CCleaner Cripples Application Load Times

[Mastertech]

I already said I tested it on numerous systems. Here is one.

Test System:
P4 2.0 GHz
512MB RAM
7200 RPM HD
Windows XP SP2

Firefox with Prefetching = 5 seconds to load
Firefox without Prefetching = 11 seconds to load

Same system

Boot with Prefetching enabled = 41 seconds
Boot with Prefetching disabled = 90 seconds

Boot times using Bootvis.

"noticing" is irrelevant. You have to use a timing device. Of course no one "notices" it because the application loads either way.

Also no one have said deleting the prefetch folder is good, not even CC maker. Again you are jumping to conclusions.

Then why is it there? It does nothing but slow down applications when loading.

If CCleaner deletes any prefetch file for an installed application, that application will load SLOWER. So of course you can blame CCleaner. If the NTFS last access date option is off and it deletes the whole folder and everything loading including boot up is slow again you blame CCleaner.

What part of this do you not understand?

The inner workings of prefetching has EVERYTHING to do with a feature in CCleaner that does nothing but cripples the prefetcher from doing what it is supposed to do.

[Mastertech]

Here is a Microsoft Whitepaper clearly showing how Prefetching improves boot performance. http://www.microsoft.com/whdc/system/sysperf/fastboot/fastboot-winxp.mspx It includes detailed explanations and test results. Look under the Prefetching section.

[bob3160]

If CCleaner deletes any prefetch file for an installed application, that application will load SLOWER. So of course you can blame CCleaner. If the NTFS last access date option is off and it deletes the whole folder and everything loading including boot up is slow again you blame CCleaner.

Is that the default setting??? if it's not, blame the person who changed the setting NOT CCleaner.

[Abraxas]

darth.mikey

Abraxas i think it's maybe time to close this thread i think enough has been said on the subject already...what do you think?And if somebody would sticky it that would be nice...

p3t3rb0nn
 

Really guys this topic has been done to death we are not in the system startup, cleaning, configuring,

"Grand Prix" are we??    CCleaner is a very good program use it as you will. Prefetching well there is

probably enough information on this forum the  pros and cons in the 6 or so pages  to write a book on the subject.on the subject.

I have no say in what people want to add to my initial reporting of a pretty minor observation about CCleaner. Obviously it's good to have all this information about Prefetching, and thanks to all who passionately linked information about it    I have to say personally  I thought this topic  died on about the 3rd page.
Maybe people are bored or sumfin' ... 

[FreewheelinFrank]

Prefetch files are non executable. Therefore they cannot be malware or viruses. Can a virus hide in the prefetch folder? Sure but any AV can scan and remove it or you can delete it manually. The file would stand out as not having a .pf or .ini extension. There is no reason to delete the regular prefetch files. Why would you delete files that have nothing to do with the virus? It makes no sense.

Here's a case where an anti-virus program hasn't noticed malware in prefetch, and it did have a .pf extension, even if a deceitful one.

I’m running Windows XP with Zone Alarm and Vcom anti-virus. Today, I noticed a file called MSBLAST.EXE-39813b24.pf in the prefetch folder. My anti-virus software hasn’t noticed it, but on online scan at Sophos picked it up. I regularly update my anti-virus software, so is my PC infected?

http://www.pcanswers.co.uk/tips/default.asp?pagetypeid=2&articleid=27958&subsectionid=616

Due to a missed quote, the opinion Mastertech was railing against was just one of the many that come up on Google if you search for prefetch and virus.

[Mastertech]

Is that the default setting??? if it's not, blame the person who changed the setting NOT CCleaner.

That is not the point, it shows a major problem with CCleaner. The last access date for two weeks is flawed. Since this can include installed applications! This scenario further shows how dangerous it can be.

Here's a case where an anti-virus program hasn't noticed malware in prefetch, and it did have a .pf extension, even if a deceitful one.

I’m running Windows XP with Zone Alarm and Vcom anti-virus. Today, I noticed a file called MSBLAST.EXE-39813b24.pf in the prefetch folder. My anti-virus software hasn’t noticed it, but on online scan at Sophos picked it up. I regularly update my anti-virus software, so is my PC infected?

That file is NOT a virus. The virus file is the MSBLAST.EXE in the system32 folder. Since MSBLAST is an executable windows creates a prefetch for it. but the file MSBLAST.EXE-39813b24.pf has NO VIRUS CODE IN IT! Windows has simply created the reference file for MSBLAST.EXE to optimally load the virus. Without the MSBLAST.EXE in the System32 folder the file MSBLAST.EXE-39813b24.pf is not used.

Due to a missed quote, the opinion Mastertech was railing against was just one of the many that come up on Google if you search for prefetch and virus.

All those searches are the same thing. A prefetch file can not execute or contain virus code. They are reference files for the virus to load into memory quicker.

Don't be confused by this.

[FreewheelinFrank]

This chap Ed seems as passionate about the possibility as you, Mastertech, yet does admit the possibility of a virus living in prefetch.

#  Philidor Says:

October 9th, 2005 at 12:20 am

Can the prefetch start an application?

Years ago I had to fight a virus on my daughter’s pc. (Not sure that we had XP then.)

I kept cleaning it out and it kept reinstalling on reboot.

The way I finally got rid of it was to shut down each process individually by name, using an AV site for the list, then running the AV, and using a script to empty the prefetch.

All of those steps finally allowed me to get rid of the virus completely by one last AV scan on the next reboot.

I knew I had cleaned out all the startup lists.
I had a theory that prefetch was activating the virus code before I could run the AV.

Possible the virus writer was using the prefetch?

Thanks.
# Ed Bott Says:

October 9th, 2005 at 6:43 am

I’ve had knowledgeable people swear to me that they discovered viruses in the Prefetch folder. I’ve never seen it myself, but I’ve heard it enough times from enough people to believe it could be true. Unusual, but possible.

http://www.edbott.com/weblog/?p=743

[Mastertech]

Yes a virus can live in the folder like it can in any folder. But it cannot be a .pf file. It has to be executable. When was the last time you found a virus in a .txt text file? It is the same thing. Double click a .pf file and try to run it.

[dk70]

Im wondering what Mastertech will do should he some day face a real problem. This is make believe. The issue here is not prefetch on/off as he would like to think but CCleaner on/off. Has CCleaner done anything bad to anyones computer? and if so why? There must be 1000s of sad stories to read if what you say is relevant. Where are they? As I said XP can kill itself, has many risky settings - if you insist on using them or dont know what you are doing. The setting CC has say delete old prefetch data not disable prefetch - there are no double boot time yes/no setting. All in your head and based on the idea CCleaner is here to annoy you.

Since XP only allow 128 entries in prefetch folder OS itself is also "dangerous" cause number 129 will screw it all up and no pf-file should be deleted for installed application. Exactly what you blaim CCleaner for. Number is too low = prefetch is flawed.

[Mastertech]

DK what is the purpose of the Clean Old Prefetch Data option in CCleaner then? And what would you use it for?

Has CCleaner done anything bad to anyones computer? and if so why?

Yes it cleared my prefetch folder, slowing my whole computer down. Why? Because the author of CCleaner does not understand how prefetching works.

The setting CC has say delete old prefetch data not disable prefetch - there are no double boot time yes/no setting

When it deletes a prefetch file for an installed application, it effectively disables prefetching the next time you launch it. With the NTFS last access date turned off it does this to every application including Windows boot up.

All in your head and based on the idea CCleaner is here to annoy you

What is all in my head? I posted clear results of what happens when a prefetch file or the folder is cleared.

The problem is simple CCleaner has an option that does nothing but slow down your computer when used and is enabled by default. Which means everytime you run CCleaner your computer slows down. It should be removed.

[dk70]

Yes it "disables" prefetching the same way XP would do in exact same situation! You are making a big effort trying to make CC look bad but in fact it does nothing wrong. As everyone will tell you it is perfectly safe to delete those files, not dangerous! Not a special CC feature though probably better implemented than in most cleaners which just wipe out folder.

Just because author make that 2 week limit shows he fully understand prefetch. Why delete pf-files for actively used programs? Why is that hard to understand?

I have tried to explain to you how cleaners work, the idea behind them. You can take out 50% of all features in every cleaner if you want. Useless or essential - in the eye of the beholder. If you can delete something then better do it today than next week - when OS might do it automatically. Dont use them if you feel they do you no good. Or at least untick the options you dont like.

If we assume you are correct about ntfs access date tweak vs. CC then why is it not allways a good idea to turn it off? Dont you think it is a meaningful tweak UNLESS your programs rely on it? If that is so CC should mention in help but may be author is thinking that if user does registry hacks he is well aware of pros/cons? Would be naive but make sense just the same. Im sure Microsoft mention it, of course you would look up a tweak before applyin it? Nothing wrong in CC making use of ntfs feature. That you wish to disable it is your problem. You shouldnt be tweaking if you dont understand effect.

With no tweak we dont have a problem do we? Not so good is it? May be better to prove a point by silently assume the worst - then test right? And subject magically becomes prefetch vs no prefetch. If you test with no assumptions you will have a hard time telling difference between before and after since no pf-files used last 2 weeks are deleted. That of course includes the one used for booting. Status quo except any older ones is gone - cleaner thing you cant relate to. May be go to CC forums to understand why some are hooked on cleaning.

So your tests and white papers from 2002 have nothing to do with your target CC. Unless those reading your posts actually know CC they must believe it screw up computer - false statement. You could ask author to underline last access being important, rest is ranting and assumptions.

I suggest you move on to registry cleaners - much better area to waste energy.

[Mastertech]

No you still don't understand. XP DOES NOT DELETE ANY PREFETCH FILE FOR ANY INSTALLED APPLICATION below 128 entries. CCleaner does. XP DOES NOT WORK OFF A TWO WEEK TIME LIMIT, it works off a 128 item limit. If all 128 items are installed it will not remove any of them. CCleaner DOES NOT DO WHAT XP does PERIOD!

Here is another situation. Say you go on vacation or do not use your Computer for two weeks and come back, CCleaner will delete every application's prefetch. Why? For what reason. You still haven't answered this. Why are you ignoring the question?

If we assume you are correct about ntfs access date tweak vs. CC then why is it not allways a good idea to turn it off?

Not assume, I am correct. I tested it. You haven't tested one thing.

You shouldnt be tweaking if you dont understand effect.

I do understand, you don't understand. Turning this feature off improves file system performance.

With no tweak we dont have a problem do we

Yes we do! Why are you not reading anything I type? Just because a prefetch file is two weeks old does not mean it is still not installed. XP will never remove these files below the 128 limit. CCleaner does.

So your tests and white papers from 2002 have nothing to do with your target CC. Unless those reading your posts actually know CC they must believe it screw up computer - false statement. You could ask author to underline last access being important, rest is ranting and assumptions.

They have everything to do with it. That is why I posted them. Nothing is assumed. Everything has been tested. You are the one who hasn't tested a single thing. The author needs to remove this option since it is useless and only hurts performance.

I suggest you move on to registry cleaners - much better area to waste energy.

I suggest you read what I am typing and actually test something.

Answer these questions:

#1. Why is this option in CCleaner and on by default?
#2. Have you ever used CCleaner?
#3. Have you tested anything?

[FreewheelinFrank]

I continue to suspect that virus writers have found ways to abuse prefetch, and I also suspect that a statement like this can only be a challenge to virus writers to find ways to hide their code here.

A prefetch file can not execute or contain virus code. They are reference files for the virus to load into memory quicker.

Don't be confused by this.

I view of this I think it may still be a good idea to zap the prefetch file if malware infection is suspected: I just wonder now if CCleaner is the way to do this if it doesn't touch active prefetch entries?

I finally got the file to show itself in a search.  I first tried various spyware programs without success - no problems noted.  I then deleted the c:\windows\prefetch folder -- not just the contents, but the entire folder -- and emptied the recycle bin.  Once I did that, the file then appeared in c:\windows\system32.  Prior to deleting the prefetch folder the file did not appear in a search of the system32 folder.

http://www.experts-exchange.com/Applications/Q_21185769.html

I was about to scream, when I decided for some reason (divine inspiration, perhaps) to try to find the files myself. So I fired up the Windows search tool, which I don't typically use because it's slow and on a customer's computer I often end up having to deal with that blasted dog, and entered the current name of the files. Bingo. It turns out that there was a file in the Windows prefetch folder that I hadn't been able to find previously. I deleted this.

Then I searched for the name in the registry, and found another instance where the file was being loaded. It wasn't in any of the typical run locations (and, in fact, I don't recall where it was - sorry), and moreover it wasn't even what I'd expect to see, as there was information appended to the end of the filename. For instance, instead of ukidoek.exe, it was ukidoek.exeCommonStartup or something similar. Probably a play on the ever-popular extension overloading issues suffered by Microsoft products.

Sure enough, after disabling these two instances by using msconfig, they stopped loading. I was unable to disable them myself because the entries weren't in the normal locations, and it seems that the prefetch folder can actually load things even if they aren't being called anywhere - as if these files are preloaded for you. A trojan or virus in there simply loads itself at boot time, no startup entry or registry entry or anything.

Once disabled, I was able to remove the files, and search again through the registry for the particular names that I deleted, and finally, wonder of wonders, everything cleared up. But it wasn't easy. Seems that at least one trojan/virus writer has found some pretty nifty hooks into the Windows system. Hooks that aren't among those usually found, and hooks that aren't checked by at least Trend Micro. It detected the virus once running, but even an online scan with their latest product couldn't remove the prefetch entries that were causing it to return over and over.

http://jayseae.cxliv.org/2005/01/06/narrator_trojan_headaches.html

[darth.mikey]

Very interesting Frank a trojan that hides in Prefetch....  What will they think of next?

[Mastertech]

I continue to suspect that virus writers have found ways to abuse prefetch, and I also suspect that a statement like this can only be a challenge to virus writers to find ways to hide their code here.

The one thing virus writers cannot get around is the fact that the virus has to execute. Which means it has to be an executable file. Executable files can be put in the prefetch folder and there are ways to hide the extension. Regardless you would want to delete the malware file not the folder. This is the same reason you don't delete the system32 folder because one executable inside is malware. The confusion comes in because people treat the prefetch folder like a temp folder. No special permissions are applied to the prefetch folder preventing AntiSpyware or AntiVirus from removing an infected file found in the folder, nor from you manually deleting it.

I view of this I think it may still be a good idea to zap the prefetch file if malware infection is suspected: I just wonder now if CCleaner is the way to do this if it doesn't touch active prefetch entries?

CCleaner will definitely not do this unless the malware that was removed was over two weeks old or you disable the NTFS last access date. This is just not a good idea regardless to use any prefetch folder cleaner. Just delete the file manually if none of the scanner remove it, don't hurt all your applications load times. It is like using a NUKE when you only needed a laser. Either way it is not possible for a prefetch file to infect you system. But there is also nothing wrong with deleting a .pf associated with Malware since it is unnecessary either way.