存在另一个WFP的WFP x64出现问题 [英] Problem with WFP x64 with another WFP present

问题描述

我正在尝试解决与其他AV产品的冲突，他们正在使用WFP，问题是在重启后x64上我的WFP会不再为ALE_CONNECT_REDIRECT获取任何事件，但是如果我重新启动我的WFP，它将再次运行。

I'm trying to solve a conflict with another AV product, they are using WFP, and the problem is that on x64 after a reboot my WFP will no longer get any events for ALE_CONNECT_REDIRECT, but if I restart my WFP, it will work again.

我已经做了一些测试来缩小问题范围并发现它在重启后会起作用在带有AV存在的x86上，并且在没有AV存在的情况下重新启动x86和x64后将工作。在AV存在AV的x64上，加载
驱动程序时没有启动时间错误。

I've done some tests to narrow down the problem and found that it will work after reboot on x86 with the AV present, and will work after reboot on x86 and x64 without the AV present. On x64 when the AV is present there are no boot time errors while loading the driver.

我可以在检测到此AV时停止/启动WFP但我更愿意找到问题的原因，你有想法/线索在哪里寻找。

I can do a work around to stop/start the WFP when this AV is detected but I prefer to find the cause of the problem, do you have ideas/clues where to look for.

谢谢，

Barak

推荐答案

你是什么意思没有事件？ 你的意思是你的标注不再被调用了？ 你之前的另一个AV重定向吗？

What do you mean you get no events?  You mean that your callout is no longer getting invoked?  does the other AV redirect before you?

过滤器的权重是多少？ 他们都在同一个子层中吗？ 如果没有，子层的权重是多少？

What are the weights of the filters?  are they all in the same sublayer?  if not, what are the weights of the sublayers?

这篇关于存在另一个WFP的WFP x64出现问题的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！