Hello,
I have been working on a prototype filter driver and have recently been testing it on systems with different antivirus products installed. I haven’t seen any issues until I tested against Avast Antivirus on Windows XP.
Here is a little description of the prototype and the how it has been working.
I have a control app which first communicates with the driver and tells it what file to track. The control app then opens the file and the driver recognizes that the control app is opening the file and so it sets a completion routing for the IRP_MJ_CREATE to try and flush the cache for the file:
if (pfileObject->SectionObjectPointer != NULL)
{
CcFlushCache(pfileObject->SectionObjectPointer, NULL, 0, NULL);
if (pfileObject->SectionObjectPointer->ImageSectionObject != NULL)
{
MmFlushImageSection(pfileObject->SectionObjectPointer, MmFlushForWrite);
}
if (pfileObject->SectionObjectPointer->DataSectionObject != NULL)
{
CcPurgeCacheSection(pfileObject->SectionObjectPointer, NULL, 0, TRUE);
}
CcUninitializeCacheMap(pfileObject, 0, NULL);
}
The controlling app then launches another process which will open up the tracked file. Under normal circumstances, including on systems with Norton, Mcafee, or AVG running, the driver will then see IRP_MJ_READ with IRP_NOCACHE and IRP_PAGING_IO flags set.
This is not the case with Avast on Windows XP. I do not see any IRP_MJ_READS nor any FastIO reads. Note, that it works fine on Windows 2000 with Avast running.
On XP if I stop Avasts “Standard Shield” provider, then it works as normal. Once the “Standard Shield” is restarted, the driver does not see the reads for the tracked file.
Can anyone help shed some light as to what is going on or tips on how to debug this issue further.
Any help would be greatly appreciated.
Sincerely,
Steve