hi have you disabled w10 or w7 Performance Counters Schema ? it could be disabled with cmd as administrator to disable diskperf -N to enable diskperf -Y I have found in w7 in the folder C:\Windows\Temp , file like Code: c:\Windows\Temp\XYZ1C6.tmp c:\Windows\Temp\XYZ1C7.tmp c:\Windows\Temp\XYZ1B4.tmp c:\Windows\Temp\XYZ1B5.tmp can't find an answer , but they do seem file created by erformance Counters Schema have files like these? i have from few months ago no updates , outside kaspersky they do start with Code: <instrumentationManifest xmlns="http://schemas.microsoft.com/win/2004/08/events" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://schemas.microsoft.com/win/2004/08/events eventman.xsd"> <metadata name="evt:meta/winTypes"> <channels> <channel name="TraceClassic" type="Debug" symbol="WINEVENT_CHANNEL_CLASSIC_TRACE" value="0" message="$(string.channel.TraceClassic)"> Events for Classic ETW tracing. </channel> <channel name="System" type="Admin" symbol="WINEVENT_CHANNEL_GLOBAL_SYSTEM" isolation="System" value="8" message="$(string.channel.System)"> Events for all installed system services. This channel is secured to applications running under system service accounts or user applications running under local adminstrator privileges. </channel> <channel name="Application" type="Admin" symbol="WINEVENT_CHANNEL_GLOBAL_APPLICATION" isolation="Application" value="9" message="$(string.channel.Application)"> Events for all user-level applications. This channel is not secured and open to any applications. Applications which log extensive information should define an application-specific channel. </channel> <channel name="Security" type="Admin" symbol="WINEVENT_CHANNEL_GLOBAL_SECURITY" isolation="System" value="10" message="$(string.channel.Security)"> The Windows Audit Log. For exclusive use of the Windows Local Security Authority. User events may appear as audits if supported by the underlying application. </channel> </channels> thanks