently open for use by client threads.  [Dev Only]
2303
Sessions % Used is the percentage of database sessions currently open for use by client threads.  [Dev Only]
2305
No text
2307
Table Open Cache % Hit is the percentage of database tables opened using cached schema information.  If this percentage is too low, the table cache size may be too small.
2309
No text
2311
Table Open Cache Hits/sec is the number of database tables opened using cached schema information per second.  If this rate is too low, the table cache size may be too small.
2313
Table Open Cache Misses/sec is the number of database tables opened without using cached schema information per second.  If this rate is too high, the table cache size may be too small.
2315
Table Opens/sec is the number of database tables opened per second.
2317
Log Bytes Write per second is the rate bytes are written to the log.
2319
Log Buffer Bytes Used is the amount of bytes in the log buffers that have not yet been flushed to the logs.  [Dev only]
2321
Log Buffer Bytes Free is the amount of free space available in the log buffers.  [Dev only]
2323
Log Threads Waiting is the number of threads waiting for their data to be written to the log in order to complete an update of the database.  If this number is too high, the log may be a bottleneck.
2325
Log Checkpoint Depth represents the amount of work, in bytes, that will need to be redone or undone to the database file(s) if the process crashes.  [Dev Only]
2327
Log Generation Checkpoint Depth represents the amount of work, in count of log files, that will need to be redone or undone to the database file(s) if the process crashes.  [Dev Only]
2329
User Read Only Transaction Commits to Level 0/sec is the count of fully committed transactions started by the calling process that do not modify any data stored in the database engine.  [Dev Only]
2331
User Read/Write Transaction Commits to Level 0/sec is the count of fully committed transactions started by the calling process that modify data stored in the database engine.  [Dev Only]
2333
User Transaction Commits to Level 0/sec is the count of fully committed transactions started by the calling process that access data stored in the database engine.  [Dev Only]
2335
User Read Only Transaction Rollbacks to Level 0/sec is the count of aborted transactions started by the calling process that do not modify any data stored in the database engine.  [Dev Only]
2337
User Read/Write Transaction Rollbacks to Level 0/sec is the count of aborted transactions started by the calling process that modify data stored in the database engine.  [Dev Only]
2339
User Transaction Rollbacks to Level 0/sec is the count of aborted transactions started by the calling process that access data stored in the database engine.  [Dev Only]
2341
System Read Only Transaction Commits to Level 0/sec is the count of fully committed transactions started internally that do not modify any data stored in the database engine.  [Dev Only]
2343
System Read/Write Transaction Commits to Level 0/sec is the count of fully committed transactions started internally that modify data stored in the database engine.  [Dev Only]
2345
System Transaction Commits to Level 0/sec is the count of fully committed transactions started internally that access data stored in the database engine.  [Dev Only]
2347
System Read Only Transaction Rollbacks to Level 0/sec is the count of aborted transactions started internally that do not modify any data stored in the database engine.  [Dev Only]
2349
System Read/Write Transaction Rollbacks to Level 0/sec is the count of aborted transactions started internally that modify data stored in the database engine.  [Dev Only]
2351
System Transaction Rollbacks to Level 0/sec is the count of aborted transactions started internally that access data stored in the database engine.  [Dev Only]
2353
Database Page Allocation File Extension Async Consumed/sec is the rate of page allocations from a database file that must be serviced by extending the database file, but which do not stall when doing doing so.  [Dev Only]
2355
Database Page Allocation File Extension Stalls/sec is the rate of page allocations from a database file that must be serviced by extending the database file and which stall when doing so.  [Dev Only]
2357
Log Records/sec is the count of records written to the database log buffers per second.  [Dev Only]
2359
Log Buffer Capacity Flushes/sec is the count of times the database log buffers must be flushed per second because they are full.  [Dev Only]
2361
Log Buffer Commit Flushes/sec is the count of times the database log buffers must be flushed per second because a transaction is fully committing its changes.  [Dev Only]
2363
Log Buffer Flushes/sec is the count of times the database log buffers must be flushed per second.
2365
Log Writes/sec is the number of times the log buffers are written to the log file(s) per second.  If this number approaches the maximum write rate for the media holding the log file(s), the log may be a bottleneck.
2367
Log Record Stalls/sec is the number of log records that cannot be added to the log buffers per second because they are full.  If this counter is non-zero most of the time, the log buffer size may be a bottleneck.
2369
Total number of version buckets allocated
2371
Total number of version buckets allocated for FlagDelete RCEs  [Dev Only]
2373
VER Bucket Allocations Wait For Version Cleanup/sec is the number of version bucket allocations that must first wait for version cleanup in an attempt to free used version buckets  for re-use. [Dev Only]
2375
Average length of bookmark in RCE  [Dev Only]
2377
Number of times per second we look in the version store for a node whose version bit is set but which has no versions  [Dev Only]
2379
Number of times per second a version store clean task is dispatched asynchronously to be performed  [Dev Only]
2381
Number of times per second a version store clean task is performed synchronously  [Dev Only]
2383
Number of times per second a version store clean task was discarded due to load concerns  [Dev Only]
2385
Number of times per second a dispatched version store cleanup task fails  [Dev Only]
2387
Record Inserts/sec is the rate at which records are being inserted into database tables.  [Dev Only]
2389
Record Deletes/sec is the rate at which records in database tables are being flagged for deletion.  [Dev Only]
2391
Record Deletes/sec is the rate at which records in database tables are being updated.  [Dev Only]
2393
Record Unnecessary Replaces/sec is the rate at which updates to records in database tables are being discarded because the update did not actually modify the contents of the record.  [Dev Only]
2395
Record Redundant Replaces/sec is the rate at which records in database tables are being updated with the exact same content of the original record.  [Dev Only]
2397
Record Escrow-Updates/sec is the rate at which records in database tables are being escrow-updated.  [Dev Only]
2399
Secondary Index Inserts/sec is the rate at which entries are being inserted into indexes of database tables.  [Dev Only]
2401
Secondary Index Deletes/sec is the rate at which entries in indexes of database tables are being flagged for deletion.  [Dev Only]
2403
False Index Column Updates/sec is the number of times per second an attempt was made to update an index because an update to at least one of the indexed columns was detected, only to discover that none of the indexed columns had actually changed (and therefore no index update was actually required).  [Dev Only]
2405
False Tuple Index Column Updates/sec is the number of times per second an attempt was made to update a tuple index because an update to the tuple-indexed column was detected, only to discover that the column had not actually changed (and therefore no index update was actually required).  [Dev Only]
2407
Record Intrinsic Long-Values Updated/sec is the rate at which intrinsic long-values are added to or replaced in records of database tables.  [Dev Only]
2409
Record Separated Long-Values Added/sec is the rate at which separated long-values are normally added to records of database tables.  [Dev Only]
2411
Record Separated Long-Values Forced/sec is the rate at which separated long-values are added to records of a database table because they could not be accommodated in the record itself.  [Dev Only]
2413
Record Separated Long-Values All Forced/sec is the rate at which all intrinsic long-values are separated out of a record of a database table in order to accommodate updates to the record.  [Dev Only]
2415
Record Separated Long-Values Reference All/sec is the rate at which a reference is added for all the separated long-values associated with a record of a database table.  [Dev Only]
2417
Record Separated Long-Values Dereference All/sec is the rate at which a reference is removed for all the separated long-values associated with a record of a database table.  [Dev Only]
2419
Separated Long-Value Seeks/sec is the rate at which seeks for a separated long-value in a database table are performed.  [Dev Only]
2421
Separated Long-Value Retrieves/sec is the rate at which retrievals of a separated long-value in a database table are performed.  [Dev Only]
2423
Separated Long-Value Creates/sec is the rate at which new separated long-values are added to a database table.  [Dev Only]
2425
Separated Long-Value Updates/sec is the rate at which existing separated long-values in a database table are modified.  [Dev Only]
2427
Separated Long-Value Deletes/sec is the rate at which separated long-values in a database table are flagged for deletion.  [Dev Only]
2429
Separated Long-Value Copies/sec is the rate at which existing separated long-values in a database table are copied.  [Dev Only]
2431
Separated Long-Value Chunk Seeks/sec is the rate at which seeks for a particular chunk of a separated long-value in a database table are performed.  [Dev Only]
2433
Separated Long-Value Chunk Retrieves/sec is the rate at which retrievals of a chunk of a separated long-value in a database table are performed.  [Dev Only]
2435
Separated Long-Value Chunk Appends/sec is the rate at which chunks are appended to separated long-values of database tables.  [Dev Only]
2437
Separated Long-Value Chunk Replaces/sec is the rate at which existing separated long-value chunks in a database table are replaced.  [Dev Only]
2439
Separated Long-Value Chunk Deletes/sec is the rate at which separated long-value chunks in a database table are flagged for deletion.  [Dev Only]
2441
Separated Long-Value Chunk Copies/sec is the rate at which existing separated long-value chunks in a database table are copied.  [Dev Only]
2443
B+ Tree Append Splits/sec is the count of times a page is appended to a database B+ Tree per second.  [Dev Only]
2445
B+ Tree Right Splits/sec is the count of times a page is split right in a database B+ Tree per second.  [Dev Only]
2447
B+ Tree Right Hotpoint Splits/sec is the count of times a page is split right in a database B+ Tree, but which is treated as an append at a local "hotpoint" in the B+ Tree per second.  [Dev Only]
2449
B+ Tree Vertical Splits/sec is the count of times a page is split vertically in a database B+ Tree per second.  [Dev Only]
2451
B+ Tree Splits/sec is the count of times a page is appended to or split in a database B+ Tree per second.  [Dev Only]
2453
B+ Tree Empty Page Merges/sec is the count of empty pages removed from a database B+ Tree per second.  [Dev Only]
2455
Right Merges/sec is the count of pages removed from a database B+ Tree per second by moving all its records to the next page to the right.  [Dev Only]
2457
B+ Tree Partial Merges/sec is the count of pages where some of its records are moved to a page on the right in a database B+ Tree per second.  [Dev Only]
2459
B+ Tree Merges/sec is the count of pages merged in a database B+ Tree per second.  [Dev Only]
2461
B+ Tree Failed Simple Page Cleanup Attempts/sec is the rate that attempts to reclaim deleted node space on a page are unsuccessful due to a conflict when attempting to write-latch the page. The cleanup is re-tried by locking the root of the B+ Tree.  [Dev Only]
2463
B+ Tree Seek Short Circuits/sec is the count of repeated seeks to the same record in a database B+ Tree that are saved by jumping directly to the cached physical location of that record per second.  [Dev Only]
2465
B+ Tree Unnecessary Sibling Latches/sec is the count of sibling pages latched during a database B+ Tree Delete in the hopes of performing a merge where a merge is not possible, making that latch unnecessary.  [Dev Only]
2467
B+ Tree Move Nexts/sec is the count of times the database engine moves to the next record in a B+ Tree per second.  [Dev Only]
2469
B+ Tree Move Nexts (Non-Visible Nodes Skipped)/sec is the count of times the database engine skips non-visible records while attempting to move to the next visible record in a B+ Tree per second.  [Dev Only]
2471
B+ Tree Move Prevs/sec is the count of times the database engine moves to the previous record in a B+ Tree per second.  [Dev Only]
2473
B+ Tree Move Prevs (Non-Visible Nodes Skipped)/sec is the count of times the database engine skips non-visible records while attempting to move to the previous visible record in a B+ Tree per second.  [Dev Only]
2475
B+ Tree Seeks/sec is the count of times a record is seeked to by a key in a database B+ Tree per second.  [Dev Only]
2477
B+ Tree Inserts/sec is the count of times a record is inserted in a database B+ Tree per second.  [Dev Only]
2479
B+ Tree Replaces/sec is the count of times a record is replaced in a database B+ Tree per second.  [Dev Only]
2481
B+ Tree Flag Deletes/sec is the count of times a record is flag deleted in a database B+ Tree per second.  [Dev Only]
2483
B+ Tree Deletes/sec is the count of times a record is deleted in a database B+ Tree per second.  [Dev Only]
2485
B+ Tree Appends/sec is the count of times a record is appended to a database B+ Tree per second.  [Dev Only]
2487
B+ Tree Creates/sec is the number of B+ Trees and their corresponding space trees (if any) created per second.  This can also be viewed as the number of FDP creates per second.  [Dev Only]
2489
B+ Tree Creates (Total) is the total number of B+ Trees and their corresponding space trees (if any) created.  This can also be viewed as the total number of FDP creates.  [Dev Only]
2491
B+ Tree Destroys/sec is the number of B+ Trees and their corresponding space trees (if any) destroyed per second.  This can also be viewed as the number of FDP destroys per second.  [Dev Only]
2493
B+ Tree Destroys (Total) is the total number of B+ Trees and their corresponding space trees (if any) destroyed.  This can also be viewed as the total number of FDP destroys.  [Dev Only]
2495
Database Cache % Hit is the percentage of database file page requests that were fulfilled by the database cache without causing a file operation.  If this percentage is too low, the database cache size may be too small.
2497
No text
2499
Database Cache % Clean is the percentage of the database cache that does not contain modified data.  [Dev Only]
2501
No text
2503
Database Pages Read Async/sec is the rate that pages are asynchronously read from the database file(s) into the database cache.  [Dev Only]
2505
Database Pages Read Sync/sec is the rate that pages are synchronously read from the database file(s) into the database cache.  [Dev Only]
2507
Database Pages Written/sec is the rate that pages are written to the database file (s) from the database cache.  [Dev Only]
2509
Database Pages Transferred/sec is the rate that pages are transferred from the database file(s) to the database cache and vice versa.  [Dev Only]
2511
Database Page Latches/sec is the rate that database pages are latched for access to their data.  [Dev Only]
2513
Database Page Fast Latches/sec is the rate that database pages are latched for access to their data using a hint to tell the cache manager where that page might be in memory.  [Dev Only]
2515
Database Page Bad Latch Hints/sec is the rate that incorrect hints to the location of a given page in the cache are given to the cache manager.  These hints are used to perform fast latches.  [Dev Only]
2517
Database Cache % Fast Latch is the percentage of database pages latched for access to their data using a hint to tell the cache manager where that page might be in memory.  Ideally, this percentage should match Database Cache % Hit.  [Dev Only]
2519
No text
2521
Database Page Latch Conflicts/sec is the rate that users latching a database page for access to its data fail due to a conflicting latch owned on that same page by another user.  [Dev Only]
2523
Database Page Latch Stalls/sec is the rate that users latching a database page for access to its data must wait for another user to release a latch on that same page.  [Dev Only]
2525
Database Cache % Available is the percentage of the database cache that can be allocated to cache database pages that are newly created or read in from the database file(s).  [Dev Only]
2527
No text
2529
Database Page Faults/sec is the rate that database file page requests require the database cache manager to allocate a new page from the database cache.
2531
Database Page Evictions/sec is the rate that database file page requests that require the database cache manager to allocate a new page from the database cache force another database page out of the cache.  The eviction count is charged when the page is allocated and not when the previous owner of that page was actually evicted from the cache.  If this rate is too high, the database cache size may be too small.
2533
Database Page Fault Stalls/sec is the rate of page faults that cannot be serviced because there are no pages available for allocation from the database cache.  If this counter is non-zero most of the time, the clean threshold may be too low.
2535
Database Cache Size (MB) is the amount of system memory (in MegaBytes) used by the database cache manager to hold commonly used information from the database file(s) to prevent file operations.  If the database cache size seems to be too small for optimal performance and there is very little available memory on the system (see Memory/Available Bytes), adding more memory to the system may increase performance.  If there is a lot of available memory on the system and the database cache size is not growing beyond a certain point, the database cache size may be capped at an artificially low limit.  Increasing this limit may increase performance.
2537
Database Cache Size is the amount of system memory used by the database cache manager to hold commonly used information from the database file(s) to prevent file operations.  If the database cache size seems to be too small for optimal performance and there is very little available memory on the system (see Memory/Available Bytes), adding more memory to the system may increase performance.  If there is a lot of available memory on the system and the database cache size is not growing beyond a certain point, the database cache size may be capped at an artificially low limit.  Increasing this limit may increase performance.
2539
Database Cache Size Min is the minimum amount of system memory configured for use by the database cache manager to hold commonly used information from the database file(s) to prevent file operations.  [Dev Only]
2541
Database Cache Size Max is the maximum amount of system memory configured for use by the database cache manager to hold commonly used information from the database file(s) to prevent file operations.  [Dev Only]
2543
Database Cache % Available Min is the minimum percentage of the database cache that is kept to be allocated to cache database pages that are newly created or read in from the database file(s).  If the percentage of available pages drops below this minimum, pages are thrown out of the database cache until the maximum percentage of available pages is reached.  This percentage should be set as low as possible without causing the actual percentage to drop to zero, causing cache fault stalls.  [Dev Only]
2545
No text
2547
Database Cache % Available Max is the maximum percentage of the database cache that is kept to be allocated to cache database pages that are newly created or read in from the database file(s).  This percentage should be set as low as possible but far enough above the minimum percentage so that efficient production of availible pages is possible.  [Dev Only]
2549
No text
2551
Database Pages Preread/sec is the rate that pages are read in anticipation of future use from the database file(s) into the database cache.  [Dev Only]
2553
Database Cached Pages Preread/sec is the rate that pages are read in anticipation of future use from the database file(s) into the database cache that are already cached.  This is non-ideal behavior that represents a waste of processing time.  [Dev Only]
2555
Database Pages Preread Untouched/sec is the rate that pages are read in anticipation of future use from the database file(s) into the database cache that were subsequently thrown out without being used. This is non-ideal behavior that represents a waste of I/O bandwidth and processing time .  [Dev Only]
2557
Database Pages Versioned / sec is the rate at which pages in the database cache are being copied into new pages in the cache for the purpose of being asynchronously written while the current version of that page in the database file is still being modified.  This feature is primarily used to avoid cycles, branches, or long chains of flush order dependencies without requiring the pages involved to be synchronously written to disk.  [Dev Only]
2559
Database Cache % Versioned is the percentage of the database cache that contains older versions of currently cached pages that have not yet been written to disk and thrown out of the cache.  [Dev Only]
2561
No text
2563
Database Pages Ordinarily Written/sec is the rate that pages are written to the database file (s) from the database cache in preparation for evicting them from the cache to make room for other data.  [Dev Only]
2565
Database Pages Anomalously Written/sec is the rate that pages are written to the database file (s) from the database cache before they would ordinarily be written.  [Dev Only]
2567
Database Pages Opportunely Written/sec is the rate that pages are written to the database file (s) from the database cache because they happen to be near other pages that must be written.  These additional writes are performed before they must happen in the hope that the total number of seeks required to write all the pages is reduced.  [Dev Only]
2569
Database Pages Repeatedly Written/sec is the rate that pages are written to the database file (s) from the database cache more than once in their lifetime in the cache.  These page writes represent extra writes above the theoretical minimum and can therefore be considered overhead.  [Dev Only]
2571
Database Pages Idly Written/sec is the rate that pages are written to the database file (s) from the database cache because there is low disk activity.  [Dev Only]
2573
Database Pages Coalesced Written/sec is the rate that pages are written to the database file (s) from the database cache coalesced with another page. [Dev Only]
2575
Database Pages Coalesced Read/sec is the rate that pages are read from the database file (s) to the database cache coalesced with another page. [Dev Only]
2577
Database Page History Records is the current number of database page access history records retained for supporting the LRU-K page replacment algorithm.  [Dev Only]
2579
Database Page History % Hit is the percentage of database page access history record lookups that were successful.  [Dev Only]
2581
No text
2583
Database Page Scans/sec is the rate at which database pages are considered for eviction from the database page cache.  [Dev Only]
2585
Database Page Scans Out-of-order/sec is the rate at which database pages are considered for eviction from the database page cache in a priority counter to the page replacement algorithm.  [Dev Only]
2587
No text
2589
Streaming Backup Pages Read/sec is the rate of database read operations performed for the purpose of streaming backups.  [Dev Only]
2591
Online Defrag Pages Referenced/sec is the rate at which online defragmentation is touching database pages.  [Dev Only]
2593
Online Defrag Pages Read/sec is the rate of database read operations being performed by online defragmentation. [Dev Only]
2595
Online Defrag Pages Preread/sec is the rate at which database pages are read in anticipation of future use by online defragmentation.  [Dev Only]
2597
Online Defrag Pages Dirtied/sec is the rate at which online defragmentation is modifying clean database pages. [Dev Only]
2599
Online Defrag Pages Re-Dirtied/sec is the rate at which online defragmentation is modifying database pages that already contained modifications.  [Dev Only]
2601
Online Defrag Log Records/sec is the rate at which online defragmentation is generating log records.  [Dev Only]
2603
Online Defrag Average Log Bytes is the average size of the log records being generated by online defragmentation.  [Dev only]
2605
No text
2607
Database Tasks Pages Referenced/sec is the rate at which background database tasks are touching database pages. [Dev Only]
2609
Database Tasks Pages Read/sec is the rate of database read operations being performed by background database tasks. [Dev Only]
2611
Database Tasks Pages Preread/sec is the rate at which database pages are read in anticipation of future use by background database tasks.  [Dev Only]
2613
Database Tasks Pages Dirtied/sec is the rate at which background database tasks are modifying clean database pages. [Dev Only]
2615
Database Tasks Pages Re-Dirtied/sec is the rate at which background databases tasks are modifying database pages that already contained modifications.  [Dev Only]
2617
Database Tasks Log Records/sec is the rate at which background database tasks are generating log records.  [Dev Only]
2619
Database Tasks Average Log Bytes is the average size of the log records being generated by background database tasks.  [Dev only]
2621
No text
2623
I/O Database Reads/sec is the rate of database read operations completed.
2625
I/O Database Reads Average Latency is the average length of time,  in milliseconds, per database read operation.
2627
No text
2629
I/O Database Reads Average Bytes is the average number of bytes transferred per database read operation.  [Dev Only]
2631
No text
2633
I/O Database Reads In Heap is the number of database read operations queued in the database engine's I/O heap and waiting to be issued.  [Dev Only]
2635
I/O Database Reads Async Pending is the number of database read operations asynchronously pending completion.  [Dev Only]
2637
I/O Database Reads Abnormal Latency/sec is the rate of database read operations that take an abnormally long length of time (default is 1 minute) to be serviced by the OS.  [Dev Only]
2639
I/O Log Reads/sec is the rate of logfile read operations completed.
2641
I/O Log Reads Average Latency is the average length of time, in milliseconds, per logfile read operation.  [Dev Only]
2643
No text
2645
I/O Log Reads Average Bytes is the average number of bytes transferred per logfile read operation.  [Dev Only]
2647
No text
2649
I/O Log Reads In Heap is the number of logfile read operations queued in the database engine's I/O heap and waiting to be issued.  [Dev Only]
2651
I/O Log Reads Async Pending is the number of logfile read operations asynchronously pending completion.  [Dev Only]
2653
I/O Log Reads Abnormal Latency/sec is the rate of logfile read operations that take an abnormally long length of time (default is 1 minute) to be serviced by the OS.  [Dev Only]
2655
I/O Database Writes/sec is the rate of database write operations completed.
2657
I/O Database Writes Average Latency is the average length of time,  in milliseconds, per database write operation.
2659
No text
2661
I/O Database Writes Average Bytes is the average number of bytes transferred per database write operation.  [Dev Only]
2663
No text
2665
I/O Database Writes In Heap is the number of database write operations queued in the database engine's I/O heap and waiting to be issued.  [Dev Only]
2667
I/O Database Writes Async Pending is the number of database write operations asynchronously pending completion.  [Dev Only]
2669
I/O Database Writes Abnormal Latency/sec is the rate of database write operations that take an abnormally long length of time (default is 1 minute) to be serviced by the OS.  [Dev Only]
2671
I/O Log Writes/sec is the rate of logfile write operations completed.
2673
I/O Log Writes Average Latency is the average length of time, in milliseconds, per logfile write operation.
2675
No text
2677
I/O Log Writes Average Bytes is the average number of bytes transferred per logfile write operation.  [Dev Only]
2679
No text
2681
I/O Log Writes In Heap is the number of logfile write operations queued in the database engine's I/O heap and waiting to be issued.  [Dev Only]
2683
I/O Log Writes Async Pending is the number of logfile write operations asynchronously pending completion.  [Dev Only]
2685
I/O Log Writes Abnormal Latency/sec is the rate of logfile write operations that take an abnormally long length of time (default is 1 minute) to be serviced by the OS.  [Dev Only]
2687
SLV File Table Inserts/sec is the rate at which entries are inserted into an SLV File Table in the system.  [Dev Only]
2689
SLV File Table Cleans/sec is the rate at which attempta are made to delete an entry from an SLV File Table in the system.  [Dev Only]
2691
SLV File Table Deletes/sec is the rate at which entries are deleted from an SLV File Table in the system.  [Dev Only]
2693
SLV File Table Entries is the total number of entries contained in all SLV File Tables in the system.  [Dev Only]
2695
Threads Blocked/sec is the rate at which the execution of threads are suspended to wait for a specific event to occur or for the acquisition of a resource currently owned by another thread. [Dev Only]
2697
Threads Blocked is the current number of threads whose execution has been suspended to wait for a specific event to occur or for the acquisition of a resource currently owned by another thread. [Dev Only]
2699
Statistics for the ESE high performance embedded database management system by Table Class
2701
Record Inserts/sec is the rate at which records are being inserted into database tables.  [Dev Only]
2703
Record Deletes/sec is the rate at which records in database tables are being flagged for deletion.  [Dev Only]
2705
Record Deletes/sec is the rate at which records in database tables are being updated.  [Dev Only]
2707
Record Unnecessary Replaces/sec is the rate at which updates to records in database tables are being discarded because the update did not actually modify the contents of the record.  [Dev Only]
2709
Record Redundant Replaces/sec is the rate at which records in database tables are being updated with the exact same content of the original record.  [Dev Only]
2711
Record Escrow-Updates/sec is the rate at which records in database tables are being escrow-updated.  [Dev Only]
2713
Secondary Index Inserts/sec is the rate at which entries are being inserted into indexes of database tables.  [Dev Only]
2715
Secondary Index Deletes/sec is the rate at which entries in indexes of database tables are being flagged for deletion.  [Dev Only]
2717
False Index Column Updates/sec is the number of times per second an attempt was made to update an index because an update to at least one of the indexed columns was detected, only to discover that none of the indexed columns had actually changed (and therefore no index update was actually required).  [Dev Only]
2719
False Tuple Index Column Updates/sec is the number of times per second an attempt was made to update a tuple index because an update to the tuple-indexed column was detected, only to discover that the column had not actually changed (and therefore no index update was actually required).  [Dev Only]
2721
Record Intrinsic Long-Values Updated/sec is the rate at which intrinsic long-values are added to or replaced in records of database tables.  [Dev Only]
2723
Record Separated Long-Values Added/sec is the rate at which separated long-values are normally added to records of database tables.  [Dev Only]
2725
Record Separated Long-Values Forced/sec is the rate at which separated long-values are added to records of a database table because they could not be accommodated in the record itself.  [Dev Only]
2727
Record Separated Long-Values All Forced/sec is the rate at which all intrinsic long-values are separated out of a record of a database table in order to accommodate updates to the record.  [Dev Only]
2729
Record Separated Long-Values Reference All/sec is the rate at which a reference is added for all the separated long-values associated with a record of a database table.  [Dev Only]
2731
Record Separated Long-Values Dereference All/sec is the rate at which a reference is removed for all the separated long-values associated with a record of a database table.  [Dev Only]
2733
Separated Long-Value Seeks/sec is the rate at which seeks for a separated long-value in a database table are performed.  [Dev Only]
2735
Separated Long-Value Retrieves/sec is the rate at which retrievals of a separated long-value in a database table are performed.  [Dev Only]
2737
Separated Long-Value Creates/sec is the rate at which new separated long-values are added to a database table.  [Dev Only]
2739
Separated Long-Value Updates/sec is the rate at which existing separated long-values in a database table are modified.  [Dev Only]
2741
Separated Long-Value Deletes/sec is the rate at which separated long-values in a database table are flagged for deletion.  [Dev Only]
2743
Separated Long-Value Copies/sec is the rate at which existing separated long-values in a database table are copied.  [Dev Only]
2745
Separated Long-Value Chunk Seeks/sec is the rate at which seeks for a particular chunk of a separated long-value in a database table are performed.  [Dev Only]
2747
Separated Long-Value Chunk Retrieves/sec is the rate at which retrievals of a chunk of a separated long-value in a database table are performed.  [Dev Only]
2749
Separated Long-Value Chunk Appends/sec is the rate at which chunks are appended to separated long-values of database tables.  [Dev Only]
2751
Separated Long-Value Chunk Replaces/sec is the rate at which existing separated long-value chunks in a database table are replaced.  [Dev Only]
2753
Separated Long-Value Chunk Deletes/sec is the rate at which separated long-value chunks in a database table are flagged for deletion.  [Dev Only]
2755
Separated Long-Value Chunk Copies/sec is the rate at which existing separated long-value chunks in a database table are copied.  [Dev Only]
2757
B+ Tree Append Splits/sec is the count of times a page is appended to a database B+ Tree per second.  [Dev Only]
2759
B+ Tree Right Splits/sec is the count of times a page is split right in a database B+ Tree per second.  [Dev Only]
2761
B+ Tree Right Hotpoint Splits/sec is the count of times a page is split right in a database B+ Tree, but which is treated as an append at a local "hotpoint" in the B+ Tree per second.  [Dev Only]
2763
B+ Tree Vertical Splits/sec is the count of times a page is split vertically in a database B+ Tree per second.  [Dev Only]
2765
B+ Tree Splits/sec is the count of times a page is appended to or split in a database B+ Tree per second.  [Dev Only]
2767
B+ Tree Empty Page Merges/sec is the count of empty pages removed from a database B+ Tree per second.  [Dev Only]
2769
Right Merges/sec is the count of pages removed from a database B+ Tree per second by moving all its records to the next page to the right.  [Dev Only]
2771
B+ Tree Partial Merges/sec is the count of pages where some of its records are moved to a page on the right in a database B+ Tree per second.  [Dev Only]
2773
B+ Tree Merges/sec is the count of pages merged in a database B+ Tree per second.  [Dev Only]
2775
B+ Tree Failed Simple Page Cleanup Attempts/sec is the rate that attempts to reclaim deleted node space on a page are unsuccessful due to a conflict when attempting to write-latch the page. The cleanup is re-tried by locking the root of the B+ Tree.  [Dev Only]
2777
B+ Tree Seek Short Circuits/sec is the count of repeated seeks to the same record in a database B+ Tree that are saved by jumping directly to the cached physical location of that record per second.  [Dev Only]
2779
B+ Tree Unnecessary Sibling Latches/sec is the count of sibling pages latched during a database B+ Tree Delete in the hopes of performing a merge where a merge is not possible, making that latch unnecessary.  [Dev Only]
2781
B+ Tree Move Nexts/sec is the count of times the database engine moves to the next record in a B+ Tree per second.  [Dev Only]
2783
B+ Tree Move Nexts (Non-Visible Nodes Skipped)/sec is the count of times the database engine skips non-visible records while attempting to move to the next visible record in a B+ Tree per second.  [Dev Only]
2785
B+ Tree Move Prevs/sec is the count of times the database engine moves to the previous record in a B+ Tree per second.  [Dev Only]
2787
B+ Tree Move Prevs (Non-Visible Nodes Skipped)/sec is the count of times the database engine skips non-visible records while attempting to move to the previous visible record in a B+ Tree per second.  [Dev Only]
2789
B+ Tree Seeks/sec is the count of times a record is seeked to by a key in a database B+ Tree per second.  [Dev Only]
2791
B+ Tree Inserts/sec is the count of times a record is inserted in a database B+ Tree per second.  [Dev Only]
2793
B+ Tree Replaces/sec is the count of times a record is replaced in a database B+ Tree per second.  [Dev Only]
2795
B+ Tree Flag Deletes/sec is the count of times a record is flag deleted in a database B+ Tree per second.  [Dev Only]
2797
B+ Tree Deletes/sec is the count of times a record is deleted in a database B+ Tree per second.  [Dev Only]
2799
B+ Tree Appends/sec is the count of times a record is appended to a database B+ Tree per second.  [Dev Only]
2801
B+ Tree Creates/sec is the number of B+ Trees and their corresponding space trees (if any) created per second.  This can also be viewed as the number of FDP creates per second.  [Dev Only]
2803
B+ Tree Creates (Total) is the total number of B+ Trees and their corresponding space trees (if any) created.  This can also be viewed as the total number of FDP creates.  [Dev Only]
2805
B+ Tree Destroys/sec is the number of B+ Trees and their corresponding space trees (if any) destroyed per second.  This can also be viewed as the number of FDP destroys per second.  [Dev Only]
2807
B+ Tree Destroys (Total) is the total number of B+ Trees and their corresponding space trees (if any) destroyed.  This can also be viewed as the total number of FDP destroys.  [Dev Only]
2809
Database Cache Size (MB) is the amount of system memory (in MegaBytes) used by the database cache manager to hold commonly used information from the database file(s) to prevent file operations.  If the database cache size seems to be too small for optimal performance and there is very little available memory on the system (see Memory/Available Bytes), adding more memory to the system may increase performance.  If there is a lot of available memory on the system and the database cache size is not growing beyond a certain point, the database cache size may be capped at an artificially low limit.  Increasing this limit may increase performance.
2811
Database Pages Read Async/sec is the rate that pages are asynchronously read from the database file(s) into the database cache.  [Dev Only]
2813
Database Pages Read Sync/sec is the rate that pages are synchronously read from the database file(s) into the database cache.  [Dev Only]
2815
Database Pages Written/sec is the rate that pages are written to the database file (s) from the database cache.  [Dev Only]
2817
Database Pages Transferred/sec is the rate that pages are transferred from the database file(s) to the database cache and vice versa.  [Dev Only]
2819
Database Pages Preread/sec is the rate that pages are read in anticipation of future use from the database file(s) into the database cache.  [Dev Only]
2821
Database Cached Pages Preread/sec is the rate that pages are read in anticipation of future use from the database file(s) into the database cache that are already cached.  This is non-ideal behavior that represents a waste of processing time.  [Dev Only]
2823
Database Pages Preread Untouched/sec is the rate that pages are read in anticipation of future use from the database file(s) into the database cache that were subsequently thrown out without being used. This is non-ideal behavior that represents a waste of I/O bandwidth and processing time .  [Dev Only]
2825
Database Pages Versioned / sec is the rate at which pages in the database cache are being copied into new pages in the cache for the purpose of being asynchronously written while the current version of that page in the database file is still being modified.  This feature is primarily used to avoid cycles, branches, or long chains of flush order dependencies without requiring the pages involved to be synchronously written to disk.  [Dev Only]
2827
Database Pages Ordinarily Written/sec is the rate that pages are written to the database file (s) from the database cache in preparation for evicting them from the cache to make room for other data.  [Dev Only]
2829
Database Pages Anomalously Written/sec is the rate that pages are written to the database file (s) from the database cache before they would ordinarily be written.  [Dev Only]
2831
Database Pages Opportunely Written/sec is the rate that pages are written to the database file (s) from the database cache because they happen to be near other pages that must be written.  These additional writes are performed before they must happen in the hope that the total number of seeks required to write all the pages is reduced.  [Dev Only]
2833
Database Pages Repeatedly Written/sec is the rate that pages are written to the database file (s) from the database cache more than once in their lifetime in the cache.  These page writes represent extra writes above the theoretical minimum and can therefore be considered overhead.  [Dev Only]
2835
Database Pages Idly Written/sec is the rate that pages are written to the database file (s) from the database cache because there is low disk activity.  [Dev Only]
2837
Database Pages Coalesced Written/sec is the rate that pages are written to the database file (s) from the database cache coalesced with another page. [Dev Only]
2839
Database Pages Coalesced Read/sec is the rate that pages are read from the database file (s) to the database cache coalesced with another page. [Dev Only]
2841
Instances in this process
2843
Pages Converted/sec is the count of times per second a database page is converted from an older database format
2845
Pages Converted is the count of database pages that have been converted from an older format
2847
Records Converted/sec is the count of times per second a database record is converted from an older database format
2849
Records Converted is the count of database records that have been converted from an older format
2851
FCB Asynchronous Scan/sec is the number of cached schema records (FCBs) scanned during asynchronous schema record cleanup. These records are scanned to age out older schema definitions. [Dev Only]
2853
FCB Asynchronous Purge/sec is the number of cached schema records (FCBs) purged during asynchronous schema record cleanup. These records are purged to age out older schema definitions. [Dev Only]
2855
FCB Asynchronous Threshold-Scan/sec is the number of cached schema records (FCBs) scanned during asynchronous schema record cleanup.  Cleanup was triggered by a large number of schema records above the preferred limit.  These records are aggressively scanned to age out older schema definitions.  [Dev Only]
2857
FCB Asynchronous Threshold-Purge/sec is the number of cached schema records (FCBs) purged during asynchronous schema record cleanup.  Cleanup was triggered by a large number of schema records above the preferred limit.  These records are aggressively purged to age out older schema definitions.  [Dev Only]
2859
FCB Asynchronous Purge Conflicts/sec is the number of failed purge attempts on cached schema records (FCBs) during asynchronous schema record cleanup.  The purge operation failed because exclusive ownership of the schema record could not be obtained.  [Dev Only]
2861
FCB Synchronous Purge/sec is the number of cached schema records (FCBs) being synchronously purged each second.  [Dev Only]
2863
FCB Synchronous Purge Stalls/sec is the number of stalls encountered while waiting for exclusive ownership of cached schema records (FCBs) in order to synchronously purge them.  [Dev Only]
2865
FCB Allocations Wait For Version Cleanup/sec is the number of FCB allocations that must first wait for version cleanup in an attempt to free used FCBs for re-use. [Dev Only]
2867
FCB Purge On Cursor Close/sec is the number of cached schema records (FCBs) being synchronously purged when the cursor is closed (instead of leaving the schema record cached) each second.  [Dev Only]
2869
FCB Cache % Hit is the percentage of schema records (FCBs) opened directly from the schema record cache.  No file operations were required.  [Dev Only]
2871
No text
2873
FCB Cache Stalls/sec is the number of stalls encountered while waiting for exclusive ownership of cached schema records (FCBs) in order to update their reference count.  [Dev Only]
2875
FCB Cache Maximum is the absolute maximum number of the schema records (FCBs) that can exist in the cache.  [Dev Only]
2877
FCB Cache Preferred is the preferred maximum number of the schema records (FCBs) that should exist in the cache.  [Dev Only]
2879
FCB Cache Allocated is the number of cached schema records (FCBs) currently allocated and in use.  [Dev Only]
2881
FCB Cache Available is the number of cached schema records (FCBs) currently allocated but not in use.  These records will be used and/or purged as required.  [Dev Only]
2883
Sessions In Use is the number of database sessions currently open for use by client threads.  [Dev Only]
2885
Sessions % Used is the percentage of database sessions currently open for use by client threads.  [Dev Only]
2887
No text
2889
Table Open Cache % Hit is the percentage of database tables opened using cached schema information.  If this percentage is too low, the table cache size may be too small.
2891
No text
2893
Table Open Cache Hits/sec is the number of database tables opened using cached schema information per second.  If this rate is too low, the table cache size may be too small.
2895
Table Open Cache Misses/sec is the number of database tables opened without using cached schema information per second.  If this rate is too high, the table cache size may be too small.
2897
Table Opens/sec is the number of database tables opened per second.
2899
Log Bytes Write per second is the rate bytes are written to the log.
2901
Log Buffer Size is the amount of memory, in bytes, allocated for the database log buffers.  [Dev Only]
2903
Log Buffer Bytes Used is the amount of bytes in the log buffers that have not yet been flushed to the logs.  [Dev only]
2905
Log Buffer Bytes Free is the amount of free space available in the log buffers.  [Dev only]
2907
Log Threads Waiting is the number of threads waiting for their data to be written to the log in order to complete an update of the database.  If this number is too high, the log may be a bottleneck.
2909
Log File Size is the size, in bytes, of the database log files.  [Dev Only]
2911
Log Checkpoint Depth represents the amount of work, in bytes, that will need to be redone or undone to the database file(s) if the process crashes.  [Dev Only]
2913
Log Generation Checkpoint Depth represents the amount of work, in count of log files, that will need to be redone or undone to the database file(s) if the process crashes.
2915
User Read Only Transaction Commits to Level 0/sec is the count of fully committed transactions started by the calling process that do not modify any data stored in the database engine.  [Dev Only]
2917
User Read/Write Transaction Commits to Level 0/sec is the count of fully committed transactions started by the calling process that modify data stored in the database engine.  [Dev Only]
2919
User Transaction Commits to Level 0/sec is the count of fully committed transactions started by the calling process that access data stored in the database engine.  [Dev Only]
2921
User Read Only Transaction Rollbacks to Level 0/sec is the count of aborted transactions started by the calling process that do not modify any data stored in the database engine.  [Dev Only]
2923
User Read/Write Transaction Rollbacks to Level 0/sec is the count of aborted transactions started by the calling process that modify data stored in the database engine.  [Dev Only]
2925
User Transaction Rollbacks to Level 0/sec is the count of aborted transactions started by the calling process that access data stored in the database engine.  [Dev Only]
2927
System Read Only Transaction Commits to Level 0/sec is the count of fully committed transactions started internally that do not modify any data stored in the database engine.  [Dev Only]
2929
System Read/Write Transaction Commits to Level 0/sec is the count of fully committed transactions started internally that modify data stored in the database engine.  [Dev Only]
2931
System Transaction Commits to Level 0/sec is the count of fully committed transactions started internally that access data stored in the database engine.  [Dev Only]
2933
System Read Only Transaction Rollbacks to Level 0/sec is the count of aborted transactions started internally that do not modify any data stored in the database engine.  [Dev Only]
2935
System Read/Write Transaction Rollbacks to Level 0/sec is the count of aborted transactions started internally that modify data stored in the database engine.  [Dev Only]
2937
System Transaction Rollbacks to Level 0/sec is the count of aborted transactions started internally that access data stored in the database engine.  [Dev Only]
2939
Database Page Allocation File Extension Async Consumed/sec is the rate of page allocations from a database file that must be serviced by extending the database file, but which do not stall when doing doing so.  [Dev Only]
2941
Database Page Allocation File Extension Stalls/sec is the rate of page allocations from a database file that must be serviced by extending the database file and which stall when doing so.  [Dev Only]
2943
Log Records/sec is the count of records written to the database log buffers per second.  [Dev Only]
2945
Log Buffer Capacity Flushes/sec is the count of times the database log buffers must be flushed per second because they are full.  [Dev Only]
2947
Log Buffer Commit Flushes/sec is the count of times the database log buffers must be flushed per second because a transaction is fully committing its changes.  [Dev Only]
2949
Log Buffer Flushes/sec is the count of times the database log buffers must be flushed per second.
2951
Log Writes/sec is the number of times the log buffers are written to the log file(s) per second.  If this number approaches the maximum write rate for the media holding the log file(s), the log may be a bottleneck.
2953
Log Record Stalls/sec is the number of log records that cannot be added to the log buffers per second because they are full.  If this counter is non-zero most of the time, the log buffer size may be a bottleneck.
2955
Total number of version buckets allocated
2957
Total number of version buckets allocated for FlagDelete RCEs  [Dev Only]
2959
VER Bucket Allocations Wait For Version Cleanup/sec is the number of version bucket allocations that must first wait for version cleanup in an attempt to free used version buckets  for re-use. [Dev Only]
2961
Average length of bookmark in RCE  [Dev Only]
2963
Number of times per second we look in the version store for a node whose version bit is set but which has no versions  [Dev Only]
2965
Number of times per second a version store clean task is dispatched asynchronously to be performed  [Dev Only]
2967
Number of times per second a version store clean task is performed synchronously  [Dev Only]
2969
Number of times per second a version store clean task was discarded due to load concerns  [Dev Only]
2971
Number of times per second a dispatched version store cleanup task fails  [Dev Only]
2973
Record Inserts/sec is the rate at which records are being inserted into database tables.  [Dev Only]
2975
Record Deletes/sec is the rate at which records in database tables are being flagged for deletion.  [Dev Only]
2977
Record Deletes/sec is the rate at which records in database tables are being updated.  [Dev Only]
2979
Record Unnecessary Replaces/sec is the rate at which updates to records in database tables are being discarded because the update did not actually modify the contents of the record.  [Dev Only]
2981
Record Redundant Replaces/sec is the rate at which records in database tables are being updated with the exact same content of the original record.  [Dev Only]
2983
Record Escrow-Updates/sec is the rate at which records in database tables are being escrow-updated.  [Dev Only]
2985
Secondary Index Inserts/sec is the rate at which entries are being inserted into indexes of database tables.  [Dev Only]
2987
Secondary Index Deletes/sec is the rate at which entries in indexes of database tables are being flagged for deletion.  [Dev Only]
2989
False Index Column Updates/sec is the number of times per second an attempt was made to update an index because an update to at least one of the indexed columns was detected, only to discover that none of the indexed columns had actually changed (and therefore no index update was actually required).  [Dev Only]
2991
False Tuple Index Column Updates/sec is the number of times per second an attempt was made to update a tuple index because an update to the tuple-indexed column was detected, only to discover that the column had not actually changed (and therefore no index update was actually required).  [Dev Only]
2993
Record Intrinsic Long-Values Updated/sec is the rate at which intrinsic long-values are added to or replaced in records of database tables.  [Dev Only]
2995
Record Separated Long-Values Added/sec is the rate at which separated long-values are normally added to records of database tables.  [Dev Only]
2997
Record Separated Long-Values Forced/sec is the rate at which separated long-values are added to records of a database table because they could not be accommodated in the record itself.  [Dev Only]
2999
Record Separated Long-Values All Forced/sec is the rate at which all intrinsic long-values are separated out of a record of a database table in order to accommodate updates to the record.  [Dev Only]
3001
Record Separated Long-Values Reference All/sec is the rate at which a reference is added for all the separated long-values associated with a record of a database table.  [Dev Only]
3003
Record Separated Long-Values Dereference All/sec is the rate at which a reference is removed for all the separated long-values associated with a record of a database table.  [Dev Only]
3005
Separated Long-Value Seeks/sec is the rate at which seeks for a separated long-value in a database table are performed.  [Dev Only]
3007
Separated Long-Value Retrieves/sec is the rate at which retrievals of a separated long-value in a database table are performed.  [Dev Only]
3009
Separated Long-Value Creates/sec is the rate at which new separated long-values are added to a database table.  [Dev Only]
3011
Separated Long-Value Updates/sec is the rate at which existing separated long-values in a database table are modified.  [Dev Only]
3013
Separated Long-Value Deletes/sec is the rate at which separated long-values in a database table are flagged for deletion.  [Dev Only]
3015
Separated Long-Value Copies/sec is the rate at which existing separated long-values in a database table are copied.  [Dev Only]
3017
Separated Long-Value Chunk Seeks/sec is the rate at which seeks for a particular chunk of a separated long-value in a database table are performed.  [Dev Only]
3019
Separated Long-Value Chunk Retrieves/sec is the rate at which retrievals of a chunk of a separated long-value in a database table are performed.  [Dev Only]
3021
Separated Long-Value Chunk Appends/sec is the rate at which chunks are appended to separated long-values of database tables.  [Dev Only]
3023
Separated Long-Value Chunk Replaces/sec is the rate at which existing separated long-value chunks in a database table are replaced.  [Dev Only]
3025
Separated Long-Value Chunk Deletes/sec is the rate at which separated long-value chunks in a database table are flagged for deletion.  [Dev Only]
3027
Separated Long-Value Chunk Copies/sec is the rate at which existing separated long-value chunks in a database table are copied.  [Dev Only]
3029
B+ Tree Append Splits/sec is the count of times a page is appended to a database B+ Tree per second.  [Dev Only]
3031
B+ Tree Right Splits/sec is the count of times a page is split right in a database B+ Tree per second.  [Dev Only]
3033
B+ Tree Right Hotpoint Splits/sec is the count of times a page is split right in a database B+ Tree, but which is treated as an append at a local "hotpoint" in the B+ Tree per second.  [Dev Only]
3035
B+ Tree Vertical Splits/sec is the count of times a page is split vertically in a database B+ Tree per second.  [Dev Only]
3037
B+ Tree Splits/sec is the count of times a page is appended to or split in a database B+ Tree per second.  [Dev Only]
3039
B+ Tree Empty Page Merges/sec is the count of empty pages removed from a database B+ Tree per second.  [Dev Only]
3041
Right Merges/sec is the count of pages removed from a database B+ Tree per second by moving all its records to the next page to the right.  [Dev Only]
3043
B+ Tree Partial Merges/sec is the count of pages where some of its records are moved to a page on the right in a database B+ Tree per second.  [Dev Only]
3045
B+ Tree Merges/sec is the count of pages merged in a database B+ Tree per second.  [Dev Only]
3047
B+ Tree Failed Simple Page Cleanup Attempts/sec is the rate that attempts to reclaim deleted node space on a page are unsuccessful due to a conflict when attempting to write-latch the page. The cleanup is re-tried by locking the root of the B+ Tree.  [Dev Only]
3049
B+ Tree Seek Short Circuits/sec is the count of repeated seeks to the same record in a database B+ Tree that are saved by jumping directly to the cached physical location of that record per second.  [Dev Only]
3051
B+ Tree Unnecessary Sibling Latches/sec is the count of sibling pages latched during a database B+ Tree Delete in the hopes of performing a merge where a merge is not possible, making that latch unnecessary.  [Dev Only]
3053
B+ Tree Move Nexts/sec is the count of times the database engine moves to the next record in a B+ Tree per second.  [Dev Only]
3055
B+ Tree Move Nexts (Non-Visible Nodes Skipped)/sec is the count of times the database engine skips non-visible records while attempting to move to the next visible record in a B+ Tree per second.  [Dev Only]
3057
B+ Tree Move Prevs/sec is the count of times the database engine moves to the previous record in a B+ Tree per second.  [Dev Only]
3059
B+ Tree Move Prevs (Non-Visible Nodes Skipped)/sec is the count of times the database engine skips non-visible records while attempting to move to the previous visible record in a B+ Tree per second.  [Dev Only]
3061
B+ Tree Seeks/sec is the count of times a record is seeked to by a key in a database B+ Tree per second.  [Dev Only]
3063
B+ Tree Inserts/sec is the count of times a record is inserted in a database B+ Tree per second.  [Dev Only]
3065
B+ Tree Replaces/sec is the count of times a record is replaced in a database B+ Tree per second.  [Dev Only]
3067
B+ Tree Flag Deletes/sec is the count of times a record is flag deleted in a database B+ Tree per second.  [Dev Only]
3069
B+ Tree Deletes/sec is the count of times a record is deleted in a database B+ Tree per second.  [Dev Only]
3071
B+ Tree Appends/sec is the count of times a record is appended to a database B+ Tree per second.  [Dev Only]
3073
B+ Tree Creates/sec is the number of B+ Trees and their corresponding space trees (if any) created per second.  This can also be viewed as the number of FDP creates per second.  [Dev Only]
3075
B+ Tree Creates (Total) is the total number of B+ Trees and their corresponding space trees (if any) created.  This can also be viewed as the total number of FDP creates.  [Dev Only]
3077
B+ Tree Destroys/sec is the number of B+ Trees and their corresponding space trees (if any) destroyed per second.  This can also be viewed as the number of FDP destroys per second.  [Dev Only]
3079
B+ Tree Destroys (Total) is the total number of B+ Trees and their corresponding space trees (if any) destroyed.  This can also be viewed as the total number of FDP destroys.  [Dev Only]
3081
Database Pages Read Async/sec is the rate that pages are asynchronously read from the database file(s) into the database cache.  [Dev Only]
3083
Database Pages Read Sync/sec is the rate that pages are synchronously read from the database file(s) into the database cache.  [Dev Only]
3085
Database Pages Written/sec is the rate that pages are written to the database file (s) from the database cache.  [Dev Only]
3087
Database Pages Transferred/sec is the rate that pages are transferred from the database file(s) to the database cache and vice versa.  [Dev Only]
3089
Database Pages Preread/sec is the rate that pages are read in anticipation of future use from the database file(s) into the database cache.  [Dev Only]
3091
Database Cached Pages Preread/sec is the rate that pages are read in anticipation of future use from the database file(s) into the database cache that are already cached.  This is non-ideal behavior that represents a waste of processing time.  [Dev Only]
3093
Database Pages Preread Untouched/sec is the rate that pages are read in anticipation of future use from the database file(s) into the database cache that were subsequently thrown out without being used. This is non-ideal behavior that represents a waste of I/O bandwidth and processing time .  [Dev Only]
3095
Database Pages Versioned / sec is the rate at which pages in the database cache are being copied into new pages in the cache for the purpose of being asynchronously written while the current version of that page in the database file is still being modified.  This feature is primarily used to avoid cycles, branches, or long chains of flush order dependencies without requiring the pages involved to be synchronously written to disk.  [Dev Only]
3097
Database Pages Ordinarily Written/sec is the rate that pages are written to the database file (s) from the database cache in preparation for evicting them from the cache to make room for other data.  [Dev Only]
3099
Database Pages Anomalously Written/sec is the rate that pages are written to the database file (s) from the database cache before they would ordinarily be written.  [Dev Only]
3101
Database Pages Opportunely Written/sec is the rate that pages are written to the database file (s) from the database cache because they happen to be near other pages that must be written.  These additional writes are performed before they must happen in the hope that the total number of seeks required to write all the pages is reduced.  [Dev Only]
3103
Database Pages Repeatedly Written/sec is the rate that pages are written to the database file (s) from the database cache more than once in their lifetime in the cache.  These page writes represent extra writes above the theoretical minimum and can therefore be considered overhead.  [Dev Only]
3105
Database Pages Idly Written/sec is the rate that pages are written to the database file (s) from the database cache because there is low disk activity.  [Dev Only]
3107
Database Pages Coalesced Written/sec is the rate that pages are written to the database file (s) from the database cache coalesced with another page. [Dev Only]
3109
Database Pages Coalesced Read/sec is the rate that pages are read from the database file (s) to the database cache coalesced with another page. [Dev Only]
3111
Streaming Backup Pages Read/sec is the rate of database read operationsperformed for the purpose of streaming backups.
3113
Online Defrag Pages Referenced/sec is the rate at which online defragmentation is touching database pages.  [Dev Only]
3115
Online Defrag Pages Read/sec is the rate of database read operations being performed by online defragmentation. [Dev Only]
3117
Online Defrag Pages Preread/sec is the rate at which database pages are read in anticipation of future use by online defragmentation.  [Dev Only]
3119
Online Defrag Pages Dirtied/sec is the rate at which online defragmentation is modifying clean database pages. [Dev Only]
3121
Online Defrag Pages Re-Dirtied/sec is the rate at which online defragmentation is modifying database pages that already contained modifications.  [Dev Only]
3123
Online Defrag Log Records/sec is the rate at which online defragmentation is generating log records.  [Dev Only]
3125
Online Defrag Average Log Bytes is the average size of the log records being generated by online defragmentation.  [Dev only]
3127
No text
3129
Database Tasks Pages Referenced/sec is the rate at which background database tasks are touching database pages. [Dev Only]
3131
Database Tasks Pages Read/sec is the rate of database read operations being performed by background database tasks. [Dev Only]
3133
Database Tasks Pages Preread/sec is the rate at which database pages are read in anticipation of future use by background database tasks.  [Dev Only]
3135
Database Tasks Pages Dirtied/sec is the rate at which background database tasks are modifying clean database pages. [Dev Only]
3137
Database Tasks Pages Re-Dirtied/sec is the rate at which background databases tasks are modifying database pages that already contained modifications.  [Dev Only]
3139
Database Tasks Log Records/sec is the rate at which background database tasks are generating log records.  [Dev Only]
3141
Database Tasks Average Log Bytes is the average size of the log records being generated by background database tasks.  [Dev only]
3143
No text
3145
I/O Database Reads/sec is the rate of database read operations completed.
3147
I/O Database Reads Average Latency is the average length of time,  in milliseconds, per database read operation.
3149
No text
3151
I/O Database Reads Average Bytes is the average number of bytes transferred per database read operation.  [Dev Only]
3153
No text
3155
I/O Database Reads In Heap is the number of database read operations queued in the database engine's I/O heap and waiting to be issued.  [Dev Only]
3157
I/O Database Reads Async Pending is the number of database read operations asynchronously pending completion.  [Dev Only]
3159
I/O Database Reads Abnormal Latency/sec is the rate of database read operations that take an abnormally long length of time (default is 1 minute) to be serviced by the OS.  [Dev Only]
3161
I/O Log Reads/sec is the rate of logfile read operations completed.
3163
I/O Log Reads Average Latency is the average length of time, in milliseconds, per logfile read operation.  [Dev Only]
3165
No text
3167
I/O Log Reads Average Bytes is the average number of bytes transferred per logfile read operation.  [Dev Only]
3169
No text
3171
I/O Log Reads In Heap is the number of logfile read operations queued in the database engine's I/O heap and waiting to be issued.  [Dev Only]
3173
I/O Log Reads Async Pending is the number of logfile read operations asynchronously pending completion.  [Dev Only]
3175
I/O Log Reads Abnormal Latency/sec is the rate of logfile read operations that take an abnormally long length of time (default is 1 minute) to be serviced by the OS.  [Dev Only]
3177
I/O Database Writes/sec is the rate of database write operations completed.
3179
I/O Database Writes Average Latency is the average length of time,  in milliseconds, per database write operation.
3181
No text
3183
I/O Database Writes Average Bytes is the average number of bytes transferred per database write operation.  [Dev Only]
3185
No text
3187
I/O Database Writes In Heap is the number of database write operations queued in the database engine's I/O heap and waiting to be issued.  [Dev Only]
3189
I/O Database Writes Async Pending is the number of database write operations asynchronously pending completion.  [Dev Only]
3191
I/O Database Writes Abnormal Latency/sec is the rate of database write operations that take an abnormally long length of time (default is 1 minute) to be serviced by the OS.  [Dev Only]
3193
I/O Log Writes/sec is the rate of logfile write operations completed.
3195
I/O Log Writes Average Latency is the average length of time, in milliseconds, per logfile write operation.
3197
No text
3199
I/O Log Writes Average Bytes is the average number of bytes transferred per logfile write operation.  [Dev Only]
3201
No text
3203
I/O Log Writes In Heap is the number of logfile write operations queued in the database engine's I/O heap and waiting to be issued.  [Dev Only]
3205
I/O Log Writes Async Pending is the number of logfile write operations asynchronously pending completion.  [Dev Only]
3207
I/O Log Writes Abnormal Latency/sec is the rate of logfile write operations that take an abnormally long length of time (default is 1 minute) to be serviced by the OS.  [Dev Only]
3209
Microsoft Distributed Transaction Coordinator performance counters
3211
Number of currently active transactions
3213
Number of committed transactions
3215
Number of aborted transactions
3217
Number of in doubt transactions
3219
Maximum number of transactions ever concurrently active
3221
Number of transactions committed by the system administrator
3223
Number of transactions aborted by the system administrator
3225
Minimum time delta between transaction begin and commit
3227
Average time delta between transaction begin and commit
3229
Maximum time delta between transaction begin and commit
3231
Transactions performed per second
3233
Transactions committed per second
3235
Transactions aborted per second
3425
Displays the current bulk transfer rate in bytes/sec.
3427
Displays the current isochronous transfer rate in bytes/sec.
3429
Displays the current interrupt transfer rate in bytes/sec.
3431
Displays the current control transfer rate in bytes/sec.
3433
Displays the rate of PCI interrupt generation by the USB controller. For controller instances only.
3435
Displays the current rate Work Signals generated per second by the usbport driver.  For controller instances only.
3437
Displays the percentage of BW reserved for interrupt transfers
3439
Displays the percentage of BW reserved for ISO transfers
3441
USB I/O Counters
3443
Displays the average size of all transfer URBs. For device instances only.
3445
Number of ISO packets that are NOT late, but complete with an error. For device instances only.
3447
Avg number of ms between the current frame and the start frame of an ISO transfer when scheduled.  For device instances only.
3449
Number of Transfer URBs completing with an error status. For device instances only.
3451
Non-zero value if the host controller is not running(idle).
3453
Non-Zero value if the host controller async schedule is not running(idle).
3455
Incremented each time the controller async cache is flushed.
3457
Non-Zero if the periodic schedule is not running(idle).
3459
Incremented each time the controller periodic cache is flushed.
3461
Help not available.
3463
The cumulative total number of socket connections established for this process since the process was started.
3465
The cumulative total number of bytes received over all open socket connections since the process was started. This number includes data and any protocol information that is not defined by the TCP/IP protocol.
3467
The cumulative total number of bytes sent over all open socket connections since the process was started. This number includes data and any protocol information that is not defined by the TCP/IP protocol.
3469
The cumulative total number of datagram packets received since the process was started.
3471
The cumulative total number of datagram packets sent since the process was started.
3473
Counters for System.Data.SqlClient
3475
The number of actual connections per second that are being made to servers
3477
The number of actual disconnects per second that are being made to servers
3479
The number of connections we get from the pool per second
3481
The number of connections we return to the pool per second
3483
The number of connections that are not using connection pooling
3485
The number of connections that are managed by the connection pooler
3487
The number of unique connection strings
3489
The number of unique connection strings waiting for pruning
3491
The number of active connection pools
3493
The number of inactive connection pools
3495
The number of connections currently in-use
3497
The number of connections currently available for use
3499
The number of connections currently waiting to be made ready for use
3501
The number of connections we reclaim from GCed external connections
3503
.Net CLR Data
3505
Current number of connections, pooled or not.
3507
Current number of connections in all pools associated with the process.
3509
Current number of pools associated with the process.
3511
The highest number of connections in all pools since the process started.
3513
The total number of connection open attempts that have failed for any reason.
3515
The total number of command executes that have failed for any reason.
3517
Counters for CLR Garbage Collected heap.
3519
This counter displays the number of times the generation 0 objects (youngest; most recently allocated) are garbage collected (Gen 0 GC) since the start of the application. Gen 0 GC occurs when the available memory in generation 0 is not sufficient to satisfy an allocation request. This counter is incremented at the end of a Gen 0 GC. Higher generation GCs include all lower generation GCs. This counter is explicitly incremented when a higher generation (Gen 1 or Gen 2) GC occurs. _Global_ counter value is not accurate and should be ignored. This counter displays the last observed value.
3521
This counter displays the number of times the generation 1 objects are garbage collected since the start of the application. The counter is incremented at the end of a Gen 1 GC. Higher generation GCs include all lower generation GCs. This counter is explicitly incremented when a higher generation (Gen 2) GC occurs. _Global_ counter value is not accurate and should be ignored. This counter displays the last observed value.
3523
This counter displays the number of times the generation 2 objects (older) are garbage collected since the start of the application. The counter is incremented at the end of a Gen 2 GC (also called full GC). _Global_ counter value is not accurate and should be ignored. This counter displays the last observed value.
3525
This counter displays the bytes of memory that survive garbage collection (GC) and are promoted from generation 0 to generation 1; objects that are promoted just because they are waiting to be finalized are not included in this counter. This counter displays the value observed at the end of the last GC; its not a cumulative counter.
3527
This counter displays the bytes of memory that survive garbage collection (GC) and are promoted from generation 1 to generation 2; objects that are promoted just because they are waiting to be finalized are not included in this counter. This counter displays the value observed at the end of the last GC; its not a cumulative counter. This counter is reset to 0 if the last GC was a Gen 0 GC only.
3529
This counter displays the bytes per second that are promoted from generation 0 (youngest) to generation 1; objects that are promoted just because they are waiting to be finalized are not included in this counter. Memory is promoted when it survives a garbage collection. This counter was designed as an indicator of relatively long-lived objects being created per sec. This counter displays the difference between the values observed in the last two samples divided by the duration of the sample interval.
3531
This counter displays the bytes per second that are promoted from generation 1 to generation 2 (oldest); objects that are promoted just because they are waiting to be finalized are not included in this counter. Memory is promoted when it survives a garbage collection. Nothing is promoted from generation 2 since it is the oldest. This counter was designed as an indicator of very long-lived objects being created per sec. This counter displays the difference between the values observed in the last two samples divided by the duration of the sample interval.
3533
This counter displays the bytes of memory that are promoted from generation 0 to generation 1 just because they are waiting to be finalized. This counter displays the value observed at the end of the last GC; its not a cumulative counter.
3535
This counter displays the process ID of the CLR process instance being monitored.
3537
This counter displays the maximum bytes that can be allocated in generation 0 (Gen 0); its does not indicate the current number of bytes allocated in Gen 0. A Gen 0 GC is triggered when the allocations since the last GC exceed this size. The Gen 0 size is tuned by the Garbage Collector and can change during the execution of the application. At the end of a Gen 0 collection the size of the Gen 0 heap is infact 0 bytes; this counter displays the size (in bytes) of allocations that would trigger the next Gen 0 GC. This counter is updated at the end of a GC; its not updated on every allocation.
3539
This counter displays the current number of bytes in generation 1 (Gen 1); this counter does not display the maximum size of Gen 1. Objects are not directly allocated in this generation; they are promoted from previous Gen 0 GCs. This counter is updated at the end of a GC; its not updated on every allocation.
3541
This counter displays the current number of bytes in generation 2 (Gen 2). Objects are not directly allocated in this generation; they are promoted from Gen 1 during previous Gen 1 GCs. This counter is updated at the end of a GC; its not updated on every allocation.
3543
This counter displays the current size of the Large Object Heap in bytes. Objects greater than 20 KBytes are treated as large objects by the Garbage Collector and are directly allocated in a special heap; they are not promoted through the generations. This counter is updated at the end of a GC; its not updated on every allocation.
3545
This counter displays the number of garbage collected objects that survive a collection because they are waiting to be finalized. If these objects hold references to other objects then those objects also survive but are not counted by this counter; the "Promoted Finalization-Memory from Gen 0" and "Promoted Finalization-Memory from Gen 1" counters represent all the memory that survived due to finalization. This counter is not a cumulative counter; its updated at the end of every GC with count of the survivors during that particular GC only. This counter was designed to indicate the extra overhead that the application might incur because of finalization.
3547
This counter displays the current number of GC Handles in use. GCHandles are handles to resources external to the CLR and the managed environment. Handles occupy small amounts of memory in the GCHeap but potentially expensive unmanaged resources.
3549
This counter displays the rate of bytes per second allocated on the GC Heap. This counter is updated at the end of every GC; not at each allocation. This counter is not an average over time; it displays the difference between the values observed in the last two samples divided by the duration of the sample interval.
3551
This counter displays the peak number of times a garbage collection was performed because of an explicit call to GC.Collect. Its a good practice to let the GC tune the frequency of its collections.
3553
% Time in GC is the percentage of elapsed time that was spent in performing a garbage collection (GC) since the last GC cycle. This counter is usually an indicator of the work done by the Garbage Collector on behalf of the application to collect and compact memory. This counter is updated only at the end of every GC and the counter value reflects the last observed value; its not an average.
3555
Not Displayed.
3557
This counter is the sum of four other counters; Gen 0 Heap Size; Gen 1 Heap Size; Gen 2 Heap Size and the Large Object Heap Size. This counter indicates the current memory allocated in bytes on the GC Heaps.
3559
This counter displays the amount of virtual memory (in bytes) currently committed by the Garbage Collector. (Committed memory is the physical memory for which space has been reserved on the disk paging file).
3561
This counter displays the amount of virtual memory (in bytes) currently reserved by the Garbage Collector. (Reserved memory is the virtual memory space reserved for the application but no disk or main memory pages have been used.)
3563
This counter displays the number of pinned objects encountered in the last GC. This counter tracks the pinned objects only in the heaps that were garbage collected e.g. a Gen 0 GC would cause enumeration of pinned objects in the generation 0 heap only. A pinned object is one that the Garbage Collector cannot move in memory.
3565
This counter displays the current number of sync blocks in use. Sync blocks are per-object data structures allocated for storing synchronization information. Sync blocks hold weak references to managed objects and need to be scanned by the Garbage Collector. Sync blocks are not limited to storing synchronization information and can also store COM interop metadata. This counter was designed to indicate performance problems with heavy use of synchronization primitives.
3567
Statistics for CLR Class Loader.
3569
This counter displays the cumulative number of classes loaded in all Assemblies since the start of this application.
3571
Reserved for future use.
3573
Reserved for future use.
3575
This counter displays the peak number of classes that have failed to load since the start of the application. These load failures could be due to many reasons like inadequate security or illegal format. Full details can be found in the profiling services help.
3577
This counter displays the number of classes that failed to load per second. This counter is not an average over time; it displays the difference between the values observed in the last two samples divided by the duration of the sample interval. These load failures could be due to many reasons like inadequate security or illegal format. Full details can be found in the profiling services help.
3579
This counter displays the current size (in bytes) of the memory committed by the class loader across all AppDomains. (Committed memory is the physical memory for which space has been reserved on the disk paging file.)
3581
This counter displays the total number of AppDomains unloaded since the start of the application. If an AppDomain is loaded and unloaded multiple times this counter would count each of those unloads as separate.
3583
This counter displays the number of AppDomains unloaded per second. This counter is not an average over time; it displays the difference between the values observed in the last two samples divided by the duration of the sample interval.
3585
This counter displays the current number of classes loaded in all Assemblies.
3587
This counter displays the number of classes loaded per second in all Assemblies. This counter is not an average over time; it displays the difference between the values observed in the last two samples divided by the duration of the sample interval.
3589
This counter displays the current number of AppDomains loaded in this application. AppDomains (application domains) provide a secure and versatile unit of processing that the CLR can use to provide isolation between applications running in the same process.
3591
This counter displays the peak number of AppDomains loaded since the start of this application. AppDomains (application domains) provide a secure and versatile unit of processing that the CLR can use to provide isolation between applications running in the same process.
3593
This counter displays the number of AppDomains loaded per second. AppDomains (application domains) provide a secure and versatile unit of processing that the CLR can use to provide isolation between applications running in the same process. This counter is not an average over time; it displays the difference between the values observed in the last two samples divided by the duration of the sample interval.
3595
This counter displays the current number of Assemblies loaded across all AppDomains in this application. If the Assembly is loaded as domain-neutral from multiple AppDomains then this counter is incremented once only. Assemblies can be loaded as domain-neutral when their code can be shared by all AppDomains or they can be loaded as domain-specific when their code is private to the AppDomain.
3597
This counter displays the total number of Assemblies loaded since the start of this application. If the Assembly is loaded as domain-neutral from multiple AppDomains then this counter is incremented once only. Assemblies can be loaded as domain-neutral when their code can be shared by all AppDomains or they can be loaded as domain-specific when their code is private to the AppDomain.
3599
This counter displays the number of Assemblies loaded across all AppDomains per second. If the Assembly is loaded as domain-neutral from multiple AppDomains then this counter is incremented once only. Assemblies can be loaded as domain-neutral when their code can be shared by all AppDomains or they can be loaded as domain-specific when their code is private to the AppDomain. This counter is not an average over time; it displays the difference between the values observed in the last two samples divided by the duration of the sample interval.
3601
Stats for CLR Jit.
3603
This counter displays the total number of methods compiled Just-In-Time (JIT) by the CLR JIT compiler since the start of the application. This counter does not include the pre-jitted methods.
3605
This counter displays the total IL bytes jitted since the start of the application. This counter is exactly equivalent to the "Total # of IL Bytes Jitted" counter.
3607
This counter displays the total IL bytes jitted since the start of the application. This counter is exactly equivalent to the "# of IL Bytes Jitted" counter.
3609
This counter displays the rate at which IL bytes are jitted per second. This counter is not an average over time; it displays the difference between the values observed in the last two samples divided by the duration of the sample interval.
3611
This counter displays the peak number of methods the JIT compiler has failed to JIT since the start of the application. This failure can occur if the IL cannot be verified or if there was an internal error in the JIT compiler.
3613
This counter displays the percentage of elapsed time spent in JIT compilation since the last JIT compilation phase. This counter is updated at the end of every JIT compilation phase. A JIT compilation phase is the phase when a method and its dependencies are being compiled.
3615
Not Displayed.
3617
Stats for CLR interop.
3619
This counter displays the current number of Com-Callable-Wrappers (CCWs). A CCW is a proxy for the .NET managed object being referenced from unmanaged COM client(s). This counter was designed to indicate the number of managed objects being referenced by unmanaged COM code.
3621
This counter displays the current number of stubs created by the CLR. Stubs are responsible for marshalling arguments and return values from managed to unmanaged code and vice versa; during a COM Interop call or PInvoke call.
3623
This counter displays the total number of times arguments and return values have been marshaled from managed to unmanaged code and vice versa since the start of the application. This counter is not incremented if the stubs are inlined. (Stubs are responsible for marshalling arguments and return values). Stubs usually get inlined if the marshalling overhead is small.
3625
Reserved for future use.
3627
Reserved for future use.
3629
Stats for CLR Locks and Threads.
3631
This counter displays the total number of times threads in the CLR have attempted to acquire a managed lock unsuccessfully. Managed locks can be acquired in many ways; by the "lock" statement in C# or by calling System.Monitor.Enter or by using MethodImplOptions.Synchronized custom attribute.
3633
Rate at which threads in the runtime attempt to acquire a managed lock unsuccessfully. Managed locks can be acquired in many ways; by the "lock" statement in C# or by calling System.Monitor.Enter or by using MethodImplOptions.Synchronized custom attribute.
3635
This counter displays the total number of threads currently waiting to acquire some managed lock in the application. This counter is not an average over time; it displays the last observed value.
3637
This counter displays the total number of threads that waited to acquire some managed lock since the start of the application.
3639
This counter displays the number of threads per second waiting to acquire some lock in the application. This counter is not an average over time; it displays the difference between the values observed in the last two samples divided by the duration of the sample interval.
3641
This counter displays the number of current .NET thread objects in the application. A .NET thread object is created either by new System.Threading.Thread or when an unmanaged thread enters the managed environment. This counters maintains the count of both running and stopped threads. This counter is not an average over time; it just displays the last observed value.
3643
This counter displays the number of native OS threads created and owned by the CLR to act as underlying threads for .NET thread objects. This counters value does not include the threads used by the CLR in its internal operations; it is a subset of the threads in the OS process.
3645
This counter displays the number of threads that are currently recognized by the CLR; they have a corresponding .NET thread object associated with them. These threads are not created by the CLR; they are created outside the CLR but have since run inside the CLR at least once. Only unique threads are tracked; threads with same thread ID re-entering the CLR or recreated after thread exit are not counted twice.
3647
This counter displays the total number of threads that have been recognized by the CLR since the start of this application; these threads have a corresponding .NET thread object associated with them. These threads are not created by the CLR; they are created outside the CLR but have since run inside the CLR at least once. Only unique threads are tracked; threads with same thread ID re-entering the CLR or recreated after thread exit are not counted twice.
3649
This counter displays the number of threads per second that have been recognized by the CLR; these threads have a corresponding .NET thread object associated with them. These threads are not created by the CLR; they are created outside the CLR but have since run inside the CLR at least once. Only unique threads are tracked; threads with same thread ID re-entering the CLR or recreated after thread exit are not counted twice. This counter is not an average over time; it displays the difference between the values observed in the last two samples divided by the duration of the sample interval.
3651
Stats for CLR Security.
3653
This counter displays the total number of runtime Code Access Security (CAS) checks performed since the start of the application. Runtime CAS checks are performed when a caller makes a call to a callee demanding a particular permission; the runtime check is made on every call by the caller; the check is done by examining the current thread stack of the caller. This counter used together with "Stack Walk Depth" is indicative of performance penalty for security checks.
3655
Reserved for future use.
3657
This counter displays the total number of linktime Code Access Security (CAS) checks since the start of the application. Linktime CAS checks are performed when a caller makes a call to a callee demanding a particular permission at JIT compile time; linktime check is performed once per caller. This count is not indicative of serious performance issues; its indicative of the security system activity.
3659
This counter displays the percentage of elapsed time spent in performing runtime Code Access Security (CAS) checks since the last such check. CAS allows code to be trusted to varying degrees and enforces these varying levels of trust depending on code identity. This counter is updated at the end of a runtime security check; it represents the last observed value; its not an average.
3661
Not Displayed.
3663
This counter displays the depth of the stack during that last runtime Code Access Security check. Runtime Code Access Security check is performed by crawling the stack. This counter is not an average; it just displays the last observed value.

### #13 ianlh

ianlh
• Topic Starter

• Members
• 11 posts
• OFFLINE
•
• Local time:08:15 PM

Posted 26 August 2013 - 04:22 PM

minireg #5 (last one)

3665
Stats for CLR Remoting.
3667
This counter displays the number of remote procedure calls invoked per second. A remote procedure call is a call on any object outside the caller;s AppDomain. This counter is not an average over time; it displays the difference between the values observed in the last two samples divided by the duration of the sample interval.
3669
This counter displays the total number of remoting channels registered across all AppDomains since the start of the application. Channels are used to transport messages to and from remote objects.
3671
This counter displays the total number of remoting proxy objects created in this process since the start of the process. Proxy object acts as a representative of the remote objects and ensures that all calls made on the proxy are forwarded to the correct remote object instance.
3673
This counter displays the current number of context-bound classes loaded. Classes that can be bound to a context are called context-bound classes; context-bound classes are marked with Context Attributes which provide usage rules for synchronization; thread affinity; transactions etc.
3675
This counter displays the number of context-bound objects allocated per second. Instances of classes that can be bound to a context are called context-bound objects; context-bound classes are marked with Context Attributes which provide usage rules for synchronization; thread affinity; transactions etc. This counter is not an average over time; it displays the difference between the values observed in the last two samples divided by the duration of the sample interval.
3677
This counter displays the current number of remoting contexts in the application. A context is a boundary containing a collection of objects with the same usage rules like synchronization; thread affinity; transactions etc.
3679
This counter displays the total number of remote procedure calls invoked since the start of this application. A remote procedure call is a call on any object outside the caller;s AppDomain.
3681
Runtime statistics on CLR exception handling.
3683
This counter displays the total number of exceptions thrown since the start of the application. These include both .NET exceptions and unmanaged exceptions that get converted into .NET exceptions e.g. null pointer reference exception in unmanaged code would get re-thrown in managed code as a .NET System.NullReferenceException; this counter includes both handled and unhandled exceptions. Exceptions that are re-thrown would get counted again. Exceptions should only occur in rare situations and not in the normal control flow of the program.
3685
This counter displays the number of exceptions thrown per second. These include both .NET exceptions and unmanaged exceptions that get converted into .NET exceptions e.g. null pointer reference exception in unmanaged code would get re-thrown in managed code as a .NET System.NullReferenceException; this counter includes both handled and unhandled exceptions. Exceptions should only occur in rare situations and not in the normal control flow of the program; this counter was designed as an indicator of potential performance problems due to large (>100s) rate of exceptions thrown. This counter is not an average over time; it displays the difference between the values observed in the last two samples divided by the duration of the sample interval.
3687
This counter displays the number of .NET exception filters executed per second. An exception filter evaluates whether an exception should be handled or not. This counter tracks the rate of exception filters evaluated; irrespective of whether the exception was handled or not. This counter is not an average over time; it displays the difference between the values observed in the last two samples divided by the duration of the sample interval.
3689
This counter displays the number of finally blocks executed per second. A finally block is guaranteed to be executed regardless of how the try block was exited. Only the finally blocks that are executed for an exception are counted; finally blocks on normal code paths are not counted by this counter. This counter is not an average over time; it displays the difference between the values observed in the last two samples divided by the duration of the sample interval.
3691
This counter displays the number of stack frames traversed from the frame that threw the .NET exception to the frame that handled the exception per second. This counter resets to 0 when an exception handler is entered; so nested exceptions would show the handler to handler stack depth. This counter is not an average over time; it displays the difference between the values observed in the last two samples divided by the duration of the sample interval.
3693
Counters for System.Data.OracleClient
3695
The number of actual connections per second that are being made to servers
3697
The number of actual disconnects per second that are being made to servers
3699
The number of connections we get from the pool per second
3701
The number of connections we return to the pool per second
3703
The number of connections that are not using connection pooling
3705
The number of connections that are managed by the connection pooler
3707
The number of unique connection strings
3709
The number of unique connection strings waiting for pruning
3711
The number of active connection pools
3713
The number of inactive connection pools
3715
The number of connections currently in-use
3717
The number of connections currently available for use
3719
The number of connections currently waiting to be made ready for use
3721
The number of connections we reclaim from GCed external connections
3723
Counters for the Windows Search Service Gatherer Project object
3725
The number of add notifications.
3727
The number of document additions per second.
3729
The number of delete notifications.
3731
The number of document deletes per second.
3733
The number of modify notifications.
3735
The number of modify notifications per second.
3737
The number of documents waiting to be processed. When this number goes to zero the catalog is idle. This number indicates the total queue size of unprocessed documents in the gatherer.
3739
The number of documents in progress.
3741
The number of documents on hold because a document with the same URL is currently in process.
3743
The number of documents delayed due to site hit frequency rules.
3745
The number of files (URLs) in the history list. This indicates the total size of your document corpus that was indexed.
3747
The number of documents processed since the history has been reset.
3749
The number of documents processed per second.
3751
The number of successfully filtered documents.
3753
The number of successfully filtered documents per second.
3755
The number of filtered documents which returned an error.
3757
The number of filtered documents which returned an error per second.
3763
The number of file protocol errors received while getting documents.
3765
The number of file protocol errors received per second.
3771
The number of documents accessed via file system.
3773
The number of documents accessed via file system per second.
3779
The number of office documents filtered.
3781
The number of office documents filtered per second.
3783
The number of text documents filtered.
3785
The number of text documents filtered per second.
3787
Number of crawls in progress.
3789
The Gatherer paused flag indicates if the Gatherer has been paused.
3791
The recovery in progress flag indicates if recovery is currently in progress. Indexing will not be resumed until this flag is off.
3793
The number of documents which were not filtered because no modification was detected since the last crawl.
3795
The Iterating history in progress flag indicates if the Gatherer is currently iterating over the URL history.
3797
Number of incremental crawls in progress.
3799
The number of documents currently being filtered.
3801
The number of documents initiated into the Gatherer service. This includes the number of documents on hold, in the active queue, and currently filtered. When this number goes to zero during a crawl, it means the crawl will be done soon.
3803
The total number of times a document access has been retried. Having this number high may indicate a problem with accessing the data.
3805
The number of retries per second.
3813
Documents incorrectly rejected by adaptive crawl
3819
Documents which have changed since the last crawl
3821
The number of Move/Rename notifications.
3823
The number of document Moves and Renames per second.
3825
Number of unique documents in the system. Documents are considered not unique if their contents is the same.
3827
Percentage of the history recovery completed
3829
Counters for the Windows Search Service Gathering service object
3831
Currently connected external notification sources.
3833
The total number of notifications received from all notification sources excluding file system.
3835
The rate of external notifications received per second.
3837
The number of currently connected administrative clients.
3839
The total number of heartbeats counted since startup. A heartbeat occurs once every 10 seconds while the service is running. If the service is not running there will be no heartbeat and the number of ticks will not be incremented.
3841
Displays one heartbeat every 10 seconds.
3843
The total number of filtering threads in the system. This number is calculated based on your system resources.
3845
The number of threads waiting for documents.
3847
The number of document entries currently in memory. Zero means no indexing activity is going on.
3849
Indicates the level of the amount of system resources that the Gatherer service is allowed to use.
3851
The number of documents waiting for robot threads. If this number is not 0, all threads should be filtering.
3853
The number of filtering processes in the system.
3855
The maximum number of filtering processes that have existed in the system since startup.
3857
The total number of times a filter process was created or restarted. Having too many filter processes created indicates that filtering is having trouble with the data in the documents.
3859
The number of documents delayed due to site hit frequency rules.
3861
The number of servers recently accessed by the system.
3863
The number of times a new server object had to be created.
3865
The number of filter objects in the system. Each filter object corresponds to a URL currently being filtered.
3867
The number of times a filter object was created. This corresponds to the total number of documents filtered in the system since startup.
3869
The number of documents filtered per second.
3871
The total number of timeouts detected by the system since startup.
3873
A server becomes unavailable when a number of requests to that server time out.
3875
A server becomes unavailable when a number of requests to that server time out.
3877
The number of threads waiting for a response from the filter process. If no activity is going on and this number is equal to number of filtering threads, it may indicate a network problem or unavailability of the server it is crawling.
3879
The number of threads waiting for plug-ins to complete an operation.
3881
The number of documents successfully filtered.
3883
The number of successfully filtered documents per second.
3885
The number of documents that will be retried after time-out. When this is non-zero, it means that the local server it is crawling is shut down.
3887
Number of available cached word breakers instances
3889
Number of available cached stemmer instances. Too many may indicate a resource usage problem.
3891
The total number of notifications received from all notification sources including file system.
3893
The rate of external notifications received per second.
3895
System IO (disk) traffic rate in KB/s detected by back off logic
3897
The code describing why the Gatherer service went into back off state. 0 - up and running 1 - high system IO traffic 2 - high notifications rate 3 - delayed recovery in progress (not implemented) 4 - back off due to user activity 5 - Battery Low 6 - Memory Low 99 - back off for some internal reason (forced by Search itself) While backing off, no indexing is performed. To resume the indexing you must eliminate the reason for back off. If the Gatherer service is in back off state, the Search service is paused and there is a message in the event log.
3899
The number of threads blocked due to back off event
3901
Indexer PlugIn statistics
3903
The level of the master index.
3905
Number of Master Merges to Date
3907
Master Merge Progress
3909
Shadow Merge Levels
3911
Shadow Merge Levels Threshold
3913
Number of Persistent Indexes
3915
Size of Index
3917
Number of Unique Keys
3919
Number of Documents Filtered
3921
Number of invalidator work items that were created
3923
Number of invalidator work items that were deleted
3925
Number of clean WidSets
3927
Number of dirty WidSets
3929
Indicator if a master merge is going on.
3931
Active Connections
3933
Number of Queries
3935
Number of Queries Failed
3937
Number of Queries Succeeded
3939
The number of L0 Indexes (Wordlists)
3941
The number of L0 merges (flushes) in progress at any one moment.
3943
The average value [documents/hour] computed for the speed of L0 merges (flushes) since the catalog has been loaded
3945
The number of L0 merges (flushes) since the catalog was loaded
3947
The last value [documents/hour] computed for the speed of L0 merges (flushes).
3949
The number of L1 Indexes
3951
The number of L1 merges in progress at any one moment.
3953
The average value [documents/hour] computed for the speed of L1 merges since the catalog has been loaded
3955
The number of L1 merges since the catalog was loaded
3957
The last value [documents/hour] computed for the speed of L1 merges.
3959
The number of L2 Indexes
3961
The number of L2 merges in progress at any one moment.
3963
The average value [documents/hour] computed for the speed of L2 merges since the catalog has been loaded
3965
The number of L2 merges since the catalog was loaded
3967
The last value [documents/hour] computed for the speed of L2 merges.
3969
The number of L3 Indexes
3971
The number of L3 merges in progress at any one moment.
3973
The average value [documents/hour] computed for the speed of L3 merges since the catalog has been loaded
3975
The number of L3 merges since the catalog was loaded
3977
The last value [documents/hour] computed for the speed of L3 merges.
3979
The number of L4 Indexes
3981
The number of L4 merges in progress at any one moment.
3983
The average value [documents/hour] computed for the speed of L4 merges since the catalog has been loaded
3985
The number of L4 merges since the catalog was loaded
3987
The last value [documents/hour] computed for the speed of L4 merges.
3989
The number of L5 Indexes
3991
The number of L5 merges in progress at any one moment.
3993
The average value [documents/hour] computed for the speed of L5 merges since the catalog has been loaded
3995
The number of L5 merges since the catalog was loaded
3997
The last value [documents/hour] computed for the speed of L5 merges.
3999
The number of L6 Indexes
4001
The number of L6 merges in progress at any one moment.
4003
The average value [documents/hour] computed for the speed of L6 merges since the catalog has been loaded
4005
The number of L6 merges since the catalog was loaded
4007
The last value [documents/hour] computed for the speed of L6 merges.
4009
The number of L7 Indexes
4011
The number of L7 merges in progress at any one moment.
4013
The average value [documents/hour] computed for the speed of L7 merges since the catalog has been loaded
4015
The number of L7 merges since the catalog was loaded
4017
The last value [documents/hour] computed for the speed of L7 merges.
4019
The number of L8 Indexes
4021
The number of L8 merges in progress at any one moment.
4023
The average value [documents/hour] computed for the speed of L8 merges since the catalog has been loaded
4025
The number of L8 merges since the catalog was loaded
4027
The last value [documents/hour] computed for the speed of L8 merges.
4029
Performance Counters for the Peer Networking Resolution Protocol
4031
Number of IDs registered in the Peer Networking Resolution Protocol
4033
Number of resolves made in the Peer Networking Resolution Protocol
4035
Average outbound bandwidth utilization of the Peer Networking Resolution Protocol, in terms of bytes sent per second
4037
Average inbound bandwidth utilization of the Peer Networking Resolution Protocol, in terms of bytes received per second
4039
Stale cache entry hits in the Peer Networking Resolution Protocol
4041
ServiceModelOperation 3.0.0.0 performance counters
4043
The number of calls to this operation. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.Calls.aspx
4045
The number of calls to this operation per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.CallsPerSecond.aspx
4047
The number of calls to this operation that are in progress. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.CallsOutstanding.aspx
4049
The number of calls with unhandled exceptions in this operation. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.CallsFailed.aspx
4051
The number of calls with unhandled exceptions in this operation per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.CallsFailedPerSecond.aspx
4053
The number of calls to this operation that returned faults. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.CallsFaulted.aspx
4055
The number of calls to this operation that returned faults per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.CallsFaultedPerSecond.aspx
4057
The average duration of calls to this operation. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.CallDuration.aspx
4059
Base counter for the 'Calls Duration' counter.
4061
The number of transactions that flowed to this operation. This counter is incremented any time a transaction ID is present in the message sent to the operation. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.TxFlowed.aspx
4063
The number of transactions that flowed to this operation per second. This counter is incremented any time a transaction ID is present in the message sent to the operation. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.TxFlowedPerSecond.aspx
4065
The number of calls to this operation that failed validation or authentication. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.SecurityValidationAuthenticationFailures.aspx
4067
The number of calls to this operation that failed validation or authentication per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.SecurityValidationAuthenticationFailuresPerSecond.aspx
4069
The number of calls to this operation that failed authorization. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.SecurityCallsNotAuthorized.aspx
4071
The number of calls to this operation that failed authorization per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.SecurityCallsNotAuthorizedPerSecond.aspx
4073
Displays performance statistics about the ReadyBoost Cache
4075
The number of bytes read from the cache per second.
4077
The number of bytes read from the volume per second.
4079
The number of bytes written to the volume per second.
4081
The number of read bytes serviced from the update buffers per second.
4083
The total (uncompressed) amount of data currently stored in the cache.
4085
The number of bytes invalidated in update buffers per second.
4087
The number of reads from the cache per second.
4089
(Actual size of data in cache) / (Uncompressed size of data in cache)
4091
The number of I/Os not serviced by the cache due to sequentiality per second.
4093
The number of I/Os not serviced by the cache because the size is bigger than the maximum read size per second.
4095
Writes rescheduled due to the lack of regions per second.
4097
Writes rescheduled due to the lack of update buffers per second.
4099
The number of blocks in update buffers invalidated per second.
4101
ServiceModelService 3.0.0.0 performance counters
4103
The number of calls to this service. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.Calls.aspx
4105
The number of calls to this service per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.CallsPerSecond.aspx
4107
The number of calls to this service that are in progress. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.CallsOutstanding.aspx
4109
The number of calls with unhandled exceptions in this service. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.CallsFailed.aspx
4111
The number of calls with unhandled exceptions in this service per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.CallsFailedPerSecond.aspx
4113
The number of calls to this service that returned faults. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.CallsFaulted.aspx
4115
The number of calls to this service that returned faults per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.CallsFaultedPerSecond.aspx
4117
The average duration of calls to this service. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.CallDuration.aspx
4119
Base counter for the 'Calls Duration' counter.
4121
The number of transactions that flowed to operations in this service. This counter is incremented any time a transaction ID is present in the message that is sent to the service. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.TxFlowed.aspx
4123
The number of transactions that flowed to operations in this service per second. This counter is incremented any time a transaction ID is present in the message that is sent to the service. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.TxFlowedPerSecond.aspx
4125
The number of transacted operations with the outcome committed in this service. Work done under such operations is fully committed. Resources are updated in accordance with the work done in the operation. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.TxCommitted.aspx
4127
The number of transacted operations with the outcome committed in this service per second. Work done under such operations is fully committed. Resources are updated in accordance with the work done in the operation. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.TxCommittedPerSecond.aspx
4129
The number of transacted operations with the outcome aborted in this service. Work done under such operations is rolled back. Resources are reverted to their previous state. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.TxAborted.aspx
4131
The number of transacted operations with the outcome aborted in this service per second. Work done under such operations is rolled back. Resources are reverted to their previous state. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.TxAbortedPerSecond.aspx
4133
The number of transacted operations with an outcome in doubt in this service. Work done with an outcome in doubt is in an indeterminate state. Resources are held pending outcome. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.TxInDoubt.aspx
4135
The number of transacted operations with an outcome in doubt in this service per second. Work done with an outcome in doubt is in an indeterminate state. Resources are held pending outcome. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.TxInDoubtPerSecond.aspx
4137
The number of calls to this service that failed validation or authentication. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.SecurityValidationAuthenticationFailures.aspx
4139
The number of calls to this service that failed validation or authentication per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.SecurityValidationAuthenticationFailuresPerSecond.aspx
4141
The number of calls to this service that failed authorization. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.SecurityCallsNotAuthorized.aspx
4143
The number of calls to this service that failed authorization per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.SecurityCallsNotAuthorizedPerSecond.aspx
4145
The total number of instances of the service. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.Instances.aspx
4147
The creation rate of service instances per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.InstancesPerSecond.aspx
4149
The number of reliable messaging sessions that were faulted in this service. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.RMSessionsFaulted.aspx
4151
The number of reliable messaging sessions that were faulted in this service per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.RMSessionsFaultedPerSecond.aspx
4153
The number of reliable messaging messages that were dropped in this service. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.RMMessagesDropped.aspx
4155
The number of reliable messaging messages that were dropped in this service per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.RMMessagesDroppedPerSecond.aspx
4157
The number of messages to this service that were marked poisoned by the queued transport. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.MsmqPoisonMessages.aspx
4159
The number of messages to this service that were marked poisoned by the queued transport per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.MsmqPoisonMessagesPerSecond.aspx
4161
The number of messages to this servcie that were rejected by the queued transport. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.MsmqRejectedMessages.aspx
4163
The number of messages to this service that were rejected by the queued transport per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.MsmqRejectedMessagesPerSecond.aspx
4165
The number of messages to this service that were dropped by the queued transport. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.MsmqDroppedMessages.aspx
4167
The number of messages to this service that were dropped by the queued transport per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.MsmqDroppedMessagesPerSecond.aspx
4169
MSDTC Bridge 3.0.0.0 performance counters
4171
The number of WS-AT protocol messages that the WS-AT service failed to send per second.
4173
The number of Prepare retry messages that the WS-AT service has sent per second.
4175
The number of Commit retry messages that the WS-AT service has sent per second.
4177
The number of Prepared retry messages that the WS-AT service has sent per second.
4179
The number of Replay retry messages that the WS-AT service has sent per second.
4181
The number of Fault messages that the WS-AT service has received per second.
4183
The number of Fault messages that the WS-AT service has sent per second.
4185
Average time in milliseconds for the WS-AT service to receive a Prepare message response from a participant.
4187
Base counter for the 'Average participant prepare response time' counter.
4189
Average time in milliseconds for the WS-AT service to receive a Commit message response from a participant.
4191
Base counter for the 'Average participant commit response time' counter.
4273
SMSvcHost 3.0.0.0 performance counters
4275
The total number of failures at the protocol layer of net.tcp.
4277
The total number of failures at the protocol layer of net.pipe.
4279
The total number of failures dispatching messages received over net.tcp.
4281
The total number of failures dispatching messages received over net.pipe.
4283
The total number of connections dispatched over net.tcp.
4285
The total number of connections dispatched over net.pipe.
4287
The total number of TCP connections accepted over net.tcp.
4289
The total number of named pipe connections accepted over net.pipe.
4291
The number of uri registrations currently active for net.tcp.
4293
The number of uri registrations currently active for net.pipe.
4295
The total number of uris that were succesfully registered for net.tcp.
4297
The total number of uris that were succesfully registered for net.pipe.
4299
The total number of uris that were succesfully unregistered for net.tcp.
4301
The total number of uris that were succesfully unregistered for net.pipe.
4303
ServiceModelEndpoint 3.0.0.0 performance counters
4305
The number of calls to this endpoint. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.Calls.aspx
4307
The number of calls to this endpoint per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.CallsPerSecond.aspx
4309
The number of calls to this endpoint that are in progress. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.CallsOutstanding.aspx
4311
The number of calls with unhandled exceptions at this endpoint. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.CallsFailed.aspx
4313
The number of calls with unhandled exceptions at this endpoint per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.CallsFailedPerSecond.aspx
4315
The number of calls to this endpoint that returned faults. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.CallsFaulted.aspx
4317
The number of calls to this endpoint that returned faults per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.CallsFaultedPerSecond.aspx
4319
The average duration of calls to this endpoint. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.CallDuration.aspx
4321
Base counter for the 'Calls Duration' counter.
4323
The number of transactions that flowed to operations at this endpoint. This counter is incremented any time a transaction ID is present in the message that is sent to the endpoint. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.TxFlowed.aspx
4325
The number of transactions that flowed to operations at this endpoint per second. This counter is incremented any time a transaction ID is present in the message that is sent to the endpoint. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.TxFlowedPerSecond.aspx
4327
The number of calls to this endpoint that failed validation or authentication. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.SecurityValidationAuthenticationFailures.aspx
4329
The number of calls to this endpoint that failed validation or authentication per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.SecurityValidationAuthenticationFailuresPerSecond.aspx
4331
The number of calls to this endpoint that failed authorization. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.SecurityCallsNotAuthorized.aspx
4333
The number of calls to this endpoint that failed authorization per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.SecurityCallsNotAuthorizedPerSecond.aspx
4335
The number of reliable messaging sessions that faulted at this endpoint. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.RMSessionsFaulted.aspx
4337
The number of reliable messaging sessions that faulted at this endpoint per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.RMSessionsFaultedPerSecond.aspx
4339
The number of reliable messaging messages that were dropped at this endpoint. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.RMMessagesDropped.aspx
4341
The number of reliable messaging messages that were dropped at this endpoint per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.RMMessagesDroppedPerSecond.aspx
4343
Windows Workflow Foundation Performance Counters
4345
Total number of workflows created.
4347
Rate of workflows created per second.
4349
Total number of workflows unloaded.
4351
Rate of workflows unloaded per second.
4353
Total number of workflows loaded.
4355
Rate of workflows loaded per second.
4357
Total number of workflows completed.
4359
Rate of workflows completed per second.
4361
Total number of workflows suspended.
4363
Rate of workflows suspended per second.
4365
Total number of workflows terminated.
4367
Rate of workflows terminated per second.
4369
Total number of workflows in memory.
4371
Total number of workflows aborted.
4373
Rate of workflows aborted per second.
4375
Total number of workflows persisted.
4377
Rate of workflows persisted per second.
4379
Total number of workflow instances actively executing.
4381
Rate of workflows becoming idle per second.
4383
Total number of workflows ready to execute.
4385
Total number of workflows waiting for a thread.
4387
Flow statistics from the packet scheduler
4389
Pipe statistics from the packet scheduler
4391
The number of packets dropped by the packet scheduler
4393
The number of packets which got scheduled in some way (rather than just being directly sent to the underlying miniport)
4395
The number of packets from this flow which have been sent
4397
The average number of packets in the shaper over the last sampling period
4399
The maximum number of packets that have ever simultaneously been in the shaper
4401
The average number of packets in the sequencer over the last sampling period
4403
The maximum number of packets that have ever simultaneously been in the sequencer
4405
The number of bytes which got scheduled in some way (rather than just being directly sent to the underlying miniport)
4407
The number of bytes from this flow which have been sent
4409
The number of bytes per second from this flow which have been sent
4411
The number of bytes per second from this flow which have been scheduled
4413
The number of packets per second from this flow which have been sent
4415
The number of packets per second from this flow which have been scheduled
4417
The number of packets dropped by the packet scheduler from this flow per second
4419
The number of packets that have entered the packet scheduler at a rate which exceeded the flow parameters
4421
The rate at which nonconforming packets have entered the packet scheduler
4423
The number of packets that have been sent by the packet scheduler at a rate which exceeded the flow parameters
4425
The rate at which nonconforming packets have been sent by the packet scheduler
4427
The maximum number of packets that have been queued in the netcard by this flow.
4429
The average number of packets that have been queued in the netcard by this flow.
4431
The number of times Pacer has been unable to allocate a packet
4433
The number of flows opened on this pipe (some of which may now be closed)
4435
The number of flows that have been closed
4437
The number of flow creations that were rejected
4439
The of times a flow has been modified
4441
The number of times a flow modification has been rejected
4443
The maximum number of flows that have been simultaneously open on this pipe
4445
The number of packets that have entered the packet scheduler at a rate which exceeded that packet's flow parameters
4447
The rate at which nonconforming packets have entered the packet scheduler
4449
The number of packets that have been sent by the packet scheduler at a rate which exceeded that packet's flow parameters
4451
The rate at which nonconforming packets have been sent by the packet scheduler
4453
The average number of packets in the shaper over the last sampling period
4455
The maximum number of packets that have ever simultaneously been in the shaper
4457
The average number of packets in the sequencer over the last sampling period
4459
The maximum number of packets that have ever simultaneously been in the sequencer
4461
The maximum number of packets ever simultaneously in the network card
4463
The average number of packets in the network card over the last sampling period
4993
ASP.NET v1.1.4322 global performance counters
4995
ASP.NET v1.1.4322 application performance counters
4997
Number of times the application has been restarted during the web server's lifetime.
4999
Number of currently running web applications.
5001
The number of requests disconnected due to communication errors or user terminated.
5003
The number of milliseconds that it took to execute the most recent request.
5005
The number of requests rejected because the request queue was full.
5007
The number of requests waiting to be processed.
5009
Number of worker processes running on the machine.
5011
Number of times a worker process has restarted on the machine.
5013
The number of milliseconds the most recent request was waiting in the queue.
5015
The current number of sessions currently active.
5017
The number of sessions that have been explicitly abandoned.
5019
The number of sessions timed out.
5021
The number of sessions total.
5023
The current number of requests, including those that are queued, currently executing, or waiting to be written to the client.  Under the ASP.NET process model, when this counter exceeds the requestQueueLimit defined in the processModel configuration section, ASP.NET will begin rejecting requests.
5025
Number of requests utilizing anonymous authentication.
5027
Number of Authentication Anonymous Requests/Sec
5029
Total number of entries within the cache (both internal and user added)
5031
Number of additions and removals to the total cache per second.
5033
Total number of hits from the cache.
5035
Total number of cache misses.
5037
Ratio of hits from all cache calls.
5039
Cache Total Hit Ratio Base
5041
Total number of entries within the cache added by the user.
5043
Number of additions and removals to the API cache per second.
5045
Number of cache hits from user code.
5047
Number of cache misses called from user code.
5049
Ratio of hits called from user code.
5051
Cache API Hit Ratio Base
5053
Current number of entries in the output cache.
5055
Number of additions and removals to the output cache per second.
5057
Total number of ouput cacheable requests served from the output cache.
5059
Total number of ouput cacheable requests not served from the output cache.
5061
Ratio of hits to requests for output cacheable requests.
5063
Output Cache Hit Ratio Base
5065
Number of .asax, .ascx, .ashx, .asmx, or .aspx source files dynamically compiled.
5067
Number of debugging requests processed.
5069
Number of errors that have occurred during parsing and configuration.
5071
Number of errors that have occurred during compilation.
5073
Number of errors that have occurred during the processing of a request.
5075
Number of errors not handled by user code, but by the default error handler.
5077
Rate of unhandled errors.
5079
Total number of errors occurred.
5081
Rate of errors occurred.
5083
Number of active pipeline instances.
5085
The total size, in bytes, of all requests.
5087
The total size, in bytes, of responses sent to a client.  This does not include standard HTTP response headers.
5089
The number of requests currently executing.
5091
Total number of failed requests.
5093
The number of requests for resources that were not found.
5095
Number of requests failed due to unauthorized access.
5097
The number of requests in the application request queue.
5099
The number of requests that timed out.
5101
The number of requests that executed successfully.
5103
The total number of requests since the application was started.
5105
The number of requests executed per second.
5107
The current number of sessions currently active.
5109
The number of sessions that have been explicitly abandoned.
5111
The number of sessions timed out.
5113
Total number of sessions since the application was started.
5115
The number of transactions aborted.
5117
The number of transactions committed.
5119
Number of transactions in progress.
5121
The total number of transactions since the application was started.
5123
Transactions started per second.
5125
The total number of connections to the State Server used by session state.
5127
The total number of connections to the SQL Server used by session state.
5405
Terminal Services per-session resource monitoring.
5407
Number of bytes input on this session after all protocol overhead has been removed.
5409
The number of frames input after any additional protocol added frames have been removed.
5411
The number of times that a wait for an available send buffer was done by the protocols on the client side of the connection.
5413
Number of frames (packets) input on this Session.
5415
Number of bytes input on this session that includes all protocol overhead.
5417
Number of bytes input after compression. This number compared with the Total Bytes input is the compression ratio.
5419
Number of input compression dictionary flushes. When the data can not be compressed, the compression dictionary is flushed so that newer data has a better chance of being compressed. Some causes of data not compressing includes transferring compressed files over Client Drive Mapping.
5421
Number of input errors of all types. Some example input errors are lost ACK's, badly formed packets, etc.
5423
The total number of timeouts on the communication line as seen from the client side of the connection. These are typically the result of a noisy line. On some high latency networks, this could be the result of the protocol timeout being too short. Increasing the protocol timeout on these types of lines will improve performance by reducing needless re-transmissions.
5425
Number of input async framing errors. These can be caused by a noisy transmission line. Using a smaller packet size may help in some cases.
5427
Number of input async overrun errors. These can be caused by the baud rate being faster than the computer can handle, or a non-16550 serial line is used. Overruns can also occur if too many high speed serial lines are active at one time for the processor's power.
5429
Number of input async overflow errors. These can be caused by a lack of buffer space available on the host.
5431
Number of input async parity errors. These can be caused by a noisy transmission line
5433
Number of Terminal Services transport-level errors on input.
5435
Number of bytes output on this session after all protocol overhead has been removed.
5437
The number of frames output before any additional protocol frames have been added.
5439
This is the number of times that a wait for an available send buffer was done by the protocol on the server side of the connection.
5441
Number of frames (packets) output on this session.
5443
Number of bytes output on this Session that includes all protocol overhead.
5445
Number of bytes output after compression. This number compared with the Total Bytes output is the compression ratio.
5447
Number of output compression dictionary flushes. When the data can not be compressed, the compression dictionary is flushed so that newer data has a better chance of being compressed. Some causes of data not compressing includes transfering compressed files over Client Drive Mapping.
5449
Number of output errors of all types. Some example output errors are lost ACK's, badly formed packets, etc.
5451
The total number of timeouts on the communication line from the host side of the connection. These are typically the result of a noisy line. On some high latency networks, this could be the result of the protocol timeout being too short. Increasing the protocol timeout on these types of lines will improve performance by reducing needless re-transmissions.
5453
Number of output async framing errors. This could be caused by a hardware or line problem.
5455
Number of output async overrun errors.
5457
Number of output async overflow errors.
5459
Number of output async parity errors. These can be caused by a hardware or line problem.
5461
Number of Terminal Services transport-level errors on output.
5463
Total number of bytes on this Session after all protocol overhead has been removed.
5465
The total number of frames input and output before any additional protocol frames have been added.
5467
The number of times that a wait for an available send buffer was done by the protocols on both the server and client sides of the connection.
5469
Total number of frames (packets) on this Session.
5471
Total number of bytes on this Session that includes all protocol overhead.
5473
Total number of bytes after compression. This number compared with the total bytes is the compression ratio.
5475
Total number of compression dictionary flushes. When the data can not be compressed, the compression dictionary is flushed so that newer data has a better chance of being compressed. Some causes of data not compressing includes transfering compressed files over Client Drive Mapping.
5477
Total number of errors of all types. Some example errors are lost ACK's, badly formed packets, etc.
5479
The total number of timeouts on the communication line from both the host and client sides of the connection. These are typically the result of a noisy line. On some high latency networks, this could be the result of the protocol timeout being too short. Increasing the protocol timeout on these types of lines will improve performance by reducing needless re-transmissions.
5481
Total number of async framing errors. These can be caused by a noisy transmission line. Using a smaller packet size may help in some cases.
5483
Total number of async overrun errors. These can be caused by the baud rate being faster than the computer can handle, or a non-16550 serial line is used. Overruns can also occur if too many high speed serial lines are active at one time for the processor's power.
5485
Total number of async overflow errors. These can be caused by a lack of buffer space available on the host.
5487
Total number of async parity errors. These can be caused by a noisy transmission line.
5489
Total number of Terminal Services transport-level errors.
5491
Total references to all protocol caches.
5493
Total hits in all protocol caches. The protocol caches Windows objects that are likely to be re-used to avoid having to re-send them on the transmission line. Example objects are Windows icons and brushes. Hits in the cache represent objects that did not need to be re-sent.
5495
Overall hit ratio for all protocol caches.
5497
Number of references to the protocol bitmap cache.
5499
Number of hits in the protocol bitmap cache.
5501
Hit ratio in the protocol bitmap cache. A higher hit ratio means better performance since data transmissions are reduced. Low hit ratios are due to the screen updating with new information that is either not re-used, or is flushed out of the client cache.
5503
Number of references to the protocol glyph cache.
5505
Number of hits in the protocol glyph cache.
5507
Hit ratio in the protocol glyph cache. A higher hit ratio means better performance since data transmissions are reduced. Low hit ratios are due to the screen updating with new information that is either not re-used, or is flushed out of the client cache.
5509
Number of references to the protocol brush cache.
5511
Number of hits in the protocol brush cache.
5513
Hit ratio in the protocol brush cache. A higher hit ratio means better performance since data transmissions are reduced. Low hit ratios are due to the screen updating with new information that is either not re-used, or is flushed out of the client cache.
5515
Number of references to the protocol save screen bitmap cache.
5517
Number of hits in the protocol save screen bitmap cache.
5519
Hit ratio in the protocol save screen bitmap cache. A higher hit ratio means better performance since data transmissions are reduced. Low hit ratios are due to the screen updating with new information that is either not re-used, or is flushed out of the client cache.
5521
Compression ratio of the server input data stream.
5523
Compression ratio of the server output data stream.
5525
Total compression ratio of the server data stream.
6009
Counters for classes in the System.Net namespace.
6011
The cumulative total number of socket connections established for this process since the process was started.
6013
The cumulative total number of bytes received over all open socket connections since the process was started. This number includes data and any protocol information that is not defined by the TCP/IP protocol.
6015
The cumulative total number of bytes sent over all open socket connections since the process was started. This number includes data and any protocol information that is not defined by the TCP/IP protocol.
6017
The cumulative total number of datagram packets received since the process was started.
6019
The cumulative total number of datagram packets sent since the process was started.
6021
The number of HttpWebRequest objects created during the last sample interval (typically 1 sec).
6023
The average lifetime of all web requests completed during the last sample interval. The lifetime is defined as the time between the creation of the HttpWebRequest object and the closing of either the HttpWebResponse object or the response stream object. Values are shown in milliseconds.
6025
HttpWebRequests Average Lifetime Base
6027
The number of HttpWebRequest objects added to a waiting queue during the last sample interval (typically 1 sec). A request is added to a waiting queue if all connections to the server are already in use when the request is submitted.
6029
The average time HttpWebRequest objects spent in a waiting queue. A request is added to a waiting queue if all connections to the server are already in use when the request is submitted, and remains there until a connection becomes available. Values are shown in milliseconds.
6031
HttpWebRequests Average Queue Time Base
6033
The number of HttpWebRequest objects aborted during the last sample interval (typically 1 sec). Typically requests are aborted either by calling HttpWebRequest.Abort() or if the request times out.
6035
The number of HttpWebRequest objects failed during the last sample interval (typically 1 sec). A request is considered failed, if after starting the request processing one of the following methods throw an exception: HttpWebRequest.EndGetRequestStream(), HttpWebRequest.GetRequestStream(), HttpWebRequest.EndGetResponse(), HttpWebRequest.GetResponse()
11875
Number of WMI High Performance provider returned by WMI Adapter
11877
Shows High Performance Classes
11879
Shows if High Performance Classes are valid
11881
BatteryStatus
11883
ChargeRate
11885
DischargeRate
11887
RemainingCapacity
11889
Tag
11891
Voltage
11893
MSiSCSI_ConnectionStatistics
11895
BytesReceived
11897
BytesSent
11899
PDUCommandsSent
11901
PDUResponsesReceived
11903
MSiSCSI_InitiatorInstanceStatistics
11905
SessionConnectionTimeoutErrorCount
11907
SessionDigestErrorCount
11909
SessionFailureCount
11911
SessionFormatErrorCount
11913
MSiSCSI_InitiatorLoginStatistics
11915
LoginAcceptRsps
11917
LoginAuthenticateFails
11919
LoginAuthFailRsps
11921
LoginFailures
11923
LoginNegotiateFails
11925
LoginOtherFailRsps
11927
LoginRedirectRsps
11929
LogoutNormals
11931
LogoutOtherCodes
11933
MSiSCSI_MMIPSECStats
11935
AcquireFailures
11937
AcquireHeapSize
11939
ActiveAcquire
11941
ActiveReceive
11943
AuthenticationFailures
11945
ConnectionListSize
11947
GetSPIFailures
11949
InvalidCookiesReceived
11951
InvalidPackets
11953
KeyAdditionFailures
11955
KeyAdditions
11957
KeyUpdateFailures
11959
KeyUpdates
11961
NegotiationFailures
11963
OakleyMainMode
11965
OakleyQuickMode
11967
ReceiveFailures
11969
ReceiveHeapSize
11971
SendFailures
11973
SoftAssociations
11975
TotalGetSPI
11977
MSiSCSI_NICPerformance
11979
BytesReceived
11981
BytesTransmitted
11983
PDUReceived
11985
PDUTransmitted
11987
MSiSCSI_QMIPSECStats
11989
ActiveSA
11991
ActiveTunnels
11993
AuthenticatedBytesReceived
11995
AuthenticatedBytesSent
11997
BadSPIPackets
11999
ConfidentialBytesReceived
12001
ConfidentialBytesSent
12003
KeyAdditions
12005
KeyDeletions
12007
PacketsNotAuthenticated
12009
PacketsNotDecrypted
12011
PacketsWithReplayDetection
12013
PendingKeyOperations
12015
ReKeys
12017
TransportBytesReceived
12019
TransportBytesSent
12021
TunnelBytesReceived
12023
TunnelBytesSent
12025
MSiSCSI_RequestTimeStatistics
12027
AverageProcessingTime
12029
MaximumProcessingTime
12031
MSiSCSI_SessionStatistics
12033
BytesReceived
12035
BytesSent
12037
ConnectionTimeoutErrors
12039
DigestErrors
12041
FormatErrors
12043
PDUCommandsSent
12045
PDUResponsesReceived
12047
ProcessorPerformance
12049
frequency
12051
percentage
12053
power
12055
Video_Scheduler_Statistics
12057
WmiCompletedDMABufferCount
12059
WmiGPUBusy
12061
WmiGPUContext
12063
WmiGPUContextSwitch
12065
WmiPreemptedDMABufferCount
12067
WmiPresentCount
12069
WmiSubmitDMABufferCount
12223
SMSvcHost 4.0.0.0 performance counters
12225
The total number of failures at the protocol layer of net.tcp.
12227
The total number of failures at the protocol layer of net.pipe.
12229
The total number of failures dispatching messages received over net.tcp.
12231
The total number of failures dispatching messages received over net.pipe.
12233
The total number of connections dispatched over net.tcp.
12235
The total number of connections dispatched over net.pipe.
12237
The total number of TCP connections accepted over net.tcp.
12239
The total number of named pipe connections accepted over net.pipe.
12241
The number of uri registrations currently active for net.tcp.
12243
The number of uri registrations currently active for net.pipe.
12245
The total number of uris that were succesfully registered for net.tcp.
12247
The total number of uris that were succesfully registered for net.pipe.
12249
The total number of uris that were succesfully unregistered for net.tcp.
12251
The total number of uris that were succesfully unregistered for net.pipe.
12253
MSDTC Bridge 4.0.0.0 performance counters
12255
The number of WS-AT protocol messages that the WS-AT service failed to send per second.
12257
The number of Prepare retry messages that the WS-AT service has sent per second.
12259
The number of Commit retry messages that the WS-AT service has sent per second.
12261
The number of Prepared retry messages that the WS-AT service has sent per second.
12263
The number of Replay retry messages that the WS-AT service has sent per second.
12265
The number of Fault messages that the WS-AT service has received per second.
12267
The number of Fault messages that the WS-AT service has sent per second.
12269
Average time in milliseconds for the WS-AT service to receive a Prepare message response from a participant.
12271
Base counter for the 'Average participant prepare response time' counter.
12273
Average time in milliseconds for the WS-AT service to receive a Commit message response from a participant.
12275
Base counter for the 'Average participant commit response time' counter.
5391
Terminal Services Summary Information
5393
Number of active Terminal Services sessions
5395
Number of inactive Terminal Services sessions
5397
Total number Terminal services sessions
1927
WFPv4 is the set of Windows Filtering Platform counters that apply to traffic and connections over Internet Protocol version 4.
1929
Inbound Packets Discarded per second is the rate at which inbound packets are discarded by the Windows Filtering Platform.
1931
Outbound Packets Discarded per second is the rate at which outbound packets are discarded by the Windows Filtering Platform.
1933
Packets Discarded per second is the rate at which the total of inbound and outbound packets are discarded by the Windows Filtering Platform.
1935
Blocked Binds is the number of network resource assignment requests blocked by the Windows Filtering Platform since the computer was last started.
1937
Inbound Connections Blocked per second is the rate at which inbound connections are being blocked by the Windows Filtering Platform.
1939
Outbound Connections Blocked per second is the rate at which outbound connections are being blocked by the Windows Filtering Platform.
1941
Inbound Connections Allowed per second is the rate at which inbound connections are being allowed by the Windows Filtering Platform.
1943
Outbound Connections Allowed per second is the rate at which outbound connections are being allowed by the Windows Filtering Platform.
1945
Inbound Connections is the number of inbound connections allowed by the Windows Filtering Platform since the computer was last started.
1947
Outbound Connections is the number of outbound connections allowed by the Windows Filtering Platform since the computer was last started.
1949
Active Inbound Connections is the number of current inbound connections allowed by the Windows Filtering Platform.
1951
Active Outbound Connections is the number of current outbound connections allowed by the Windows Filtering Platform.
1953
Allowed Classifies per second is the rate of Windows Filtering Platform security rule evaluations which allow network activity.
1987
IPsec Driver is the set of Internet Protocol security (IPsec) driver counters that apply to traffic over Internet Protocol version 4 and Internet Protocol version 6.
1989
Active Security Associations is the number of active Quick Mode security associations.
1991
Pending Security Associations is the number of pending Quick Mode security associations.
1993
Incorrect SPI packets is the number of packets for which the Security Parameter Index (SPI) was incorrect since the computer was last started. A large number of packets with bad SPIs within a short amount of time might indicate a packet spoofing attack.
1995
Bytes Received in Tunnel Mode per second is the rate of bytes received using Tunnel Mode.
1997
Bytes Sent in Tunnel Mode per second is the rate of bytes sent using Tunnel Mode.
1999
Bytes Received in Transport Mode per second is the rate of bytes received using Transport Mode.
2001
Bytes Sent in Transport Mode per second is the rate of bytes sent using Transport Mode.
2003
Offloaded Security Associations is the number of active Quick Mode security associations offloaded to hardware. Certain network adapters can accelerate IPsec processing by performing hardware offload of IPsec cryptographic functions.
2005
Offloaded Bytes Received per second is the rate of bytes received using IPsec hardware offload. Certain network adapters can accelerate IPsec processing by performing hardware offload of IPsec cryptographic functions.
2007
Offloaded Bytes Sent per second is the rate of bytes sent using IPsec hardware offload. Certain network adapters can accelerate IPsec processing by performing hardware offload of IPsec cryptographic functions.
2009
Packets That Failed Replay Detection is the number of packets that contained an invalid sequence number since the computer was last started. Increases in this counter might indicate a network problem or replay attack.
2011
Packets Not Authenticated is the number of packets for which data could not be verified (for which the integrity hash verification failed) since the computer was last started. Increases in this counter might indicate an IPsec packet spoofing or modification attack, or packet corruption by network devices.
2013
Packets Not Decrypted is the number of packets that could not be decrypted since the computer was last started. A packet might not be decrypted if it fails a validation check.
2015
SA Rekeys is the number of successful rekey operations for Quick Mode security associations since the computer was last started.
2017
Security Associations Added is the number of security associations added since the computer was last started.
2019
Packets That Failed ESP Validation is the number of packets received that failed ESP validation since the computer was last started.
2021
Packets That Failed UDP-ESP Validation is the number of packets received that failed UDP-ESP validation (used for NAT traversal) since the computer was last started.
2023
Packets Received Over Wrong SA is the number of packets received over the wrong security association since the computer was last started.
2025
Plaintext Packets Received is the number of clear text packets received since the computer was last started.
1983
WFP is the set of Windows Filtering Platform counters that do not apply to any specific Internet Protocol version.
1985
Provider Count is the number of providers registered with the Windows Filtering Platform.
1955
WFPv6 is the set of Windows Filtering Platform counters that apply to traffic and connections over Internet Protocol version 6.
1957
Inbound Packets Discarded per second is the rate at which inbound packets are discarded by the Windows Filtering Platform.
1959
Outbound Packets Discarded per second is the rate at which outbound packets are discarded by the Windows Filtering Platform.
1961
Packets Discarded per second is the rate at which the total of inbound and outbound packets are discarded by the Windows Filtering Platform.
1963
Blocked Binds is the number of network resource assignment requests blocked by the Windows Filtering Platform since the computer was last started.
1965
Inbound Connections Blocked per second is the rate at which inbound connections are being blocked by the Windows Filtering Platform.
1967
Outbound Connections Blocked per second is the rate at which outbound connections are being blocked by the Windows Filtering Platform.
1969
Inbound Connections Allowed per second is the rate at which inbound connections are being allowed by the Windows Filtering Platform.
1971
Outbound Connections Allowed per second is the rate at which outbound connections are being allowed by the Windows Filtering Platform.
1973
Inbound Connections is the number of inbound connections allowed by the Windows Filtering Platform since the computer was last started.
1975
Outbound Connections is the number of outbound connections allowed by the Windows Filtering Platform since the computer was last started.
1977
Active Inbound Connections is the number of current inbound connections allowed by the Windows Filtering Platform.
1979
Active Outbound Connections is the number of current outbound connections allowed by the Windows Filtering Platform.
1981
Allowed Classifies per second is the rate of Windows Filtering Platform security rule evaluations which allow network activity.
5399
The set of Counters for Authorization Manager application object
5401
Shows the total number of scopes in the application
5403
Shows the number of scopes that are currently loaded in memory
5539
The DFS replicated folders performance object. This object includes counters for staging and conflict quotas.
5541
Conflict Files Generated shows the number of files and folders in this replicated folder that were moved to the Conflict and Deleted folder by the DFS Replication service. The DFS Replication service automatically detects and resolves conflicts encountered in replicated folders and moves the losing version to the Conflict and Deleted folder. The service automatically cleans up the Conflict and Deleted folder when it exceeds a pre-configured threshold of the quota.
5543
Conflict Bytes Generated shows the total size (in bytes) of the files and folders in this replicated folder that were moved to the Conflict and Deleted folder by the DFS Replication service. The DFS Replication service automatically detects and resolves conflicts encountered in replicated folders and moves the losing version to the Conflict and Deleted folder. The service automatically cleans up the Conflict and Deleted folder when it exceeds a pre-configured threshold of the quota.
5545
Conflict Files Cleaned up shows the number the conflict loser files and folders that were deleted from the Conflict and Deleted folder by the DFS Replication service. The DFS Replication service automatically detects and resolves conflicts encountered in replicated folders and moves the losing version to the Conflict and Deleted folder. The service automatically cleans up the Conflict and Deleted folder when it exceeds a pre-configured threshold of the quota.
5547
Conflict Bytes Cleaned up shows the total size (in bytes) of the conflict loser files and folders that were deleted from the Conflict and Deleted folder by the DFS Replication service. The DFS Replication service automatically detects and resolves conflicts encountered in replicated folders and moves the losing version to the Conflict and Deleted folder. The service automatically cleans up the Conflict and Deleted folder when it exceeds a pre-configured threshold of the quota.
5549
Conflict Space in Use shows the total size (in bytes) of the conflict loser files and folders currently in the Conflict and Deleted folder used by the DFS Replication service. The DFS Replication service automatically detects and resolves conflicts encountered in replicated folders and moves the losing version to the Conflict and Deleted folder. The service automatically cleans up the Conflict and Deleted folder when it exceeds a pre-configured threshold of the quota.
5551
Conflict Folder Cleanups Completed shows the number of times conflict loser files and folders in the Conflict and Deleted folder were deleted by the DFS Replication service. The DFS Replication service automatically detects and resolves conflicts encountered in replicated folders and moves the losing version to the Conflict and Deleted folder. The service automatically cleans up the Conflict and Deleted folder when it exceeds a pre-configured threshold of the quota.
5553
File Installs Succeeded shows the number of files that were successfully received from sending members and installed locally on this server. The DFS Replication service replicates staged files into the staging folder, uncompresses them in the Installing folder, and renames them to the target location. The second and third steps of this process are known as installing the file.
5555
File Installs Retried shows the number of file installs that are being retried due to sharing violations or other errors encountered when installing the files. The DFS Replication service replicates staged files into the staging folder, uncompresses them in the Installing folder, and renames them to the target location. The second and third steps of this process are known as installing the file.
5557
Updates Dropped shows the number of redundant file replication update records that were ignored by the DFS Replication service because they did not change the replicated file or folder. For example, dropped updates can occur when access control lists (ACLs) are overwritten with identical ACLs on a file or folder.
5559
Deleted Files Generated shows the number of replicated deleted files and folders that were moved to the Conflict and Deleted folder after they were deleted from a replicated folder on a sending member. The DFS Replication service automatically cleans up the Conflict and Deleted folder when it exceeds a pre-configured threshold of the quota.
5561
Deleted Bytes Generated shows the total size (in bytes) of replicated deleted files and folders that were moved to the Conflict and Deleted folder after they were deleted from a replicated folder on a sending member. The DFS Replication service automatically cleans up the Conflict and Deleted folder when it exceeds a pre-configured threshold of the quota.
5563
Deleted Files Cleaned up shows the number of replicated deleted files and folders that were cleaned up from the Conflict and Deleted folder by the DFS Replication service. The service automatically cleans up the Conflict and Deleted folder when it exceeds a pre-configured threshold of the quota.
5565
Deleted Bytes Cleaned up shows the total size (in bytes) of replicating deleted files and folders (in bytes) that were cleaned up from the Conflict and Deleted folder by the DFS Replication service. The service automatically cleans up the Conflict and Deleted folder when it exceeds a pre-configured threshold of the quota.
5567
Deleted Space in Use shows the total size (in bytes) of the deleted files and folders currently in the Conflict and Deleted folder used by the DFS Replication service. The DFS Replication service detects remote deletes from its sending partner and moves the file or folder to the Conflict and Deleted folder. The service automatically cleans up the Conflict and Deleted folder when it exceeds a pre-configured threshold of the quota.
5569
Total Files Received shows the number of files that were received by this replicated folder.
5571
Size of Files Received shows the uncompressed size (in bytes) of the files received for this replicated folder. This is the number of bytes that would have been received had DFS Replication compression not been used.
5573
Compressed Size of Files Received shows the compressed size (in bytes) of files received for this replicated folder.
5575
RDC Number of Files Received shows the number files that were received for this replicated folder.
5577
RDC Size of Files Received shows the uncompressed size (in bytes) of the files received with remote differential compression (RDC) for this replicated folder. This is the number of bytes that would have been received had neither compression nor RDC been used. This is not the actual bytes received over the network.
5579
RDC Compressed Size of Files Received shows the compressed size (in bytes) of the files received with remote differential compression (RDC) for this replicated folder. This is the number of bytes that would have been received had RDC not been used. This is not the actual bytes received over the network.
5581
RDC Bytes Received shows the number of bytes that were received in replicating files using remote differential compression (RDC) for this replicated folder. This is the actual bytes received over the network without the networking protocol overhead.
5583
Bandwidth Savings Using DFS Replication shows the percentage of bandwidth that was saved by the DFS Replication service for this replicated folder using a combination of remote differential compression (RDC) and other compression technologies that minimize network bandwidth. For example, a value of 20 indicates that the DFS Replication service used 20% less bandwidth than it would have used if it had transmitted the entire files uncompressed over the network.
5585
The DFS Replication connections performance object for incoming connections.
5587
Total Bytes Received shows the total number of bytes received on the connection. The bytes received value includes file data and replication metadata.
5589
Total Files Received shows the number of files that were received on the connection.
5591
Size of Files Received shows the uncompressed size (in bytes) of the files received on this connection. This is the number of bytes that would have been received had DFS Replication compression not been used.
5593
Compressed Size of Files Received shows the compressed size of files (in bytes) received on the connection.
5595
Bytes Received Per Second shows an estimate of the average number of bytes that were received each second over the past 30 seconds.
5597
RDC Number of Files Received shows the number files that were received on this connection.
5599
RDC Size of Files Received shows the uncompressed size (in bytes) of files received with remote differential compression (RDC) for this connection. This is the number of bytes that would have been received had neither compression nor RDC been used. This is not the actual number of bytes received over the network.
5601
RDC Compressed Size of Files Received shows the compressed size (in bytes) of files received with remote differential compression (RDC) for this connection. This is the number of bytes that would have been received had RDC not been used. This is not the actual number of bytes received over the network.
5603
RDC Bytes Received shows the bytes that were received on this connection while replicating files using remote differential compression (RDC). This is the actual bytes received over the network without the networking protocol overhead.
5605
Bandwidth Savings Using DFS Replication shows the percentage of bandwidth that was saved by the DFS Replication service for this connection using a combination of remote differential compression (RDC) and other compression technologies that minimize network bandwidth use. For example, a value of 20 indicates that the DFS Replication service used 20% less bandwidth than it would have used if it had transmitted the entire files uncompressed over the network.
5527
The DFS Replication service volume performance object. This object includes counters for update sequence number (USN) journal records and database processing on each volume.
5529
USN Journal Records Read shows the number of update sequence number (USN) journal records that were read by the DFS Replication service.
5531
USN Journal Records Accepted shows the number of update sequence number (USN) journal records that were processed by the DFS Replication service. The DFS Replication service processes all USN journal records for replicated content on a volume and ignores records for non-replicated files and folders on the volume.
5533
USN Journal Unread Percentage shows the percent of the update sequence number (USN) journal that has not yet been read and processed by the DFS Replication service. A journal wrap will occur if this counter reaches 100.
5535
Database Commits shows the number of database commit operations performed by the DFS Replication service. This counter indicates how intensive the DFS Replication service is from a database perspective.
5537
Database Lookups shows the number of database search operations performed by the DFS Replication service This counter indicates how intensive the DFS Replication service is from a database perspective.
2223
Generic IKE and AuthIP is the set of Internet Protocol security (IPsec) Internet Key Exchange (IKE) and Authenticated IP (AuthIP) counters that are generic and do not apply to a specific Internet Protocol version.
2225
IKE Main Mode Negotiation Time is the number of milliseconds taken for the last IKE Main Mode security association negotiated.
2227
AuthIP Main Mode Negotiation Time is the number of milliseconds taken for the last Authenticated IP Main Mode security association negotiated.
2229
IKE Quick Mode Negotiation Time is the number of milliseconds taken for the last IKE Quick Mode security association negotiated.
2231
AuthIP Quick Mode Negotiation Time is the number of milliseconds taken for the last Authenticated IP Quick Mode security association negotiated.
2233
Extended Mode Negotiation Time is the number of milliseconds taken for the last Extended Mode security association negotiated.
2235
Packets Received per second is the rate at which validated IPsec packets are being received.
2237
Invalid Packets Received per second is the rate at which invalid IPsec packets are being received.
2239
Successful Negotiations is the number of negotiations completed for IKE and AuthIP since IPsec was last started.
2241
Successful Negotiations per second is the rate of negotiations completed for IKE and AuthIP.
2243
Failed Negotiations is the number of failed negotiations for IKE and AuthIP since IPsec was last started.
2245
Failed Negotiations per second is the rate of failed negotiations attempted for IKE and AuthIP.
2103
IPsec AuthIPv4 is the set of Internet Protocol security (IPsec) Authenticated IP (AuthIP) counters that apply to traffic and connections over Internet Protocol version 4.
2105
Active Main Mode SAs is the number of currently active Main Mode security associations.
2107
Pending Main Mode Negotiations is the number of pending Main Mode negotiations.
2109
Main Mode Negotiations is the number of Main Mode negotiations attempted since IPsec was last started.
2111
Main Mode Negotiations per second is the rate at which Main Mode negotiations are being attempted.
2113
Successful Main Mode Negotiations is the number of Main Mode negotiations completed since IPsec was last started.
2115
Successful Main Mode Negotiations per second is the rate of Main Mode negotiations completed.
2117
Failed Main Mode Negotiations is the number of failed Main Mode negotiations since IPsec was last started.
2119
Failed Main Mode Negotiations per second is the rate of failed Main Mode negotiations.
2121
Main Mode Negotiation Requests Received is the number of Main Mode negotiations initiated by a peer since IPsec was last started.
2123
Main Mode Negotiation Requests Received per second is the rate of Main Mode negotiations initiated by a peer.
2125
Main Mode SAs That Used Impersonation is the number of Main Mode security associations completed using impersonation since IPsec was last started.
2127
Main Mode SAs That Used Impersonation per second is the rate of Main Mode security associations completed using impersonation.
2129
Active Quick Mode SAs is the number of currently active Quick Mode security associations.
2131
Pending Quick Mode Negotiations is the number of pending Quick Mode negotiations.
2133
Quick Mode Negotiations is the number of Quick Mode negotiations attempted since IPsec was last started.
2135
Quick Mode Negotiations per second is the rate at which Quick Mode negotiations are being attempted.
2137
Successful Quick Mode Negotiations is the number of Quick Mode negotiations completed since IPsec was last started.
2139
Successful Quick Mode Negotiations per second is the rate of Quick Mode negotiations completed.
2141
Failed Quick Mode Negotiations is the number of failed Quick Mode negotiations since IPsec was last started.
2143
Failed Quick Mode Negotiations per second is the rate of failed Quick Mode negotiations.
2145
Active Extended Mode SAs is the number of currently active Extended Mode security associations.
2147
Pending Extended Mode Negotiations is the number of pending Extended Mode negotiations.
2149
Extended Mode Negotiations is the number of Extended Mode negotiations attempted since IPsec was last started.
2151
Extended Mode Negotiations per second is the rate at which Extended Mode negotiations are being attempted.
2153
Successful Extended Mode Negotiations is the number of Extended Mode negotiations completed since IPsec was last started.
2155
Successful Extended Mode Negotiations per second is the rate of Extended Mode negotiations completed.
2157
Failed Extended Mode Negotiations is the number of failed Extended Mode negotiations since IPsec was last started.
2159
Failed Extended Mode Negotiations per second is the rate of failed Extended Mode negotiations.
2161
Extended Mode SAs That Used Impersonation is the number of Extended Mode security associations completed using impersonation since IPsec was last started.
2163
IPsec AuthIPv6 is the set of Internet Protocol security (IPsec) Authenticated IP (AuthIP) counters that apply to traffic and connections over Internet Protocol version 6.
2165
Active Main Mode SAs is the number of currently active Main Mode security associations.
2167
Pending Main Mode Negotiations is the number of pending Main Mode negotiations.
2169
Main Mode Negotiations is the number of Main Mode negotiations attempted since IPsec was last started.
2171
Main Mode Negotiations per second is the rate at which Main Mode negotiations are being attempted.
2173
Successful Main Mode Negotiations is the number of Main Mode negotiations completed since IPsec was last started.
2175
Successful Main Mode Negotiations per second is the rate of Main Mode negotiations completed.
2177
Failed Main Mode Negotiations is the number of failed Main Mode negotiations since IPsec was last started.
2179
Failed Main Mode Negotiations per second is the rate of failed Main Mode negotiations.
2181
Main Mode Negotiation Requests Received is the number of Main Mode negotiations initiated by a peer since IPsec was last started.
2183
Main Mode Negotiation Requests Received per second is the rate of Main Mode negotiations initiated by a peer.
2185
Main Mode SAs That Used Impersonation is the number of Main Mode security associations completed using impersonation since IPsec was last started.
2187
Main Mode SAs That Used Impersonation per second is the rate of Main Mode security associations completed using impersonation.
2189
Active Quick Mode SAs is the number of currently active Quick Mode security associations.
2191
Pending Quick Mode Negotiations is the number of pending Quick Mode negotiations.
2193
Quick Mode Negotiations is the number of Quick Mode negotiations attempted since IPsec was last started.
2195
Quick Mode Negotiations per second is the rate at which Quick Mode negotiations are being attempted.
2197
Successful Quick Mode Negotiations is the number of Quick Mode negotiations completed since IPsec was last started.
2199
Successful Quick Mode Negotiations per second is the rate of Quick Mode negotiations completed.
2201
Failed Quick Mode Negotiations is the number of failed Quick Mode negotiations since IPsec was last started.
2203
Failed Quick Mode Negotiations per second is the rate of failed Quick Mode negotiations.
2205
Active Extended Mode SAs is the number of currently active Extended Mode security associations.
2207
Pending Extended Mode Negotiations is the number of pending Extended Mode negotiations.
2209
Extended Mode Negotiations is the number of Extended Mode negotiations attempted since IPsec was last started.
2211
Extended Mode Negotiations per second is the rate at which Extended Mode negotiations are being attempted.
2213
Successful Extended Mode Negotiations is the number of Extended Mode negotiations completed since IPsec was last started.
2215
Successful Extended Mode Negotiations per second is the rate of Extended Mode negotiations completed.
2217
Failed Extended Mode Negotiations is the number of failed Extended Mode negotiations since IPsec was last started.
2219
Failed Extended Mode Negotiations per second is the rate of failed Extended Mode negotiations.
2221
Extended Mode SAs That Used Impersonation is the number of Extended Mode security associations completed using impersonation since IPsec was last started.
2027
IPsec IKEv4 is the set of Internet Protocol security (IPsec) Internet Key Exchange (IKE) counters that apply to traffic and connections over Internet Protocol version 4.
2029
Active Main Mode SAs is the number of currently active Main Mode security associations.
2031
Pending Main Mode Negotiations is the number of pending Main Mode negotiations.
2033
Main Mode Negotiations is the number of Main Mode negotiations attempted since IPsec was last started.
2035
Main Mode Negotiations per second is the rate at which Main Mode negotiations are being attempted.
2037
Successful Main Mode Negotiations is the number of Main Mode negotiations completed since IPsec was last started.
2039
Successful Main Mode Negotiations per second is the rate of Main Mode negotiations completed.
2041
Failed Main Mode Negotiations is the number of failed Main Mode negotiations since IPsec was last started.
2043
Failed Main Mode Negotiations per second is the rate of failed Main Mode negotiations.
2045
Main Mode Negotiation Requests Received is the number of Main Mode negotiations initiated by a peer since IPsec was last started.
2047
Main Mode Negotiation Requests Received per second is the rate of Main Mode negotiations initiated by a peer.
2049
Active Quick Mode SAs is the number of currently active Quick Mode security associations.
2051
Pending Quick Mode Negotiations is the number of pending Quick Mode negotiations.
2053
Quick Mode Negotiations is the number of Quick Mode negotiations attempted since IPsec was last started.
2055
Quick Mode Negotiations per second is the rate at which Quick Mode negotiations are being attempted.
2057
Successful Quick Mode Negotiations is the number of Quick Mode negotiations completed since IPsec was last started.
2059
Successful Quick Mode Negotiations per second is the rate of Quick Mode negotiations completed.
2061
Failed Quick Mode Negotiations is the number of failed Quick Mode negotiations since IPsec was last started.
2063
Failed Quick Mode Negotiations per second is the rate of failed Quick Mode negotiations.
2065
IPsec IKEv6 is the set of Internet Protocol security (IPsec) Internet Key Exchange (IKE) counters that apply to traffic and connections over Internet Protocol version 6.
2067
Active Main Mode SAs is the number of currently active Main Mode security associations.
2069
Pending Main Mode Negotiations is the number of pending Main Mode negotiations.
2071
Main Mode Negotiations is the number of Main Mode negotiations attempted since IPsec was last started.
2073
Main Mode Negotiations per second is the rate at which Main Mode negotiations are being attempted.
2075
Successful Main Mode Negotiations is the number of Main Mode negotiations completed since IPsec was last started.
2077
Successful Main Mode Negotiations per second is the rate of Main Mode negotiations completed.
2079
Failed Main Mode Negotiations is the number of failed Main Mode negotiations since IPsec was last started.
2081
Failed Main Mode Negotiations per second is the rate of failed Main Mode negotiations.
2083
Main Mode Negotiation Requests Received is the number of Main Mode negotiations initiated by a peer since IPsec was last started.
2085
Main Mode Negotiation Requests Received per second is the rate of Main Mode negotiations initiated by a peer.
2087
Active Quick Mode SAs is the number of currently active Quick Mode security associations.
2089
Pending Quick Mode Negotiations is the number of pending Quick Mode negotiations.
2091
Quick Mode Negotiations is the number of Quick Mode negotiations attempted since IPsec was last started.
2093
Quick Mode Negotiations per second is the rate at which Quick Mode negotiations are being attempted.
2095
Successful Quick Mode Negotiations is the number of Quick Mode negotiations completed since IPsec was last started.
2097
Successful Quick Mode Negotiations per second is the rate of Quick Mode negotiations completed.
2099
Failed Quick Mode Negotiations is the number of failed Quick Mode negotiations since IPsec was last started.
2101
Failed Quick Mode Negotiations per second is the rate of failed Quick Mode negotiations.
12071
ServiceModel performance counters for service
12073
The number of calls to this service. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.Calls.aspx
12075
The number of calls to this service per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.CallsPerSecond.aspx
12077
The number of calls to this service that are in progress. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.CallsOutstanding.aspx
12079
The number of calls with unhandled exceptions in this service. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.CallsFailed.aspx
12081
The number of calls with unhandled exceptions in this service per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.CallsFailedPerSecond.aspx
12083
The number of calls to this service that returned faults. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.CallsFaulted.aspx
12085
The number of calls to this service that returned faults per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.CallsFaultedPerSecond.aspx
12087
The average duration of calls to this service. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.CallDuration.aspx
12089
The number of calls to this service that failed validation or authentication. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.SecurityValidationAuthenticationFailures.aspx
12091
The number of calls to this service that failed validation or authentication per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.SecurityValidationAuthenticationFailuresPerSecond.aspx
12093
The number of calls to this service that failed authorization. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.SecurityCallsNotAuthorized.aspx
12095
The number of calls to this service that failed authorization per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.SecurityCallsNotAuthorizedPerSecond.aspx
12097
The total number of instances of the service. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.Instances.aspx
12099
The creation rate of service instances per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.InstancesPerSecond.aspx
12101
The number of reliable messaging sessions that were faulted in this service. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.RMSessionsFaulted.aspx
12103
The number of reliable messaging sessions that were faulted in this service per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.RMSessionsFaultedPerSecond.aspx
12105
The number of reliable messaging messages that were dropped in this service. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.RMMessagesDropped.aspx
12107
The number of reliable messaging messages that were dropped in this service per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.RMMessagesDroppedPerSecond.aspx
12109
The number of transactions that flowed to operations in this service. This counter is incremented any time a transaction ID is present in the message that is sent to the service. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.TxFlowed.aspx
12111
The number of transactions that flowed to operations in this service per second. This counter is incremented any time a transaction ID is present in the message that is sent to the service. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.TxFlowedPerSecond.aspx
12113
The number of transacted operations with the outcome committed in this service. Work done under such operations is fully committed. Resources are updated in accordance with the work done in the operation. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.TxCommitted.aspx
12115
The number of transacted operations with the outcome committed in this service per second. Work done under such operations is fully committed. Resources are updated in accordance with the work done in the operation. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.TxCommittedPerSecond.aspx
12117
The number of transacted operations with the outcome aborted in this service. Work done under such operations is rolled back. Resources are reverted to their previous state. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.TxAborted.aspx
12119
The number of transacted operations with the outcome aborted in this service per second. Work done under such operations is rolled back. Resources are reverted to their previous state. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.TxAbortedPerSecond.aspx
12121
The number of transacted operations with an outcome in doubt in this service. Work done with an outcome in doubt is in an indeterminate state. Resources are held pending outcome. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.TxInDoubt.aspx
12123
The number of transacted operations with an outcome in doubt in this service per second. Work done with an outcome in doubt is in an indeterminate state. Resources are held pending outcome. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.TxInDoubtPerSecond.aspx
12125
The number of messages to this service that were marked poisoned by the queued transport. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.MsmqPoisonMessages.aspx
12127
The number of messages to this service that were marked poisoned by the queued transport per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.MsmqPoisonMessagesPerSecond.aspx
12129
The number of messages to this servcie that were rejected by the queued transport. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.MsmqRejectedMessages.aspx
12131
The number of messages to this service that were rejected by the queued transport per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.MsmqRejectedMessagesPerSecond.aspx
12133
The number of messages to this service that were dropped by the queued transport. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.MsmqDroppedMessages.aspx
12135
The number of messages to this service that were dropped by the queued transport per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.MsmqDroppedMessagesPerSecond.aspx
12137
Number of calls waiting to be or being processed in the dispatcher as a percentage of max calls throttle. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.CallsPercentOfMaxCalls.aspx
12139
Number of active instances and messages waiting for instances as a percentage of max instances throttle. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.InstancessPercentOfMaxInstances.aspx
12141
Number of active sessions and messages waiting for sessions as a percentage of max sessions throttle. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Service.SessionsPercentOfMaxSessions.aspx
12143

12145

12147

12191
ServiceModelOperation 4.0.0.0 performance counters
12193
The number of calls to this operation. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.Calls.aspx
12195
The number of calls to this operation per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.CallsPerSecond.aspx
12197
The number of calls to this operation that are in progress. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.CallsOutstanding.aspx
12199
The number of calls with unhandled exceptions in this operation. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.CallsFailed.aspx
12201
The number of calls with unhandled exceptions in this operation per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.CallsFailedPerSecond.aspx
12203
The number of calls to this operation that returned faults. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.CallsFaulted.aspx
12205
The number of calls to this operation that returned faults per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.CallsFaultedPerSecond.aspx
12207
The average duration of calls to this operation. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.CallDuration.aspx
12209
The number of calls to this operation that failed validation or authentication. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.SecurityValidationAuthenticationFailures.aspx
12211
The number of calls to this operation that failed validation or authentication per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.SecurityValidationAuthenticationFailuresPerSecond.aspx
12213
The number of calls to this operation that failed authorization. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.SecurityCallsNotAuthorized.aspx
12215
The number of calls to this operation that failed authorization per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.SecurityCallsNotAuthorizedPerSecond.aspx
12217
The number of transactions that flowed to this operation. This counter is incremented any time a transaction ID is present in the message sent to the operation. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.TxFlowed.aspx
12219
The number of transactions that flowed to this operation per second. This counter is incremented any time a transaction ID is present in the message sent to the operation. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.TxFlowedPerSecond.aspx
12221
The average duration of calls to this operation. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Operation.CallDuration.aspx
12151
ServiceModel performance counters for endpoint
12153
The number of calls to this endpoint. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.Calls.aspx
12155
The number of calls to this endpoint per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.CallsPerSecond.aspx
12157
The number of calls to this endpoint that are in progress. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.CallsOutstanding.aspx
12159
The number of calls with unhandled exceptions at this endpoint. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.CallsFailed.aspx
12161
The number of calls with unhandled exceptions at this endpoint per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.CallsFailedPerSecond.aspx
12163
The number of calls to this endpoint that returned faults. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.CallsFaulted.aspx
12165
The number of calls to this endpoint that returned faults per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.CallsFaultedPerSecond.aspx
12167
The average duration of calls to this endpoint. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.CallDuration.aspx
12169
The number of calls to this endpoint that failed validation or authentication. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.SecurityValidationAuthenticationFailures.aspx
12171
The number of calls to this endpoint that failed validation or authentication per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.SecurityValidationAuthenticationFailuresPerSecond.aspx
12173
The number of calls to this endpoint that failed authorization. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.SecurityCallsNotAuthorized.aspx
12175
The number of calls to this endpoint that failed authorization per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.SecurityCallsNotAuthorizedPerSecond.aspx
12177
The number of reliable messaging sessions that faulted at this endpoint. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.RMSessionsFaulted.aspx
12179
The number of reliable messaging sessions that faulted at this endpoint per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.RMSessionsFaultedPerSecond.aspx
12181
The number of reliable messaging messages that were dropped at this endpoint. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.RMMessagesDropped.aspx
12183
The number of reliable messaging messages that were dropped at this endpoint per second. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.RMMessagesDroppedPerSecond.aspx
12185
The number of transactions that flowed to operations at this endpoint. This counter is incremented any time a transaction ID is present in the message that is sent to the endpoint. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.TxFlowed.aspx
12187
The number of transactions that flowed to operations at this endpoint per second. This counter is incremented any time a transaction ID is present in the message that is sent to the endpoint. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.TxFlowedPerSecond.aspx
12189
The average duration of calls to this endpoint. http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.PerformanceCounters.Endpoint.CallDuration.aspx
5373
Set of request queue counters
5375
Number of requests in the queue
5377
Age of the oldest request in the queue
5379
Rate at which requests are arriving in the queue
5381
Rate at which requests are rejected from the queue
5383
Total number of requests rejected from the queue
5385
Rate of cache hits for the queue
5353
Set of URL Group-specific counters
5355
Rate of sending data by HTTP service for this site
5357
Rate of received data by HTTP service for this site
5359
Rate of total bytes transferred (sent and received) by HTTP service for this site
5361
Number of current connections established for this site
5363
Maximum number of concurrent connections established for this site
5365
Rate at which connection attempts are being made for this site
5367
Rate at which GET method requests are made for this site
5369
Rate at which HEAD method requests are made for this site
5371
Total number of HTTP requests made for this site
5339
Set of HTTP service counters
5341
Total number of URIs currently cached by the kernel
5343
Total number of URIs added to the kernel since service startup
5345
Total number of successful lookups in the kernel URI cache
5347
Total number of unsuccessful lookups in the kernel URI cache
5349
Total number of kernel URI cache flushes (complete or partial) since service startup
5351
Total number of URIs that have been removed from the kernel URI cache since service startup
5325
Counters for measuring the performance of Netlogon.
5327
Number of thread currently waiting to acquire the semaphore.
5329
Number of thread currently holding the semaphore.
5331
The total number of times the semaphore has been acquired over the lifetime of the Secure Channel connection (or since system boot for _Total).
5333
The total number of times a thread has timed out waiting for the semaphore over the lifetime of the Secure Channel connection (or since system boot for _Total).
5335
The average amount of time the semaphore is held over the last sample.
5337
The base value used to calculate the average semaphore hold time.
6233
Displays quota usage and violation information for WS-Management processes.
6235
Displays the number of approved and rejected requests per second from authorized users.
6237
Displays the number of user quota violations.
6239
Displays the number of requests subject to system throttling.
6241
Displays the current number of active shells for all users.
6243
Displays the current number of active operations for all users.
6245
Displays the current number of active, authorized users.
3419
Performance counters for the TPM Base Services component.
3421
The number of TBS contexts that are currently active.
3423
The number of resources that are currently being managed by the TBS.
"
[HKEY_LOCAL_MACHINE\SOFTWARE\Voice\TextToSpeech\Engine\{1B6BF820-9299-101B-8A19-265D428C60FF}]
"Dirty"="0x01"
[HKEY_LOCAL_MACHINE\SOFTWARE\Voice\TextToSpeech\Engine\{E0725551-286F-11d0-8E73-00A0C9083363}]
"Dirty"="0x01"
[HKEY_LOCAL_MACHINE\SOFTWARE\Voice\TextToSpeech\Engine\{F063EDA0-8C65-11CF-8FC8-0020AF14F271}]
"Dirty"="0x01"
==========================================
Search Result For: "Decrypt "

==== End of Search ====

### #14 Oh My!

Oh My!

Adware and Spyware and Malware.....

• Malware Response Instructor
• 37,001 posts
• OFFLINE
•
• Gender:Male
• Location:California
• Local time:12:15 PM

Posted 26 August 2013 - 04:45 PM

Hi Ian,

This is going to take me a bit of time to investigate.  Please be patient.

Gary

If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

### #15 Oh My!

Oh My!

Adware and Spyware and Malware.....

• Malware Response Instructor
• 37,001 posts
• OFFLINE
•
• Gender:Male
• Location:California
• Local time:12:15 PM

Posted 26 August 2013 - 08:58 PM

Hi Ian,

Unfortunately there is nothing there that can help us out.
Gary

If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#### 0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users