So... I went and chased this down in MSDN....the Windows Driver Kit is mind-numbingly boring. :-)
Windows simply calls it "registering and unregistering a callback". An installable file system (IFS) driver is allowed to indicate (on initialization) whether it can be unregistered or not (that was a surprise to me - I thought unregistration was required, but apparently not). Further, on unregistration, the driver is allowed to indicate whether its DLL(s) should (can) be unloaded or not. (If they can't be unloaded, this is the "hanging code" I was referring to earlier.) And finally, if unregistration fails, Windows simply doesn't call the driver any more. (Also a situation with "hanging code".) Going back to Ben's original point - if the driver's author was lazy or under pressure to get a product out of the door - it may not be possible to unload the driver. And going back to Tom's original post - Ben's probably right - if the Sunbelt driver author had allowed for unregistration of the driver, the Sunbelt method would probably use it. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com -----Original Message----- From: Steven M. Caesare [mailto:[email protected]] Sent: Saturday, August 28, 2010 8:41 AM To: NT System Admin Issues Subject: RE: For you Vipre custoomers: Vipre unattended agent uninstall (more) I like the section entitled " OS/2 & Windows 16-bit address hack". :) -sc -----Original Message----- From: Michael B. Smith [mailto:[email protected]] Sent: Saturday, August 28, 2010 8:13 AM To: NT System Admin Issues Subject: RE: For you Vipre custoomers: Vipre unattended agent uninstall (more) I debated calling it a "shim", but after looking it up, decided that "thunk" was the better word. http://en.wikipedia.org/wiki/Thunk See the sections on "Thunks applied generically..." and "Thunks in Dynamic Linking". Compare and contrast to http://en.wikipedia.org/wiki/Shim_(computing) I didn't take the time to go hunt down the API to see exactly what it's called within the API. My bad. Consider that as an exercise for the reader. :-) Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com -----Original Message----- From: Steven M. Caesare [mailto:[email protected]] Sent: Saturday, August 28, 2010 1:02 AM To: NT System Admin Issues Subject: RE: For you Vipre custoomers: Vipre unattended agent uninstall (more) "Thunk" This used to be a term for managing the call from on "bitness" API to another (i.e.- Win16 to Win32) back in the day. Does it have another accepted meaning now? -sc -----Original Message----- From: Michael B. Smith [mailto:[email protected]] Sent: Friday, August 27, 2010 2:39 PM To: NT System Admin Issues Subject: RE: For you Vipre custoomers: Vipre unattended agent uninstall (more) You can thunk it, in Vista and above; to allow it to be removed from the active list (or replaced, if necessary). Yes, it leaves a little piece of hanging code; but it avoids the reboot requirement. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com -----Original Message----- From: Ben Scott [mailto:[email protected]] Sent: Friday, August 27, 2010 2:17 PM To: NT System Admin Issues Subject: Re: For you Vipre custoomers: Vipre unattended agent uninstall (more) On Fri, Aug 27, 2010 at 2:14 PM, Tom Miller <[email protected]> wrote: > Forgot to mention I don't want to use the Sunbelt tool since that > forces a reboot. So that tool is out. I don't think you can remove a filesystem filter driver on Windows without rebooting. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- You are currently subscribed to ntsysadmin as: [email protected]. To unsubscribe click here: http://lyris.sunbelt-software.com/u?id=8142875.a9cf90b99baa17cb4fcf8293a59eb3b1&n=T&l=ntsysadmin&o=9077629 or send a blank email to leave-9077629-8142875.a9cf90b99baa17cb4fcf8293a59eb...@lyris.sunbelt-software.com
