Don't hook the system calls, this is extremely dangerous and unsupported.
Also, what will you do for a driver that issues calls that bypass the system
calls? You are going to need a file system filter driver.
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply