Windows is full of mysterious processes and files. What's behind them?

The Windows system consists of 1000’s of information. Many of them have unusual names, others have extensions that almost all customers have by no means seen earlier than. Normally you don’t want to fret about these information.

Windows is designed to configure, optimize, and in lots of instances even restore itself. It is neither supposed nor desired that the person intervenes within the system, deletes, or modifies information.

However, if you want to know extra about how Windows works internally, what duties the person parts have, and the way they work collectively, that is the fitting article for you.

We will spotlight the information that stand out from the mass of information attributable to their title, dimension, or operate.

Further studying: 13 important Windows settings to adjust immediately

Huge information within the system folder: Hibernation & Co.

Windows is generally put in on the C: drive within the “Windows” folder. However, the system folder, usually additionally known as the basis listing, already comprises numerous information created by the working system. Some of those can develop to a substantial dimension.

However, you’ll be able to solely see these information you probably have deactivated the setting “Hide protected system files (recommended)” within the “Folder options” of the Explorer within the “View” tab.

Foundry

Foundry

Foundry

Most house is taken up by hiberfil.sys, which could be a number of gigabytes in dimension. The title is a brief type of “hibernate file,” which implies hibernation file. If you choose hibernate mode when shutting down the PC, Windows saves the present contents of the RAM on this file, together with all energetic functions and open paperwork.

As quickly as you turn the pc again on, you’ll be able to instantly proceed working from the place you left off. The extra RAM you’ve, the bigger hiberfil.sys will likely be.

The file can’t be deleted through Explorer, however it may be deleted through the command immediate: To do that, sort cmd within the search subject of the taskbar and click on on “Run as administrator.” Now enter the command

powercfg /h off 

adopted by the Enter key. Windows deletes the file with out prompting you and deactivates hibernation. If desired, you’ll be able to restore hibernation at any time with the command

powercfg /h on 

at any time.

The working system creates two swap information

The second conspicuously massive file within the system folder known as pagefile.sys. This is the swap file that Windows at all times makes use of when there’s not sufficient reminiscence for the loaded applications and information. The working system dynamically adjusts the dimensions of pagefile.sys to the required reminiscence.

IDG

IDG

IDG

If there’s ample RAM within the PC, you may contemplate deactivating pagefile.sys (deletion doesn’t work). Although that is doable, it isn’t really useful. This is as a result of the inner reminiscence administration accesses the file infrequently, even when there’s house within the RAM. If the file is now not accessible, error messages, together with doable system crashes, will likely be displayed.

Thirdly, swapfile.sys seems in the principle folder. This can also be a swap file, however it’s used completely for Windows apps. So that the RAM just isn’t burdened by dormant or sleeping apps, they’re moved to the file on the laborious drive/SSD.

Further studying: 4 just-added Windows 11 features that make your life easier

Windows adjusts the dimensions of swapfile.sys as required: If no apps are energetic, it’s normally 16MB in dimension. If a number of apps are working, it might probably develop as much as 256MB.

You can take away the file through the registry: To do that, open the trail

HKEY_LOCAL_MACHINESystemCurrentControlSetControlSession ManagerReminiscence Management 

and create a brand new DWORD worth known as “SwapfileControl” after right-clicking in the fitting half of the window. Double-click on this and be sure that “0” is entered as the worth.

This will trigger swapfile.sys to vanish the following time you restart. Bear in thoughts that Windows apps might begin extra slowly because of this. To restore the file, delete the registry entry.

Windows with crash log and laborious disk take a look at

You will even discover a file known as DumpStack.log.tmp on C:. Windows logs system crashes on this file. In some instances, it slows down the beginning of the TOR community for nameless browsing; with out this file, the TOR browser generally connects a lot quicker.

The DumpStack.log.tmp can not merely be deleted as entry is blocked. However, you’ll be able to take away the block through the registry: To do that, go to the folder

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlCrashControl 

and set the worth of the “Enable- LogFile” key to “0”. After a restart, you’ll be able to delete the DumpStack.log.tmp with the Explorer. There aren’t any unfavourable negative effects to be feared; nevertheless, some crash logs could be useful for assist workers.

Sometimes additionally, you will discover the small file bootTel.dat within the system listing. Windows creates these information if you test the laborious disk/SSD for errors. If you wish to begin an error search, sort with administrator rights

chkdsk 

within the command immediate.

Huge folders and what’s behind them

According to Explorer or instruments corresponding to Treesize Free, WinSxS beneath C:Windows is likely one of the largest Windows folders of all: It usually takes up a number of gigabytes of cupboard space.

But this data is deceptive. WinSxS collects 1000’s of laborious hyperlinks that consult with applications and system parts on the laborious drive. The whole dimension of all linked information and applications seems because the folder dimension.

IDG

IDG

IDG

Under no circumstances must you cut back the dimensions of WinSxS by deleting subfolders and information. The folder comprises, amongst different issues, downloaded Windows updates and system information that Windows restores from right here within the occasion of system errors.

If you take away these information, you’ll be able to render your system unusable. You ought to subsequently use Windows Disk Cleanup, which you can begin by coming into

cleanmgr within the search subject of the taskbar. Click on “Clean up system files,” place a tick in entrance of every choice and ensure with “OK.”

The SysWOW64 folder can also be usually fairly massive. It comprises the WOW64 subsystem (Windows on Windows 64-bit), which is required to run 32-bit applications in a 64-bit Windows. You should not change this folder.

Mysterious processes within the Windows activity supervisor

IDG

IDG

IDG

If you open the Task Manager, one can find the entry with the title AggregatorHost.exe or Microsoft (R) Aggregator Host within the processes. The course of belongs to a file that was nonetheless positioned within the C:WindowsSystem32 folder in Windows 10. Windows 11 shops it in a subfolder of C:WindowsWinSxS.

What this course of does is unclear. Microsoft doesn’t present any data. Since “Aggregator” stands for “collect,” it appears believable that the method connects numerous system parts with components corresponding to notifications and preview pictures within the taskbar. In any case, this isn’t malware. As the file hardly takes up any reminiscence, ignore it.

The case is clearer with taskhostw.exe: It can also be a course of; it’s liable for beginning Windows providers which can be based mostly on DLLs. It usually works unnoticed within the background. Users repeatedly report error messages in reference to this file, and the method additionally causes a CPU load that’s stretched to the restrict.

The Windows instruments sfc.exe and DISM will help towards this. Open the command immediate with administrator rights, sort

sfc /scannow 

and run the take a look at. Then enter the three instructions

DISM /Online /Cleanup-Image /Check-Health
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /Restore-Health

one after the opposite. This usually solves the issues.

Explained: What are the hosts file and the MUI and PF information for?

The hosts file within the C:WindowsSystem32driversetc folder is characterised by the truth that it has no extension. This has to do with the truth that this file initially comes from the Unix world. Today, hosts exists not solely on Windows computer systems, but additionally on Macintosh computer systems, Linux computer systems, and smartphones and tablets with the Android and iOS cell working techniques.

The file dates again to the early days of the web. Back then, it was wanted to translate entries corresponding to www.microsoft.com into addresses corresponding to 20.231.239.246. Back then, the hosts information contained lengthy tables with handle assignments. Today, this file might be empty in your system; URLs at the moment are resolved through the DNS system.

Nevertheless, hosts nonetheless has a sensible use: You can use it to forestall entry to sure web sites corresponding to promoting servers. If you enter “0.0.0.0 www.werbeserver.com” within the hosts file, the entry of www.werbeserver.com will likely be redirected to the non-existent handle 0.0.0.0.

The course of ends with an error message. To edit the file, merely use the Editor app or the Hosts file editor from the Microsoft Powertoys (Microsoft Store).

Files with the extension MUI (Multilingual User Interface) are continuously encountered on Windows PCs. These are information for switching the working system from, say, German to a different language.

Instead of deleting such information, nevertheless, it’s advisable to uninstall complete language packs. To do that, click on on the Time and language > Language and area button within the Settings app.

Then click on on the three dots to the fitting of the language you now not want and press the “Remove” button.

PF information, i.e. information with the extension PF, solely exist within the folder C:WindowsPrefetch. When an software is opened for the primary time, Windows mechanically creates an appropriate PF file. It is used to hurry up the startup technique of this system. If you delete the information, the working system mechanically creates the information once more the following time you begin the related software.

Useful: The small freeware software Winprefetchview lists the PF information on the pc and shows a variety of file data.

Three copies of the msedge.dll file?

IDG

IDG

IDG

If you seek for the msedge.dll file with a software like Everything, three copies of it seem: one beneath C:Program Files (x86)MicrosoftEdgeApplication[version number], one beneath C:Program Files (x86)MicrosoftEdgeCore[version number], and a 3rd one beneath C:Program Files (x86)MicrosoftEdgeWebViewSoftware[version number].

However, the file truly solely exists as soon as, particularly within the path C:Program Files (x86)MicrosoftEdgeApplication[version number].

The different two places are laborious hyperlinks to the unique. These even have the property of displaying the dimensions of the unique file, though it is just saved as soon as in a distinct location.

This article was translated from German to English and initially appeared on pcwelt.de.