写入FileStream的行为很奇怪，正如进程监视器

Question

所观察到的我正在使用FileStream写入文件，并使用Process Monitor观察底层系统调用。我在生产部署中遇到了一些文件锁定问题，所以我正在仔细查看细节。

此示例代码：

 using (FileStream fs = new FileStream("c:\\temp\\test.txt", FileMode.Create, FileAccess.Write, FileShare.Read)) 
     { 
      fs.Write(new byte[] { 1, 2, 3, 4, 5 }, 0, 5); 
      fs.Close(); 
     } 

导致以下系统调用：

9:27:09.4561092 AM ConsoleApplication1.vshost.exe 2320 CreateFile C:\temp\test.txt SUCCESS Desired Access: Generic Read/Write, Disposition: OverwriteIf, Options: Synchronous IO Non-Alert, Non-Directory File, Open No Recall, Attributes: n/a, ShareMode: Read, AllocationSize: 0, OpenResult: Overwritten 
9:27:12.2217409 AM ConsoleApplication1.vshost.exe 2320 WriteFile C:\temp\test.txt SUCCESS Offset: 0, Length: 5 
9:27:12.2219901 AM ConsoleApplication1.vshost.exe 2320 CloseFile C:\temp\test.txt SUCCESS 
9:27:12.2234484 AM ConsoleApplication1.vshost.exe 2320 CreateFile C:\temp\test.txt SUCCESS Desired Access: Generic Read, Write Attributes, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Random Access, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 
9:27:12.2248664 AM ConsoleApplication1.vshost.exe 2320 QueryBasicInformationFile C:\temp\test.txt SUCCESS CreationTime: 10/29/2008 9:04:14 AM, LastAccessTime: 10/29/2008 9:27:12 AM, LastWriteTime: 10/29/2008 9:27:12 AM, ChangeTime: 10/29/2008 9:27:12 AM, FileAttributes: A 
9:27:12.2250075 AM ConsoleApplication1.vshost.exe 2320 SetBasicInformationFile C:\temp\test.txt SUCCESS CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a 
9:27:12.2255889 AM ConsoleApplication1.vshost.exe 2320 QueryStandardInformationFile C:\temp\test.txt SUCCESS AllocationSize: 8, EndOfFile: 5, NumberOfLinks: 1, DeletePending: False, Directory: False 
9:27:12.2257571 AM ConsoleApplication1.vshost.exe 2320 ReadFile C:\temp\test.txt SUCCESS Offset: 0, Length: 5 
9:27:12.2259825 AM ConsoleApplication1.vshost.exe 2320 ReadFile C:\temp\test.txt SUCCESS Offset: 0, Length: 5 
9:27:12.2261588 AM ConsoleApplication1.vshost.exe 2320 ReadFile C:\temp\test.txt SUCCESS Offset: 0, Length: 5 
9:27:12.2265161 AM ConsoleApplication1.vshost.exe 2320 ReadFile C:\temp\test.txt SUCCESS Offset: 0, Length: 2 
9:27:12.2268237 AM ConsoleApplication1.vshost.exe 2320 ReadFile C:\temp\test.txt SUCCESS Offset: 0, Length: 5 
9:27:12.2271332 AM ConsoleApplication1.vshost.exe 2320 ReadFile C:\temp\test.txt SUCCESS Offset: 0, Length: 5 
9:27:12.2272841 AM ConsoleApplication1.vshost.exe 2320 ReadFile C:\temp\test.txt SUCCESS Offset: 0, Length: 5 
9:27:12.2274779 AM ConsoleApplication1.vshost.exe 2320 ReadFile C:\temp\test.txt SUCCESS Offset: 0, Length: 5 
9:27:12.2276249 AM ConsoleApplication1.vshost.exe 2320 ReadFile C:\temp\test.txt SUCCESS Offset: 0, Length: 5 
9:27:12.2278766 AM ConsoleApplication1.vshost.exe 2320 ReadFile C:\temp\test.txt SUCCESS Offset: 0, Length: 5 
9:27:12.2282577 AM ConsoleApplication1.vshost.exe 2320 ReadFile C:\temp\test.txt SUCCESS Offset: 0, Length: 5 
9:27:12.2284476 AM ConsoleApplication1.vshost.exe 2320 QueryFileInternalInformationFile C:\temp\test.txt SUCCESS IndexNumber: 0x2d000000016b88 
9:27:12.2286183 AM ConsoleApplication1.vshost.exe 2320 CloseFile C:\temp\test.txt SUCCESS 
9:27:12.2288759 AM ConsoleApplication1.vshost.exe 2320 CreateFile C:\temp\test.txt SUCCESS Desired Access: Read Attributes, Write Attributes, Disposition: Open, Options: , Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 
9:27:12.2305722 AM ConsoleApplication1.vshost.exe 2320 QueryBasicInformationFile C:\temp\test.txt SUCCESS CreationTime: 10/29/2008 9:04:14 AM, LastAccessTime: 10/29/2008 9:27:12 AM, LastWriteTime: 10/29/2008 9:27:12 AM, ChangeTime: 10/29/2008 9:27:12 AM, FileAttributes: A 
9:27:12.2307379 AM ConsoleApplication1.vshost.exe 2320 CloseFile C:\temp\test.txt SUCCESS 

前三个IO调用预计（创建，写，关闭），但在处理前进到多读十几次文件并重复打开和关闭它。

我现在在Win XP SP2和Win 2003 x64上观察到了这种行为。但是，我家中的Windows Vista机器的性能与预期相同（只是前三行）。

有关为什么在非Vista运行时发生这种情况的任何线索？

Answer 1

一种可能性是您安装了病毒扫描程序，它将自身注入到每个正在运行的进程中？