Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Minifilter - Scan any files added to your pc

jay96612jay96612 Member Posts: 57

I am making a program that basically scans any new files downloaded to my PC. I just want to scan only after the file is completely downloaded to the PC. I have gone through the Avscan minifilter examples but it scans any file opened. So even if a file is downloading, it scans while downloading as well because chrome/firefox opens the file for modification while downloading. So how can scan just after the file is completely downloaded.

What I have tried so far -
I have used a file watcher to detect any new files.
Whenever a file is downloaded from chrome then the following happens :

For example: Let's say a pdf file is being downloaded.

  • .tmp file created first

  • .tmp file is renamed to .crdownload

  • .crdownload is modified multiple times

  • .crdownload file is renamed to .pdf

  • .pdf file is modified multiple times.

The problem is when can I say a file is completely downloaded because it is modified multiple times after renaming from .crdownload to .pdf file.

Once become sure that the file is completely downloaded then we can scan the file.
So how can we be sure that file is completely downloaded?
After that, if anyone opens the file then we can use Avscan to scan the data in the file.

Any help I am looking for from the great community.
Thanks a lot.

Comments

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 January 2023 Live, Online
Developing Minifilters 20 March 2023 Live, Online
Writing WDF Drivers TBD 2023 Live, Online
Internals & Software Drivers 17 April 2023 Live, Online