刚才时间仓促，不能详细回复，现在补充一下：开机之后出现红伞，确认任务管理器里能看到RavMonD.exe，里面记录的内容从6号到8号，只是帖发时提示字节太长，只能帖了今天的记录，晚上回家后才能上传附件，现在文字说明一下吧

我的也是总关闭,手动开启后又正常了,已经出现好几次了,19版前没出现过啊,我感觉电脑里没病毒!!

我的也是哦，手动重启可以，查没毒

[1056] 2007-11-08 12:16:24:968 : WinMain begin!!!
[2184] 2007-11-08 12:18:26:123 : WinMain begin!!!
[2196] 2007-11-08 12:18:26:233 : WinMain begin!!!
[2196] 2007-11-08 12:18:26:233 : Init Cfg Begin!
[2196] 2007-11-08 12:18:26:248 : Init LogManager Begin!
[2196] 2007-11-08 12:18:26:498 : Init AccessRuleManager Begin!
[2196] 2007-11-08 12:18:27:092 : Init DriverCenter Begin!
[2196] 2007-11-08 12:18:28:920 : Load m_ProcComHelp Begin!!
[2196] 2007-11-08 12:18:28:920 : Create CommunicationObject Begin!!
[2196] 2007-11-08 12:18:28:983 : RavmonD.Control.File,CRavMonBase::Init
[2196] 2007-11-08 12:18:28:983 : RavmonD.Control.File,CreateCommunicationObject begin
[2196] 2007-11-08 12:18:28:983 : CFileAccessControl::AccessThread Create!
[2196] 2007-11-08 12:18:28:983 : CFileAccessControl::AccessAtctionThread Create!
[2196] 2007-11-08 12:18:29:076 : MonIint RAVMOND_CONTROL_FILE
[2196] 2007-11-08 12:18:29:076 : RavmonD.Control.Reg,CRavMonBase::Init
[2196] 2007-11-08 12:18:29:076 : RavmonD.Control.Reg,CreateCommunicationObject begin
[2196] 2007-11-08 12:18:29:092 : CRegAccessControl::AccessThread!
[2196] 2007-11-08 12:18:29:264 : MonIint RAVMOND_CONTROL_REG
[2196] 2007-11-08 12:18:29:264 : RavmonD.Control.Proc,CRavMonBase::Init
[2196] 2007-11-08 12:18:29:280 : RavmonD.Control.Proc,CreateCommunicationObject begin
[2196] 2007-11-08 12:18:29:295 : CProcessAccessControl::AccessThread!
[2196] 2007-11-08 12:18:29:295 : CProcessAccessControl::AccessAtctionThread!
[2196] 2007-11-08 12:18:29:373 : MonIint RAVMOND_CONTROL_PROC
[2196] 2007-11-08 12:18:29:373 : RavmonD.Control.Api,CRavMonBase::Init
[2196] 2007-11-08 12:18:29:373 : RavmonD.Control.Api,CreateCommunicationObject begin
[2196] 2007-11-08 12:18:29:405 : CSysAccessControl::NtAccessThread!
[2196] 2007-11-08 12:18:29:405 : CSysAccessControl::W32AccessThread!
[2196] 2007-11-08 12:18:29:405 : CSysAccessControl::AccessAtctionThread!
[2196] 2007-11-08 12:18:29:420 : MonIint RAVMOND_CONTROL_API
[2196] 2007-11-08 12:18:29:420 : RavmonD.Virus.Action,CRavMonBase::Init
[2196] 2007-11-08 12:18:29:420 : RavmonD.Virus.Action,CreateCommunicationObject begin
[2196] 2007-11-08 12:18:29:436 : CVirusAtcion::InitVirusAction!
[2196] 2007-11-08 12:18:29:530 : CVirusAtcion::CreateObject IRSStoreObj!
[2196] 2007-11-08 12:18:29:858 : MonIint RAVMOND_ACTION
[2196] 2007-11-08 12:18:29:858 : RavmonD.Detect.Proc,CRavMonBase::Init
[2196] 2007-11-08 12:18:29:858 : RavmonD.Detect.Proc,CreateCommunicationObject begin
[2196] 2007-11-08 12:18:30:201 : CDetectProc::AccessThread Create!
[2196] 2007-11-08 12:18:30:201 : MonIint RAVMOND_DETECT_PROC
[2196] 2007-11-08 12:18:30:311 : CMailMonitor::Init WSAStartup!!
[2196] 2007-11-08 12:18:30:311 : CMailMonitor::Init m_MailMonHelp.Load!!
[2196] 2007-11-08 12:18:30:420 : CMailMonitor::Init m_KillMailScanObj.Init!!
[2196] 2007-11-08 12:18:30:670 : Start KillFileThread !!!
[2196] 2007-11-08 12:18:30:670 : CMailMonitor::Init StartAcceptPort!!
[2196] 2007-11-08 12:18:30:701 : CMailMonitor::Init NetThread!!
[2196] 2007-11-08 12:18:30:701 : CMailMonitor::Init m_MailMonHelp.InitMonitor!!
[2196] 2007-11-08 12:18:30:701 : CMailMonitor::Init MailPortChange!!
[2196] 2007-11-08 12:18:30:701 : RavmonD.Mon.Mail,CRavMonBase::Init
[2196] 2007-11-08 12:18:30:701 : RavmonD.Mon.Mail,CreateCommunicationObject begin
[2196] 2007-11-08 12:18:30:733 : MonIint RAVMOND_MON_MAIL
[2196] 2007-11-08 12:18:30:733 : CWebMonitor m_WebMonHelp.Load
[2196] 2007-11-08 12:18:30:905 : CWebMonitor m_KillWebMonScanObj.Init
[2196] 2007-11-08 12:18:30:936 : CWebMonitor m_WebMonHelp.InitWebMon
[2196] 2007-11-08 12:18:30:936 : RavmonD.Mon.Web,CRavMonBase::Init
[2196] 2007-11-08 12:18:30:936 : RavmonD.Mon.Web,CreateCommunicationObject begin
[2196] 2007-11-08 12:18:30:967 : MonIint RAVMOND_MON_WEB
[2196] 2007-11-08 12:18:30:967 : m_PreScanObj init begin!
[2196] 2007-11-08 12:18:30:967 : m_KillExeScanObj init begin!
[2196] 2007-11-08 12:18:30:983 : m_KillDataScanObj init begin!
[2196] 2007-11-08 12:18:30:998 : RavmonD.Mon.File,CRavMonBase::Init
[2196] 2007-11-08 12:18:30:998 : RavmonD.Mon.File,CreateCommunicationObject begin
[2196] 2007-11-08 12:18:31:045 : MonIint RAVMOND_MON_FILE

6号晚升级到20.17.12时,发现又出现监控关闭情况,已经确认了进程中有RavMonD.exe,于是决定重装一次机子.但是今天早上升级到20.17.22,中午再开机时又有状况发生.文件监控，邮件监控，网页监控三个都关闭,但主动防御则可用,已经全盘查杀一次,确认没有病毒,在任务管理器也可以看到RavMonD.exe.
RavMonD.exe.txt上传到附件中

WinXp sp2 下启动出现小红伞（不是总是，但很频繁），有时出现了登录选择用户界面，但左上角的监控图标不出现；
Win2000 sp4 下启动监控正常，但选择禁用所有监控失效，不能关闭(监控图标不变红，不提示监控被关闭)！

提示RAVmonD.exe出错需要关闭,但是伞还是绿色。（这次是打开一个正常的EXCEL文件，以前是打开超级兔子）

进程中没有RAVmonD.exe

伞的功能失效，不能禁用启用监控。

出现过几次  现在好象好了

我的有段时间会开机变红
启动监控也没用  但重起下又好了

关注中啊。