NvCpl.dll worm xp

Anonymous
2011-12-03T00:25:26+00:00

I have a slow running XP machine.  While troubleshooting, I remove all startup items with msconfig by the disable all button and restarted the machine.

Upon a msconfig a checked MvCpl.dll command line was there.  The original on was also there uncheck.  I searched my C-drive for NvCpl.* and received:

   NvCpl     C:\Windows\Help  Help File

  NvCpl.dll  C:\Windows\System32 

  NvCpl       C:\Dell\Drivers\R65699 Help File

  NvCpl.dll   C:\Dell\Drivers\R65699

  NvCpl       C:\Dell\Drivers\R89437   DL_File

  NvCpl        C:\Dell\Drivers\R89437   HL_File

Bounced around on the internet and learned that a rwiz.exe seem to belong to this worm.  It is also in my msconfig startup page.

Any help with removing this Worm would be appreciated.

Avalonfv

Windows for home | Previous Windows versions | Windows update

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2012-01-05T03:06:41+00:00

I just re-read the entire thread. I was struck by two things:

  1. This PC was once on a domain.
  2. This PC had trojans.

I am aware you reconfigured the PC to change it from Domain to Workgroup, but there still might be something in the profile that is searching for something on the domain. I suppose you could create a fresh profile, but I'm not sure I'd waste my time since...

I believe the PC is still compromised. Malware can sometimes be VERY tricky to remove. Sometimes it might APPEAR to be gone, but there will still be a nasty, almost-impossible-to-detect rootkit present (or maybe even a "bootkit" hiding out in the boot sector). The symptoms you describe certainly indicate the presence of malware; the PC might very well be a part of the "botnet" right now.

I recommend that you make sure all the data is backed up and nuke the drive and start from scratch. It's a hassle, but it would probably still be the quickest (and surely be the most effective) way to deal with this mess.

If you had unlimited time and wished to experiment and explore (but I believe you said this PC belongs to a friend), you could search the web for Process Explorer tutorials and start a thread on Bleeping Computer or a similar site to get guided help. But I truly think you'll be better off if you flatten and rebuild.

Good luck and Happy New Year!

Was this answer helpful?

1 person found this answer helpful.
0 comments

42 additional answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2011-12-08T01:43:43+00:00

    10. I did change the network environment to home.  Thus eleminating all of the domains.  Everytime I boot the system I must return it to a home environment to get out on the internet.

    What does that mean, exactly?  How did you remove the machine from the domain?  Removing the machine from the domain is a one time only thing, once disjoined from a domain there should be no need to have to do this ever again.  Did you log on with a local administrator account to disjoin from the domain?  The long boot time could be an indication that the the machine is still trying to contact a domain controller.

    John

    Was this answer helpful?

    0 comments
  2. Anonymous
    2011-12-08T07:40:21+00:00

    I am not Mr. Bear - I was acknowledging that the helpful advice and information about reinstalling AVG and what options NOT to install (if you are compelled to keep AVG) came from PA Bear (a long time ago actually), who is another forum contributor!

    You need to tell us once and for all if you have properly uninstalled AVG or not.  I already said that I would use their uninstaller to uninstall all of AVG - at least temporarily, to see how things look without it.

    It is also important to thoroughly respond to the question from John John MVP.  If your system thinks it is supposed to be connecting to some domain that isn't there, that will really slow things down (I missed that in your first post). 

    Has the system ever been connected to a network domain and/or had a need to login to a domain?   Sometimes this is the case with second hand systems when they are removed from a corporate environment where there is a domain to a home environment where there is (usually) no domain.  Is that the case with your system?

    Based on your replies, I hope John John MVP will stick around and help figuring out that part since that area of my brain is stale.

    Was this answer helpful?

    0 comments
  3. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more

  4. Anonymous
    2011-12-08T17:24:24+00:00

    John John MVP,

    I am sorry.  I did not read this post until the 8th.

    Yes used the administrator account eleminated the domain reference.

    I do appreciate your input.  Now that I have caught up with the posts.  I will install the memory as Joselbarra has suggested.

    Avalonfv

    Was this answer helpful?

    0 comments