Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
Tim Roberts, [email protected]
Providenza & Boekelheide, Inc.
It is an idea, not a solution: MAAAYYYY BE you can track the FILE_OBJECT that loads a file a check when an IRP_CLOSE reaches to the object.
It looks like you're new here. If you want to get involved, click one of these buttons!