NvCpl.dll worm xp

Anonymous
2011-12-03T00:25:26+00:00

I have a slow running XP machine.  While troubleshooting, I remove all startup items with msconfig by the disable all button and restarted the machine.

Upon a msconfig a checked MvCpl.dll command line was there.  The original on was also there uncheck.  I searched my C-drive for NvCpl.* and received:

   NvCpl     C:\Windows\Help  Help File

  NvCpl.dll  C:\Windows\System32 

  NvCpl       C:\Dell\Drivers\R65699 Help File

  NvCpl.dll   C:\Dell\Drivers\R65699

  NvCpl       C:\Dell\Drivers\R89437   DL_File

  NvCpl        C:\Dell\Drivers\R89437   HL_File

Bounced around on the internet and learned that a rwiz.exe seem to belong to this worm.  It is also in my msconfig startup page.

Any help with removing this Worm would be appreciated.

Avalonfv

Windows for home | Previous Windows versions | Windows update

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2012-01-05T03:06:41+00:00

I just re-read the entire thread. I was struck by two things:

  1. This PC was once on a domain.
  2. This PC had trojans.

I am aware you reconfigured the PC to change it from Domain to Workgroup, but there still might be something in the profile that is searching for something on the domain. I suppose you could create a fresh profile, but I'm not sure I'd waste my time since...

I believe the PC is still compromised. Malware can sometimes be VERY tricky to remove. Sometimes it might APPEAR to be gone, but there will still be a nasty, almost-impossible-to-detect rootkit present (or maybe even a "bootkit" hiding out in the boot sector). The symptoms you describe certainly indicate the presence of malware; the PC might very well be a part of the "botnet" right now.

I recommend that you make sure all the data is backed up and nuke the drive and start from scratch. It's a hassle, but it would probably still be the quickest (and surely be the most effective) way to deal with this mess.

If you had unlimited time and wished to experiment and explore (but I believe you said this PC belongs to a friend), you could search the web for Process Explorer tutorials and start a thread on Bleeping Computer or a similar site to get guided help. But I truly think you'll be better off if you flatten and rebuild.

Good luck and Happy New Year!

Was this answer helpful?

1 person found this answer helpful.
0 comments

42 additional answers

Sort by: Newest
Most helpful Newest Oldest
  1. Anonymous
    2012-01-03T21:18:50+00:00

    So, Clean Boot does not speed things up significantly...

    Is Safe Mode equally problematic?

    Is WgaTray.exe still a problem?

    Was this answer helpful?

    0 comments
  2. Anonymous
    2012-01-03T20:00:41+00:00

    Daavee,

    Happy New Year.  I hope you are still with me.

    Over the Holiday period, read and secured a couple of tools from the Windows Sysinternals Site.  I now have Process Explorer and Perfmon.msc helping me monitor the system.

    They system is still taking about 10 min to settle down on boot up to useable state.  During boot up interrupts  are ramping up to 80 to 90% during the 100% cpu usage.  When interrupts come down a copy Scvhost ramp up to 80 to 90% during the 100% cpu usage.  Periodically the memory swaps take place to about a 60% level.

    If you have any ideas on what I can go after next I sure would appreciate the help.

    Avalonfv

    Was this answer helpful?

    0 comments
  3. Anonymous
    2011-12-22T18:53:24+00:00

    Daavee,

    Sorry I had Christmas duties the last few days.

    I did download the latest installation file for MSE.  Disconnected from the internet and uninstalled MSE.  I used to boot with no startups, only Microsoft Services.

    It took about six minutes to settle down to between 1% 25% of CPU unsage.  During that six minutes, WgaTray.exe (Genuine Advantage)92% and explorer.exe 50%.

    The uninstall of MSE did not fix the problem but did help expose other contributors to CPU usage.

    Hope you have a good Holiday Season.  Please get back to me at your convenience.

    Avalonfv

    Was this answer helpful?

    0 comments
  4. Anonymous
    2011-12-18T16:09:35+00:00

    You might need to uninstall MSE. It's possible that there is a conflict with one of your other programs or a recent update might have caused a problem. You can always reinstall it. Or you can choose another AV program like the free version of Avira Antivirus.

    I think you should download the most recent installation file for MSE. Then physically disconnect from the Internet and uninstall MSE and reboot. I suspect that will fix your performance issue. Let us know if it does.

    Was this answer helpful?

    0 comments