I have been experimenting with a passive (i.e. it does nothing but ‘look’ at
the file calls) file system filter (my first) on Windows XP. I have noticed
several CREATEs coming through with bad paths. for example a Unicode string
buffer may look like this:
??\C:??\C:\Windows\System32\kbdus.dll
with the length member of the Unicode string including the entire string as
shown above.
All of these calls return 0xC0000033, STATUS_OBJECT_NAME_INVALID as they
should.
It seems that an extra ??\C: was prefix to the path.
If I ‘fix’ the path, I get a dialog box claiming that winlogon.exe can not
load the msgina.dll to log users in to the computer.
Has anyone else experienced this? Is this an XP bug?