BSOD due to base????32

John Doe

Thanx - I'll try that after I try Bart . . .

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:Oau%23zcbxIHA.4952@TK2MSFTNGP05.phx.gbl...
> From: "John Doe" <johndoe@microsoft.com>
>
> | There is some sort of infector going around that injects itself into the
> | boot sequence of XP that randomly names itself "base????32" (where the
> last
> | 4 or 5 letters are random, but the first 4 are always base & the last 2
> are
> | always 32) & causes the machine to fail on boot up because it cannot
> find
> | this file:
> |
> | STOP: c0000135 {Unable To Locate Component}
> | This application has failed to start because baseokfrf32 was not found.
> | Re-installing the application may fix this problem.
> |
> | This usually occurs after removing the winantivituspro infector (clearly
> the
> | anti-malware people haven't figured out how to remove this properly
> yet!).
> |
> | Any ideas on how to repair this issue without having to do an XP repair
> | install? Or where XP gets the command to look for the file? I can't
> seem
> | to find a "boot.sys" or any such file that references it, and obviously
> | can't go into the registry to look for it . . .
> |
> | I've tried going into the Recovery Console & doing fixboot, fixmbr,
> chkdsk
> | /p /r etc but no good.
> |
>
> Afterthought:
>
> Boot into the Windows Recovery Console and logon as the Administrator and
> then go to;
> %windir%\system32
>
> Copy; basesrv.dll to baseokfrf32.dll
>
> Then reboot the PC. See if that will allow the PC to load properly.
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
>
>

Malke

John Doe wrote:

> Thanx - I'll check out these resources. I shoulda mentioned, I cannot get
> into safe mode, last known good, or anything. I'll try a Bart PE build &
> see what that does for me; once I boot up using Bart, 1) how do I access
> the Registry, & 2) where am I looking to remove this offencer?

I think this is what you're looking for with a Bart's. With an ERD Commander
(old expensive software no longer available unfortunately since MS bought
Winternals) you can edit the host system directly. I think David Lipman
told you where to look, didn't he?

Registry - edit for other users (MVP Doug Knox)

From an account with Administrator level access

1) Click Start, Run and enter REGEDIT
2) In Regedit, highlight the HKEY_USERS key and go to File, Load Hive.
3) Use the File Open dialog to go to the Documents and Settings\<username>
folder, where <username> is the account you wish to modify.
4) Highlight the NTUSER.DAT file in this folder (usually a hidden file) and
select Open.
5) You'll be prompted to enter a "Key name". You can use whatever you wish,
but I use the User's logon name.
6) You can now expand the Hive you just loaded and make any needed changes.
7) When finished, highlight this Hive again and go to File, Unload Hive.

NOTE: You MUST unload the Hive prior to logging on to the users account.
Otherwise XP may have trouble loading the user's profile.

Malke
--
MS-MVP
Elephant Boy Computers
www.elephantboycomputers.com
Don't Panic!

John Doe

I'll try this as well. Still gotta put together a Bart CD, then try getting
in, then try findinh the registry file(s), etc . . .

"Malke" <malke@invalid.invalid> wrote in message
news:esaS0DdxIHA.4492@TK2MSFTNGP02.phx.gbl...
> John Doe wrote:
>
>> Thanx - I'll check out these resources. I shoulda mentioned, I cannot
>> get
>> into safe mode, last known good, or anything. I'll try a Bart PE build &
>> see what that does for me; once I boot up using Bart, 1) how do I access
>> the Registry, & 2) where am I looking to remove this offencer?
>
> I think this is what you're looking for with a Bart's. With an ERD
> Commander
> (old expensive software no longer available unfortunately since MS bought
> Winternals) you can edit the host system directly. I think David Lipman
> told you where to look, didn't he?
>
> Registry - edit for other users (MVP Doug Knox)
>
> From an account with Administrator level access
>
> 1) Click Start, Run and enter REGEDIT
> 2) In Regedit, highlight the HKEY_USERS key and go to File, Load Hive.
> 3) Use the File Open dialog to go to the Documents and Settings\<username>
> folder, where <username> is the account you wish to modify.
> 4) Highlight the NTUSER.DAT file in this folder (usually a hidden file)
> and
> select Open.
> 5) You'll be prompted to enter a "Key name". You can use whatever you
> wish,
> but I use the User's logon name.
> 6) You can now expand the Hive you just loaded and make any needed
> changes.
> 7) When finished, highlight this Hive again and go to File, Unload Hive.
>
> NOTE: You MUST unload the Hive prior to logging on to the users account.
> Otherwise XP may have trouble loading the user's profile.
>
> Malke
> --
> MS-MVP
> Elephant Boy Computers
> www.elephantboycomputers.com
> Don't Panic!

David H. Lipman

From: "John Doe" <johndoe@microsoft.com>

| I'll try this as well. Still gotta put together a Bart CD, then try getting
| in, then try findinh the registry file(s), etc . . .
|

The Recovery Console may get you there faster if you try my suggestion of copying the DLL.

"Boot into the Windows Recovery Console and logon as the Administrator and then go to;
%windir%\system32

Copy; basesrv.dll to baseokfrf32.dll

Then reboot the PC. See if that will allow the PC to load properly."

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

Kyle Johnson

I am having this same problem on a client's computer. It was infected with
WinAntiVirus Pro as well. The file it is referencing on this system is
basehoe32.

John, did you find a solution that worked for you?

"John Doe" wrote:

> There is some sort of infector going around that injects itself into the
> boot sequence of XP that randomly names itself "base????32" (where the last
> 4 or 5 letters are random, but the first 4 are always base & the last 2 are
> always 32) & causes the machine to fail on boot up because it cannot find
> this file:
>
> STOP: c0000135 {Unable To Locate Component}
> This application has failed to start because baseokfrf32 was not found.
> Re-installing the application may fix this problem.
>
> This usually occurs after removing the winantivituspro infector (clearly the
> anti-malware people haven't figured out how to remove this properly yet!).
>
> Any ideas on how to repair this issue without having to do an XP repair
> install? Or where XP gets the command to look for the file? I can't seem
> to find a "boot.sys" or any such file that references it, and obviously
> can't go into the registry to look for it . . .
>
> I've tried going into the Recovery Console & doing fixboot, fixmbr, chkdsk
> /p /r etc but no good.
>
>
>
>

Kyle Johnson

Nevermind, I got it working. Followed Lipman's post. I edited the registry
offline, System Hive, changed basehoe32 to basesrv in that particular
registry entry and voila!

Thank you!

BTW, I just pulled the drive, hooked it up to another computer and loaded
the System hive. No need for special software.

"Kyle Johnson" wrote:

> I am having this same problem on a client's computer. It was infected with
> WinAntiVirus Pro as well. The file it is referencing on this system is
> basehoe32.
>
> John, did you find a solution that worked for you?
>
> "John Doe" wrote:
>
> > There is some sort of infector going around that injects itself into the
> > boot sequence of XP that randomly names itself "base????32" (where the last
> > 4 or 5 letters are random, but the first 4 are always base & the last 2 are
> > always 32) & causes the machine to fail on boot up because it cannot find
> > this file:
> >
> > STOP: c0000135 {Unable To Locate Component}
> > This application has failed to start because baseokfrf32 was not found.
> > Re-installing the application may fix this problem.
> >
> > This usually occurs after removing the winantivituspro infector (clearly the
> > anti-malware people haven't figured out how to remove this properly yet!).
> >
> > Any ideas on how to repair this issue without having to do an XP repair
> > install? Or where XP gets the command to look for the file? I can't seem
> > to find a "boot.sys" or any such file that references it, and obviously
> > can't go into the registry to look for it . . .
> >
> > I've tried going into the Recovery Console & doing fixboot, fixmbr, chkdsk
> > /p /r etc but no good.
> >
> >
> >
> >

John Doe

Here's the ONLY solution that's worked for me so far (all the "Popular"
antimalware programs ignore this one so far):

Download combofix, vundofix, virtumondebegone, & SiRi's virtumonde removers,
then boot into safe mode, then run each of them, then boot from the OS
Install CD & do a "repair re-installation" of the OS< then do all the
updates.


"Kyle Johnson" <Kyle Johnson@discussions.microsoft.com> wrote in message
news643486D-5F25-4F5E-846E-A0C62C6A7175@microsoft.com...
>I am having this same problem on a client's computer. It was infected with
> WinAntiVirus Pro as well. The file it is referencing on this system is
> basehoe32.
>
> John, did you find a solution that worked for you?
>
> "John Doe" wrote:
>
>> There is some sort of infector going around that injects itself into the
>> boot sequence of XP that randomly names itself "base????32" (where the
>> last
>> 4 or 5 letters are random, but the first 4 are always base & the last 2
>> are
>> always 32) & causes the machine to fail on boot up because it cannot find
>> this file:
>>
>> STOP: c0000135 {Unable To Locate Component}
>> This application has failed to start because baseokfrf32 was not found.
>> Re-installing the application may fix this problem.
>>
>> This usually occurs after removing the winantivituspro infector (clearly
>> the
>> anti-malware people haven't figured out how to remove this properly
>> yet!).
>>
>> Any ideas on how to repair this issue without having to do an XP repair
>> install? Or where XP gets the command to look for the file? I can't
>> seem
>> to find a "boot.sys" or any such file that references it, and obviously
>> can't go into the registry to look for it . . .
>>
>> I've tried going into the Recovery Console & doing fixboot, fixmbr,
>> chkdsk
>> /p /r etc but no good.
>>
>>
>>
>>

David H. Lipman

From: "John Doe" <johndoe@microsoft.com>

| Here's the ONLY solution that's worked for me so far (all the "Popular"
| antimalware programs ignore this one so far):
|
| Download combofix, vundofix, virtumondebegone, & SiRi's virtumonde removers,
| then boot into safe mode, then run each of them, then boot from the OS
| Install CD & do a "repair re-installation" of the OS< then do all the
| updates.
|

S!ri's SmitfraudFix is NOT for the Vundo Trojan/Virtuomonde adware also known as the
WinFixer family. It is geared for ZLob/FakeAlert/Rendos malware associted with the
SmitFraud family.

BTW: Norman has now released Vundo Trojan removal tool.
http://download.norman.no/public/Nor...do_Cleaner.exe
http://www.norman.com/Virus/Virus_re...tools/52658/en

Additionally, MBAM (MalwareBytes Anti Malware utility) is also *very* effective on the
WinFixer family.
http://www.malwarebytes.org/mbam/program/mbam-setup.exe


--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

Indiana

Thanks david that worked like a charm!!! stupid viruses anyway!!




"David H. Lipman" wrote:

> From: "John Doe" <johndoe@microsoft.com>
>
> | There is some sort of infector going around that injects itself into the
> | boot sequence of XP that randomly names itself "base????32" (where the last
> | 4 or 5 letters are random, but the first 4 are always base & the last 2 are
> | always 32) & causes the machine to fail on boot up because it cannot find
> | this file:
> |
> | STOP: c0000135 {Unable To Locate Component}
> | This application has failed to start because baseokfrf32 was not found.
> | Re-installing the application may fix this problem.
> |
> | This usually occurs after removing the winantivituspro infector (clearly the
> | anti-malware people haven't figured out how to remove this properly yet!).
> |
> | Any ideas on how to repair this issue without having to do an XP repair
> | install? Or where XP gets the command to look for the file? I can't seem
> | to find a "boot.sys" or any such file that references it, and obviously
> | can't go into the registry to look for it . . .
> |
> | I've tried going into the Recovery Console & doing fixboot, fixmbr, chkdsk
> | /p /r etc but no good.
> |
>
> This sounds like a SubSys Trojan.
>
> It loads via...
> HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\windows
>
> Example of text in an infected PC:
> -----------------------------------
> %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512,512
> Windows=On SubSystemType=Windows ServerDll=basevml32,1
> ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2
> ProfileControl=Off MaxRequestThreads=16
>
> Example of correct text:
> ----------------------------
> %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512,512
> Windows=On SubSystemType=Windows ServerDll=basesrv,1
> ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2
> ProfileControl=Off MaxRequestThreads=16
>
>
>
> Note in the infected PC line; ServerDll=basevml32
> basevml32.dll is the Trojan. It will load and subsequently load basesrv.dll which is
> legitimate and thus injects itself into the process.
>
> The problem is it sounds like the DLL was removed and thus can NOT be loaded and therefore a
> BSoD.
>
> If you canNOT edit the Registry such that baseokfrf32.dll is not loaded but basesrv.dll is
> properly loaded then you will have to repair the OS.
>
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
>
>
>

David H. Lipman

From: "Indiana" <Indiana@discussions.microsoft.com>

| Thanks david that worked like a charm!!! stupid viruses anyway!!
|

YW

Interesting how I am seeing a recent flurry of what appears to be variants of the SubSys
type of Trojan.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp