瑞星卡卡安全论坛

只要打开比特精灵，电驴，QQ旋风，任何一个在下载，瑞星全功能2010，就会狂读写硬盘。
所以不要问我是哪一个软件引起的。在XP下会如此，在VISTA下好像没这问题（没去试）

已经很多天，所有的版本，从过年前天到今天，天天更新，每个版本都是如此。很多人如此。
所以不要问我是哪一个版本的“全功能2010”，从过年前到现在，每个版本都是如此
瑞星的工作人员过年过得真舒服啊，年初十了，还不来上班。

只要打开“应用程序网络访问监控”就会如此，无论下载的速度是多少，硬盘都会狂读写。

图片上传不了，只能打包成RAR，里面有两个图片，是打开那个选项，几秒后，IO写入的次数变化

附件: IO.rar (2010-2-23 20:57:02, 37.15 K)
该附件被下载次数 243

今天用Filemon，记录下瑞星是怎样狂写硬盘的。（我截的图无法上传，说无效文件）
全是在不停的读写几个文件，一秒内来回的读写几个文件200次左右。
如果没有这个软件的朋友，你们可以打开任务管理器，打监控的列加上 I/O的读写，就会看到瑞星的RavMonD.exe，在不停的读写，一秒读写200次左右

16867 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Offset: 0 Length: 512
16868 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Offset: 512 Length: 4
16869 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Offset: 516 Length: 1024
16870 20:29:24 RavMonD.exe:1452 WRITE C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Offset: 1540 Length: 4
16871 20:29:24 RavMonD.exe:1452 WRITE C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Offset: 1544 Length: 4
16872 20:29:24 RavMonD.exe:1452 WRITE C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Offset: 1548 Length: 1024
16873 20:29:24 RavMonD.exe:1452 WRITE C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Offset: 2572 Length: 4
16874 20:29:24 RavMonD.exe:1452 READ C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal END OF FILE Offset: 3072 Length: 8
16875 20:29:24 RavMonD.exe:1452 FLUSH C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS 
16876 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Offset: 0 Length: 4096
16877 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Offset: 0 Length: 4096
16878 20:29:24 RavMonD.exe:1452 WRITE C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Offset: 0 Length: 12
16879 20:29:24 RavMonD.exe:1452 FLUSH C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS 
16880 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Offset: 0 Length: 4096
16881 20:29:24 RavMonD.exe:1452 LOCK C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Excl: Yes Offset: 1073741824 Length: 1
16882 20:29:24 RavMonD.exe:1452 UNLOCK C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Offset: 1073741826 Length: 510
16883 20:29:24 RavMonD.exe:1452 LOCK C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Excl: Yes Offset: 1073741826 Length: 510
16884 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Offset: 0 Length: 1024
16885 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Offset: 83968 Length: 1024
16886 20:29:24 RavMonD.exe:1452 FLUSH C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS 
16887 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Offset: 0 Length: 4096
16888 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Offset: 81920 Length: 4096
16889 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Offset: 0 Length: 4096
16890 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Offset: 81920 Length: 4096
16891 20:29:24 RavMonD.exe:1452 CLOSE C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS 
16892 20:29:24 RavMonD.exe:1452 OPEN C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Options: Open  Access: 00010080
16893 20:29:24 RavMonD.exe:1452 QUERY INFORMATION C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS FileAttributeTagInformation
16894 20:29:24 RavMonD.exe:1452 DELETE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS 
16895 20:29:24 RavMonD.exe:1452 CLOSE C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS 
16896 20:29:24 RavMonD.exe:1452 QUERY INFORMATION C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal NOT FOUND Attributes: Error
16897 20:29:24 RavMonD.exe:1452 UNLOCK C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Offset: 1073741826 Length: 510
16898 20:29:24 RavMonD.exe:1452 LOCK C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Excl: No Offset: 1073741826 Length: 510
16899 20:29:24 RavMonD.exe:1452 UNLOCK C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Offset: 1073741825 Length: 1
16900 20:29:24 RavMonD.exe:1452 UNLOCK C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Offset: 1073741824 Length: 1
16901 20:29:24 RavMonD.exe:1452 UNLOCK C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Offset: 1073741826 Length: 510
16902 20:29:24 RavMonD.exe:1452 QUERY INFORMATION D:\PROGRAM FILES\BITSPIRIT\BITSPIRIT.EXE SUCCESS Attributes: A
16903 20:29:24 RavMonD.exe:1452 OPEN D:\PROGRAM FILES\BITSPIRIT\BITSPIRIT.EXE SUCCESS Options: Open  Access: Read
16904 20:29:24 RavMonD.exe:1452 QUERY INFORMATION D:\PROGRAM FILES\BITSPIRIT\BITSPIRIT.EXE SUCCESS Length: 3619328
16905 20:29:24 RavMonD.exe:1452 QUERY INFORMATION D:\PROGRAM FILES\BITSPIRIT\BITSPIRIT.EXE SUCCESS Length: 3619328
16906 20:29:24 RavMonD.exe:1452 CLOSE D:\PROGRAM FILES\BITSPIRIT\BITSPIRIT.EXE SUCCESS 
16907 20:29:24 RavMonD.exe:1452 LOCK C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Excl: Yes Offset: 1073741824 Length: 1
16908 20:29:24 RavMonD.exe:1452 LOCK C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Excl: No Offset: 1073741826 Length: 510
16909 20:29:24 RavMonD.exe:1452 UNLOCK C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Offset: 1073741824 Length: 1
16910 20:29:24 RavMonD.exe:1452 QUERY INFORMATION C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal NOT FOUND Attributes: Error
16911 20:29:24 RavMonD.exe:1452 QUERY INFORMATION C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Length: 117760
16912 20:29:24 RavMonD.exe:1452 READ C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Offset: 24 Length: 16
16913 20:29:24 RavMonD.exe:1452 LOCK C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Excl: Yes Offset: 1073741825 Length: 1
16914 20:29:24 RavMonD.exe:1452 OPEN C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Options: OpenIf  Access: 0012019F
16915 20:29:24 RavMonD.exe:1452 OPEN C:\WINDOWS\system32 SUCCESS Options: Open Directory  Access: 00100001
16916 20:29:24 RavMonD.exe:1452 QUERY INFORMATION C:\WINDOWS\system32 SUCCESS FileFsSizeInformation
16917 20:29:24 RavMonD.exe:1452 CLOSE C:\WINDOWS\system32 SUCCESS 
16918 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Offset: 0 Length: 512
16919 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Offset: 512 Length: 4
16920 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Offset: 516 Length: 1024
16921 20:29:24 RavMonD.exe:1452 WRITE C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Offset: 1540 Length: 4
16922 20:29:24 RavMonD.exe:1452 WRITE C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Offset: 1544 Length: 4
16923 20:29:24 RavMonD.exe:1452 WRITE C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Offset: 1548 Length: 1024
16924 20:29:24 RavMonD.exe:1452 WRITE C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Offset: 2572 Length: 4
16925 20:29:24 RavMonD.exe:1452 READ C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal END OF FILE Offset: 3072 Length: 8
16926 20:29:24 RavMonD.exe:1452 FLUSH C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS 
16927 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Offset: 0 Length: 4096
16928 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Offset: 0 Length: 4096
16929 20:29:24 RavMonD.exe:1452 WRITE C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Offset: 0 Length: 12
16930 20:29:24 RavMonD.exe:1452 FLUSH C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS 
16931 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS Offset: 0 Length: 4096
16932 20:29:24 RavMonD.exe:1452 LOCK C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Excl: Yes Offset: 1073741824 Length: 1
16933 20:29:24 RavMonD.exe:1452 UNLOCK C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Offset: 1073741826 Length: 510
16934 20:29:24 RavMonD.exe:1452 LOCK C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Excl: Yes Offset: 1073741826 Length: 510
16935 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Offset: 0 Length: 1024
16936 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Offset: 99328 Length: 1024
16937 20:29:24 RavMonD.exe:1452 FLUSH C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS 
16938 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Offset: 0 Length: 4096
16939 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Offset: 98304 Length: 4096
16940 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Offset: 0 Length: 4096
16941 20:29:24 RavMonD.exe:1452 WRITE  C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db SUCCESS Offset: 98304 Length: 4096
16942 20:29:24 RavMonD.exe:1452 CLOSE C:\Documents and Settings\All Users\Application Data\Rising\common\rsnetsvr.db-journal SUCCESS

十来秒，就能有1.7W条记录，日志都有5MB

如果是SSD硬盘，一个月就完蛋了。
用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0; QQDownload 609; GTB6.4; QQWubi 133; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; CIBA; .NET CLR 3.5.30729; .NET CLR 3.0.30618)

问题已经提交反馈。

和我在这贴里回复的情况差不多，希望瑞星能够抓紧时间处理
http://bbs.ikaka.com/showtopic-8693649.aspx

硬盘狂写应该和那个 日志里面的内容无关
你即使不卡了 那个东西也会写

乱说，只要一停了那个选项，就不会这样读写

这个读写，是一秒150次以上，在资源管理器的IO读写次数里也能看出来
这个是一秒不停的读写150次，一停了立马没有。不下截，或那选项不打开，随便停一个，都不会有这现像，关掉瑞星也行。

只需要十来秒，记录的日志就能有3MB多。

全功能软件的版本号，相关下载软件的版本号及下载地址，IO检测软件的下载地址都提供下

解决方法在这里
http://bbs.ikaka.com/showtopic-8697099.aspx

支持你的观点！停用此监控后，I/O操作明显减少。
且7楼的方法在我这里不适用。

这个是对进程 读取文件时候的 扫描吧·