Showing posts with label registry edits. Show all posts
Showing posts with label registry edits. Show all posts

Tuesday, August 21, 2007

U.Z.A. O/S - do not format your system to remove it...

Have you heard of "U.Z.A. O/S"? Maybe you have seen this screen?



This is caused by a malware. It hurts you by running a simple program or two and using few wallpapers and modifying the registry so that you cannot change the desktop wallpaper and end process with Windows Task Manager.

The following hacks are for advanced users.
For you to be able to reverse the process you need to be able to view hidden files, system files and edit registry. [You may want to disable system restore to prevent restoring of files you modify.]

If you are able to view Hidden Files and System Files:
1. Delete %windir%\system\uos.exe ["%windir% = C:\windows", most of the time]
2. Delete %windir%\system32\VisLoader.exe
3. Edit C:\boot.ini to remove extra parameters after multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

If you are able to edit registry copy the following to a text document and save with the extension .reg and double click the .reg file to update the registry or edit the following entries in the hive:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"NoDispAppearancePage"=dword:00000000
"NoDispBackgroundPage"=dword:00000000
"NoDispScrSavPage"=dword:00000000
"NoDispSettingsPage"=dword:00000000

[HKEY_CURRENT_USER\Control Panel\International]
"sTimeFormat"="HH:mm:ss"



Other resources to follow:

Enabling Task Manager from Group Policy Editor

1. Run -> gpedit.msc
2. User Configuration -> Administrative Templates -> System -> Ctrl+Alt+Del Options
3. Set "Remove Task Manager" to "Disabled" or "Not Configured".
4. Close gpedit.msc
5. Run -> gpupdate /force