Symantec 10 fix

NTFSD
1

Initial testing with Symantec 10.0.1.1000 indicates
that the reentrant create that was causing my filter
grief is now fixed.

Thank you Symantec!

Just wanted to post this here because apparently this
was fixed in July and I didn’t know about it.
Hopefully it’s useful info for someone else.

2

This is what I observed in version 10. They now are using the original
IRP_MJ_CREATE Irp to obtain a fileobject for their use in scanning. Whereas
in earlier versions they generated a new open request on the file, causing
the re-entrant issue that you observed.

Though they are still holding a per file lock while this open request is
outstanding, thus if another AV product, or some other system, tries to open
the file again from, say, user mode, well they’re hosed.

Why can’t we just all get along!

Pete

Kernel Drivers
Windows Filesystem and Device Driver Consulting
www.KernelDrivers.com
(303)546-0300

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Randy Cook
Sent: Friday, October 07, 2005 11:17 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Symantec 10 fix

Initial testing with Symantec 10.0.1.1000 indicates
that the reentrant create that was causing my filter
grief is now fixed.

Thank you Symantec!

Just wanted to post this here because apparently this
was fixed in July and I didn’t know about it.
Hopefully it’s useful info for someone else.

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Hi,

It will be good if you can elobarate on how it help you and your product.

Also if possible please share the differences that you observed in Symantec
10.0 from Symantec 10.0

Thanks,
Kedar.

“Randy Cook” wrote in message news:xxxxx@ntfsd…
> Initial testing with Symantec 10.0.1.1000 indicates
> that the reentrant create that was causing my filter
> grief is now fixed.
>
> Thank you Symantec!
>
> Just wanted to post this here because apparently this
> was fixed in July and I didn’t know about it.
> Hopefully it’s useful info for someone else.
>

4

Your filter must be prepared to be reentered with a
create request when you send down a create below you.

The fact that Symantec changed their behavior means
nothing. There is still other software out there that
does this.

— kedar wrote:

> Hi,
>
> It will be good if you can elobarate on how it help
> you and your product.
>
> Also if possible please share the differences that
> you observed in Symantec
> 10.0 from Symantec 10.0
>
> Thanks,
> Kedar.
>
> “Randy Cook” wrote in message
> news:xxxxx@ntfsd…
> > Initial testing with Symantec 10.0.1.1000
> indicates
> > that the reentrant create that was causing my
> filter
> > grief is now fixed.
> >
> > Thank you Symantec!
> >
> > Just wanted to post this here because apparently
> this
> > was fixed in July and I didn’t know about it.
> > Hopefully it’s useful info for someone else.
> >
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>