problems with IoRegisterFsRegistrationChange with Symantec

NTFSD
1

Hi,

I have a legacy file system filter driver on Windows XP which attaches
dynamically to file system and the start type is SERVICE_SYSTEM_START. The
filter driver is getting notifications for USB removable drives when
Symantec anti virus is not installed but my filter driver is not getting
notification when Symantec anti virus is not installed.

But if I change the start type to SERVICE_BOOT_START my filter driver gets
the notifications but I want my filter start type to be
SERVICE_SYSTEM_START. Does anyone have any idea why this strange behaiovr is
happening with Symantec AV.

any information would be appreciated.

thanks,
Kedar.

2

I think no ways. All non-FltMgr old-style FSFs must be Boot start.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Kedar”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Sunday, July 16, 2006 11:10 AM
Subject: [ntfsd] problems with IoRegisterFsRegistrationChange with Symantec

> Hi,
>
> I have a legacy file system filter driver on Windows XP which attaches
> dynamically to file system and the start type is SERVICE_SYSTEM_START. The
> filter driver is getting notifications for USB removable drives when
> Symantec anti virus is not installed but my filter driver is not getting
> notification when Symantec anti virus is not installed.
>
> But if I change the start type to SERVICE_BOOT_START my filter driver gets
> the notifications but I want my filter start type to be
> SERVICE_SYSTEM_START. Does anyone have any idea why this strange behaiovr is
> happening with Symantec AV.
>
> any information would be appreciated.
>
> thanks,
> Kedar.
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Hi Maxim Shatskih,

But could you please tell me why it is so? and how does it work when
Symantec is not installed and does not work when Symantec is installed.

What I think OS supports the call even if the start type is system start
because it is working when symantec is not installed.

thanks,
Kedar.’

“Kedar” wrote in message news:xxxxx@ntfsd…
> Hi,
>
> I have a legacy file system filter driver on Windows XP which attaches
> dynamically to file system and the start type is SERVICE_SYSTEM_START.
> The filter driver is getting notifications for USB removable drives when
> Symantec anti virus is not installed but my filter driver is not getting
> notification when Symantec anti virus is not installed.
>
> But if I change the start type to SERVICE_BOOT_START my filter driver gets
> the notifications but I want my filter start type to be
> SERVICE_SYSTEM_START. Does anyone have any idea why this strange behaiovr
> is happening with Symantec AV.
>
> any information would be appreciated.
>
> thanks,
> Kedar.
>
>

4

Hi,

I found that when there are two drivers that are registered for FS
registration notification and one is of start type BOOT and other SYSTEM the
OS is not calling the driver whose start type is SYSTEM. But when both are
of tye SYSTEM OS calls both drivers.

Could any MS guys confirms this and is there is anyway to overcome this
problem.

thanks,
Kedar.

“Kedar” wrote in message news:xxxxx@ntfsd…
> Hi,
>
> I have a legacy file system filter driver on Windows XP which attaches
> dynamically to file system and the start type is SERVICE_SYSTEM_START.
> The filter driver is getting notifications for USB removable drives when
> Symantec anti virus is not installed but my filter driver is not getting
> notification when Symantec anti virus is not installed.
>
> But if I change the start type to SERVICE_BOOT_START my filter driver gets
> the notifications but I want my filter start type to be
> SERVICE_SYSTEM_START. Does anyone have any idea why this strange behaiovr
> is happening with Symantec AV.
>
> any information would be appreciated.
>
> thanks,
> Kedar.
>
>

5

Hi All,

sorry my last statement looks to be wrong and I see problem only when
symantec is installed.

thanks,
Kedar.
“Kedar” wrote in message news:xxxxx@ntfsd…
> Hi,
>
> I found that when there are two drivers that are registered for FS
> registration notification and one is of start type BOOT and other SYSTEM
> the OS is not calling the driver whose start type is SYSTEM. But when both
> are of tye SYSTEM OS calls both drivers.
>
> Could any MS guys confirms this and is there is anyway to overcome this
> problem.
>
> thanks,
> Kedar.
>
>
> “Kedar” wrote in message news:xxxxx@ntfsd…
>> Hi,
>>
>> I have a legacy file system filter driver on Windows XP which attaches
>> dynamically to file system and the start type is SERVICE_SYSTEM_START.
>> The filter driver is getting notifications for USB removable drives when
>> Symantec anti virus is not installed but my filter driver is not getting
>> notification when Symantec anti virus is not installed.
>>
>> But if I change the start type to SERVICE_BOOT_START my filter driver
>> gets the notifications but I want my filter start type to be
>> SERVICE_SYSTEM_START. Does anyone have any idea why this strange behaiovr
>> is happening with Symantec AV.
>>
>> any information would be appreciated.
>>
>> thanks,
>> Kedar.
>>
>>
>
>
>

6

Hi,
I think this call doesn’t depend from the start type. The OS has the only
one list( IopFsNotifyChangeQueueHead ) of registered notification routines
and I think the OS doesn’t make difference between the list entries.
You wrote that your filter did not receive notification for " USB removable
drives ", for me it sounds like a device plug in notification which doesn’t
relate with the FSD registration.

“Kedar” wrote in message news:xxxxx@ntfsd…
> Hi,
>
> I have a legacy file system filter driver on Windows XP which attaches
> dynamically to file system and the start type is SERVICE_SYSTEM_START.
> The filter driver is getting notifications for USB removable drives when
> Symantec anti virus is not installed but my filter driver is not getting
> notification when Symantec anti virus is not installed.
>
> But if I change the start type to SERVICE_BOOT_START my filter driver gets
> the notifications but I want my filter start type to be
> SERVICE_SYSTEM_START. Does anyone have any idea why this strange behaiovr
> is happening with Symantec AV.
>
> any information would be appreciated.
>
> thanks,
> Kedar.
>
>

7

You will not be able to properly attach to the SystemRoot volume if you are
not starting as Boot.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Kedar”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Sunday, July 16, 2006 11:27 AM
Subject: Re:[ntfsd] problems with IoRegisterFsRegistrationChange with Symantec

> Hi Maxim Shatskih,
>
> But could you please tell me why it is so? and how does it work when
> Symantec is not installed and does not work when Symantec is installed.
>
> What I think OS supports the call even if the start type is system start
> because it is working when symantec is not installed.
>
> thanks,
> Kedar.'
>
>
> “Kedar” wrote in message news:xxxxx@ntfsd…
> > Hi,
> >
> > I have a legacy file system filter driver on Windows XP which attaches
> > dynamically to file system and the start type is SERVICE_SYSTEM_START.
> > The filter driver is getting notifications for USB removable drives when
> > Symantec anti virus is not installed but my filter driver is not getting
> > notification when Symantec anti virus is not installed.
> >
> > But if I change the start type to SERVICE_BOOT_START my filter driver gets
> > the notifications but I want my filter start type to be
> > SERVICE_SYSTEM_START. Does anyone have any idea why this strange behaiovr
> > is happening with Symantec AV.
> >
> > any information would be appreciated.
> >
> > thanks,
> > Kedar.
> >
> >
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com