Has anyone worked on a filesystem minifilter driver for ClamWin?

I am interested in writing one as a personal first time kernel-mode programming challenge.

It doesn't look too hard, just hooking file opens and memory pagings that have an executable flag. Or would you rather have it check all files (or only files that are being saved)? I'm not sure what commercial AV's do.

Also what would be better for you guys, a user mode service written in python or C?

C will be faster but I can't see why the service side of a real time scanner can't be done in python.

Hi,

we have a usermode service in svn, look for clamwind (c++).

It would be great if you could help us with the minifilter. Please email me at alex [at] clamwin.com and we will discuss the details.

Cheers,
Alch

Did you get my email?