Hi all,
I’m trying to write an anti-virus which scans file’s content when file operations are performed on them.
I’ve followed the avscan sample of Microsoft and added some stuff of my own.
The Microsoft sample scans the file when it is opened (IRP_MJ_CREATE) and when it is closed if the file was modified (IRP_MJ_CLEANUP).
After running the sample multiple times I witnessed the performance hit caused by this minifilter, since it scans almost every opened file.
Any ideas how to minimize the performance hit?