OK, your right! how can I rename file? and in which dispatcher?
>how can I rename file?
FltSetInformationFile with a FILE_RENAME_INFORMATION.
and in which dispatcher?
IRP_MJ_CREATE and IRP_MJ_SET_INFORMATION. See initial reply.
I suggest you start out with the filespy sample. Then modify it to list
files that are being deleted, list every time a file has a delete flag
getting set or cleared. Then you get a good idea of the type of activity
your filter will be exposed to.
//Daniel
finally what I must do with this list?