Perfmon .dat files are changing according to a checksum

Posted on 2012-09-11
Last Modified: 2014-01-08
A checksum running daily against C:\WINDOWS\System32 for the last 18months with no changes previously has is identified the below listed files as changed.  I have no idea of what normal windows operation changes these files.  I'm inclined to this this is a malicious event, but I am unsure.


Any Ideas?
Question by:jp415
    1 Comment
    LVL 76

    Accepted Solution

    This could be updated by a configured alert,trace. download process monitor. Using this tool you can try and detect which process writes into it.
    Alternative is to use perfmon to load one of the files to see what counter/s are being monitored and at what interval.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Don't lose your head updating email signatures!

    Do your end users still have the wrong email signature? Do email signature updates bore you or fill you with a sense of dread? You can make this a whole lot easier on yourself by trusting an Exclaimer email signature management solution. Over 50 million users should you!

    The password reset disk is often mentioned as the best solution to deal with the lost Windows password problem. In Windows 2008, 7, Vista and XP, a password reset disk can be easily created. But besides Windows 7/Vista/XP, Windows Server 2008 and ot…
    Know what services you can and cannot, should and should not combine on your server.
    This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
    This tutorial will walk an individual through the process of upgrading their existing Backup Exec 2012 to 2014. Either install the CD\DVD into the drive and let it auto-start, or browse to the drive and double-click the Browser file: Select the ap…

    758 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    11 Experts available now in Live!

    Get 1:1 Help Now