Disclaimer
The opinions expressed herein are my own personal opinions and do not represent anyone else's view in any way, including those of my employer.
© Copyright 2008
The opinions expressed herein are my own personal opinions and do not represent anyone else's view in any way, including those of my employer.
© Copyright 2008
You are running Windows XP and you recently removed some malware. After removing the malware, you get the following message on a blue screen (BSOD):
STOP: C0000135 {Unable to locate component} This application has failed to start because [name] was not found. Reinstalling the application may fix this problem.
… where [name] is a word starting with the letters ‘base’ (not winsrv or user32) and has some random crap on the end of it, and you can’t boot the machine anymore.
You have inadvertently deleted a file windows ‘thinks’ it needs, but doesn’t really. The malware you removed hijacked a registry entry to ensure it is loaded with every Windows session, so you have to un-hijack the registry it to fix it, basically pointing Windows to the original non-malware version of the file it thinks it needs.
XHTML:
More Options ...
Categories
Tag Cloud
Blog RSS
Comments RSS
Void 
Life « Default
Earth 
Wind 
Water 
Fire Light
Previous: 
Next: 
Comment Meta:
Last 50 Posts 
Back
12:57 pm - June 19th, 2008
What you described is exactly what happend on this PC. I followed your instructions and voila…the PC booted. Cleaned the rest of the crap off the thing and now we’re sitting pretty!
THANKS!!
5:23 pm - June 19th, 2008
Glad I could help! I beat my head against this thing for a week trying to figure it out.
6:17 pm - June 22nd, 2008
As a computer consultant, I got one job of removing a few viruses from one PC. My virus scanner of choice did a great job of cleaning the PC out, but I also got this problem. I have never needed to export a registry hive from another PC prior to this. Your instructions were simple and VERY helpful. Thanks !!
7:59 pm - June 22nd, 2008
Inanis - - You Rock! I encountered this after cleaning a clients XP Home HDD plagued with 315 infections of all kinds of nasty viruses, spyware and malware.
I tried many different variations of troubleshooting methods and pre-install tecniques. After scanning for days and backing up data, preparing to tell my client; “I have to rebuild the entire OS”, I found this post. I quickly gave this a shot and bamm … It booted. I’m so grateful …I’m going to have a shot of my favorite drink!
KUDOS! : )
10:41 pm - July 2nd, 2008
This works to perfection! Thanks for the fix!!
5:09 pm - July 4th, 2008
Strong Work! I was poised for a repair install; instead took the drive out, hooked it to a usb interface, plugged into my working system, bingo. a 5 minute fix instead of an hour or more. You write very clearly which is a refreshing change from quasi-experts who try to make themselves look smart with ridiculous abreviations.
ditto Marcellus
Thank you!
9:39 am - July 5th, 2008
Hey, thanks everyone. I, like the rest of you, detest doing a format or repair install when I know a simple reg hack will do the trick. That’s all it took in this case.
Remember - loading the registry offline is always a good trick - you might be surprised at what you can do with it.
12:03 pm - July 9th, 2008
Ok, this is exactly what is happening, but, I dont know how to load a “system” hive fil on a clean system. I am obviously a novice, but have no clue how to do this? I cant even get into safe mode, safe mode with command prompt, etc. I can do NOTHING! Can you give me step by step instructions? Thanks~
8:58 pm - July 9th, 2008
Wendy, I will reply to your comment via e-mail, since it would be a bit big for a comment.
8:56 am - July 11th, 2008
Thanks! this web page, along with the “Ultimate Boot CD” really got me going quickly!
1:50 pm - July 13th, 2008
THANKS FOR YOUR HELP!
WORKED LIKE A CHARM<<<<<
9:37 pm - July 15th, 2008
Awesome fix, worked for me too. I took drive out put in in a usb enclosure and fixed it from my working PC’s registry.
Thanks man you saved me from reinstalling this PC.
5:14 pm - July 19th, 2008
Seriously. Lifesaver.
*bow down*
3:27 pm - July 22nd, 2008
thank you. I loaded the reg remote and searched for the base* file and it didn’t find it. for some reason it wasn’t loading the system hive. your fix is perfect.
1:31 am - July 23rd, 2008
sorry my email address does not work at the moment. i have the same problem as Wendy. I have a recovery disk but do not know how to go from there. please help
4:49 pm - July 23rd, 2008
The best way to do this fix is as follows:
(Please read the instructions fully, twice, before embarking on this adventure. Things can get hairy here…)
* Physically remove the hard drive from the “broken” computer
* Install it in a “working” computer with Windows XP
* If you are familiar with the BIOS settings of the computer, you may want to check those out before proceeding to the next step, to make sure your Hard Drive boot order is correct (i.e. making sure the “working” computer is still set to boot to it’s own hard drive, not the one from the “broken” computer. Some newer systems go wacky when you add a hard drive to them.)
* Boot the “working” computer. Wait 5 minutes or so after it has booted. If it asks to reboot because it detected new hardware, this is okay.
* On the “working” computer, click Start and then Run
* In the Run dialog, type “regedit” (without quotes) and click OK
* Highlight the “HKEY_LOCAL_MACHINE” branch at the left by clicking on it once
* Click the “File” menu, then “Load Hive…”
* Next, browse and find the “broken” hive.
o Assuming the hard drive from the broken computer is now mounted as E:, the file you are looking for will be in “E:\windows\system32\config”, and is called “system” (with no file extension on it.)
* When you load the hive, regedit will ask for a name to load the hive as. Tell it “FIX” (uppercase, without quotes).
* Next, navigate to: HKEY_LOCAL_MACHINE\FIX\CurrentControlSet\Control\Session Manager\SubSystems
o The folder above called CurrentControlSet may be called ControlSet1 or ControlSet2, or the like. There may be more than one. If you are unsure which one to use, perform the following steps in all of them.
* At the right, you will see the value at the right called “Windows”. This is the infected registry value. You must replace the value with the following, all on one line. At the right, right click on the item called “Windows”, and select “Modify”, then paste in the following value:
o %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
* When done, go back to the top and highlight the FIX folder underneath HKEY_LOCAL_MACHINE. Then click “File” and “Unload Hive…”
* Put your fixed machine back together (i.e. put the hard drive back in it)
* Boot it up!
9:05 pm - July 25th, 2008
This fix works like a charm. It was simple, to the point and saved hours of rebuilding….Thanks alot dude.
8:22 pm - July 27th, 2008
I want to thank you very very much!
I have spent this day running all types of the various spyware malware and virus programs on a friend’s computer and got that bsod type error and felt pretty bummed. Instead of losing all hope, I kept looking and looking in google and found a guy who had the same problem and solved it but he also referenced your much easier fix which he found after he had solved his problem. The fix worked like a charm and was very easy to understand for a novice like myself. Now, I can continue on cleaning up the rest of his computer.
Thanks Again x 1million!!
10:08 am - July 29th, 2008
This worked like a charm. A real lifesaver! Thanks so much for posting this!
Randy
1:17 pm - July 29th, 2008
My gosh! So many people have had success with this fix, and I am glad I was able to help you all out.
I get a “moderate” message on all these comments, so I know about all of you and I am glad to have been of assistance.
7:57 pm - August 4th, 2008
This has helped take away the blue screen with the error message for me. But now when I boot I get passed the Windows XP loading screen and the computer goes straight to a black screen. I double checked the registry lines I was supposed to input and they look correct (couldnt find any typos)… any ideas?
6:38 pm - August 5th, 2008
Good question. I believe this may be because the baserv32.dll file (or it might be baserv.sys, not sure) is missing from C:\windows\system32 (or it might be C:\windows\system32\drivers, again not sure)
Check that out and see if that is the source of the issue.
6:40 pm - August 5th, 2008
thats basesrv, actually. Sorry. On vacation… brain turned off.
5:00 pm - August 14th, 2008
yo! great save…worked perfectly, Thanks!!!!!!
7:17 pm - August 17th, 2008
Great analysis and fix! After a AV scan I got the blue screen complaining about not finding a baseboq32 file. Googling on baseboq got zero hits, but now if you publish this note, others may find it.
I copied the fix value to a floppy and, using the Ultimate boot Disk CD was able to paste it into the registry value. Thanks again
9:53 pm - August 21st, 2008
I have a laptop and cannot take it apart to fix this, i have now idea what I am doing here…please help! I am having the same problems and do not want to have to do a full reinstall.
12:47 pm - August 22nd, 2008
Angie, if you cannot remove the hard drive from the computer, your best bet is to make a WinPE (Windows Preinstallation Environment) CD with some sort of registry editing tool added to it. I can’t tell you how to do that very quickly, because I have never done it before, but it can be done.
This disc would allow you to boot to a version of Windows on CD. This would give you access to the registry in an “offline” fashion, and would allow you to fix the broken registry entry.
The best thing I can say is to go visit http://nu2.nu/pebuilder/ and make a build of the BartPE (the best WinPE environment in my opinion) and start there. I believe it has a registry hive editor, but I am not sure how it works. As I said above, there are ways to build a good regedit style tool into the BartPE Disc, but I have never done that before.
Good luck, and let me know if you need any more assistance.
~~~~~~~~~~~~~~~~~~
P.S. I highly suggest you “try” to remove the hard drive from the laptop. It is usually accessible from a bottom panel, with one or two screws. Remove said panel and the drive will come right out. Some laptops also have the hard drive underneath the keyboard, but that is rarer. Removing the keyboard on most laptops is relatively easy too: you start by carefully popping off the front bezel between the keyboard and the screen hinge area. It usually pops right out. From there, remove a couple of screws and the keyboard lifts up easily. After that, you will need some sort of adapter to connect your laptop 2.5″ hard drive to a regular computer. I suggest one of these:
http://www.cablesunlimited.com/products/Prod_Individual3.aspx?groupcode=I3523
It’s USB, and allows you to connect old IDE, new SATA and laptop drives directly to any computer via USB. Makes quick work of many diagnostics.
9:05 pm - September 5th, 2008
This really saves me a lot of embarrassment and hassle. A customer brought this stupid Dell in, complaining of viruses. I pull the drive, scan it on my Linux box and put it back nice and clean like I’ve done a gazillion times…and bsod.
Google turned up zip for baseevr32- never thought to look in the stupid registry (I just spent three hours regediting the bejeebers out of another pc- oh God, no more…).
Thank you Inanis, thank you so much for saving me from backing up and reinstalling this comp with eight- yes “8″, thats 4+4- user accounts full, no doubt, of Brittney mp4’s and gruesome hunting pics.
Thank you, thank you, thank you.
Stupid Dell.
4:37 am - September 10th, 2008
in case someone has the same additional problem like me:
My error message was “…baserv…missing”. This message is WRONG because actually basesrv (with the “s” bevore “rv”) was missing.
So additionally to Inanis’ INGENIOUS fix I had to copy C:\WINDOWS\system32\basesrv.dll from the “working” machine to the same location on connected drive from the corrupted machine (because there this file was really missing there).
Not till this additional file-copiying the machine booted again.
Inanis, I thank you VERY VERY much that you could save me so much time!!!!!!
5:41 pm - September 13th, 2008
I am wondering why my AV just stupidly deletes file without fixing the registry? This is a completely strange behavior because such an automatic “fix” makes OS non-bootable at all. Moreover, I am sure that Windows subsystem registry key is NOT changed by other programs in the vast majority of Windows installations around the World, so in most cases it is quite safe to change it to default you mentioned above. What is the reason why AV vendors not doing so?
Thank you very much for this fix. I was going to reinstall Windows before I found this solution.
7:27 pm - September 13th, 2008
Your average anti-virus program works on a “signature” and/or “heuristic” type scanning system. It finds a file it’s signatures or “brain” identifies as bad and deletes it (or quarantines it). It’s really that simple. Anti-virus programs are not humans and are not intelligent: they only do what their limited programming tells them to do. Anti-virus software vendors don’t know everything about Windows, nor do they know everything about every particular variant of malware or virus, so they -generally- have no idea how any specific strain is going to modify the system.
If they made a system that took everything possible into account for every strain of stuph, your definition files would be several magnitude larger in size, scans would take several magnitude longer to complete, and your computer would probably be completely unusable while the software is installed (which is almost the case now with several of the ‘popular’ anti-virus suites).
This is why there are computer technicians and Windows MVPs. These are the people smarter than the anti-virus software (and the malware, for that matter) that know what is where in Windows and can dispense their knowledge on how to fix these issues. Sometimes for free, sometimes not.
In any case, glad I could help you out!
11:29 pm - September 13th, 2008
I was working for one AV company for a while, and I know that situations such as “Your AV program killed my entire OS” are the worst cases AV companies are trying to avoid. If an AV program kills the OS, a customer will most likely search for another AV program and in worst case he will claim for getting his money back — this is the scenario AV vendors don’t want the most.
I agree that AVs are not as intelligent as a human, but humans ARE analyzing malware and humans ARE adding signatures and (are they?) curing actions to definitions base. I agree that definitions base size will be larger, but scanning time will be the same, ’cause the scan will still be based on the same signatures. The curing action will be different: delete a file AND fix the registry — it’ll take not much longer than just deleting a file.
In case of heuristics AV quarantines the file and then does nothing — detected malware was not in AV vendor’s lab, so AV program has no curing actions for this kind of malware. But the trojan we’re talking about WAS in hands of AV’s analytics staff, ’cause it was detected using signatures (as I remember) and AV program shouted it’s name. So I think this is a completely AV vendor’s fault.
10:21 am - September 14th, 2008
I see what you mean. Doesn’t matter I guess, the AV companies aren’t going to care anyways. They are just going to make a program that kills the files and moves on. They don’t -really- care if your computer gets fixed or not, just that you update your subscription yearly.
1:00 am - September 17th, 2008
Noooo.
If AV vendors don’t really care about customer’s computer gets fixed or not, they’re going to lose their customers, if they are losing their customers, they are losing their money. So, usually AV vendors are trying to please their customers or, at least, not to make customer’s computer-related life horrible. It’s a HUGE mistake to make kill-and-move-on fixing, ’cause someday an epidemic of malware that cannot be fixed that way can occur, and tens of thousands of computers will be fixed to death. This is a night horror of any AV lab, believe me. 
“Who cares” statement is wrong for business (at least for non-monopolistic ones 
They’re trying… Sometimes not that hard… So yes, there’s always a room for MVP pros here.
8:07 am - September 25th, 2008
I’m having the same Blue Screen of Death with the c0000135 error on the 32.dll file. I’m a novice and don’t know how to get into the specified files. Would it be possible to email some basic easy to follow instruction? I have a computer in which I can download things off the Internet and put them on either a CD or Jump Drive. Thanks for any assistance.
8:48 pm - September 25th, 2008
Replying to Ryan via email…
5:49 am - September 26th, 2008
Inanis-
I have a laptop with this problem also.
Would a crossover cable work to access the laptop registry from my desktop?
Jason
9:50 pm - September 26th, 2008
Jason, I suggest taking a look at the comment above by “angie” and my reply to her question.
A crossover cable is nice to connect two computers together, however, if you cannot get the operating system up and running, you won’t be able to get into the laptop from another computer in that manner. When the system does a “BSOD”, it is -essentially- locked up and will not respond to outside requests, so a crossover cable will not work.
I suggest getting a cool technicians gadget (http://www.cablesunlimited.com/products/Prod_Individual3.aspx?groupcode=I3523), disconnecting the hard drive from the laptop, and using the gadget to connect it to a working computer, then perform the procedure above. It really is the easiest way I know of.
1:15 am - September 28th, 2008
Inanis-
I figured as much, I thought id ask someone who knows more than me though!
I will try your suggestion and get a “gadget”.
I wont be able to try for a couple of weeks but I will let you know the results after I give it a go.
Thanks
jason
11:07 pm - October 2nd, 2008
This fix is amazing, thank you thank you thank you!
I was fixing a friend’s Dell, and even after running hijackthis, combofix, and other related programs, I knew there were still infected files somewhere in the drive. Everything booted properly and acted snappy, but I was still concerned about dormant threats.
Naturally, I downloaded and installed AVG Free 8.0 (to update the existing AVG 7.1 already on the system) and ran a full virus scan before I went to work. Got home tonight and it said it was finished and needed to restart. So I did.
BOOM! BSOD. No safe mode, command prompt, nothing.
After searching for basehxao32 to no avail, I tried searching the error code (c0000135) and was sent here.
What a relief! I have Linux Mint installed on a pen drive, so I popped it in, booted to it, shared the system32 folder, and from my main system (a mac mini running MacOSX/WinXP) loaded up the registry and fixed it like you say here. The only difference is that my ControlSet1 key was called ControlSet001 and ControlSet003. Fixed them both.
Then, just reboot normally and I’m back at a login screen. YEEHAW!
Didn’t even have to dig for a WinXP Home install disk. I’m so relieved.
Thanks!
5:55 am - October 25th, 2008
Inanis,
I have a BSOD on my Sony VAIO that says “STOP: C0000135 {Unable to locate component} This application has failed to start because USER32.dll was not found. Reinstalling the application may fix this problem.
I tried your excellent steps listed above, but had no luck. Do you have a different procedure for “user32.dll” ? I noticed that both control set 1 and control set 3 registry values were already correct, but I cut and pasted anyway.
I bought a SATA USB enclosure to transfer important files but I hope to save the hard drive without having to reformat. Thanks forr the detailed instructions, very easy to follow!
10:07 am - October 25th, 2008
Clint,
This is most likely because user32.dll is missing. Follow the procedures to get access to your drive on another computer. However, instead of editing the registry, grab a copy of user32.dll from C:\windows\system32 on a working computer and place it in the same directory on the broken hard drive. Then put the drive back into the computer and you should be set - that is if user32.dll really is missing or corrupt.
Worst case scenario, do what you said in your post: back up your data and reinstall windows from scratch on the broken computer.
4:37 pm - November 3rd, 2008
Absolute Brilliance. Cleaned up malware/virus/rootkit garbage and rebooted into this blue screen. Just by chance found this article and it worked perfectly. I would have never thought to look at the controlset for this fix. Thanks a billion.
1:49 pm - November 7th, 2008
“Ryan said…
8:07 am - September 25th, 2008
I’m having the same Blue Screen of Death with the c0000135 error on the 32.dll file. I’m a novice and don’t know how to get into the specified files. Would it be possible to email some basic easy to follow instruction? I have a computer in which I can download things off the Internet and put them on either a CD or Jump Drive. Thanks for any assistance.”
Same situation here. Can you help? Thanks.
4:19 am - November 10th, 2008
Ryan said…
8:07 am - September 25th, 2008
I’m having the same Blue Screen of Death with the c0000135 error on the 32.dll file. I’m a novice and don’t know how to get into the specified files. Would it be possible to email some basic easy to follow instruction? I have a computer in which I can download things off the Internet and put them on either a CD or Jump Drive. Thanks for any assistance.
Please reply to me via emai as well. Thanks
8:25 am - November 10th, 2008
I guess I have the same problem as many above, but I really am not acquainted with this stuff. Out of the blue, connected an external hard disk into my girlfriend’s latop as well as to mine last night. She got a virus (trojan) message straight away. No problems with mine.
to be breif…when we restarted our laptops this morning…exaclty the same message on both:
STOP : c0000135 {N unable to tocale component}
Application falied to start b/c USER32.dll was not found…etc.
Can you please help???!!!
Thanks a lot,
Giovanni
2:50 pm - November 10th, 2008
Hi Inanis,
I´m i have the user32.dll problem and i’m trying to use recovery console but i don’t know what line of comands to use… can you help me?
10:44 pm - November 10th, 2008
Hi Inanis, i’ve read the procedure you post on this page and i’m amost clear on the steps i’ve to follow but my big question is (maybe i’ll sound stupid): do i need to put the “broken hard drive” into a “working computer” with Windows XP ???
This problem happened to my cousin and i already take off the hard drive but my computer has Windows Vista. I would like to know if i can execute your procedure anyway or if i have to get a windowsXP computer around to do it.
Thanks a lot for you support.
Gus
11:06 pm - November 10th, 2008
Gus,
Yes, a Windows XP Computer is best, but Vista should also be okay. Just make sure that you run regedit as an Administrator, if it gives you that option.
7:22 am - November 12th, 2008
Thanks a lot for your solution. A lot of very important data could now be redirected to our new external hard disk (to be sure for future problems).
This problem occured after using Ad-Aware2008 Free. Nothing worked, until I found your solution after several hours of search on the web. Even for a computer dummy as me it was very easy to do.
Can you tell me if Ad-Aware2008 Free, CCleaner and Avast Free can be used from now on? Or should I wait for new upgrades?
8:58 pm - November 12th, 2008
Robin,
All three of those applications are good for general malware removal. I also suggest a program called HijackThis. I am also partial to AVG Free instead of Avast, but you know, whatever floats your boat!
2:34 pm - November 15th, 2008
Excellent fix. Saved me much time and effort in searching for that in the registry. Your WP theme looks really nice also.
Thanks again.
11:10 am - November 16th, 2008
Hi Inanis, i ran the process using an operating Win XP pro 3 times and the problem is still there. I did a search for the file/component not found by the system (user32.dll). I did a copy of the dll file from the operating hard disk to the broken one and the system booted finally.
There is a non common behavior on the session right now, the system boots fine… but AVG is making the system so slow. I’m trying to uninstall the AVG 8.x from the computer but it’s not possible.
For some reason i can’t start the system in Safe Mode to uninstall the AVG program.
Could you suggest me some procedure to follow it.
Regards,
Gus
11:33 am - November 16th, 2008
A trick to remove AVG: try to re-install the same version you already have installed. The installer program will give you the option to uninstall it. Hop on over to my contact page, shoot me an email and we can continue this there. Its gonna be too long and messy for comments.
http://www.inanis.net/blog/index.php/about/contact-me/
7:31 pm - November 16th, 2008
Gus, you might try going into services(Start-Run-Type “services.msc”-Ok) and stopping the avg services(right click each and select “stop”) before you attempt the uninstall.
12:12 pm - November 17th, 2008
I have the same problem as wendy and am unsure how to load he “SYSTEM” hive onto a clean system. Also now the screen just goes black when I try to turn my pc on (it was blue screening with this error before when i tried to start it), is this another affect of the virus, or due to me opening up the pc and fiddling?
1:18 pm - November 17th, 2008
fixed monitor with no display issue.
7:57 pm - November 17th, 2008
Dan, good question. My comment on July 23rd, 2008 at 4:49 pm is quite explicit on fixing the issue. Also, my comment on August 22nd, 2008 gives a hint on how to access the drive on another computer. Go up, give it a read and see if that helps you. If not, let me know and I will try to write it out using clearer language (a challenge for me, I tend to be obtuse!)
As for it BSODing, and now just giving a black screen, yes, that could be related to what you call “fiddling”. At this point, I cannot officially advise any course of action, simply because of the legal ramifications of doing so. However, I can at the least suggest reversing your steps to see if the BSOD comes back. If so, then your computer isn’t totally busted.
In any case, the black screen could be caused by your trying to start up the system without a hard drive in it. Is that the case?
7:58 pm - November 17th, 2008
Oops. didn’t see the second comment waiting for approval. My bad.
10:27 am - November 19th, 2008
I also get diferent BSOD messages every time (this was just one of the messages i wrote down). Do you think this fix will still work?
7:34 pm - November 19th, 2008
Dan,
If you are getting completely different BSOD messages, you more likely have a hardware problem. I would check out http://www.ultimatebootcd.com/ and grab a copy, burn it and boot to it on the broken computer. Run MemTest86 and see what you get.