L2Mfix 1.02a
Running From:
C:\Documents and Settings\Ashley Rossi\Desktop\l2mfix
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Setting registry permissions:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Denying C access for really "Everyone"
- adding new ACCESS DENY entry
Registry Permissions set too:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- Everyone
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Setting up for Reboot
Starting Reboot!
C:\Documents and Settings\Ashley Rossi\Desktop\l2mfix
System Rebooted!
Running From:
C:\Documents and Settings\Ashley Rossi\Desktop\l2mfix
killing explorer and rundll32.exe
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003
[email protected]Killing PID 1052 'explorer.exe'
Killing PID 1052 'explorer.exe'
Error 0x5 : Access is denied.
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003
[email protected]Error, Cannot find a process with an image name of rundll32.exe
Scanning First Pass. Please Wait!
First Pass Completed
Second Pass Scanning
Second pass Completed!
Backing Up: C:\WINNT\system32\dn0001dme.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\dn0s01d7e.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\gpj0l31m1.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\kt6ul7j91.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\nlsdexts.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\o6pqlg7516.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\guard.tmp
1 file(s) copied.
deleting: C:\WINNT\system32\dn0001dme.dll
Successfully Deleted: C:\WINNT\system32\dn0001dme.dll
deleting: C:\WINNT\system32\dn0s01d7e.dll
Successfully Deleted: C:\WINNT\system32\dn0s01d7e.dll
deleting: C:\WINNT\system32\gpj0l31m1.dll
Successfully Deleted: C:\WINNT\system32\gpj0l31m1.dll
deleting: C:\WINNT\system32\kt6ul7j91.dll
Successfully Deleted: C:\WINNT\system32\kt6ul7j91.dll
deleting: C:\WINNT\system32\nlsdexts.dll
Successfully Deleted: C:\WINNT\system32\nlsdexts.dll
deleting: C:\WINNT\system32\o6pqlg7516.dll
Successfully Deleted: C:\WINNT\system32\o6pqlg7516.dll
deleting: C:\WINNT\system32\guard.tmp
Successfully Deleted: C:\WINNT\system32\guard.tmp
Desktop.ini sucessfully removed
Zipping up files for submission:
adding: dn0001dme.dll (152 bytes security) (deflated 3%)
adding: dn0s01d7e.dll (152 bytes security) (deflated 4%)
adding: gpj0l31m1.dll (152 bytes security) (deflated 3%)
adding: kt6ul7j91.dll (152 bytes security) (deflated 4%)
adding: nlsdexts.dll (152 bytes security) (deflated 4%)
adding: o6pqlg7516.dll (152 bytes security) (deflated 3%)
adding: guard.tmp (152 bytes security) (deflated 4%)
adding: clear.reg (152 bytes security) (deflated 51%)
adding: echo.reg (152 bytes security) (deflated 10%)
adding: desktop.ini (152 bytes security) (deflated 14%)
adding: direct.txt (152 bytes security) (stored 0%)
adding: lo2.txt (152 bytes security) (deflated 76%)
adding: readme.txt (152 bytes security) (deflated 49%)
adding: report.txt (152 bytes security) (deflated 65%)
adding: test.txt (152 bytes security) (deflated 65%)
adding: test2.txt (152 bytes security) (deflated 33%)
adding: test3.txt (152 bytes security) (deflated 33%)
adding: test5.txt (152 bytes security) (deflated 33%)
adding: xfind.txt (152 bytes security) (deflated 58%)
adding: backregs/2252501E-705E-4431-B8B6-6EC50E515D85.reg (152 bytes security) (deflated 71%)
adding: backregs/8D51E60A-1E87-47AF-B94B-CCF26359625D.reg (152 bytes security) (deflated 70%)
adding: backregs/B1908EAE-BF5C-4435-97AC-D457D996B86C.reg (152 bytes security) (deflated 70%)
adding: backregs/shell.reg (152 bytes security) (deflated 74%)
Restoring Registry Permissions:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Revoking access for really "Everyone"
Registry permissions set too:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators ... successful
deleting local copy: dn0001dme.dll
deleting local copy: dn0s01d7e.dll
deleting local copy: gpj0l31m1.dll
deleting local copy: kt6ul7j91.dll
deleting local copy: nlsdexts.dll
deleting local copy: o6pqlg7516.dll
deleting local copy: guard.tmp
The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000
The following are the files found:
****************************************************************************
C:\WINNT\system32\dn0001dme.dll
C:\WINNT\system32\dn0s01d7e.dll
C:\WINNT\system32\gpj0l31m1.dll
C:\WINNT\system32\kt6ul7j91.dll
C:\WINNT\system32\nlsdexts.dll
C:\WINNT\system32\o6pqlg7516.dll
C:\WINNT\system32\guard.tmp
Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{D1833057-9B6F-48AF-851D-B65A7CD8F713}"=-
"{2252501E-705E-4431-B8B6-6EC50E515D85}"=-
"{B1908EAE-BF5C-4435-97AC-D457D996B86C}"=-
"{8D51E60A-1E87-47AF-B94B-CCF26359625D}"=-
[-HKEY_CLASSES_ROOT\CLSID\{D1833057-9B6F-48AF-851D-B65A7CD8F713}]
[-HKEY_CLASSES_ROOT\CLSID\{2252501E-705E-4431-B8B6-6EC50E515D85}]
[-HKEY_CLASSES_ROOT\CLSID\{B1908EAE-BF5C-4435-97AC-D457D996B86C}]
[-HKEY_CLASSES_ROOT\CLSID\{8D51E60A-1E87-47AF-B94B-CCF26359625D}]
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{4D71E666-7F4D-4ADE-AD5C-18FFE54C8D67}"=-
****************************************************************************
Desktop.ini Contents:
****************************************************************************
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
<IDone>{4D71E666-7F4D-4ADE-AD5C-18FFE54C8D67}</IDone>
<IDtwo>DS3</IDtwo>
<VERSION>200</VERSION>
****************************************************************************
