Home Malware Programs Fake Warning Messages 'U.Z.A. Operating System Wallpaper' Fake Wallpaper

'U.Z.A. Operating System Wallpaper' Fake Wallpaper

Posted: March 18, 2009

The 'U.Z.A. Operating System Wallpaper' fake wallpaper is a distinctive black-and-white wallpaper that appears as a symptom of infection by the U.Z.A. O/S Eliminator worm. This ominously named worm is a fairly accurate label, since improper removal of the UZA worm can cause your OS to become non-functional. Along with creating a 'U.Z.A. Operating System Wallpaper' fake wallpaper and locking your desktop to it, the UZA worm will also disable certain Windows features and programs, including Task Manager. Since this results in a much less safe PC, SpywareRemove.com malware experts recommend that you delete 'U.Z.A. Operating System Wallpaper' fake wallpaper and its accompanying UZA worm with a qualified anti-malware product. Until you've confirmed that your PC is once again free of both 'U.Z.A. Operating System Wallpaper' fake wallpaper and its worm, you should pay close attention to your removable drives, since the UZA worm has been known to use USB devices and other types of removable drives to infect new computers.

Seeing What Lies Beyond 'U.Z.A. Operating System Wallpaper' Fake Wallpaper's Minimalist Presentation

The 'U.Z.A. Operating System Wallpaper' fake wallpaper is always attended by a UZA worm infection and can be identified with ease by its stark promotion of U.Z.A. O/S Eliminator in white text against a black background. The UZA worm may also add a UZA O/S icon next to your system tray's clock, but these visible alterations aren't nearly as significant as the UZA worm's concealed functions. SpywareRemove.com malware analysts note that, as a PC threat that came from the Maldives in mid-2007, the UZA worm currently has low distribution and your chances of being infected with it are low. Despite this, the UZA worm's damage potential can be potentially high due to the attacks it makes against baseline Windows features that are linked to the security of your OS.

The most likely source of infection by the UZA worm, as is the case for many worms, is through USB devices and other forms of removable hard drives. These removable drives can play unwitting host to UZA worms, which conceal their .exe files as fake My_Personal_Data folders. From this vantage point, the UZA worm can install itself automatically via AutoRun exploits, and afterwards lock the new computer's wallpaper to another 'U.Z.A. Operating System Wallpaper' fake wallpaper.

Why You Should Step Lightly Around a 'U.Z.A. Operating System Wallpaper' Fake Wallpaper

Although a 'U.Z.A. Operating System Wallpaper' fake wallpaper isn't able, under its own power, to harm your PC, SpywareRemove.com malware researchers recommend the utilization of the best anti-malware applications that are available to scan your computer whenever you see an 'U.Z.A. Operating System Wallpaper' fake wallpaper appear. UZA worms that are associated with 'U.Z.A. Operating System Wallpaper' fake wallpaper have been known to cause other issues that are less visible than the 'U.Z.A. Operating System Wallpaper' fake wallpaper but considerably more dangerous than this wallpaper, such as:

  • Disabling Windows Task Manager.
  • Blocking the Shift override function that can be used to bypass applications while Windows starts.
  • Disabling Windows completely, in cases where UZA worms or components of them, such as 'U.Z.A. Operating System Wallpaper' fake wallpapers, aren't removed in an appropriate fashion.

Since UZA worms that traffic in 'U.Z.A. Operating System Wallpaper' fake wallpapers will create copies of themselves and conceal themselves in your Windows\System32 folder, SpywareRemove.com malware research team discourages any attempt to catch and get rid of UZA worms by non-automated means. Appropriate anti-malware programs remain your best bet of getting rid of a 'U.Z.A. Operating System Wallpaper' fake wallpaper and UZA worm without damaging Windows. However, since the UZA worm fails to block the Registry Editor despite using Windows Registry-based attacks, PC experts may attempt to revert some of an UZA worm's system changes by editing the Registry, although this is not advisable for non-experts in PC security.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Windows%\boot.bmp
    2 %Windows%\System32\DPP(1).dll
    3 %Windows%\System32\DPP(10).dll
    4 %Windows%\System32\DPP(2).dll
    5 %Windows%\System32\DPP(3).dll
    6 %Windows%\System32\DPP(4).dll
    7 %Windows%\System32\DPP(5).dll
    8 %Windows%\System32\DPP(6).dll
    9 %Windows%\System32\DPP(7).dll
    10 %Windows%\System32\DPP(8).dll
    11 %Windows%\System32\DPP(9).dll
    12 %Windows%\System32\PWallpaper.jpg
    13 %Windows%\System32\uos.exe
    14 %Windows%\System32\VisLoader.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies: delete everything in Policies except the value: "default"HKEY..\..\..\..{RegistryKeys}HKEY_CURRENT_USER\Control Panel\International find the value 'sTimeFormat' and change to read: hh:mm:ss tt
Loading...