NvCpl.dll worm xp

Anonymous
2011-12-03T00:25:26+00:00

I have a slow running XP machine.  While troubleshooting, I remove all startup items with msconfig by the disable all button and restarted the machine.

Upon a msconfig a checked MvCpl.dll command line was there.  The original on was also there uncheck.  I searched my C-drive for NvCpl.* and received:

   NvCpl     C:\Windows\Help  Help File

  NvCpl.dll  C:\Windows\System32 

  NvCpl       C:\Dell\Drivers\R65699 Help File

  NvCpl.dll   C:\Dell\Drivers\R65699

  NvCpl       C:\Dell\Drivers\R89437   DL_File

  NvCpl        C:\Dell\Drivers\R89437   HL_File

Bounced around on the internet and learned that a rwiz.exe seem to belong to this worm.  It is also in my msconfig startup page.

Any help with removing this Worm would be appreciated.

Avalonfv

Windows for home | Previous Windows versions | Windows update

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2012-01-05T03:06:41+00:00

I just re-read the entire thread. I was struck by two things:

  1. This PC was once on a domain.
  2. This PC had trojans.

I am aware you reconfigured the PC to change it from Domain to Workgroup, but there still might be something in the profile that is searching for something on the domain. I suppose you could create a fresh profile, but I'm not sure I'd waste my time since...

I believe the PC is still compromised. Malware can sometimes be VERY tricky to remove. Sometimes it might APPEAR to be gone, but there will still be a nasty, almost-impossible-to-detect rootkit present (or maybe even a "bootkit" hiding out in the boot sector). The symptoms you describe certainly indicate the presence of malware; the PC might very well be a part of the "botnet" right now.

I recommend that you make sure all the data is backed up and nuke the drive and start from scratch. It's a hassle, but it would probably still be the quickest (and surely be the most effective) way to deal with this mess.

If you had unlimited time and wished to experiment and explore (but I believe you said this PC belongs to a friend), you could search the web for Process Explorer tutorials and start a thread on Bleeping Computer or a similar site to get guided help. But I truly think you'll be better off if you flatten and rebuild.

Good luck and Happy New Year!

Was this answer helpful?

1 person found this answer helpful.
0 comments

42 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2011-12-07T11:54:39+00:00

    Name   NVIDIA GeForce FX Go5200

    PNP Device ID PCI\VEN_10DE&DEV_0324&SUBSYS_015F1028&REV_A1\4&1AB4B779&0&0008

    Adapter Type    GeForce FX Go5200, NVIDIA compatible

    Adapter Description      NVIDIA GeForce FX Go5200

    Adapter RAM    32.00 MB (33,554,432 bytes)

    Installed Drivers           nv4_disp.dll

    Driver Version  6.14.10.6742

    INF File            oem5.inf (nv4_NV34_WinXP section)

    Color Planes     1

    Color Table Entries       4294967296

    Resolution        1280 x 1024 x 60 hertz

    Bits/Pixel          32

    Memory Address          0xFC000000-0xFDFFFFFF

    Memory Address          0xD0000000-0xDFFFFFFF

    IRQ Channel     IRQ 20

    I/O Port            0x000003B0-0x000003BB

    I/O Port            0x000003C0-0x000003DF

    Memory Address          0xA0000-0xBFFFF

    Driver   c:\windows\system32\drivers\nv4_mini.sys (6.14.10.6742, 2.70 MB (2,830,688 bytes), 8/19/2004 12:44 AM)

    I also have attempted the NVIDIA the on line scan with no result.  An error message.  I will attempt again later today.  I am now scanning with Malwarebyes to ensure that I have not caught something else.  Later today I will install Microsoft Security Essentials.  I am presently running it on my personal machines.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2011-12-06T21:37:29+00:00

    When you ran your msinfo32 and did this part:

    For video driver information, expand the Components, click Display, click Edit, Select All, Copy and then paste the information back here.

    Is the window where the information should be empty/blank?

    That would mean that as far as XP is concerned, there are no video drivers installed, so you either need to get the NVIDIA drivers from the Dell Support Site, and/or get to the NVIDIA site and see if you can find them there and install the drivers.

    The msinfo32 video driver section should look something like this example (this is from a different machine than yours):

    Name    NVIDIA GeForce 6150SE nForce 430

    PNP Device ID    PCI\VEN_10DE&DEV_03D0&SUBSYS_73091462&REV_A2\3&267A616A&0&68

    Adapter Type    GeForce 6150SE nForce 430, NVIDIA compatible

    Adapter Description    NVIDIA GeForce 6150SE nForce 430

    Adapter RAM    256.00 MB (268,435,456 bytes)

    Installed Drivers    nv4_disp.dll

    Driver Version    6.14.11.8634

    INF File    oem29.inf (Section001 section)

    Color Planes    Not Available

    Color Table Entries    Not Available

    Resolution    Not Available

    Bits/Pixel    Not Available

    Memory Address    0xFD000000-0xFDFFFFFF

    Memory Address    0xB0000000-0xDFFFFFFF

    Memory Address    0xFC000000-0xFCFFFFFF

    IRQ Channel    IRQ 23

    Driver    c:\windows\system32\drivers\nv4_mini.sys (6.14.11.8634, 7.60 MB (7,967,712 bytes), 9/27/2009 4:12 AM)

    Was this answer helpful?

    0 comments
  3. Anonymous
    2011-12-06T19:18:58+00:00

    Sorry, I neglected to include msinfo32 information in my last post:

    OS Name         Microsoft Windows XP Professional

    Version 5.1.2600 Service Pack 3 Build 2600

    OS Manufacturer          Microsoft Corporation

    System Name  

    System Manufacturer    Dell Computer Corporation

    System Model   Inspiron 5150

    System Type    X86-based PC

    Processor         x86 Family 15 Model 2 Stepping 9 GenuineIntel ~3056 Mhz

    BIOS Version/Date        Dell Computer Corporation A33, 3/8/2004

    SMBIOS Version           2.3

    Windows Directory        C:\WINDOWS

    System Directory          C:\WINDOWS\system32

    Boot Device      \Device\HarddiskVolume2

    Locale  United States

    Hardware Abstraction Layer      Version = "5.1.2600.5512 (xpsp.080413-2111)"

    User Name      

    Time Zone        Eastern Standard Time

    Total Physical Memory 512.00 MB

    Available Physical Memory       336.18 MB

    Total Virtual Memory     2.00 GB

    Available Virtual Memory           1.96 GB

    Page File Space           1.22 GB

    Page File          C:\pagefile.sys

    I will go to the Dell site asap.

    slj

    Was this answer helpful?

    0 comments
  4. Anonymous
    2011-12-06T17:45:24+00:00

    That's good.

    I'll leave whether or not to install the RAM right now up to you... you are still making some other adjustments (but it will improve things for you).

    What did you do about your AVG?  AVG  has obviously already failed to protect your system.

    Personally, I would just uninstall/whack AVG according to these directions from their WWW page, reboot and install Microsoft Security Essentials.

    MSE and MBAM are a pretty good combo.  MSE will not slow you down and I just run MBAM once a week or so or when I am suspicious of some malicious software.

    Here is a link to the AVG uninstaller:

    http://www.avg.com/us-en/utilities

    The IDE controller section looks good (all DMA).  Did you make any adjustment or was that how you found it?

    I found the information for your Service Tag on the Dell site but there are two NVIDIA options for that box (take a look on the Dell site yourself), so you still need to do the following part so we can be sure to get you the right stuff:

    Click Start, Run and in the box enter:

    msinfo32

    Click OK, and when the System Summary info appears, click Edit, Select All (Ctrl-A), Copy (Ctrl-C) and then paste (Ctrl-V) the information back here.

    For video driver information, expand the Components, click Display, click Edit, Select All, Copy and then paste the information back here.

    There will be some personal information (like System Name and User Name), and whatever appears to be private information to you, just delete it from the pasted information.

    ...or (do this part too) you can also visit the NVIDIA site and let them take a look at your system to be sure you get the latest drivers (Dell may not have the latest drivers):

    I would navigate to the NVIDIA website and let their online scanner take a look at your video system and see what it suggests for drivers and consider their analysis if they suggest a new driver.

    It is recommended to run the NVIDIA scan with Internet Explorer. 

    Here is the address to the NVIDIA page:

    http://www.nvidia.com/Download/PreScan.aspx?lang=en-us

    Read the directions, then click the GRAPHICS DRIVERS button to start the scan.

    Was this answer helpful?

    0 comments