sUBs

Spybot's TeaTimer is an excellent tool for the prevention of spyware but it can sometimes prevent HijackThis from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.

• Open Spybot Search & Destroy.
• In the Mode menu click "Advanced mode" if not already selected.
• Choose "Yes" at the Warning prompt.
• Expand the "Tools" menu.
• Click "Resident".
• Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
• In the File menu click "Exit" to exit Spybot Search & Destroy.

1. Reboot into SafeMode
   
   
2. Locate and delete the following folder(s), if present:
   
   • C:\Program Files\Aprps
     C:\WINDOWS\system32\nsvsvc
     C:\Program Files\Media Access
   
   
3. Run a scan with HiJackThis & select(tick) the following & click [Fix checked] :
   
   O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\hhnjnk.exe reg_run
   O4 - Global Startup: rrpk.exe
   
   
4. Run KillBox
   * do not be alarmed if several files aren't found
   1. Click [Replace on Reboot] and check the [Use Dummy] box.
   2. Paste the following into the top [Full Path of File to Delete] box.
      • C:\WINDOWS\system32\hhnjnk.exe
   3. Click the red-and-white [Delete File].
   4. Click Yes at the Replace on Reboot prompt.
   5. Click No at the Pending Operations prompt.
   6. Repeat steps 2-5 above for these files:
      • C:\WINDOWS\system32\nnopoek.dll
        C:\WINDOWS\system32\__delete_on_reboot__nnopoek.dll
        C:\WINDOWS\system32\ddrnrca.exe
        C:\WINDOWS\system32\iiqwq.dll
        C:\WINDOWS\system32\wwbab.dat
   7. Click [Replace on Reboot] and check the [Use Dummy] box.
   8. Paste the following file into the top [Full Path of File to Delete] box.
      • C:\Documents and Settings\All Users\Start Menu\Programs\Startup\rrpk.exe
   9. Click the red-and-white [Delete File] button.
   10. Click "Yes" at the Replace on Reboot prompt.
   11. Click "Yes" at the Pending Operations prompt to restart your computer. You do not need to reboot into Safe Mode this time.
   
   
5. When your computer reboots, post a fresh HJT log