NvCpl.dll worm xp

Anonymous
2011-12-03T00:25:26+00:00

I have a slow running XP machine.  While troubleshooting, I remove all startup items with msconfig by the disable all button and restarted the machine.

Upon a msconfig a checked MvCpl.dll command line was there.  The original on was also there uncheck.  I searched my C-drive for NvCpl.* and received:

   NvCpl     C:\Windows\Help  Help File

  NvCpl.dll  C:\Windows\System32 

  NvCpl       C:\Dell\Drivers\R65699 Help File

  NvCpl.dll   C:\Dell\Drivers\R65699

  NvCpl       C:\Dell\Drivers\R89437   DL_File

  NvCpl        C:\Dell\Drivers\R89437   HL_File

Bounced around on the internet and learned that a rwiz.exe seem to belong to this worm.  It is also in my msconfig startup page.

Any help with removing this Worm would be appreciated.

Avalonfv

Windows for home | Previous Windows versions | Windows update

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments
Answer accepted by question author
Anonymous
2012-01-05T03:06:41+00:00

I just re-read the entire thread. I was struck by two things:

  1. This PC was once on a domain.
  2. This PC had trojans.

I am aware you reconfigured the PC to change it from Domain to Workgroup, but there still might be something in the profile that is searching for something on the domain. I suppose you could create a fresh profile, but I'm not sure I'd waste my time since...

I believe the PC is still compromised. Malware can sometimes be VERY tricky to remove. Sometimes it might APPEAR to be gone, but there will still be a nasty, almost-impossible-to-detect rootkit present (or maybe even a "bootkit" hiding out in the boot sector). The symptoms you describe certainly indicate the presence of malware; the PC might very well be a part of the "botnet" right now.

I recommend that you make sure all the data is backed up and nuke the drive and start from scratch. It's a hassle, but it would probably still be the quickest (and surely be the most effective) way to deal with this mess.

If you had unlimited time and wished to experiment and explore (but I believe you said this PC belongs to a friend), you could search the web for Process Explorer tutorials and start a thread on Bleeping Computer or a similar site to get guided help. But I truly think you'll be better off if you flatten and rebuild.

Good luck and Happy New Year!

Was this answer helpful?

1 person found this answer helpful.
0 comments No comments

42 additional answers

Sort by: Most helpful
  1. Anonymous
    2011-12-06T17:19:00+00:00

    Mr. Bear,

    I have ran Malwarebytes and removed a Trojan.Agent named WinXp.

    The Dell service tag is GTLZN31.

    The system has 512MB of RAM.  I have purched 2GB for it.  At this point shall I install?  The performance of the system is better but still slow but a little quicker than before.

    The primary IDE Channel

    Device 0

    Transfer Mode DMA if available

    Current Mode Ultra DMA Mode 2

    Device 1

    Transfer Mode DMA if available

    Current Mode Not Applicable

    The secondary IDE Channel

    Device 0

    Transfer Mode DMA if available

    Current Mode PIO mode

    Device 1

    Transfer Mode DMA if available

    Current Mode Not Applicable

    I have also uninstalled AVG with it's program.

    Thanks SL Jiles

    Was this answer helpful?

    0 comments No comments
  2. Anonymous
    2011-12-03T22:40:10+00:00

    What follows looks like a lot to do but it sounds like things are a little ridiculous for you right now.  It is mostly copy/paste for me (I don't do much actual typing if I can help it).  Jut read through it all first so you can see what is going on...

    If your Dell has a Service Tag number, let's have it so we can look up some things easier on the Dell site.

    Your Dell Service Tag:   ___________________

    When you can, do this:

    Download, install, update and do a quick scan with this free malware detection program:

    Malwarebytes (MBAM):  http://malwarebytes.org/

    Since you are using IDE drives, use Device Manager to verify the transfer mode of the IDE channels is set to something like DMA if available (depends on your hardware) and not the slower PIO mode.

    PIO is the slowest, DMA is the fastest.

    This is easy to check and generally easy to fix and the mode would not have changed by itself, so if it has changed to PIO, change it to DMA and then figure out why it changed and fix it.

    To launch the Device Manger console, click Start, Run and in the box enter:

    %SystemRoot%\system32\devmgmt.msc

    Click OK.

    Expand the IDE/ATA controller section to see your IDE channels. Right click each, choose Properties, and for each channel that has an Advanced Settings tab, determine the Transfer Mode. There are usually 4 channels to check in a desktop, maybe fewer for laptops.

    The fastest selection will be some kind of DMA selection (usually: DMA DMA5, UDMA, etc.).  If it is PIO, change it to DMA.

    If you are not sure about what you see post back for help and advice.

    Follow this up with a reboot to make sure any changes stick.

    What may have caused the change?

    http://support.microsoft.com/kb/817472

    If you want faster Internet browsing, give Firefox a look.  Most folks like it better than IE, it is faster and there is nothing wrong with having multiple browsers on your system - I have 4 installed right now and never use IE except when MS makes me.  Just use IE when Microsoft makes you use it (like for updates, etc.).

    http://www.mozilla.org/en-US/firefox/new/

    When you can, lets get the msinfo32 info in it's entirety if possible so we can see for sure what your video situation is (NVIDIA or not).

    Click Start, Run and in the box enter:

    msinfo32

    Click OK, and when the System Summary info appears, click Edit, Select All (Ctrl-A), Copy (Ctrl-C) and then paste (Ctrl-V) the information back here.

    For video driver information, expand the Components, click Display, click Edit, Select All, Copy and then paste the information back here.

    There will be some personal information (like System Name and User Name), and whatever appears to be private information to you, just delete it from the pasted information.

    I can say that if you have your AVG installed "out of the box" or if it still thinks it is at the work environment (or something silly like that), it will sure slow you down.   There are other AV options out there that are less burdensome.

    You may see if you can disable AVG temporarily to see how things look, or just uninstall it all completely, reboot, test performance and reinstall it again or, just replace it with something that is less burdensome - Microsoft Security Essentials is not too bad:

    http://windows.microsoft.com/en-US/windows/products/security-essentials

    If you choose to reinstall AVG, here are some notes I have (but I have not installed AVG in a while so this could have changed):

    Find your AV uninstaller here and be sure to use it. 

    DO NOT use Add/Remove Programs to uninstall AVG - AVG has their own special uninstaller.

    http://www.raymond.cc/blog/comprehensive-list-of-uninstallers-or-removal-tools-for-antivirus-software/#more-2878

    If you are compelled to keep using AVG, then do a fresh install of AVG with their latest version.

    This time, do not install AVG with "all the options" enabled since it will add more overhead than most people need.  Of course that is up to you and your Internet habits, but generally speaking, the more protections you have installed, the slower your system is going to run.

    You can read about these AVG components first to see if you think you really need them

    in your environment or not.

    When you install AVG this time, select the CUSTOM install option and do NOT install (uncheck) the following:

    E-mail Scanner

    Personal E-mail Scanner

    Microsoft Outlook add-in

    LinkScanner

    AVG Search Shield

    AVG Surf Shield

    Firewall

    Identity Protection

    Online Shield

    Security Toolbar

    Linkscanner

    Search-Shield

    Active Surf-Shield

    Smart Scanning

    Security toolbar

    Any of the email scanning components

    If you wonder why you don't need your antivirus to scan your email, read this article:

    http://thundercloud.net/infoave/tutorials/email-scanning/index.htm

    (Thanks, PA Bear.)

    I am busy until early next week, but go ahead and post your info back and somebody else can jump in and help (hopefully).  I don't "own" this thread - this is a community forum!

    Was this answer helpful?

    0 comments No comments
  3. Anonymous
    2011-12-03T21:26:54+00:00

    JoseIbarra:

    Thank your kind help.  I shall answer your question in order.

    1. Dell Inspiron 5150
    2. XP Pro SP3
    3. Internet Explorer 8
    4. IDE
    5. SPYBOT
    6. The slowness started after being moved from a work environment to home environment.  The system belongs to a friend.  The Plant communicate with this laptop through access points to a mainframe.  Of course there were a series of domains.  I will discuss this further in answer 10.

    7.Yes DVD Optical drive is available

    1. I see a very slow reacting machine and I expect it should respond faster.
    2. I have started an AVG scan on the laptop.  It took me 4 hours to load AVG on the system.  The scan is now in its 17th hour with 97% completion and 10 files witrh Trojen Hourse Generic 16.bboc.  All files are in the recycler.

    10. I did change the network environment to home.  Thus eleminating all of the domains.  Everytime I boot the system I must return it to a home environment to get out on the internet.

    The MSINFO32 is below:

    Processor         x86 Family 15 Model 2 Stepping 9 GenuineIntel ~3061 Mhz

    BIOS Version/Date        Dell Computer Corporation A33, 3/8/2004

    SMBIOS Version           2.3

    Total Physical Memory 512.00 MB

    Page File          C:\pagefile.sys

    Was this answer helpful?

    0 comments No comments
  4. Anonymous
    2011-12-03T08:49:31+00:00

    The NvCpl.dll file is part of the NVIDIA control panel (usually) for your video system.  If you right click the file you found and go through the file Properties, you should see that it is the NVIDIA Control Panel Applet (Control Panel applets have a .cpl file extension).

    Since we don't know anything about your system except it appears to be some kind of Dell, some Dells have NVIDIA video components in them, so that could be a valid startup entry that would show up in msconfig maybe looking something like this one from my system:

    NvCplDaemon    RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

    If that is what yours looks like and it is unchecked, sombody or something unchecked it or you may have told the NVIDIA panel not to load at start up.  It is not "required" to start if you don't care to use the NVIDIA control panel, so it could have been disabled to reduce startup times (mine is disabled too) or in a troubleshooting session.

    Since we also don't know what your current antivirus and antimalware situation is, if you think your system is afflicted with malicious software, I would do this and THEN troubleshoot remaining issues:

    Perform some scans for malicious software, then fix any remaining issues:

    Download, install, update and do a full scan with these free malware detection programs:

    Malwarebytes (MBAM):  http://malwarebytes.org/

    SUPERAntiSpyware: (SAS):  http://www.superantispyware.com/

    They can be uninstalled later if desired.

    If you still have problems, then do this:

    Since the Microsoft Answers forum does not prompt for any kind of system information when a new question is asked, we know absolutely nothing about your system.  Not knowing fundamental information about a problem prolongs the frustration and agony of resolving these issues.

    Thank you MS Answers, for making the resolution of simple problems as frustrating and time consuming as possible.

    Please provide additional information about your system as best you can:

    What is your system make and model?

    What is your XP Version and Service Pack?

    What is your Internet browser and version?

    Does your system have IDE or SATA drives?

    Describe your current antivirus and anti malware situation:  McAfee, Symantec, Norton, Spybot, AVG, Avira!, MSE, Panda, Trend Micro, CA, Defender, ZoneAlarm, PC Tools, Comodo, etc.

    Was the issue preceded by a power interruption, aborted restart, or improper shutdown?  (this includes plug pulling, power buttons, removing the battery, etc.)

    Does the afflicted system have a working CD/DVD drive (internal or external)?

    Do you have a genuine bootable XP installation CD (this is not the same as any Recovery CDs that came with your system)?

    What do you see that you don't think you should be seeing and when do you see it?

    What do you not see that you think you should be seeing?

    If the system used to work properly, what do you think might have changed since the last time it did work properly?

    Now provide a few more details:

    Click Start, Run and in the box enter:

    msinfo32

    Click OK, and when the System Summary info appears, click Edit, Select All (Ctrl-A), Copy (Ctrl-C) and then paste (Ctrl-V) the information back here.

    For video driver information, expand the Components, click Display, click Edit, Select All, Copy and then paste the information back here.

    There will be some personal information (like System Name and User Name), and whatever appears to be private information to you, just delete it from the pasted information.

    This will minimize back and forth Q&A and eliminate guesswork.

    Was this answer helpful?

    0 comments No comments