Open up task manager. (Right click task bar, Task Manager)
End these tasks:
C:\kybrdff_11a.exe
C:\winnt\system32\stonedrv.exe
c:\oxaeddd.exe
Next, open HijackThis.
Select None of the above, just start the program.
Click Scan
Once it's done, tick these entries:
R3 - URLSearchHook: DeskbarBHO -
{A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program
Files\Deskbar\deskbar.dll
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_11a.exe
O4 - HKLM\..\Run: [stonedrv] c:\winnt\system32\stonedrv.exe
O4 - HKLM\..\RunServices: [stonedrv]
c:\winnt\system32\stonedrv.exe
O4 - HKCU\..\Run: [stonedrv] c:\winnt\system32\stonedrv.exe
Click Fix checked.
_____________________________
Download smitfraudfix
Extract and save it to your desktop.
Restart your computer in Safe Mode.
1) Close any open programs and open the SmitFraudFix folder
2) Double-click on the SmitfraudFix.cmd file
3) When the tool first starts you will see a credits screen. Simply
press any key on your keyboard to get to the next screen. You will
now see a menu as shown in the image below. Press the number 2 on
your keyboard and the press the enter key to choose the option
Clean (safe mode recommended).
4) The program will start cleaning your computer and go through a
series of cleanup processes. When it is done, it will automatically
start the Disk Cleanup program. This program will remove all Temp,
Temporary Internet Files, and other files that may be leftover
files from this infection. This process can take up to a few hours
depending on your computer, so please be patient. When it is
complete, it will close automatically and you will should continue
with step 5.
5) When Disk Cleanup is finished, you will be presented with an
option asking Do you want to clean the registry ? (y/n). At this
screen you should press the Y button on your keyboard and then
press the enter key.
6) When this last routine is finished, you will be presented with a
red screen stating Computer will reboot now. Close all
applications. You should now press the spacebar on your computer. A
counter will appear stating that the computer will reboot in 15
seconds. Do not cancel this countdown and allow your computer to
reboot.
7) Once the computer has rebooted, you will be presented with a
Notepad screen containing a log of all the files removed from your
computer. Post this log.
__________________________
Next, download Bruteforce Uninstaller
Unzip it to a folder of its own (c:\BFU).
Start the Brute Force Uninstaller by doubleclicking BFU.exe
Next to the 'scriptfile to execute'-window you'll see a little icon
as shown in next picture: 
When you click that icon, a little window will open that says:
'Please enter the full URL to the sript you want to execute'
In the field, copy and paste next URL:
http://metallica.geekstogo.com/alcanshorty.bfu
Click Ok.
Then click execute in Brute Force Uninstaller.
If nothing happens after pressing the Execute button, this means
that the script didn't download. In that case, download the
script
( alcanshorty.bfu ) manually from above url ( rightclick on it and
choose 'save as' and save it in your BFU-folder). Then start
BFU.exe again and click the browse button next to the 'scriptfile
to execute'-window
Browse to the script you downloaded and Click Ok and Execute in
Brute Force Uninstaller.
Wait for the complete script execution box to popup and press
OK.
Press exit to terminate the BFU program.
______________________________
Next, go to Start > Search.
Search for this file: astapi.dll
Search in all hidden and subfolders as well.
If it is not found, open HijackThis. Click None of the above, just
start the program. Tick this entry:
O20 - Winlogon Notify: RunOnceEx - C:\WINNT\system32\astapi.dll
(file missing)
Click Fix checked.
______________________________
Now, run your Ewido.
Update it before scanning.
Scan and remove anything found. Then post another HijackThis log
again.
