NvCpl.dll worm xp

Anonymous
2011-12-03T00:25:26+00:00

I have a slow running XP machine.  While troubleshooting, I remove all startup items with msconfig by the disable all button and restarted the machine.

Upon a msconfig a checked MvCpl.dll command line was there.  The original on was also there uncheck.  I searched my C-drive for NvCpl.* and received:

   NvCpl     C:\Windows\Help  Help File

  NvCpl.dll  C:\Windows\System32 

  NvCpl       C:\Dell\Drivers\R65699 Help File

  NvCpl.dll   C:\Dell\Drivers\R65699

  NvCpl       C:\Dell\Drivers\R89437   DL_File

  NvCpl        C:\Dell\Drivers\R89437   HL_File

Bounced around on the internet and learned that a rwiz.exe seem to belong to this worm.  It is also in my msconfig startup page.

Any help with removing this Worm would be appreciated.

Avalonfv

Windows for home | Previous Windows versions | Windows update

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2012-01-05T03:06:41+00:00

I just re-read the entire thread. I was struck by two things:

  1. This PC was once on a domain.
  2. This PC had trojans.

I am aware you reconfigured the PC to change it from Domain to Workgroup, but there still might be something in the profile that is searching for something on the domain. I suppose you could create a fresh profile, but I'm not sure I'd waste my time since...

I believe the PC is still compromised. Malware can sometimes be VERY tricky to remove. Sometimes it might APPEAR to be gone, but there will still be a nasty, almost-impossible-to-detect rootkit present (or maybe even a "bootkit" hiding out in the boot sector). The symptoms you describe certainly indicate the presence of malware; the PC might very well be a part of the "botnet" right now.

I recommend that you make sure all the data is backed up and nuke the drive and start from scratch. It's a hassle, but it would probably still be the quickest (and surely be the most effective) way to deal with this mess.

If you had unlimited time and wished to experiment and explore (but I believe you said this PC belongs to a friend), you could search the web for Process Explorer tutorials and start a thread on Bleeping Computer or a similar site to get guided help. But I truly think you'll be better off if you flatten and rebuild.

Good luck and Happy New Year!

Was this answer helpful?

1 person found this answer helpful.
0 comments

42 additional answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2011-12-07T13:58:03+00:00

    Are you still getting the nvcpl.dll problem?

    I thought there were two NVIDIA GeForce FX Go5200 driver options, but one is the driver and the other is some help/heath thing.

    That is the right video driver version according to Dell (maybe hte NVIDIA online scanner doesn't recognize that part for some reason), but if you are still getting the nvcpl.dll problem, you may just need to download and reinstall the driver from the Dell WWW site.  There are installation instructions on the Dell page "behind" the link.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2011-12-07T23:04:30+00:00

    The nvcpl has gone away.  I have also reinstalled the NVIDIA GeFX Go5200 Driver.  And I did get the driver rather than the other.  Thanks for the warning.

    I have installed Microsoft Security Essentials.  It has been running for 3:45 with a short scan.  I feel that is excessive.  The scan with Bytes too 6 hours for full scan took over six hours.  I plan on trying the memory if you approve.  The system seem to be running smooth but it has no where to go.  What are your thoughts?  Shall I attempt memory upgrade?

    SL Jiles

    Was this answer helpful?

    0 comments
  3. Anonymous
    2011-12-08T00:08:43+00:00

    That's good.

    That is a long time - the MBAM people say that a short scan will catch 99.9% of "things", but since this is your first time running it, I like to do at least one full scan.

    Did you properly uninstall AVG?  It is possible to have too much protection on your system ot two applications may compete too heavily for system resources so you don't want to overdo things.

    If you think things are stabilized, go ahead and install your new RAM.

    I am installing myself - in bed.

    I just wanted to get the NVIDIA problem squared away, get MBAM running and didn't want to be changing too many things all at the same time.

    Was this answer helpful?

    0 comments
  4. Anonymous
    2011-12-08T00:55:51+00:00

    I must add some more information.  It is taking this machine over 5 minutes to boot up completely.  I am ready to put the extra memory in.  I have taken a couple of programs out.  Dell quick set and Dell crash support ( a crash analysis tool).  I feel some of the goodies running is like extra clock cycles with all of AVG extras.  There are a couple of things like Broadcom advanced control suit and Broadcom Lan control.  Windows profide all these functions.  I really want to clean up all the junk.  What do you think Mr. Bear?

    slj

    Was this answer helpful?

    0 comments