This virus is somewhat marked as a Trojan virus, well, a lot of users doesn’t know it’s origin but it does take it some pretty nasty habits with it. It comes with the harmless look of MS32DLL.dll, but it comes with a very odd extention, “.vbs” (Visual Basic Script file). This sort of files can be run automatically if it is executed from the Auto run.When this virus effects one computer, it will automatically clones itself and transfer to any external drive, let it be a thumb drive, an external hardisk, or even a flash card (like SD Card, MMC or Compact Flash). I read a forum stated that some of the other virus that carries the same virus filename also put a text “Hacked by Godzilla” Title bar on Internet Explorer. And it will continue to infect any computer that connects to it.

So far I am not sure whether it is infecting throughout the private network, but I will update if it does.

How Do I Remove It?

There are quite a few steps to remove this Trojan but if your antivirus detects it earlier and erased it you are one step less to complete this detail task:1. Finding potential processes running- Press CTRL, ALT and DELETE key together. You will open the Windows Task Manager.
- Click the Processes tab, and comb through the list and see whether there is a program called wscript.exe is running. If you find it, click on it and click End Process.
- After that you can close the Task Manager window.

2. Finding the virus (for those who were not detected by the antivirus – for Microsoft Windows)

- Go to My Computer
- Click Tools at the top bar –> Folder Options
- When you come to the Folder Options window, click on the View tab
- Look for Hidden files and folders
- Click on Show hidden files and folders
- Press OK
- Once the window is closed, click on your C drive once.
- Right click and select Open from the menu bar
- Once you are in there, look for whether there is a filename called MS32DLL.dll.vbs
- If you can’t find it in C (like I did), look in C:\Windows
- If you still can’t find it, don’t worry, press F3 at the top row of your keyboard (in case you don’t know) and the search bar will be on your left. Click on All files and folders, and type in the file name MS32DLL.dll.vbs

If you don’t find any file in there, congratulations, you are one step out of it.
You can jump to step (4)

3. You found the virus

- Click on the file you found and press SHIFT key and DELETE key
- It will ask you “Are you sure you want to delete (the file name)”. Click Yes
- If you find more than one location that has MS32DLL.dll.vbs, then you need to repeat the steps in (3)

4. Editing the Windows Register (do it with full of caution!)

- Click Start –> Run
- Type regedit and press ENTER
- You will come to the Registry Editor window
- On your left there will be the registry directories. Look for:
HKEY_LOCAL_MACHINE –> Software –> Microsoft –> Windows –> Current Version –> Run
- If there is a MS32DLL in there, delete the entry.
- Then you need to look for:
HKEY_CURRENT_USER –> Software –> Microsoft –> Internet Explorer –> Main
- If you see the Window Title has “Hacked by Godzilla” you should delete that entry.
- You can now close the Registry Editor window

5. Stop all auto runs in future (recommended move)

- Click on Start –> Run
- Type gpedit.msc and press ENTER
- You will come to the Group Policy window
- Go to User Configuration –> Administrative Templates –> System
- Look for Turn off Autoplay and double click it. You will come to Turn Off Autoplay Properties window.
- Click Enable and select All drives from the drop-down combo box.
(It is suggested to turn it off to avoid further potential virus infections in future)
- You can now close the Group Policy window

6. Stopping auto run virus programs (if have)

- Click on Start –> Run – Type msconfig and press ENTER. You will come to the System Configuration Utility window
- Click on the Startup tab, and look for any programs that runs under MS32DLL.dll.vbs
- If you find then, uncheck the checkbox on the left of the file
- Click Apply
- Click Close
- When you close the window it will ask you whether to restart or not. Click on Exit without Restart.

7. Hide your system files

- Go to My Computer
- Click Tools at the top bar –> Folder Options
- When you come to the Folder Options window, click on the View tab
- Look for Hide protected operating system file
- Click on Don’t show hidden files and folders
- Press OK

8. Restarting your PC

- Before restart, make sure that you empty your recycle bin
- Restart your PC
- You will see a windows prompt that you have changed your system configurations. Check on the checkbox not to remind you anymore and press ok.

Source: http://www.interstraits.biz

p.s looks like Malwarebytes’ Anti-Malware can detect and solve the problem.

To see if the operating system is seeing the drive but attempting to assign it to a drive letter already in use, perform the following steps.

1. Click on your Control Panel
2. Find the Administrative Tools icon and double click
3. Double click on Computer Management
4. Double click on Disk Management
5. Disk 0 is always the hard drive; so the Micro Hard Drive should appear as Disk 1 or Disk 2 depending on how many hard drives you have, and the assigned drive letter will be visible here*
6. If you have to change the drive letter, right click on the appropriate Disk and choose Change Drive Letter and Paths
7. Click on the Change button
8. Assign a free Drive Letter and click OK

You will get a warning that this may cause some programs to stop running. This could happen if you have scripts directing automated actions to a specific drive letter.

The new drive letter will be assigned and will be seen as the new letter until you reboot the computer or remove the Micro Hard Drive from the port.

*Note: In the Drive Management program any external drives such as a USB Flash drive will been seen in the upper right window, but won’t be seen as a logical drive in the lower right window