Spyware, Viruses, & Security forum

General discussion

Virus software at Startup: NVCPL is a virus/trojan

by R1one / August 16, 2006 3:47 PM PDT

Trying to speedup boot time

I was trying to disable some of the /files/autoruns during start up( click START and at RUN type 'msconfig' and look at STARTUP) and look up a program call NVCpL via google and found out that i must diable or delete the NVCPL . according to website mention below its a virus . Here is my problem, after i disable it by unchecking the file and start to reboot again. It seem to be unchecked but a same file name NVCPL is still running! So i have 2 file with the same name NVcpl, one uncheck one checked.
How do i delete this joker completely or correct this ?
i have updated antivirussoftwaer spywaer etc etc and its updated .

pls help.
thanks in advance for the assistance



WinTasks Process Library
nvcpl - nvcpl.exe - Process Information

Process File: nvcpl or nvcpl.exe
Process Name: W32.SpyBot.S Worm

Run a Free System Scan for nvcpl.exe Related Errors

Description:
nvcpl.exe is a process which is registered as W32.SpyBot.S Worm. It takes advantage of the Windows LSASS vulnerability, which creates a buffer overflow and instigates your computer to shut down. To see more information about this vulnerability please look at the following Microsoft bulletin: http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx.

This process is a security risk and should be removed from your system. Please see additional details regarding this process.
For More Information About nvcpl.exe - Get WinTasks 5 Pro Now!

Recommendation for nvcpl.exe:
DISABLE AND REMOVE IMMEDIATELY. This process is most likely a virus or trojan.
To get control over your running programs we suggest WinTasks 5 Pro

Post a reply
Discussion is locked
You are posting a reply to: Virus software at Startup: NVCPL is a virus/trojan
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Virus software at Startup: NVCPL is a virus/trojan
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Hi! I'd Run an Online Scan to Confirm NOT a False Positive..
by tobeach / August 16, 2006 5:02 PM PDT

at one of the following:
If you have Sun Java Installed ( check Control Panel for a Coffee Cup Icon)
http://uk.trendmicro-europe.com/enterprise/products/housecall_launch.php
If no Sun Java (only MS native Active-X) takes much longer:http://housecall.trendmicro.com/housecall/start_corp.asp
Since don't have much description of your OS(ok for 95/98):http://us.mcafee.com/root/mfs/default.asp
or try:http://www.kaspersky.com/virusscanner

You posted your AV up to date...is it corrupted? I ask because this worm in some variations has been around since April,2003. Believe this virus will corrupt AV (NVCPL.EXE: Cripple NortonVirus.exe??).
If you think OK, try running your own anti-virus in safe mode(Reboot and press F8 key repetitively about every second/ or just hold down depending on OS version, DURING the boot-up process). Select ''Safe Mode'' (will look funny) then run virus scan as normal. Write down EXACTLY any results reported, especially the path(s) where infection found ( expl.C: w32\system\system volume\....) etc.
IF a path (in XPs) says system volume it means it's in your System Restore files and you'd need to dump them by turning OFF restore on all drives and then, when clean, turn back on and create a new CLEAN 1st restore point. Hope this helps! Happy

Collapse -
R1one
by phil66 / August 16, 2006 8:08 PM PDT

I have a new computer with xp home sp2

I also have the NvCpl in the start up menu

I ran Doug Knox Startup program Tracker v3.80 this is what I found

In Registry
Hklm\software\microsoft\windows\currentversion\run
NvCpl Daemon run.dll32.exe

In C:\windows\system 32\NvCpl.dll.Nv startup
It shows a description that this is
Nvidia display properties extension.

Do you have a nvidia card installed.

Ray

Collapse -
I also forgot to mention
by phil66 / August 16, 2006 8:54 PM PDT
In reply to: R1one

that not using the proper uppercase and lower case spelling make a big difference in results.
Here is a process analysis if you wish to farther read up on subject.


www.neuber.com/taskmanager/process/nvcpl.dll.html - 14k - Cached - Similar pages

Hth
Ray

Collapse -
ray
by R1one / October 17, 2006 7:23 AM PDT
In reply to: R1one

Yes ray is right, its not a trojan. its nvidia card i have and its almost the same name as the trojan file. the diference is the DLL and EXE.

thnaks to all who responded. cheers

Collapse -
ray
by R1one / October 17, 2006 7:28 AM PDT
In reply to: ray

I could not delete it because its part of nvidia and is essential for the system to work accordingly. its a good things the system reverse my action or else i wouldn't know(investigate further) and thought i have deleted the trojan. my ohh my....the names are so closely identical, so keep a look out.

Collapse -
Intializes the clock and memory settings on nVidia based
by Marianna Schmudlach / October 17, 2006 12:42 PM PDT
In reply to: ray
Collapse -
NVCPL exe virus notice the EXE
by R1one / October 18, 2006 4:49 AM PDT

if its NVCPL exe <<<< definately a trojan/virus

Collapse -
More on it from Computer Associates LINK
by DarCLew2 / October 17, 2006 1:08 PM PDT
Popular Forums
icon
Computer Help 49,613 discussions
icon
Computer Newbies 10,349 discussions
icon
Laptops 19,436 discussions
icon
Security 30,426 discussions
icon
TVs & Home Theaters 20,308 discussions
icon
Windows 10 360 discussions
icon
Phones 15,802 discussions
icon
Windows 7 7,351 discussions
icon
Networking & Wireless 14,641 discussions

Smartphone tip

Hoarding photos on your phone?

Those picture are hogging memory and could be slowing down your phone.