Minifilter unload hang

NTFSD
1

A customer came upon the first instance of this that I’ve ever seen:

fltmc.exe unload {filter}

doesn’t return an error, but just hangs. This is for a simple minispy-like
filter.

The computer continued to run fine, but the unload never completed. The one
thing that might have changed on his server is he added Microsoft’s Data
Protection Manager system and the DPM filter was loaded, though we don’t
really know yet if it’s at all related (it’s a production server so limited
ability to poke at it).

What sort of thing could cause fltmc to hang?

Thanks

Doug

2

The mini-filter is stuck in the FilterUnloadCallback (or something it
calls). Only way to figure out what’s gone wrong is to debug it.

Philip D. Barila (303) 776-1264

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doug Nebeker
Sent: Friday, March 18, 2011 3:04 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Minifilter unload hang

A customer came upon the first instance of this that I’ve ever seen:

fltmc.exe unload {filter}

doesn’t return an error, but just hangs. This is for a simple minispy-like
filter.

The computer continued to run fine, but the unload never completed. The one
thing that might have changed on his server is he added Microsoft’s Data
Protection Manager system and the DPM filter was loaded, though we don’t
really know yet if it’s at all related (it’s a production server so limited
ability to poke at it).

What sort of thing could cause fltmc to hang?

Thanks

Doug

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

Can you tell me:

  1. Which OS is this?

  2. Is you minifilter having start type 1?

  3. If you type fltmc, does your minifilter show up right below
    DPMFilter?

I had run into a similar issue with DPMFilter.

Regards,

Ayush Gupta

Software Consultant & Owner,

AI Consulting

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doug Nebeker
Sent: Saturday, March 19, 2011 2:34 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Minifilter unload hang

A customer came upon the first instance of this that I’ve ever seen:

fltmc.exe unload {filter}

doesn’t return an error, but just hangs. This is for a simple minispy-like
filter.

The computer continued to run fine, but the unload never completed. The one
thing that might have changed on his server is he added Microsoft’s Data
Protection Manager system and the DPM filter was loaded, though we don’t
really know yet if it’s at all related (it’s a production server so limited
ability to poke at it).

What sort of thing could cause fltmc to hang?

Thanks

Doug

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

4

Hi Ayush-

  1. Which OS is this?

I pretty sure it was Win2003 (should have written it down)

  1. Is you minifilter having start type 1?

It uses 3 - ie my service loads my filter when it is needed.

  1. If you type fltmc, does your minifilter show up right below DPMFilter?

Well, it showed up right below DPMFilter in the filter list. I hadn’t
noticed before if it’s sorted by altitude or not, but it appears it is on my
computer.

I had run into a similar issue with DPMFilter.

Were you able to do anything about it?

Thanks
Doug

5

I ran into an issue when start type was 1. Contacted MS and sent them a
dump, etc. Finally they concluded that it was a bug in filter manager on
Windows 2003. But I was able to work around it with start type 3. You need
to be loaded before DPMFilter to hit this bug. But who knows if you are
hitting the same thing.

Regards,
Ayush Gupta
Software Consultant & Owner,
AI Consulting.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doug Nebeker
Sent: Saturday, March 19, 2011 9:09 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Minifilter unload hang

Hi Ayush-

  1. Which OS is this?

I pretty sure it was Win2003 (should have written it down)

  1. Is you minifilter having start type 1?

It uses 3 - ie my service loads my filter when it is needed.

  1. If you type fltmc, does your minifilter show up right below DPMFilter?

Well, it showed up right below DPMFilter in the filter list. I hadn’t
noticed before if it’s sorted by altitude or not, but it appears it is on my
computer.

I had run into a similar issue with DPMFilter.

Were you able to do anything about it?

Thanks
Doug

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

6

Thanks for the information Ayush. I’ll see if I can figure out the load
order.

Do you happen to have anything (KB article ID, etc?) where I could look up
more about this?

Doug

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ayush Gupta
Sent: Saturday, March 19, 2011 12:38 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Minifilter unload hang

I ran into an issue when start type was 1. Contacted MS and sent them a
dump, etc. Finally they concluded that it was a bug in filter manager on
Windows 2003. But I was able to work around it with start type 3. You need
to be loaded before DPMFilter to hit this bug. But who knows if you are
hitting the same thing.

Regards,
Ayush Gupta
Software Consultant & Owner,
AI Consulting.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doug Nebeker
Sent: Saturday, March 19, 2011 9:09 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Minifilter unload hang

Hi Ayush-

  1. Which OS is this?

I pretty sure it was Win2003 (should have written it down)

  1. Is you minifilter having start type 1?

It uses 3 - ie my service loads my filter when it is needed.

  1. If you type fltmc, does your minifilter show up right below DPMFilter?

Well, it showed up right below DPMFilter in the filter list. I hadn’t
noticed before if it’s sorted by altitude or not, but it appears it is on my
computer.

I had run into a similar issue with DPMFilter.

Were you able to do anything about it?

Thanks
Doug

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer