Controling access to HDD
 

Hi all
As you seen yet,a Lot of anti-viruses perform a virus checking on anyfile being copied from a place to other one and if there was a virus the file will not be copied.
Here is my question:
How they intercept access to hard disk for preforming this check?
A simple Hooking,or a filter driver for file system or anything else?
Do you have a sample code that do this in low level?

sincerely yours

look for example on filemon source code

Samples in Windows IFS Kit and DDK 3790 can help you too ...