FILEINFO.SYS

Is there any information about which is the purpose of this MS driver: FILEINFO.SYS.
It is described as: Microsoft FileInfo Filter Driver. Not too descriptive.

I have found that it crashes sometimes when it calls FltClose from the function FIPfInterfaceClose and was trying to guess why.

Inaki.

My observation is that it appears to be related to the prefetcher. If this
started happening to me my instinct would be to ensure that I wasn’t closing
files under its feet by accident.

What does the crash look like?

Yes in the high stack I can see the component ‘sysmain’ which is in charge of prefetching. The problem happend right after I unload my minifilter. The function where the crash happens is ObpCloseHandle. This function calls KeBugCheck if the handle is invalid, it is a kernel handle and there is a debugger behind (that is, the bugcheck does not occur on free-run mode). Although the thing actually looks like I am closing the handle already, I cannot figure out in which case I am closing it out. Perhaps have you encountered this problem yourself?

You have run under verifier (and verifier for fltmgr), posibly even used a
checked version of fltmgr? Its good at finding pointers to this sort of
thing.

wrote in message news:xxxxx@ntfsd…
> Yes in the high stack I can see the component ‘sysmain’ which is in charge
> of prefetching. The problem happend right after I unload my minifilter.
> The function where the crash happens is ObpCloseHandle. This function
> calls KeBugCheck if the handle is invalid, it is a kernel handle and there
> is a debugger behind (that is, the bugcheck does not occur on free-run
> mode). Although the thing actually looks like I am closing the handle
> already, I cannot figure out in which case I am closing it out. Perhaps
> have you encountered this problem yourself?
>
>