Userdiff Registry File – USERDIFF and USERDIFF.LOG
If you run WinPatrol 10.0 or later, you'll notice the following files listed in your Hidden Files: default.log, sam.log, security.log, system.log, tempkey.log, and userdiff.log. These files are part of your Windows Registry and are often referred to as registry hive files.
A registry hive is a group of keys, subkeys, and values in the registry that has a set of supporting files containing backups of its data. The supporting files for all hives except HKEY_CURRENT_USER are in the Systemroot\System32\Config folder on Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003; the supporting files for HKEY_CURRENT_USER are in the Systemroot\Profiles\Username folder. The file name extensions of the files in these folders, and, sometimes, a lack of an extension, indicate the type of data they contain. More information can be found at http://support.microsoft.com/default.aspx?scid=kb;EN-US;256986.
These files are both safe and required. They are opened and written to each time Windows boots. If you try to use the [View Using Notepad] button under Hidden files, you'll get a warning that the files are in use. That's normal.
Safe
Microsoft