Here's the l2mfix log:
L2Mfix 1.02
Running From:
C:\Documents and Settings\Jayson\Desktop\l2mfix
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Setting registry permissions:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Denying C access for really "Everyone"
- adding new ACCESS DENY entry
Registry Permissions set too:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- Everyone
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Setting up for Reboot
Starting Reboot!
C:\Documents and Settings\Jayson\Desktop\l2mfix
System Rebooted!
Running From:
C:\Documents and Settings\Jayson\Desktop\l2mfix
killing explorer and rundll32.exe
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003
[email protected]Killing PID 1412 'explorer.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003
[email protected]Killing PID 1960 'rundll32.exe'
Scanning First Pass. Please Wait!
First Pass Completed
Second Pass Scanning
Second pass Completed!
Backing Up: C:\WINDOWS\system32\dmser.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\en26l1fs1.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\fn0021dmg.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\fu0021dmg.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\fvntext.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ip41_qc.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lv6609jse.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lvj2091oe.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lvrs0997e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\m4rm0e91eh.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mmvcrt.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\oubcconf.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\sddocvw.dll
1 file(s) copied.
deleting: C:\WINDOWS\system32\dmser.dll
Successfully Deleted: C:\WINDOWS\system32\dmser.dll
deleting: C:\WINDOWS\system32\en26l1fs1.dll
Successfully Deleted: C:\WINDOWS\system32\en26l1fs1.dll
deleting: C:\WINDOWS\system32\fn0021dmg.dll
Successfully Deleted: C:\WINDOWS\system32\fn0021dmg.dll
deleting: C:\WINDOWS\system32\fu0021dmg.dll
Successfully Deleted: C:\WINDOWS\system32\fu0021dmg.dll
deleting: C:\WINDOWS\system32\fvntext.dll
Successfully Deleted: C:\WINDOWS\system32\fvntext.dll
deleting: C:\WINDOWS\system32\ip41_qc.dll
Successfully Deleted: C:\WINDOWS\system32\ip41_qc.dll
deleting: C:\WINDOWS\system32\lv6609jse.dll
Successfully Deleted: C:\WINDOWS\system32\lv6609jse.dll
deleting: C:\WINDOWS\system32\lvj2091oe.dll
Successfully Deleted: C:\WINDOWS\system32\lvj2091oe.dll
deleting: C:\WINDOWS\system32\lvrs0997e.dll
Successfully Deleted: C:\WINDOWS\system32\lvrs0997e.dll
deleting: C:\WINDOWS\system32\m4rm0e91eh.dll
Successfully Deleted: C:\WINDOWS\system32\m4rm0e91eh.dll
deleting: C:\WINDOWS\system32\mmvcrt.dll
Successfully Deleted: C:\WINDOWS\system32\mmvcrt.dll
deleting: C:\WINDOWS\system32\oubcconf.dll
Successfully Deleted: C:\WINDOWS\system32\oubcconf.dll
deleting: C:\WINDOWS\system32\sddocvw.dll
Successfully Deleted: C:\WINDOWS\system32\sddocvw.dll
Desktop.ini sucessfully removed
Zipping up files for submission:
adding: dmser.dll (140 bytes security) (deflated 4%)
adding: en26l1fs1.dll (140 bytes security) (deflated 4%)
adding: fn0021dmg.dll (140 bytes security) (deflated 4%)
adding: fu0021dmg.dll (140 bytes security) (deflated 4%)
adding: fvntext.dll (140 bytes security) (deflated 4%)
adding: ip41_qc.dll (140 bytes security) (deflated 4%)
adding: lv6609jse.dll (140 bytes security) (deflated 4%)
adding: lvj2091oe.dll (140 bytes security) (deflated 4%)
adding: lvrs0997e.dll (140 bytes security) (deflated 4%)
adding: m4rm0e91eh.dll (140 bytes security) (deflated 4%)
adding: mmvcrt.dll (140 bytes security) (deflated 4%)
adding: oubcconf.dll (140 bytes security) (deflated 4%)
adding: sddocvw.dll (140 bytes security) (deflated 4%)
updating: cecho.reg (140 bytes security) (deflated 2%)
updating: echo.reg (140 bytes security) (deflated 9%)
adding: cleanup.reg (140 bytes security) (deflated 2%)
adding: clear.reg (140 bytes security) (deflated 46%)
updating: desktop.ini (140 bytes security) (deflated 14%)
updating: direct.txt (140 bytes security) (stored 0%)
updating: lo2.txt (140 bytes security) (deflated 80%)
updating: readme.txt (140 bytes security) (deflated 48%)
updating: report.txt (140 bytes security) (deflated 64%)
updating: test.txt (140 bytes security) (deflated 75%)
adding: log.txt (140 bytes security) (deflated 77%)
adding: test2.txt (140 bytes security) (deflated 27%)
adding: xfind.txt (140 bytes security) (deflated 69%)
adding: backregs/0C55D3BE-4FEB-4C51-A428-A8F6A7EC8999.reg (140 bytes security) (deflated 70%)
adding: backregs/12F1BECF-E3CE-46A0-94D0-4C5A32F1516E.reg (140 bytes security) (deflated 70%)
adding: backregs/248865E5-1534-4B1A-8C9F-399B3D0E99FA.reg (140 bytes security) (deflated 70%)
adding: backregs/6371AF5C-EC86-406C-BCE3-8310835E6457.reg (140 bytes security) (deflated 70%)
adding: backregs/8894E728-EC3B-4148-BFAF-F767977D5110.reg (140 bytes security) (deflated 70%)
adding: backregs/BE8A58D2-5C98-4118-A36B-9129F859848A.reg (140 bytes security) (deflated 70%)
adding: backregs/shell.reg (140 bytes security) (deflated 73%)
Restoring Registry Permissions:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Revoking access for really "Everyone"
Registry permissions set too:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators ... successful
deleting local copy: dmser.dll
deleting local copy: en26l1fs1.dll
deleting local copy: fn0021dmg.dll
deleting local copy: fu0021dmg.dll
deleting local copy: fvntext.dll
deleting local copy: ip41_qc.dll
deleting local copy: lv6609jse.dll
deleting local copy: lvj2091oe.dll
deleting local copy: lvrs0997e.dll
deleting local copy: m4rm0e91eh.dll
deleting local copy: mmvcrt.dll
deleting local copy: oubcconf.dll
deleting local copy: sddocvw.dll
The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
The following are the files found:
****************************************************************************
C:\WINDOWS\system32\dmser.dll
C:\WINDOWS\system32\en26l1fs1.dll
C:\WINDOWS\system32\fn0021dmg.dll
C:\WINDOWS\system32\fu0021dmg.dll
C:\WINDOWS\system32\fvntext.dll
C:\WINDOWS\system32\ip41_qc.dll
C:\WINDOWS\system32\lv6609jse.dll
C:\WINDOWS\system32\lvj2091oe.dll
C:\WINDOWS\system32\lvrs0997e.dll
C:\WINDOWS\system32\m4rm0e91eh.dll
C:\WINDOWS\system32\mmvcrt.dll
C:\WINDOWS\system32\oubcconf.dll
C:\WINDOWS\system32\sddocvw.dll
Registry Entries that were Deleted:
Please verify that the listing looks ok. It shouldn't be longer than 13 lines
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{8894E728-EC3B-4148-BFAF-F767977D5110}"=-
"{BE8A58D2-5C98-4118-A36B-9129F859848A}"=-
"{12F1BECF-E3CE-46A0-94D0-4C5A32F1516E}"=-
[-HKEY_CLASSES_ROOT\CLSID\{8894E728-EC3B-4148-BFAF-F767977D5110}]
[-HKEY_CLASSES_ROOT\CLSID\{BE8A58D2-5C98-4118-A36B-9129F859848A}]
[-HKEY_CLASSES_ROOT\CLSID\{12F1BECF-E3CE-46A0-94D0-4C5A32F1516E}]
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{F6EDC9D6-D2B0-42DD-985F-4E652F2DA8C4}"=-
****************************************************************************
Desktop.ini Contents:
****************************************************************************
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
<IDone>{F6EDC9D6-D2B0-42DD-985F-4E652F2DA8C4}</IDone>
<IDtwo>AD</IDtwo>
<VERSION>200</VERSION>
****************************************************************************
Classid's found from regsearch:
****************************************************************************
