BaseFlash

Posted: March 10, 2014

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	16,392
Threat Level:	2/10
Infected PCs:	25,037

First Seen:	March 10, 2014
Last Seen:	February 1, 2025
OS(es) Affected:	Windows

BaseFlash is adware that claims to provide the 'Internet as you want,' but uses features that boil down to injecting unwanted advertisements into your browser. Since BaseFlash's primary functions may modify websites in ways that harm your browser's performance and safety, there are few reasons to not remove BaseFlash once you identify BaseFlash. As usual for adware, a delay in BaseFlash's uninstallation may allow its third-party advertisements to deliver unsafe or misleading content that may lead to additional PC security problems.

BaseFlash: Redefining the Web with Advertising Sponsors

BaseFlash is an add-on designed for most modern browsers, including both OS X's Safari and several Windows brands of Web browsers. Although the marketing of its website, baseflash.com, describes BaseFlash as a product that can remove generalized advertisements in exchange for providing more 'personalized' content, BaseFlash is no different from other, common forms of adware. By modifying Web pages to load extra advertisements, BaseFlash may interfere with their native formats and expose its users to online content from a variety of third-parties, some of which may be unsafe for you or your PC.

This method of display advertisements, while not illegal, may cause issues with navigating through the website's content. BaseFlash also may hijack and block normal website advertisements, depriving them of revenue, while ensuring that BaseFlash's revenue streams remain intact. More importantly than that, malware researchers rarely find the extended presence of adware fails to provoke other security problems related to their advertisements. BaseFlash advertisements may ignore advertising blockers and browser settings designed to block such content. On the other hand, non-advertising functions, such as redirecting your browser to completely different sites, haven't been observed in BaseFlash, unlike some other, even more invasive types of adware.

Kicking BaseFlash Off Your Home Base

Contrary to its self-description, BaseFlash doesn't have any positive functions, and malware experts can find no reasons to pause in removing BaseFlash from your PC. However, BaseFlash is not a threat, and deleting BaseFlash from your browser should use security software that's designed to delete adware and similar Potentially Unwanted Programs. Alternate means of evading BaseFlash, such as switching your browser, may allow you to ignore BaseFlash's advertisements, but inherent security and performance risks related to BaseFlash will continue to persist until its deletion.

Although adware programs frequently specialize in Windows browsers such as Chrome or Internet Explorer, BaseFlash also is compatible with some OS X browsers. Accordingly, keeping your computer unimpeded by BaseFlash advertising is less a matter of using a 'safe' Web browser than it is a matter of practicing good Web-browsing behavior. Making full use of legitimate browser add-ons with security features also is recommended by malware experts.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%APPDATA%\BaseFlash\IE\BaseFlash.dll

File name: BaseFlash.dll
Size: 179.71 KB (179712 bytes)
MD5: d4ded8e7d5cac032ae52974db78e6f1c
Detection count: 504
File type: Dynamic link library
Mime Type: unknown/dll
Path: %APPDATA%\BaseFlash\IE
Group: Malware file
Last Updated: March 21, 2014

C:\Users\<username>\AppData\Roaming\BaseFlash\protect\ProtectExtension.exe

File name: ProtectExtension.exe
Size: 70.65 KB (70656 bytes)
MD5: a272540d78c7f729d75c02ffa8560f14
Detection count: 232
File type: Executable File
Mime Type: unknown/exe
Path: C:\Users\<username>\AppData\Roaming\BaseFlash\protect\ProtectExtension.exe
Group: Malware file
Last Updated: July 7, 2022

%TEMP%\baseflashsetup.exe

File name: baseflashsetup.exe
Size: 982.64 KB (982642 bytes)
MD5: 63f052464332b9696a15f460920cda9f
Detection count: 40
File type: Executable File
Mime Type: unknown/exe
Path: %TEMP%
Group: Malware file
Last Updated: March 21, 2014

%APPDATA%\BaseFlash\protect\ProtectBaseFlash.exe

File name: ProtectBaseFlash.exe
Size: 53.76 KB (53760 bytes)
MD5: 37736757095f70858e311799e01a67f6
Detection count: 21
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\BaseFlash\protect
Group: Malware file
Last Updated: March 10, 2014

More files

Registry Modifications

The following newly produced Registry Values are:

CLSID{6C51F7E9-8542-4F25-A30F-2060157752E1}{90A52F08-64AC-4DC6-9D7D-4516670275D3}Regexp file mask%Temp%\baseflashSetup.exeHKEY..\..\..\..{RegistryKeys}SOFTWARE\Classes\AppID\BaseFlash.DLLSOFTWARE\Classes\BaseFlashSOFTWARE\Classes\BaseFlash.1SOFTWARE\Microsoft\Tracing\ProtectExtension_RASAPI32SOFTWARE\Microsoft\Tracing\ProtectExtension_RASMANCSSOFTWARE\Mozilla\Firefox\Extensions\BaseFlash@B1a2s3e4F5l6a7s8h9.esSOFTWARE\ProtectExtensionSOFTWARE\Wow6432Node\BaseFlashSOFTWARE\Wow6432Node\Classes\AppID\BaseFlash.DLLSOFTWARE\Wow6432Node\Microsoft\Tracing\ProtectExtension_RASAPI32SOFTWARE\Wow6432Node\Microsoft\Tracing\ProtectExtension_RASMANCSSOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions\BaseFlash@B1a2s3e4F5l6a7s8h9.esSOFTWARE\Wow6432Node\ProtectExtension

Additional Information

The following directories were created:

%appdata%\BaseFlash

The following URL's were detected:

BaseFlash@