MS Juan Registry problem

[Sparky21]

I have a Toshiba Satilite running windows xp home sp3 and mb prints up....HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

But it is not deleted and removed it reappers after every reboot.. .I have also done mb in safe mode and it comes back with teh same problem...i Hva ealso removed all java installed software...i tried to delete it manually out of the regedit but it still returns...my brain is rattled..i am new to this forum and i am sry if i posted this in the incorrect manner but help would be greatlly apprecitated...thxs respond asap if possible.....

[AdvancedSetup]

No problem. Please follow the instructions here and then post a new topic in the HJT forum.

Pre- HJT Post Instructions

[PCInfoWiz]

I have a Toshiba Satilite running windows xp home sp3 and mb prints up....HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

But it is not deleted and removed it reappers after every reboot.. .I have also done mb in safe mode and it comes back with teh same problem...i Hva ealso removed all java installed software...i tried to delete it manually out of the regedit but it still returns...my brain is rattled..i am new to this forum and i am sry if i posted this in the incorrect manner but help would be greatlly apprecitated...thxs respond asap if possible.....

The "MS Juan" entry in the registry may be caused by an Add-On for IE6.

It is created upon starting IE6 and the privacy level for cookies changes to "Accept All cookies".

To confirm this remove MS Juan with Malwarebytes, then start IE6 and see if it reappears.

If it does, then it must be an Add-On. IE6 for Windows XP SP2 will allow you to Manage and disable Add-Ons.

The following directions may help you remove it:

1) To get there go to Internet Properties > Programs > Manage Add-Ons... and

disable "oxvvqw.dll" in the list of Active X Add-Ons.

2) In the registry, delete all key entries for "oxvvqw.dll" in the registry.

3) Finally delete the file "oxvvqw.dll" found in C:\Windows\system32\.

This was my only experience with "MS Juan" but its possible the dll file could have a different name?

Hope this works for you. Good Luck!!

[JeanInMontana]

The "MS Juan" entry in the registry may be caused by an Add-On for IE6.

It is created upon starting IE6 and the privacy level for cookies changes to "Accept All cookies".

To confirm this remove MS Juan with Malwarebytes, then start IE6 and see if it reappears.

If it does, then it must be an Add-On. IE6 for Windows XP SP2 will allow you to Manage and disable Add-Ons.

The following directions may help you remove it:

1) To get there go to Internet Properties > Programs > Manage Add-Ons... and

disable "oxvvqw.dll" in the list of Active X Add-Ons.

2) In the registry, delete all key entries for "oxvvqw.dll" in the registry.

3) Finally delete the file "oxvvqw.dll" found in C:\Windows\system32\.

This was my only experience with "MS Juan" but its possible the dll file could have a different name?

Hope this works for you. Good Luck!!

MS Juan is the Vundo trojan. The IE add on is most likely a BHO malicious in nature. The registry keys and dll's are never the same name. What you had on your system will not be the same on the next.