I have a customer with XP Pro SP3. When I went to upgrade Kaspersky Endpoint Security (kes10win_10.1.0.867en.exe), I got three prompts telling me c:\windows\system32\grpconv.exe was locked. So I uploaded grpconv to virustotal and got told nothing was wrong with it. I was able to click past the prompts. The symptoms reproduce with the prior version of KESS (kes220.127.116.111_wksfswin_en.exe)
Unlocker said grpconf was locked to explorer.exe
Suspicious, I ran GMER root kit revealer from http://www.gmer.net. Found nothing. Not satisfied, I ran combo fix. Got to the "it takes 10 minutes..." message and then nothing. So I left it run overnight. ComboFix never started counting. And, in the morning, the machine was frozen.
Her machine is running slow and weird too. I am so suspicious.
I found this on the web: http://www.securitystronghold.com/gates/grpconv.html
But I smell a rat.
Kaspersky tech support drew a blank.
I downloaded and ran DDS.com to get a report. I get the scanning screen with the "please wait" and the blocks going across. The blocks get to about 80% and then nothing for 20 minutes (would have left it longer, but the customer had to power off due to thunder storms). It is suppose to take three minutes. CPU was ~6% and dds.com was 0%.
What to do next?
Is there a way to run Combo Fix from a PE disk? (Virus would be off.)
I would run Kaspersky's Rescue Disk, but as I sell Kaspersky, I have learned that if the Windows product doesn't catch it, neither will the rescue disk, as they both use the same scanner and defination files.