Unload/Remove FSFD

Hi All,
I want to know how to remove(unload) file system filter driver
from memory?
Regards,
Medha.

Reboot or shut down the system:-)
Unloading it otherwise will “probably” bring the system down. You
can do it in a debug build but don’t do it in a release build.
The driver would unload just like any other driver, via DriverUnload
routine. Only there is no guarantee that no driver code will be called
after unload completes, thus crashing the system.

I want to know how to remove(unload) file system filter driver from
memory?


Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32
developers.

Hi,
Thanks for the information.
But is there any way to unload the FSFD without rebooting the
system?
Regards,
Medha.

On Mon, 16 Sep 2002 Dejan Maksimovic wrote :

Reboot or shut down the system:-)
Unloading it otherwise will “probably” bring the system
down. You
can do it in a debug build but don’t do it in a release build.
The driver would unload just like any other driver, via
DriverUnload
routine. Only there is no guarantee that no driver code will be
called
after unload completes, thus crashing the system.

> I want to know how to remove(unload) file system filter driver
from
> memory?


Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32
developers.
Alfa File Protector - File protection and hiding library for
Win32
developers.


You are currently subscribed to ntfsd as:
xxxxx@rediffmail.com
To unsubscribe send a blank email to
%%email.unsub%%

Its not safe to do. Still if you want to support this feature, then you need
to support unloadDriver call.
You can use net start/stop to load and unload the driver.

look at the sample driver from sysinternals.com.

thanks

-----Original Message-----
From: Medha [mailto:xxxxx@rediffmail.com]
Sent: Monday, September 16, 2002 10:00 PM
To: File Systems Developers
Subject: [ntfsd] Re: Unload/Remove FSFD

Hi,
Thanks for the information.
But is there any way to unload the FSFD without rebooting the
system?
Regards,
Medha.

On Mon, 16 Sep 2002 Dejan Maksimovic wrote :

Reboot or shut down the system:-)
Unloading it otherwise will “probably” bring the system
down. You
can do it in a debug build but don’t do it in a release build.
The driver would unload just like any other driver, via
DriverUnload
routine. Only there is no guarantee that no driver code will be
called
after unload completes, thus crashing the system.

> I want to know how to remove(unload) file system filter driver
from
> memory?


Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32
developers.
Alfa File Protector - File protection and hiding library for
Win32
developers.


You are currently subscribed to ntfsd as:
xxxxx@rediffmail.com
To unsubscribe send a blank email to
%%email.unsub%%


You are currently subscribed to ntfsd as: xxxxx@Legato.COM
To unsubscribe send a blank email to %%email.unsub%%

if you just want your fsfd not to interfere with normal operations, maybe
you can write some code in the fsfd to bypass request through some setting.

i think that’s how anti-virus s/w works. when you disable it, it will bypass
but not unload.

Ho Mun Chuen
@@ “Not everything that counts can be counted;
<” )~ and not everything that can be counted counts"
//\ … Albert Einstein
----- Original Message -----
From: “Medha”
To: “File Systems Developers”
Sent: Tuesday, September 17, 2002 1:00 PM
Subject: [ntfsd] Re: Unload/Remove FSFD

Hi,
Thanks for the information.
But is there any way to unload the FSFD without rebooting the
system?
Regards,
Medha.

On Mon, 16 Sep 2002 Dejan Maksimovic wrote :
>
> Reboot or shut down the system:-)
> Unloading it otherwise will “probably” bring the system
>down. You
>can do it in a debug build but don’t do it in a release build.
> The driver would unload just like any other driver, via
>DriverUnload
>routine. Only there is no guarantee that no driver code will be
>called
>after unload completes, thus crashing the system.
>
> > I want to know how to remove(unload) file system filter driver
> from
> > memory?
>
>–
>Kind regards, Dejan M. www.alfasp.com
>E-mail: xxxxx@alfasp.com ICQ#: 56570367
>Alfa File Monitor - File monitoring library for Win32
>developers.
>Alfa File Protector - File protection and hiding library for
>Win32
>developers.
>
>
>
>
>—
>You are currently subscribed to ntfsd as:
>xxxxx@rediffmail.com
>To unsubscribe send a blank email to
>%%email.unsub%%


You are currently subscribed to ntfsd as: xxxxx@pmail.ntu.edu.sg
To unsubscribe send a blank email to %%email.unsub%%

Hi all,
thanks for the information.
I will check with it.
Regards,
Medha.

On Tue, 17 Sep 2002 Ho Mun Chuen wrote :

if you just want your fsfd not to interfere with normal
operations, maybe
you can write some code in the fsfd to bypass request through
some setting.

i think that’s how anti-virus s/w works. when you disable it, it
will bypass
but not unload.

Ho Mun Chuen
@@ “Not everything that counts can be counted;
<” )~ and not everything that can be counted counts"
//\ … Albert Einstein
----- Original Message -----
From: “Medha”
>To: “File Systems Developers”
>Sent: Tuesday, September 17, 2002 1:00 PM
>Subject: [ntfsd] Re: Unload/Remove FSFD
>
>
>Hi,
>Thanks for the information.
>But is there any way to unload the FSFD without rebooting the
>system?
>Regards,
>Medha.
>
>On Mon, 16 Sep 2002 Dejan Maksimovic wrote :
> >
> > Reboot or shut down the system:-)
> > Unloading it otherwise will “probably” bring the system
> >down. You
> >can do it in a debug build but don’t do it in a release
>build.
> > The driver would unload just like any other driver, via
> >DriverUnload
> >routine. Only there is no guarantee that no driver code will
>be
> >called
> >after unload completes, thus crashing the system.
> >
> > > I want to know how to remove(unload) file system filter
>driver
> > from
> > > memory?
> >
> >–
> >Kind regards, Dejan M. www.alfasp.com
> >E-mail: xxxxx@alfasp.com ICQ#: 56570367
> >Alfa File Monitor - File monitoring library for Win32
> >developers.
> >Alfa File Protector - File protection and hiding library for
> >Win32
> >developers.
> >
> >
> >
> >
> >—
> >You are currently subscribed to ntfsd as:
> >xxxxx@rediffmail.com
> >To unsubscribe send a blank email to
> >%%email.unsub%%
>
>
>
>
>
>—
>You are currently subscribed to ntfsd as:
>xxxxx@pmail.ntu.edu.sg
>To unsubscribe send a blank email to %%email.unsub%%
>
>
>
>—
>You are currently subscribed to ntfsd as:
>xxxxx@rediffmail.com
>To unsubscribe send a blank email to
>%%email.unsub%%

Didnt he just responded to your question ?

----- Original Message -----
From: “Medha”
To: “File Systems Developers”
Sent: Tuesday, September 17, 2002 8:00 AM
Subject: [ntfsd] Re: Unload/Remove FSFD

> Hi,
> Thanks for the information.
> But is there any way to unload the FSFD without rebooting the
> system?
> Regards,
> Medha.
>
> On Mon, 16 Sep 2002 Dejan Maksimovic wrote :
> >
> > Reboot or shut down the system:-)
> > Unloading it otherwise will “probably” bring the system
> >down. You
> >can do it in a debug build but don’t do it in a release build.
> > The driver would unload just like any other driver, via
> >DriverUnload
> >routine. Only there is no guarantee that no driver code will be
> >called
> >after unload completes, thus crashing the system.
> >
> > > I want to know how to remove(unload) file system filter driver
> > from
> > > memory?
> >
> >–
> >Kind regards, Dejan M. www.alfasp.com
> >E-mail: xxxxx@alfasp.com ICQ#: 56570367
> >Alfa File Monitor - File monitoring library for Win32
> >developers.
> >Alfa File Protector - File protection and hiding library for
> >Win32
> >developers.
> >
> >
> >
> >
> >—
> >You are currently subscribed to ntfsd as:
> >xxxxx@rediffmail.com
> >To unsubscribe send a blank email to
> >%%email.unsub%%
>
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to %%email.unsub%%
>

You didn’t read…
'> The driver would unload just like any other driver, via

DriverUnload
routine. Only there is no guarantee that no driver code will be
called
after unload completes, thus crashing the system.

"
So, register your DriverUnload (set DriverObject->DriverUnload to
MyDriverUnload in your DriverEntry), and do any / all cleanup in
MyDriverUnload.
Once again - this is likely to cause crashes in (I don’t know how
many % of) cases.

Medha wrote:

But is there any way to unload the FSFD without rebooting the system?


Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32
developers.

Hi all,
Thanks all of you.
I will check by writing driver unload routine.
Regards,
Medha.

On Tue, 17 Sep 2002 Dejan Maksimovic wrote :

You didn’t read…
'> The driver would unload just like any other driver, via
>DriverUnload
>routine. Only there is no guarantee that no driver code will
be
>called
>after unload completes, thus crashing the system.
>
"
So, register your DriverUnload (set
DriverObject->DriverUnload to
MyDriverUnload in your DriverEntry), and do any / all cleanup
in
MyDriverUnload.
Once again - this is likely to cause crashes in (I don’t
know how
many % of) cases.

Medha wrote:

> But is there any way to unload the FSFD without rebooting the
system?


Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32
developers.
Alfa File Protector - File protection and hiding library for
Win32
developers.


You are currently subscribed to ntfsd as:
xxxxx@rediffmail.com
To unsubscribe send a blank email to
%%email.unsub%%