For the Windows 9x driver, the heart ofFileMonis in the virtual device driver: Filevxd.vxd.It is dynamically loaded, and, on initialization, it installs a file system filter via the VxD service,IFSMGR_InstallFileSystemApiHook, to insert itself onto the call chain of all file system request...
1.4RegMon download site RegMonDownload (x86 – 72 KB) – you plan on using Regmon on WinNT/2K/XP