Hi!
we have developed a driver (using the minifilter) and all seems going pretty well on on all operating systems, from Windows 2000 all the way to Windows Vista x64 but – on Windows 2003 SP1 x86 the filter unload callback is not called when one tries “sc stop ”. It is called properly on on all other operating systems.
Our filter is fairly simple and, if in my unload routine (under 2003) I call my FilterUnload() to unregister the filter the driver quits w/o any memory leak.
two simple questions:
1) is the windows 2003 unload problem a know bug? i have searched around and have not found anything, which leads me to believe that it is not a bug but perhaps due to something else.
2) if the callback is not called and I call FltUnregisterFilter myself all seems ok but in practice i suspoect no. a user mode component we have crashes soon after we stop the driver, only in release mode of course 
driver compiled with ddk 3790.1830
cheers,
Marco
Does sc stop hang or does it return an error?
It is possible you have outstanding contexts or other allocates/referenced items.
xxxxx@beyondtrust.com wrote:
> Hi!
>
> we have developed a driver (using the minifilter) and all seems going pretty well on on all operating systems, from Windows 2000 all the way to Windows Vista x64 but – on Windows 2003 SP1 x86 the filter unload callback is not called when one tries “sc stop ”. It is called properly on on all other operating systems.
>
> Our filter is fairly simple and, if in my unload routine (under 2003) I call my FilterUnload() to unregister the filter the driver quits w/o any memory leak.
>
> two simple questions:
>
> 1) is the windows 2003 unload problem a know bug? i have searched around and have not found anything, which leads me to believe that it is not a bug but perhaps due to something else.
>
> 2) if the callback is not called and I call FltUnregisterFilter myself all seems ok but in practice i suspoect no. a user mode component we have crashes soon after we stop the driver, only in release mode of course
>
> driver compiled with ddk 3790.1830
>
> cheers,
>
> Marco
>
> —
> Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@alfasp.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
–
Kind regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.
what have you specified in flt registration structure? can u tell