Once a virus kept reappearing, it was loaded in a prefetch file.

Based on this experience, I have modified my shutdown and reboot system –> they empty the prefetch directory.

I am having less problem since.

This article contains a descriprion of how prefetching works that is simple and easily understood. If only it were correct.

Prefetch does NOT preload applications at bootup and no memory is wasted. This view of prefetching is very common but completely wrong.

When an application starts Windows does not immediately load the entire application. Program code and data are loaded into memory only as needed and then cached for future use. This action is handled by the processor and operating system and is invisible to the application. This procedure is followed by virtually all systems that are based on virtual memory.

This system saves considerable memory and load time, particularly with large and complex applications. But the process isn’t optimum. Fragments of multiple files will be referenced in an order that is far from optimum for loading efficiently. The prefetch system was designed to solve this problem.

When an application starts, Windows checks the prefetch folder for an associated entry. If none is found a conventional load is performed. But while this occurs Windows monitors which files are accessed and the parts that are loaded. After the application has started this data is saved in an associated prefetch file. But take note, only an index to the files is saved, not the data itself.

When the application is run at a later time, Windows will find an associated prefetch file. The system uses the contents of this file as a guide to “prefetch” the program code and data and places it into the system cache. A normal program load is then initiated, but proceeds much faster than usual because the data is already in memory. This is what prefetching really means.

After the prefetch folder reaches 128 application entries no more will be added. Later, during idle time, the system will examine the folder and delete all but the 32 most recently used entries. The process will then continue as before. The folder is thus self cleaning and no user action is required – or desireable.

Prefetching this way has none of the problems that are commonly described, such as in this article. Application prefetch files are referenced only after application launch has been initiated so boot time is not prolonged. No data is loaded into memory that would not be loaded a few seconds later anyway. No memory is wasted so sytems with limited memory will not be impaired. Systems with as little as 64MB will benefit but 128 MB is requred to take full advantage of prefetching.

The prefetch system relies on the Task Scheduler service for proper operarion so it must be enabled and set to Automatic. Some uninformed sources have said that this service is unnecessary and may be safely disabled. Doing so will cripple the prefetch system and performace degraded. Over time this degradation can become severe.

The description of prefetch above is very much simplified and much more is actually involved. The prefetch system has been extensively tested by both Microsoft and others. My own tests confirm it. Examining the last access date of prefetch files will clearly show thay are accesed only when the program is run, not at boot time.

Manual cleaning of prefetch files will deprive Windows of a valuable resource and serves no useful purpose. The relevant registry entries are set to optimum by default and there is nothing to be gained by changing them.

The article by Tech-Recipes is incorrect and offers advice that will impair performance. Informed readers are well aware of this. Such serious errors must corrected.

The article at URL: http://www.tech-recipes.com/windows_tips671.html
is also based on the incorrect understanding of prefetch.

References:
http://home.comcast.net/~SupportCD/XPMyths.html
Also check the references on this page. One is by Ryan Myers, a Microsoft engineer on the client performance team.

I am well aware of the fact that many respected websites are promoting the same false idea as on this site. I have seen many of them. They are wrong.

Larry Miller
Microsoft MCSA
CompTIA Network+, A+
Amateur programmer.