This event can occur when an application was uninstalled but references to its performance counters remained. Also, improper registration of the counters dll may have the same effect as well as corrupted dlls.
Suggestions : "First, make sure the dll file exists, and exist in the proper locations. Once you've confirmed the location of the DLL, type REGSVR32 /U <DLL name> to unregister the DLL, then drop the /U and run it again to re-register the DLL in its current location. When you unregister the DLL, use the path from the Event Viewer. When you register it, use the path of the file in its current location. That should work."

According to Microsoft, this could be caused by Compaq (in our case) or another hardware manufacturer installing their own perfomance conters. From Microsoft point of view, this error should be ignored - for them there is no fix to disable the error, other then removing the non-MS performance counters.

In the case of corrupted dll you can manually rebuild Performance Counter Library values. See Q152513, Q275659 and Q300956.

Article Q226494 describes how to control the error checking and reporting by registry settings and list the possible event information. This is useful for testing and validating a <a href="/termdisplay.asp?termid=13">Performance Monitor Extension</a>. This is also helpful to diagnose problems with performance monitor extensions that are installed as part of a vendor's server application or device driver.

"PerfDisk", DLL name: "perfdisk.dll" - In the case of remote disk monitoring, both physical and logical, an administrator account is needed. Without administrator rights on the target machine, the counters for physical or logical disks will not appear. Administrator rights to access two files (PERFC009.DAT and PERFH009.DAT) is also required for disk monitoring.

"SnaServr", DLL name: "snaperf.dll" - See Q186713.

Service name: "Spooler", DLL name: "winspool.drv" - The status code in the data section was 0x000006ba (or 1722 decimal) and that means The RPC server is unavailable (see the Error code 1722 link). In my case this makes sense because it happened during a reboot. That is why the server was unavailable. See Q177446 on how to test Microsoft remote procedure call performance.

Service name: "Spooler", DLL name: "winspool.drv" - From a newsgroup post: "I found that I could not print, add a printer or even delete a printer from my printer list. I tracked it down to a corrupt print driver. It would appear that in Windows 2K or NT 4.0, the spool Spooler service terminated unexpectedly whenever I did anything. To correct this issue I had to delete the rogue driver entries from the registry. In my case it was a fax driver but it could be anything."

Service name: "Tcpip", DLL name: "Perfctrs.dll" - Download and install exctrlst.exe from Resource kit from Microsoft web site. Mark tcpip and reboot the server. See HP Support link below.

This error appears also when the service start is set to "manual" or "disable" in the services. By setting the service to automatic will stop the error showing up. Like previously said, the registry entry for the service should be disabled if you need to disable the service, otherwise errors in the logs will occur."

Set KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ <service name>\Performance\Disable Performance Counters - with a value of 0x1. This will disable the performance counters for that <service>.

Another fix would be to execute the Win2000 Resource Kit tool: exctrlst.exe and disable the Performance Counters you do not want monitored.

According to Microsoft, this could be caused by Compaq (in our case) or another hardware manufacturer installing their own perfomance conters. From Microsoft point of view, this error should be ignored - for them there is no fix to disable the error, other then removing the non-MS performance counters.