Reply to thread

Message

<blockquote data-quote="Libera Milanesi" data-source="post: 759289" data-attributes="member: 74385">I did read your post. Then I quoted your post and explained to you how it really works.You can find the post here: <a href="https://malwaretips.com/threads/default-deny-vs-traditional-avs.86147/post-759187" target="_blank">Discuss - Default Deny VS traditional AVs</a>If you&#039;re interesting in educating yourself further, read the following from the official documentation:<a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/fltkernel/nf-fltkernel-fltregisterfilter" target="_blank">FltRegisterFilter function</a><a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/fltkernel/nf-fltkernel-fltstartfiltering" target="_blank">FltStartFiltering function</a><a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/fltkernel/ns-fltkernel-_flt_registration" target="_blank">_FLT_REGISTRATION</a><a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/fltkernel/ns-fltkernel-_flt_operation_registration" target="_blank">_FLT_OPERATION_REGISTRATION</a><a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/irp-mj-create" target="_blank">IRP_MJ_CREATE</a><a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/irp-mj-write" target="_blank">IRP_MJ_WRITE</a><a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/fltkernel/nc-fltkernel-pflt_pre_operation_callback" target="_blank">PFLT_PRE_OPERATION_CALLBACK</a><a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/fltkernel/nc-fltkernel-pflt_post_operation_callback" target="_blank">PFLT_POST_OPERATION_CALLBACK</a>There&#039;s more documentation and pointers if you seek it on MSDN and on other forums.&nbsp;I think the words &quot;Thank you&quot; were in order, but that&#039;s okay, I can live with it.</blockquote>

[QUOTE="Libera Milanesi, post: 759289, member: 74385"] I did read your post. Then I quoted your post and explained to you how it really works. You can find the post here: [URL='https://malwaretips.com/threads/default-deny-vs-traditional-avs.86147/post-759187']Discuss - Default Deny VS traditional AVs[/URL] If you're interesting in educating yourself further, read the following from the official documentation: [URL='https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/fltkernel/nf-fltkernel-fltregisterfilter']FltRegisterFilter function[/URL] [URL='https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/fltkernel/nf-fltkernel-fltstartfiltering']FltStartFiltering function[/URL] [URL='https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/fltkernel/ns-fltkernel-_flt_registration']_FLT_REGISTRATION[/URL] [URL='https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/fltkernel/ns-fltkernel-_flt_operation_registration']_FLT_OPERATION_REGISTRATION[/URL] [URL='https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/irp-mj-create']IRP_MJ_CREATE[/URL] [URL='https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/irp-mj-write']IRP_MJ_WRITE[/URL] [URL='https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/fltkernel/nc-fltkernel-pflt_pre_operation_callback']PFLT_PRE_OPERATION_CALLBACK[/URL] [URL='https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/fltkernel/nc-fltkernel-pflt_post_operation_callback']PFLT_POST_OPERATION_CALLBACK[/URL] There's more documentation and pointers if you seek it on MSDN and on other forums. I think the words "Thank you" were in order, but that's okay, I can live with it. [/QUOTE]

Verification