Continuous I/O Spikes when Prevx SOL enabled

I have another bone to pick with Prevx/SOL.

I currently have SO disabled because when it is enabled, I see a continuous stream of I/O spikes in conjunction with explorer that goes on forever until I disable SO again. Approximately 2.7MB are being read over and over again. Does anyone know what the reason for this is?

When I enable SO, I have to logoff/logon for the continuous I/O to start. The same holds true when disabling; for the I/O to stop. No other programs are open besides process explorer. It is definitely related to Prevx SO.

XP Pro/SP3

Al

 

SafeOnline analyzes memory images and compares them against the disk complements in the background to ensure that nothing has been tampered by malware. This has to take place on a constant basis but the I/O is performed in a low priority so as to not interfere with other applications. You'll definitely see the I/O taking place, but it is low-volume and critical to ensuring that your system has clean libraries loaded in core processes.

Hope that helps!

 

Are you saying the implementation described is the only way to ensure clean loaded libraries?

Even though the I/O is low volume and does not seem to impact anything, I dislike seeing this type of behavior. Will 4.0 be doing the same?

Al

 

Why is this bad? I don't pretend to understand myself, so I'm just asking.

 

4.0 has a similar implementation but to prevent any form of tampering, the libraries do need to be re-loaded from disk to ensure they have not been modified in memory (either by hooks/code replacement/etc. which information stealing trojans do).

As the libraries are already mapped to memory from disk, there is virtually no overhead to actually read them again.

 

I don't know, did I say it was bad?

I'm picky. Anytime I see CPU or I/O spikes on a continuous basis, I start to wonder what is going on and whether what I'm observing is necessary.

AL

 

would this constant IO effect battery life at all?

 

Only very marginally - it's reading files that are loaded in memory so they will be cached. The OS identifies any IO as IO but this occurs exclusively from memory.

 

ok thanks, i guess ill give safeonline a try, hopefully since im using a new computer now i wont have my historic issue with prevx and my internet miraculously dieing lol