Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

grpconv error installing AV and ComboFix won't run


  • Please log in to reply
1 reply to this topic

#1 ToddAndMargo

ToddAndMargo

  • Members
  • 61 posts
  • OFFLINE
  •  
  • Local time:02:33 PM

Posted 08 June 2013 - 10:39 PM

Hi All,

 

Oh, my first post.  My Name is Todd. Been doing computer consulting for the past 18 years.  Am fluent in Windows, especially Linux (wish I had more Linux customers), and sometimes Apple.  I have a bachleors degree in electrical engineering.  If you have a broken computer and want to pay me to fix it, I figure it out in a hurry.  (I fixed probably the last DOS computer in the county in December.) 

 

Hi everyone!

 

Help!

 

I have a customer with XP Pro SP3.  When I went to install Kaspersky Endpoint Security (kes10win_10.1.0.867en.exe), I got three prompts telling me c:\windows\system32\grpconv.exe was locked.  So I uploaded grpconv to virustotal and got told nothing was wrong with it.  I was able to click past the prompts. 

 

Unlocker said grpconf was locked to explorer.exe

 

Suspecious, I ran GMER root kit revealer from http://www.gmer.net.  Found nothing.  Not satisfied, I ran combo fix.  Got to the "it takes 10 minutes..." message and then nothing.  So I left it run overnight.  ComboFix never started counting.  And, in the morning, the machine was frozen.

 

Her machine is running slow and weird too.  I am so suspecious.

 

I found this on the web: http://www.securitystronghold.com/gates/grpconv.html

But I smell a rat.

 

What would you do next?

 

Is there a way to run Combo Fix from a PE disk?  (Virus would be off.)

 

I would run Kaspersky's Rescue Disk, but as I sell Kaspersky, I have learned that if the Windows product doesn't catch it, neither will the rescue disk, as they both use the same scanner and defination files.

 

Many thanks,

-T


Edited by ToddAndMargo, 08 June 2013 - 11:49 PM.


BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,740 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:04:33 PM

Posted 09 June 2013 - 07:59 AM

Good morning :).

 

This forum does not deal with malware issues...it focuses solely on problems which are possibly linked only to the O/S.  Since that is the focus here, I can only try to move this to the appropriate forum.

 

<<Her machine is running slow and weird too>>

 

Since the system appears to be bootable/accessible....I suggest that you follow the guidance reflected in Preparation Guide, Before Using Malware Removal Tools and Requesting Help - http://www.bleepingcomputer.com/forums/topic34773.html and post the DDS log in that forum.  If you have a ComboFix log, you might also attach/insert that into the new topic you initiate in the Malware Removal Logs forum.

 

DO NOT run Combofix again unless instructed to do so by your Helper in the MRL forum.  Please be sure to include a description of your system issues and whatg you have attempted to resolve them.

 

If you cannot produce any of the other logs, then please create the new topic anyway, include the information that you were unable to produce the other logs and why and include the ComboFix log along with a description of your computer issues.
 

Louis


Edited by hamluis, 09 June 2013 - 08:00 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users