Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There is one error happening in one of my local machines (3 machines), which remains unsolved for me.

I'm running Microsoft Windows XP SP3, all latest updates and the error happens on attempts to do something with .lst or .ver files.

On any attempt to access them and Invalid memory access error is triggered (code 998). Also, if you rename any existant file into a .lst or .ver file, it becomes inaccessible.

Now, I could simply restore the working state of my machine (I've got backups), but this error seems interesting to me and I really want to solve it.

P.S There are people with the same error in the internet, but looks like it still remains unsolved.

Another P.S My first thoughts were about some sophisticated rootkit, which for some reasons was injecting it's code into the file reading calls, but my rootkit checks were unsuccessful.

share|improve this question
Do you have .lst and .ver under Hkey_classes_root? I noticed they were there on win 7 with no sub keys but nonexistent on fresh xp sp3 install... if so is there anything set to launch with those extensions? – Not Kyle stop stalking me May 23 '11 at 20:59

Thanks everybody, this was a trojan, which was actually hooking my NtFileXXX calls.

They were redirected to C:\Windows\lsacc.sys.

share|improve this answer
Sounds evil, any info on what you did to clear the infection? – Mokubai May 23 '11 at 21:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .