TROJ_CMXYS.A

To delete the malware/grayware folder:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
    %Program Files%\I-Tori
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.

To delete the registry key this malware/grayware/spyware created:

1. Restart your computer in Safe Mode. For instructions on how to do this, you may refer to this page. If the preceding step requires you to restart in safe mode, you may proceed to #2.
2. Open Registry Editor. To do this, click Start>Run, type REGEDIT in the text box provided, then press Enter.
3. In the left panel of the Registry Editor window, double-click the following:
   HKEY_CLASSES_ROOT>
4. Still in the left panel, locate and delete the key:
   ieware.IEPlugin.1
5. In the left panel of the Registry Editor window, double-click the following:
   HKEY_CLASSES_ROOT>AppID>
6. Still in the left panel, locate and delete the key:
   ieware.DLL
7. Again Still in the left panel, locate and delete the key:
   {5D52B60F-CCA8-4554-902F-06D3758F751C}
8. In the left panel of the Registry Editor window, double-click the following:
   HKEY_CLASSES_ROOT>CLSID>
9. Still in the left panel, locate and delete the key:
   {A9647484-125B-4CD9-B1B8-18F9456334F4}
10. In the left panel of the Registry Editor window, double-click the following:
    HKEY_CLASSES_ROOT>Interface>
11. Still in the left panel, locate and delete the key:
    {E6F362DD-68A9-410C-8765-D90BDFC3A808}
12. In the left panel of the Registry Editor window, double-click the following:
    HKEY_CLASSES_ROOT>TypeLib>
13. Still in the left panel, locate and delete the key:
    {5D52B60F-CCA8-4554-902F-06D3758F751C}
14. In the left panel of the Registry Editor window, double-click the following:
    HKEY_CURRENT_USER>Software>
15. Still in the left panel, locate and delete the key:
    I-Tori
16. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>
17. Still in the left panel, locate and delete the key:
    I-Tori
18. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>
19. Still in the left panel, locate and delete the key:
    {A9647484-125B-4CD9-B1B8-18F9456334F4}
20. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>
21. Still in the left panel, locate and delete the key:
    Net-warez
22. Close Registry Editor.

To restore the registry value this malware/grayware/spyware modified:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT>Interface>{0002DF05-0000-0000-C000-000000000046}>TypeLib
3. In the right panel, locate the registry value:
   @ = {5D52B60F-CCA8-4554-902F-06D3758F751C}
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   @ = {EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}
5. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT>Interface>{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}>TypeLib
6. In the right panel, locate the registry value:
   @ = {5D52B60F-CCA8-4554-902F-06D3758F751C}
7. Right-click on the value name and choose Modify. Change the value data of this entry to:
   @ = {EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}
8. Again In the right panel, locate the registry value:
   Version = 1.0
9. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Version = 1.1
10. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>Interface>{EAB22AC1-30C1-11CF-A7EB-0000C05BAE0B}>TypeLib
11. In the right panel, locate the registry value:
    @ = {5D52B60F-CCA8-4554-902F-06D3758F751C}
12. Right-click on the value name and choose Modify. Change the value data of this entry to:
    @ = {EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}
13. Again In the right panel, locate the registry value:
    Version = 1.0
14. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = 1.1
15. Close Registry Editor.