AVG (free) v8 removes trojan - now XP won't boot. 1

[G0AOZ]

AVG identifies the file basemlnn32.dll as Trojan horse Agent.MYK and naturally removed it. XP PRO (SP2) now won't boot in Normal or Safe mode. Produces a BSOD STOP c0000135 which tells me it can't load basemlnn32.

The basemlnn32.dll file is located in C:\Windows\System32 and the Registry shows entries for it under:-

HKEY_LOCAL_MACHINE > System > ControlSet001 > Control > Session Manager > SubSystems

Also under ControlSet003 and CurrentControlSet

I have Googled for this file but got no answers, and it doesn't appear on any other XP machines I've looked at.

Anyone any clues please?

ROGER - G0AOZ.

 

[eyec]

do you have your XP restore cd? try getting to the Setup screen (usually F2) and change the boot sequence to CD and no others then do a Repair install.

 

[sggaunt]

I can't find anything on it either and very little on Agent MYK other than 'its hard to remove'

Is your AVG the free edition?
if it is post this on the AVG Free forum, make sure you list all the details of the machine

http://freeforum.avg.com/index.php

If its paid for you should contact AVG Support.

If you really cant get it going in safe mode, then you may be looking at repairing windows, Do you have the install disk?




Steve: N.M.N.F.
If something is popular, it must be wrong: Mark Twain

 

[G0AOZ]

I was hoping to avoid having to do a repair as this often knocks out the installed programmes...

No, won't run in Safe Mode or Last known Good Configuration etc.

Steve, it's the free edition of AVG as the message title implies! I've already posted a message on the AVG forum, but no responses. (I "upset" the moderators there a week or two ago, so maybe I'll get no replies...)

I did take the precaution of making a clone of this drive before embarking on a cleanup so I can have a second bite at the cherry, so to speak... Interestingly, Panda Internet Security 2008 didn't "find" this trojan, but then whenever I do a cleanup, I usually run a disk through at least three scanners, and each one often finds something the previous one didn't!

Maybe this is a false positive on the part of AVG? If that's the case, I'll have to look to see if AVG can be programmed to ignore this file. If I right click on this file in Explorer, it just says "Unknown Application" which doesn't help.

ROGER - G0AOZ.

 

[sggaunt]

Hmm its quite odd, I looked on the M$ support site and found no reference to the dll, and as you say it cannot be found on other XP Installs.

But Panda has a very good reputation, odd for it to find nothing (assume the definitions were up to date?)

Yes sorry, I remember the AVG forum thing now !!

Might be an idea to see if you can boot from the Install CD.






Steve: N.M.N.F.
If something is popular, it must be wrong: Mark Twain

 

[G0AOZ]

Problem solved now...

AVG forum came up with a couple of modified Registry keys, and after changing those and deleting that file from the system32 folder, all appears to be well again.

Thanks for your support guys...

ROGER - G0AOZ.

 

[sggaunt]

You see if you stick to the rules the AVG Free forum is OK !!

But you did say that the system would not boot in safe mode ??


Steve: N.M.N.F.
If something is popular, it must be wrong: Mark Twain

 

[G0AOZ]

Yes, wouldn't boot in Normal, Safe or Last Known Good, etc... Next question?

ROGER - G0AOZ.

 

[sggaunt]

OK.
How were you able to retrive/change the registry values?

Ah wait a mo, you used the Cloned drive

Steve: N.M.N.F.
If something is popular, it must be wrong: Mark Twain

 

[G0AOZ]

Yup, you guessed correctly! I also could've used ERD Commander and merged a new key.

Steve, I always make a clone of a hard drive I'm going to work on, as a security measure. This generally only takes a few minutes of operator time, then I leave the cloning software (usually Acronis) to get on with. It has saved my bacon on more than one occasion when something has gone horribly wrong whilst I was battling to kill off a trojan or virus, etc. As per yesterday...

ROGER - G0AOZ.

 

[wahnula]

GFY Roger. A star for your preparedness.

That means "Good For You" for those with their minds in the gutter.

Question to mankind: Has "Last Known Good Configuration" ever worked for anybody...ever?

Tony

Users helping Users...

 

[G0AOZ]

Thanks Tony.

Glad you qualified That means "Good For You"!!

Don't recall successfully using Last Known Good Configuration in XP. Used it once or twice in NT4 when a daft user set the refresh rate too high! No video!

ROGER - G0AOZ.

 

[chet0729]

how about posting the registry fixes, i have the exact same problem and it could save me some time.

Thanks

 

[G0AOZ]

No problem!

I found these entries for basemlnn32.dll under the following Registry keys:-

HKEY_LOCAL_MACHINE > SYSTEM > ControlSet001 > Control > Session Manager > SubSystems:- Windows key:-

REG_EXPAND_SZ %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basemlnn32,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16



HKEY_LOCAL_MACHINE > SYSTEM > ControlSet003 > Control > Session Manager > SubSystems:- Windows key:-

REG_EXPAND_SZ %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basemlnn32,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16



HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Control > Session Manager > SubSystems:- Windows key:-

REG_EXPAND_SZ %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basemlnn32,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16


Each key was changed to this (below), and then the basemlnn32.dll file was deleted:-

REG_EXPAND_SZ %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16


Hope it works ok for you.

ROGER - G0AOZ.