does anyone have this in their Internet Explorer ?

http://www.geocities.com/abood24/Hacked.bmp

Is it a virus or what :os cuz I've seen it on many many computers!

I don't have it on my IE. I use FF, anyway.
That's funny, heh. It's the first time that I see and hear about this.

yeah! I downloaded firefox to my laptop and its 10 times better than IE, looks like I'll have to replace my IE in all the computers in the house!

whoa.. nope i use IE and i dont see that! you know you should upgrade your IE at www.windows.com.the new internet explorer is really good.u can open many webistes in different tabs in just one window. look at the pic

I had the Upgraded explorer in my laptop before I formatted it, it kept on crashing when I visit some websites! :os

I noticed some people facing this, its a malware. If you are willing to play with the registry, so then here is the way to get rid of it,

Removing Autostart Entry from the Registry

Removing autostart entry from the registry prevents the malware from executing at startup.

If the registry entry below is not found, the malware may not have executed as of detection. If so, proceed to the succeeding solution set.

Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
MS32DLL = "%Windows%\MS32DLL.dll.vbs"
(Note: %Windows% is the default Windows folder, usually C:\Windows or C:\WINNT.)
Removing Other Added Entry from the Registry

Still in Registry Editor, in the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Main
In the right panel, locate and delete the entry:
Window Title = "Hacked by Godzila"
Close Registry Editor.
Deleting the Malware File

Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
In the Named input box, type:
%Removal drive%\autorun.inf
(Note: %Removable drive% refers to the designated name of the removable drive where the file is saved.)
In the Look In drop-down list, select drive that contains Windows, then press Enter.
Once located, select the file then press SHIFT+DELETE.

thanx NF! this should solve the problem

Most welcome :)

Let me know you if it works.

NF, I faced the same but it doesn't work !

Anyhow,now I'm using FF !!

i have the same things, but as far as i know, its not harmful and it doesnt really do anything so wut the hell

I have the same problem, so I went thru all the steps correctly, but go stuck in the last one.




I tried sarching %Removal drive%\autorun.inf as a file/folder, but it gave me a message that it's not valid.. Help! :help:

It's not something you want to leave on your PC. It copies it self to all the harddisks and flashdisks you have connected to your PC. So with that it will copy itself to someone else via the flash for example.

What I noticed it does is slow down your file browsing a little. Hijacks your Internet Explorer title. And duplicate itself to harddisks.

Steps to clean it away are as NF metioned above. I will re-mention them in the best order I found:

1- Go to task manager (Ctrl+Shift+Esc)
- Choose the processes tab, click on any file you see with the name wscript.exe
- Note: There might be more then one. So look carefully and remove them all.
- To remove it just click on it and then click end process

2- right click on my computer and choose open
- Note: DO NOT DOUBLE CLICK to open it!!! that is how this malware gets activated. If you did by mistake, go back to step #1.
- On the top choose tools > folder options.
- Choose the view tap
- Look for show hidden files and folders and choose it.
- Look for Hide protected operating system files and untick it.
- click ok.

3- right click and choose Open on the harddisk which your windows is on. For example C:
- look for 2 files: autorun.inf and ms32dll.vbs
- use Shift+delete to delete them for good.

4- Go start > run and type regedit
-browse for this location: HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>
Windows>CurrentVersion>Run
- On the right find ms32dll.vbs
- delete it.

5- check msconfig (to go to it click start > run and type msconfig)
- on the startup tab, look for ms32dll.vbs; if you found it untick it.

6- Go to your windows harddisk, for example C: then enter your windows folder and look directly there for ms32dll.vbs and delete it.

Well done.. your clean!!!

NOTE: Remember in the whole process to only right click and OPEN. NEVER double click or else you will have to repeat the whole steps all over again.

Good luck...

Simplest solution: use Firefox.

Yes, follow DeSerTDesTroYeR's, I guess he made it easy to how solve it.

Still in Registry Editor, in the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Main
In the right panel, locate and delete the entry:
Window Title = "Hacked by Godzila"
Close Registry Editor.
Deleting the Malware File
[/I]

DD, you missed this step.. the tag "Hacked by Godzilla" on IE won't go if you don't delete that.

Thanks guys! :) Godzilla's been driving me crazy from morning. :angry: now its gone. :D

snooky: What does FF has to do with anything? The PC itself is infected. So it needs more then a change of browser to get around it. But of course FF as a browser would be recommended.


Teddy Yawza: oh ya! Well that is the least important. But good catch.

Gomennasai -transalation: Sorry-, I did not read everything and assumed it is something wrng with the browser only. What I meant is that people should stop using IE becuase it will get infected all the time somehow, unlike Firefox.

DD is possiple to export the registry file so I can import it to my registry?

What is firefox anyway:think: ?

Hacked By Godzilla remove tools Review

VBS_RESULOWS.A,This Visual Basic (VB) Script may be dropped onto a system by another malware, or may be downloaded from the Internet by an unsuspecting user when visiting a malicious Web site.Upon execution, it drops a copy of itself using the file name MS32DLL.DLL.VBS in the Windows folder. It then creates a certain registry entry so that it automatically executes at every system startup.It attempts to drop copies of itself as MS32DLL.DLL.VBS in all available removal drives every 200 seconds. Furthermore, it attempts to create and execute the file AUTORUN.INF in the same drives.


check NOD32 removal tool " Trail" (http://www.softbkk.com/download/antispyware-antivirus/remove_tools/hacked_by_godzilla_remove_tools.html)


I have another tool which cleans the file as well.I will attach it once am home.

exactly! my norton keeps on detecting this file "MS32DLL.DLL.VBS" and it can't repair it!

thanx alot Genius!
n thanx everybody! now that I'm free I will try what everyone suggested me to do! hope this works with me!

whaaaaaaaaaaat ?!!!! Godzilla !!..U2 ...do u know wht ths Godzilla thing did to my COZIN pc ... it deleted the file seystem in both hard drives ( c.d) and naw he'zzz traying to recover it .. he did got bak the D but not the C ..wooow .. i didnt know that so many ppl have this problome ..

Genius, I used cleaners u provided, and the Godzilla thingy is gone, still, my anti-virus detects the same MS32DLL.DLL.VBS file in drive C and D, also it detects it in the windows folder! what shall I do ?

BrAiKi, maybe the one I have posted wasn't that clear, did you try DeSerTDesTroYeR's method?!

Braiki ,
*turn off your window restore and any other restore softwares you got.

*Restart and enter "SAFE MODE" by Pressing F8 before windows Start.

*Use the tool again and then restart.

*Turn on your restore and make a restore point and call it " Godzilla removal restore point" or so..... so you can restore your pc if you got it again.

will try doing that and I will see..
no NF i haven't tried what DD suggested because I wasn't free until today, I will try it if Genius's method doesn't work, thank you all again :D

it turned out that many people have got this virus!

I used this to remove it from my young brothers PC .

Check the attachment.

You try DeSerTDesTroYeR's, I believe Teddy Yawza tried it & it was fine after that.

I used this to remove it from my young brothers PC .

Check the attachment.

Then what?
I tried running it, but then it recommended that I stop the script. :mmhmm:

Whom exactly recommended it , the software it self or your anti-virus or your spyware or windows ?