I am developing a FSD based on RDBSSLIB.lib. On some machines, I see
100% CPU when I start up Ladislav’s filespy.exe and Norton Antivirus
10.0 (which incidentally also has a filter called EraseUtilxxx.sys). My
FSD driver isn’t getting called at the time CPU goes 100%. I tried to
find more information about this problem from the archives but haven’t
been successful so far. This occurs very often on XP machines. What
could be going wrong ? This looks like it’s happening on when my FSD has
started, but I’m not in the loop when the problem occurs.
Here is what I have in terms of a stack trace from windbg when I run
filespy. I’m assuming at this point that Norton antivirus also has the
same problem.
f970995c 804e8452 nt!DbgBreakPointWithStatus+0x4
f97099d0 8050a9f6 nt!IoGetAttachedDevice+0xd
f97099e8 8050b1ee nt!InbvNotifyDisplayOwnershipLost+0x1ea
f97099fc b193244e nt!IoAttachDeviceToDeviceStackSafe+0x13
f9709afc b192fbc4 FSpy+0x844e
f9709be0 805e3cbf FSpy+0x5bc4
f9709bf8 805ce8f2 nt!IoCheckFunctionAccess+0x3d98
f9709c18 b1932cb0 nt!IoRegisterFsRegistrationChange+0x6a
f9709c7c 805a0799 FSpy+0x8cb0
f9709d4c 805a0a6e nt!IoWMIOpenBlock+0xefd
f9709d74 804e426b nt!IoWMIOpenBlock+0x11d2
f9709dac 8057be15 nt!ExQueueWorkItem+0x104
f9709ddc 804fa4da nt!PsCreateSystemThread+0x70
00000000 00000000 nt!KeInitializeTimer+0x107
After a long wait (15 minutes) I also got the following debug out on
windbg from filespy.
FileSpy!SpyAttachToFileSystemDevice: Error creating volume device object
for “\Device\VkFSDrv”, status=c000009a
FileSpy!SpyAttachToFileSystemDevice: Error creating volume device object
for “\Device\RdpDr”, status=c000009a
Also, does anyone know if filespy uses the sample filter from the DDK as
is ?
Thanks for any help offered.