U.Z.A. O/S - do not format your system to remove it...

Have you heard of "U.Z.A. O/S"? Maybe you have seen this screen?



This is caused by a malware. It hurts you by running a simple program or two and using few wallpapers and modifying the registry so that you cannot change the desktop wallpaper and end process with Windows Task Manager.

The following hacks are for advanced users.
For you to be able to reverse the process you need to be able to view hidden files, system files and edit registry. [You may want to disable system restore to prevent restoring of files you modify.]

If you are able to view Hidden Files and System Files:
1. Delete %windir%\system\uos.exe ["%windir% = C:\windows", most of the time]
2. Delete %windir%\system32\VisLoader.exe
3. Edit C:\boot.ini to remove extra parameters after multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

If you are able to edit registry copy the following to a text document and save with the extension .reg and double click the .reg file to update the registry or edit the following entries in the hive:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"NoDispAppearancePage"=dword:00000000
"NoDispBackgroundPage"=dword:00000000
"NoDispScrSavPage"=dword:00000000
"NoDispSettingsPage"=dword:00000000

[HKEY_CURRENT_USER\Control Panel\International]
"sTimeFormat"="HH:mm:ss"



Other resources to follow:

Enabling Task Manager from Group Policy Editor
1. Run -> gpedit.msc
2. User Configuration -> Administrative Templates -> System -> Ctrl+Alt+Del Options
3. Set "Remove Task Manager" to "Disabled" or "Not Configured".
4. Close gpedit.msc
5. Run -> gpupdate /force

Internet and Organizational policies

It is interesting that some people do not care much about data security in most organizations in Maldives. But would it be true to say that they do not care?

I know a system administrator who had the administrative account's password to the email server set with just 3 characters and he was using it at public locations. Almost all organizations allow internet access from the users' desktop machine and they are allowed to use instant messaging and also web-based email most of which allow up to 10MB to be uploaded.

The staff are highly trusted and they could use thumb drives and CDs and most are allowed to install software on their systems. This would go on probably for another five years before it is put to a stop. Already most are realizing the mistakes they make. We have in the past seen photocopies of documents and scanned images of documents on the net "leaked" by some loyal staff and it is quite common that others hear about the news before we inside the organization hear of it.

May time heal all the DATA which is lost due to carelessness of people who are responsible.