i think this is a false:NVIDIA Corporation\OpenCL\OpenCL64 [SOLVED by db 1319]

[drakin]

I didnt see this one on the list of titles if its a duplicate I'm sorry.

 

IObit Malware Fighter

 

OS: Windows Vista

Version: 2.3.0.10

Define Version: 1317

Time Elapsed: 01:35:08

Objects Scanned: 40621

Threats Found: 2

Save Time: 3/2/2014 2:33:21 AM

 

|Name|Type|Description|ID|

Trojan.Agent, FILE, C:\Windows\System32\DriverStore\FileRepository\nv_disp.inf_3649347a\OpenCL64.dll, 4064967

Trojan.Agent, FILE, C:\Program Files\NVIDIA Corporation\OpenCL\OpenCL64.dll, 4064967

 

 

I think this may be a false, it does not register under anyother scanners I have. If it is real one can some let me know how to remove it with out screwing up my comp? This didnt start showing up untill I took an update for my nvidia video/audo/network drivers from the company.

 

If anyother scan logs are needed please let me know.

[Octavian]

If its possible upload file to virustotal.com

[drakin]

results form virustotal

 

for

C:\Program Files\NVIDIA Corporation\OpenCL\OpenCL64.dll, 4064967

 

File name:

OpenCL64.dll

Detection ratio:

 

0 / 49

Analysis date:

2014-03-02 09:06:02 UTC ( 0 minutes ago )

 

for :

C:\Windows\System32\DriverStore\FileRepository\nv_ disp.inf_3649347a\OpenCL64.dll, 4064967

File name:

OpenCL64.dll

Detection ratio:

0 / 50

Analysis date:

2014-03-02 09:37:01 UTC ( 0 minutes ago )

[austingrd]

Is this a false positive? Looking at the file, looks like the owner is Khronos Group.

[Cicely]

Hi drakin,

 

Welcome to IObit forum! :-D

 

Thanks for your feedback.

 

To check whether they are false positives, please supply us the following information:

 

• Upload the files that were reported as threats to VirusTotal and supply the report links in your next post.

• Also, ZIP the files that were reported as threats and upload them to Wikisend and supply the link in your next post.

 

You can use THIS post as an example.

 

Thanks in advance.

 

Cheers.

[drakin]

data asked for by cicely

 

IObit Malware Fighter

 

OS: Windows Vista

Version: 2.3.0.10

Define Version: 1317

Time Elapsed: 01:35:08

Objects Scanned: 40621

Threats Found: 2

Save Time: 3/2/2014 2:33:21 AM

 

|Name|Type|Description|ID|

Trojan.Agent, FILE, C:\Windows\System32\DriverStore\FileRepository\nv_ disp.inf_3649347a\OpenCL64.dll, 4064967

Trojan.Agent, FILE, C:\Program Files\NVIDIA Corporation\OpenCL\OpenCL64.dll, 4064967

 

virustotal logg: link followed by details

https://www.virustotal.com/en/file/ad4efb946dc4b2835a26dd9276506380ff4ab320dc9efe9a5d079f23c386da6f/analysis/1393994870/

 

File identification

MD5 a7ea9ea9ab4b30f865eedee5fb555d9c

SHA1 f449322a3c94966c932a8f639506f0678b328c97

SHA256 ad4efb946dc4b2835a26dd9276506380ff4ab320dc9efe9a5d079f23c386da6f

ssdeep

1536:K5i+KfDTUMFfBA/EUNAt9s+4IJ5K0KRK9Ra9GO:K5MDTUM1BKE6Ar5K0KRK9RCb

imphash  3d706ab4a6d7abff973deb2b46ae0fea

File size 59.8 KB ( 61216 bytes )

File type Win32 DLL

Magic literal

PE32+ executable for MS Windows (DLL) (GUI) Mono/.Net assembly

 

VirusTotal metadata

First submission 2014-02-21 14:40:39 UTC ( 1 week, 4 days ago )

Last submission 2014-03-05 04:47:50 UTC ( 2 minutes ago )

File names

OpenCL64.dll

OpenCL

OpenCL64.dll

OpenCL.dll

 

 

SHA256:

ad4efb946dc4b2835a26dd9276506380ff4ab320dc9efe9a5d079f23c386da6f

File name:

OpenCL64.dll

Detection ratio:

0 / 50

Analysis date:

2014-03-05 04:47:50 UTC ( 0 minutes ago )

 

will attempt to send to wikisend

http://wikisend.com/download/588598/OpenCL64.dll

OpenCL64.dll

 

second one is :

http://wikisend.com/download/369792/CWindowsSystem32DriverStoreFileRepositorynv_ disp.inf_3649347aOpenCL64.dll, 4064967.zip

CWindowsSystem32DriverStoreFileRepositorynv_ disp.inf_3649347aOpenCL64.dll, 4064967.zip

 

ttl 7days

sorry if anything is duplicated

[Cicely]

Hi drakin,

 

Thanks for your continual reply.

 

Please update your Define Version of your Driver Booster to the latest 1318 to see whether the false positive remains.

 

If it does, please feel free to tell us. ;-)

 

Looking forward to hear from you.

[drakin]

3/5/14

sorry for delay am working midnight shift this week. with version 1318 flaged in both smart scan and full scan for it.

 

3/7/14

took update 3/7/14 to 1319 and smart scan no longer flags it with version 1319, no time today will try full system scan tomarrow to see if it flags or not.

 

thank you in advanced Cicely

 

was this a false positive or just programs clashing?

[drakin]

full scan

 

sorry again for delay heres the full scan broken into 2 chunks

 

heres system critical area/memory process/factory image (D:)

IObit Malware Fighter

 

OS: Windows Vista

Version: 2.3.0.10

Define Version: 1319

Time Elapsed: 00:14:59

Objects Scanned: 6866

Threats Found: 0

Save Time: 3/8/2014 8:46:37 AM

 

|Name|Type|Description|ID|

 

 

and heres hp(C:)

IObit Malware Fighter

 

OS: Windows Vista

Version: 2.3.0.10

Define Version: 1319

Time Elapsed: 01:47:37

Objects Scanned: 40619

Threats Found: 0

Save Time: 3/8/2014 10:38:45 AM

 

|Name|Type|Description|ID|

 

 

thank you it is no longer flagging

[Cicely]

Hi drakin,

 

Thanks for your time to help us improve our product. From the scan results , it is found that the false potive has been removed in the latest Define Version. Well done! Cheers!