Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 0 down vote favorite

There is one error happening in one of my local machines (3 machines), which remains unsolved for me.

I'm running Microsoft Windows XP SP3, all latest updates and the error happens on attempts to do something with .lst or .ver files.

On any attempt to access them and Invalid memory access error is triggered (code 998). Also, if you rename any existant file into a .lst or .ver file, it becomes inaccessible.

Now, I could simply restore the working state of my machine (I've got backups), but this error seems interesting to me and I really want to solve it.

P.S There are people with the same error in the internet, but looks like it still remains unsolved.

Another P.S My first thoughts were about some sophisticated rootkit, which for some reasons was injecting it's code into the file reading calls, but my rootkit checks were unsuccessful.

share|improve this question
Do you have .lst and .ver under Hkey_classes_root? I noticed they were there on win 7 with no sub keys but nonexistent on fresh xp sp3 install... if so is there anything set to launch with those extensions? – Kyle May 23 '11 at 20:59

1 Answer

up vote 0 down vote

Thanks everybody, this was a trojan, which was actually hooking my NtFileXXX calls.

They were redirected to C:\Windows\lsacc.sys.

share|improve this answer
1  
Sounds evil, any info on what you did to clear the infection? – Mokubai May 23 '11 at 21:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.