MikeLigalig.com

A friend of mine has just bought a new computer. He already has a wireless Internet in his house. Last weekend he invited me to come to his home and stay with his family. I was excited to explore the world of his new computer.

But something happened.

He doesn't have a Firefox browser in his computer. I was forced to use Internet Explorer instead, to my sorrow. Everything was perfect in his computer except for one: his Internet Explorer was just hijacked by Godzilla. He was running NOD32 anti-virus but the anti-virus failed to catch Godzilla. Does size really matter?

I don't know who this Godzilla is. I've seen many computers using Internet Explorer being hijacked by Godzilla. I couldn't find a solution because there was no way I could access the Internet and download an anti-virus or anti-spyware or whatever online tools that could kill Godzilla. Do you have a solution to kick out Godzilla from a computer?

Okay, a new computer of my friend, fresh from the manufacturer, was rendered useless until now. I'll be back to his house next week and bring some weapons of mass destruction to destroy Godzilla. For the nth time I realized that using Internet Explorer is an act of digital suicide. I had mentioned this before that I had to wipe out all the contents of my hard drive after my Internet Explorer was compromised by a fatal virus that even disabled Windows System Restore and prevented me from rebooting the computer.

If you're not yet convinced and you still want to use Internet Explorer, you are courting digital disaster.

Save the world, don't use Internet Explorer.

Linkback: https://tubagbohol.mikeligalig.com/index.php?topic=2896.0

Problem - My IE title shows 'Hacked by Godzilla'


Hacked By Godzilla - MS32DLL.dll.vbs - wscript.exe
Ariticle By
Chua Kia Nee - Techie Corner



Recently my IE title shows “Hacked by Godzilla” after transfer some files to a handy drive. “Hacked by Godzilla - MS32DLL.dll.vbs” also known as VBS.Zodgila worm was discovered since Nov 23, 2006. It has very low threat (according to symantec report). “Hacked by Godzilla - MS32DLL.dll.vbs” worm spread thru handy drive or floppy disk.



This is basically what Hacked by Godzilla - MS32DLL.dll.vbs - VBS.Zodgila do when it execute:

Creates the following files:

[DRIVE LETTER]:\MS32DLL.dll.vbs
[DRIVE LETTER]:\MS32DLL.dll.vbs
[DRIVE LETTER]:\autorun.inf

Note: %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows (Windows 95/98/Me/XP) or C:\Winnt (Windows NT/2000).

Adds the value:

“MS32DLL” = “%Windir%\MS32DLL.dll.vbs” to the registry subkey:
HKEY_LOCAL_MACHINE \SOFTWARE \Microsoft \Windows \CurrentVersion \Run
so that it runs every time Windows starts.

Adds the value:

“Window Title” = “Hacked by[REMOVED]” to the registry subkey:
HKEY_CURRENT_USER \Software \Microsoft \Internet Explorer \Main
to modify title in Internet Explorer.

Attempts to copy itself to removable drives and create registry entries every 200 seconds.

Information above was taken from Symantec website.


If your computer affected by “Hacked by Godzilla - MS32DLL.dll.vbs” worms:-

Your Internet Explorer title will end with “Hacked by Godzilla”

You might not able to open any of your drive thru double click (you still able to open/explore using right click -> explore)

How to remove “Hacked by Godzilla - MS32DLL.dll.vbs” (VBS.Zodgila) worm?

* Open Task Manager ( Right click on your taskbar and click “Task Manager” )

* Click on Processes tab and select “wscript.exe” and click “End Process” button. (Remember to remove all wscript.exe)

* Go to My Computer, Click on Tools -> Folder Options, click on View tab Under Advance settings,
check “Show Hidden files and folders“,
uncheck “Hide extensions for known file types“,
uncheck “Hide protected operating system files (Recommended)”
and click “OK” button

* Go to C:\WINDOWS or C:\WINNT and delete file MS32DLL.dll.vbs

* Now go to all your drive in your computer, and delete autorun.inf and MS32DLL.dll.vbs including your USB Drive and Floppy disk. All the autorun.inf and MS32DLL.dll.vbs file is located at the root directory of your drive, ex: c:\MS32DLL.dll.vbs, d:\MS32DLL.dll.vbs …

Note:- To access your drive, Go to My Computer, right click on the drive and select “Explore”


*Next we are going to clean your registry record. Click Start -> Run, type regedit

* Go to HKEY_LOCAL_MACHINE \Software \Microsoft \Windows \Current Version \Run and delete MS32DLL (right click on it and select delete)

* Now we are going to disable CD Autorun, Go to HKEY_LOCAL_MACHINE \SYSTEM \CurrentControlSet \Services \Cdrom look for Autorun and double click on it and enter 0 as it’s DWORD value


Note:- You can skip this steps if you do not wish to disable CD Autorun feature. But Hacked By Godzilla worm spread when CD Autorun is ON.

*Go to HKEY_CURRENT_USER \Software \Microsoft \Internet Explorer \Main and delete “Window Title” which has it’s value of “Hacked by Godzilla“

*Now go back to My Computer, Click on Tools -> Folder Options, click on View tab

* Under Advance settings,
uncheck “Show Hidden files and folders“,
check “Hide extensions for known file types“,
check “Hide protected operating system files (Recommended)”
and click “OK” button

*Empty your Recycle Bin.

*Restart your PC and your PC should be clean from Hacked by Godzilla now

---------->>>
haven't tried... pero check lang sad... 

HTH

Linkback: https://tubagbohol.mikeligalig.com/index.php?topic=2896.0

post lang sad ngari ang result mike maski failure! basin dli matabang na to. hehehe

good luck! 

Linkback: https://tubagbohol.mikeligalig.com/index.php?topic=2896.0

Atty. Handel,

Your computer has been hijacked. Yes, that is a virus now happily living in your system courtesy of Internet Explorer.

Use Firefox as soon as you can and never look back on IE.

Mike

Linkback: https://tubagbohol.mikeligalig.com/index.php?topic=2896.0

Thank you, Mike. I'll try this when I get home.

Linkback: https://tubagbohol.mikeligalig.com/index.php?topic=2896.0

Murag wala pay law, galen. Many of our senators and congressmen wa kahibalo unsa nang Internet. In other countries, congressmen and senators have their own interactive websites but in the Philippines (as read in senate.gov.ph), you'll find that our senators are still using yahoo.com e-mails instead of [email protected].

Linkback: https://tubagbohol.mikeligalig.com/index.php?topic=2896.0

Many of our provinces are bereft of websites.

Stats:

Thailand Population: 65,000,000
Websites in Thailand: 120,000 and counting

Switzerland Population: 6,000,000
Websites: 199,000 plus and counting

Philippine Population: 91,000,000 (according to the latest data from the CIA)
Websites: 27,000 and declining

Singapore Websites: 61,400

That will give you an insight of what's going on of the Philippine web trends.


Linkback: https://tubagbohol.mikeligalig.com/index.php?topic=2896.0