Widdit.com/toolbar

[Guest Alfran]

I have eset installed and it sent me a warning about 'widdit toolbar' while i was running updates on IE ,... i thought it was part of my updates and allowed it to pass. How do I now undo/ uninstall /remove it now? I think it is a malware .... I see it in the 'detechted log files'  in red with no action listed. How can i now block this now since i had not deleted it when the warning message came the first time?

[Arakasi 549]

Change the no action listed option. Try scanning again.

To quickly disable toolbar.

Go to Control panel 》internet options 》 programs tab 》manage addons 》 set to disabled

[Guest Alfran]

It doesnt seem to be listed there. The only one i cant recognize is something from Simply Tech - home tab. but it wont let me disable.

 

I think its a script not installed program. every time i try to launch a new page on IE  a message 'internet script error' comes out asking if  i want to stop running the script hxxp://api.toolbar.widdit.com/interface/HtmlCompInterfaceVer2.js

[Arakasi 549]

Step by step guide to remove Widdit.com

Step 1- Boot your computer into Safe Mode with Networking

Step 2- Reset Internet Explorer by the following guide (take IE as an example):
Open Internet Explorer >> Click on Tools >> Click on Internet Options >> In the Internet Options window click on the Connections tab >> Then click on the LAN settings button>> Uncheck the check box labeled “Use a proxy server for your LAN” under the Proxy Server section and press OK.

Step 3- Disable any suspicious startup items that are made by infections from Widdit.com
For Windows Xp: Click Start menu -> click Run -> type: msconfig in the Run box -> click Ok to open the System Configuration Utility -> Disable all possible startup items generated from Widdit.com.
For Windows Vista or Windows7: click start menu->type msconfig in the search bar -> open System Configuration Utility -> Disable all possible startup items generated from Widdit.com.

Step 4- Open Windows Task Manager and close all running processes.
[random].exe

Step 5- Remove these associated Files on your hard drive such as: ( Search throughout profile ) A.rs
%AllUsersProfile%\{random}
%AllUsersProfile%\{random}*.lnk

Step 6- Open the Registry Editor and delete the following entries: ( Recommend Rename or Backup Registry before Delete ) A.rs
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\random
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Disallow\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\random
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" = "[random].exe"

Step 7-Restart your computer normally to check whether there is still redirection while browsing.

( Full scan with Eset and Malwarebytes after the fact ) Arak.rs

( Scan with SuperAntispyware for cookies or Hitmanpro ) rs

 

 

Source: www.zimbio.com

Edited August 21, 2013 by Arakasi

[Guest Alfran]

I think i managed to do it.

It was listed under 'Simply tech - Home tab'. Managed to locate and disable and uninstall.

Hope its the end of that!

 

[Arakasi 549]

Great !