Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Difference between the TmPreFilter and MiniFilter modes of the OfficeScan (OSCE) scan engine

    • Updated:
    • 12 Apr 2016
    • Product/Version:
    • OfficeScan 10.6
    • Platform:
    • Windows 2003 Enterprise
    • Windows 2003 Enterprise 64-bit
    • Windows 2003 Standard
    • Windows 2003 Standard 64-bit
    • Windows 2008 Enterprise
    • Windows 2008 Standard
    • Windows 7 32-bit
    • Windows 7 64-bit
    • Windows XP Professional
    • Windows XP Professional 64-bit
Summary

This article provides information about the difference between the TmPreFilter and MiniFilter modes of the OSCE scan engine.

Details
Public

TMprefilter and MiniFilter are the mechanisms to hook I/O events provided by Microsoft Windows.

TmPrefilter MiniFilter mode

MiniFilter mode is also known as Filter Manager mode. Filter Manager is a component of Microsoft Windows starting from XP SP2. It allows vendors who want to hook I/O events to register the MiniFilter driver as a plug-in. Filter Mangager will then dispatch I/O events to every MiniFilter driver.

For more information, refer to the following Microsoft article: Filter Manager Concepts.

Difference between running TmPrefilter in normal mode and MiniFilter-Mode

Normal mode is also known as legacy mode. Legacy filter driver is provided by Windows as another way to hook I/O events. Windows provided the legacy filter driver after Windows 2000.

For more information, refer to the this Microsoft article: Filter Manager Concepts.

Advantages and disadvantages of running TmPrefilter in MiniFilter-mode

In MiniFilter mode, Windows will handle the hooking of I/O events. Because MiniFilter is designed as plug and play, the MiniFilter driver can be unloaded. TmPreFilter running in MiniFilter mode can be updated without doing a reboot.

For more information, refer to the this Microsoft article: Advantages of the Filter Manager Model

Advantages and disadvantages of running TmPrefilter in normal mode

In legacy mode, the filter driver cannot be unloaded. TmPreFilter running in legacy mode has to perform a reboot after a driver update.

For more information, refer to the this Microsoft article: Guidelines for Porting Legacy Filter Drivers

When is it recommended to use the MiniFilter mode?

If tmprefilter needs to be unloaded, it is recommended to use the MiniFilter mode.

Why is it recommended to use the MiniFilter mode?

MiniFilter mode is a new way to hook I/O events. Although Windows supports both filter driver modes, it is highly recommended to use MiniFilter mode. Windows can do more checks in MiniFilter mode to ensure system stability.

Platform support for TmPrefilter in MiniFilter mode

MiniFilter mode is supported starting from Windows XP SP2.

Premium
Internal
Rating:
Category:
Configure
Solution Id:
1099667
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.


Need More Help?

Create a technical support case if you need further support.