Hello guys!
I faced with problem in my file system minifilter when Kaspersky Endpoint Security 10 installed on PS : function FltGetFileNameInformation() return in all callback’s (IRP_MJ_CREATE,IRP_MJ_DIRECTORY_CONTROL) STATUS_FLT_INVALID_NAME_REQUEST!
I suppose problem in klvfs.sys (FSFilter Encryption), because when I stop this driver FltGetFileNameInformation() return STATUS_SUCCESS.
What could be the problem?
Kaspersky, like most AV but probably more so, is known to do questionable things to a system which makes interoperability difficult. If their leaked code from a few years ago is any indication, the newer stuff is still crap.
Anyway, is klvfs.sys the only Kaz driver loaded or is there an upper level filter as well? What hooks (UM and KM (assuming you’re x86)) are in place with the driver. I’m just guessing here but it’s probably trying to validate the request came from a “trusted” process but because it’s coming direct from kernel space it denies it.