NvCpl.dll worm xp

Anonymous
2011-12-03T00:25:26+00:00

I have a slow running XP machine.  While troubleshooting, I remove all startup items with msconfig by the disable all button and restarted the machine.

Upon a msconfig a checked MvCpl.dll command line was there.  The original on was also there uncheck.  I searched my C-drive for NvCpl.* and received:

   NvCpl     C:\Windows\Help  Help File

  NvCpl.dll  C:\Windows\System32 

  NvCpl       C:\Dell\Drivers\R65699 Help File

  NvCpl.dll   C:\Dell\Drivers\R65699

  NvCpl       C:\Dell\Drivers\R89437   DL_File

  NvCpl        C:\Dell\Drivers\R89437   HL_File

Bounced around on the internet and learned that a rwiz.exe seem to belong to this worm.  It is also in my msconfig startup page.

Any help with removing this Worm would be appreciated.

Avalonfv

Windows for home | Previous Windows versions | Windows update

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments
Answer accepted by question author
Anonymous
2012-01-05T03:06:41+00:00

I just re-read the entire thread. I was struck by two things:

  1. This PC was once on a domain.
  2. This PC had trojans.

I am aware you reconfigured the PC to change it from Domain to Workgroup, but there still might be something in the profile that is searching for something on the domain. I suppose you could create a fresh profile, but I'm not sure I'd waste my time since...

I believe the PC is still compromised. Malware can sometimes be VERY tricky to remove. Sometimes it might APPEAR to be gone, but there will still be a nasty, almost-impossible-to-detect rootkit present (or maybe even a "bootkit" hiding out in the boot sector). The symptoms you describe certainly indicate the presence of malware; the PC might very well be a part of the "botnet" right now.

I recommend that you make sure all the data is backed up and nuke the drive and start from scratch. It's a hassle, but it would probably still be the quickest (and surely be the most effective) way to deal with this mess.

If you had unlimited time and wished to experiment and explore (but I believe you said this PC belongs to a friend), you could search the web for Process Explorer tutorials and start a thread on Bleeping Computer or a similar site to get guided help. But I truly think you'll be better off if you flatten and rebuild.

Good luck and Happy New Year!

Was this answer helpful?

1 person found this answer helpful.
0 comments No comments

42 additional answers

Sort by: Oldest
  1. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.


    Comments have been turned off. Learn more

  2. Anonymous
    2011-12-10T16:39:53+00:00

    I am attempting to answer completely so dialog can continue. First I will list your words.

    You need to tell us once and for all if you have properly uninstalled AVG or not. I already said that I would use their uninstaller to uninstall all of AVG - at least temporarily, to see how things look without it.

    I properly uninstalled AVG with the uninstaller as instructed.

    It is also important to thoroughly respond to the question from John John MVP. If your system thinks it is supposed to be connecting to some domain that isn't there, that will really slow things down (I missed that in your first post).

    Yes, I did respond.  I went to the control panel opened system.  Clicked the computer name. Clicked the change button. Remove the domain for this system and change it to a Workgroup.  I did go to the Network ID wizard and defined it as home computer and not a business network.

    Has the system ever been connected to a network domain and/or had a need to login to a domain? Sometimes this is the case with second hand systems when they are removed from a corporate environment where there is a domain to a home environment where there is (usually) no domain. Is that the case with your system?

    Yes it has.  In a work environment, with several groups.  When you logged on the domain name was below it and you could change the domain if you wish.

    Based on your replies, I hope John John MVP will stick around and help figuring out that part since that area of my brain is stale

    Am I to assume that you are no longer with me?  I now my answer are filled with my rambling thoughts.  I will try to stick directly to your points exactly.  Shall I start a new Thread?

    Avalonfv

    Was this answer helpful?

    0 comments No comments
  3. Anonymous
    2011-12-11T01:41:39+00:00

    Since John John and Jose might be away for the weekend, I figured I'd offer my usual cut-and-paste regarding the usual causes of sluggishness:

    1. Malicious software (malware). You need to rule this out first! If you need guidance, let us know. Also, make sure you bookmark this page:

    http://www.selectrealsecurity.com/malware-removal-guide

    1. Not enough free space on the hard drive. At the very least, you should have at least 15% free space. A good goal to shoot for is 50%.
    2. Certain programs that are designed to combat malware (e.g., Norton and McAfee). Ironically, they can slow things down because they simply use way too many resources. Sometime they cause conflicts with other programs. Fortunately, there are other antimalware programs available that use far fewer resources (e.g., NOD32, Avast, and Avira).
    3. Not enough RAM, which causes the PC to overly rely on the pagefile. A quick way to determine if this is happening is to open Task Manager (Ctrl+Alt+Del) and click the Performance tab. Then note the three values under Commit Charge (K): in the lower left-hand corner: Total, Limit, and Peak.

    The Total figure represents the amount of memory you are using at that very moment. The Peak figure represents the highest amount of memory you used since last bootup. If both these figures are below the value of Physical Memory (K) Total, then you probably have plenty of RAM. In case you want to explore this further, you may run Page File Monitor for Windows XP:

    http://www.dougknox.com/xp/utils/xp_pagefilemon.htm

    1. You might also want to check that your hard drive's access mode didn't change from DMA to PIO:

    http://www.technize.com/2007/08/02/is-your-hard-disk-cddvd-drives-too-slow-while-copying/

    and

    http://winhlp.com/node/10

    Was this answer helpful?

    0 comments No comments
  4. Anonymous
    2011-12-12T12:02:47+00:00

    I am with you, but did not see your latest reply. 

    I subscribe to many threads and when the MS Answers Forum Moderators go on their "Answer" marking sprees - marking Microsoft Support Engineer replies as the "Answer" when they are not even close to being the "Answer", they all come into my inbox in big clumps and now I just delete them all in one fell swoop since there is no need to even read these alleged "Answers",  and your last reply was mixed in one of those big batches of "Answers" that I just delete.

    Follow the advice from Daavee and John John MVP (I actually am running out of ideas).

    Once your system boots, does it seem to run satisfactorily after that?

    If you want, we could take a look at your startup items and see if we can spot some things in

    there that you might be able to do without to speed up your boot time.

    Here is one way to share your list of startup items:

    A popular free tool with a built in startup manager (and other neat things) is CCleaner which you can download from here:

    http://www.piriform.com/ccleaner

    CCleaner will let you manage most Startup items and also do some other cleanup oriented operations.  Some people will recommend you not to use the registry functions in CCleaner so avoid those features for now.  I have no issue with it myself, but it is sometimes a contentious issue I prefer to avoid whenever possible!

    You can uninstall CCleaner later if you don't like it.

    You can disable startup items, see how things look and if you want - just delete them (or leave them disabled).

    After launching CCleaner and seeing what startup items you can disable/delete if you still are not sure about your startup items, do this:

    Launch CCleaner and choose Tools, Startup and in the bottom right, click the "Save to text file" button to save the Startup information to a text file - something like startup.txt

    Save the startup information text file to your desktop (or someplace you can find it) open the text file with a text editor (notepad or WordPad), select all the text (Ctrl-A), copy all the highlighted text to the Windows clipboard (Ctrl-C) and then paste (Ctrl-V) the contents of the startup list back here in your next reply and perhaps somebody can tell you other things to consider.

    Was this answer helpful?

    0 comments No comments