Defender thinks nVidia file is spyware

Discussion in 'Windows 64bit' started by jabloomf1230, Sep 10, 2006.

  1. jabloomf1230

    jabloomf1230 Guest

    I just happened to be deleting my system log files and noticed this
    "Warning" entry:

    Windows Defender Real-Time Protection agent has detected spyware or
    other potentially unwanted software.

    Scan ID: {32C51653-E534-4CD4-9023-FBA3C53A5D1C}
    User: ....\Administrator
    Name: Unknown
    ID:
    Severity ID:
    Category ID:
    Path Found: driver:NVR0Dev;file:C:\WINDOWS\nvoclk64.sys
    Alert Type: Unknown
    Detection Type:

    nvoclk64.sys gets installed with the x64 version of the nVidia system
    utility nTune. Anybody have any thoughts as to why Windows Defender
    thinks this is spyware?
     
    jabloomf1230, Sep 10, 2006
    #1
    1. Advertising

  2. There could be a multitude of reasons - a few could be that it is checking
    what passes through the registers and something it is doing happens to look
    suspicious, even though it isn't, much of this is simply warnings to alert
    you - it is ultimately YOU who decide what actions to take. I don't
    remember. but doesn't Defender have a way for you to sanction actions
    against an offender? Such that you can accept the program and never be
    reminded of it again?

    Other reasons could be that there is a bit of code that keeps rewriting
    itself, such that it never presents Defender with the same exact digital
    signature. Further, Defender might look for things in a look-up table and
    'hoot' every time it hits on something that it don't know about. And then,
    some - originally well written programs, are being distributed via sites
    that have private adds or messages inserted as a compensation for
    distributing it. Mostly harmless, but these could be a pest too.

    Better to be warned, than pestered!

    Tony. . .


    "jabloomf1230" <> wrote in message
    news:%23khO$...
    > I just happened to be deleting my system log files and noticed this
    > "Warning" entry:
    >
    > Windows Defender Real-Time Protection agent has detected spyware or
    > other potentially unwanted software.
    >
    > Scan ID: {32C51653-E534-4CD4-9023-FBA3C53A5D1C}
    > User: ....\Administrator
    > Name: Unknown
    > ID:
    > Severity ID:
    > Category ID:
    > Path Found: driver:NVR0Dev;file:C:\WINDOWS\nvoclk64.sys
    > Alert Type: Unknown
    > Detection Type:
    >
    > nvoclk64.sys gets installed with the x64 version of the nVidia system
    > utility nTune. Anybody have any thoughts as to why Windows Defender
    > thinks this is spyware?
     
    Tony Sperling, Sep 10, 2006
    #2
    1. Advertising

  3. jabloomf1230

    jabloomf1230 Guest

    I'm only suspicious about it, since it's a .sys file and it's installed
    in the folder c:\windows, which is somewhat unusual these days. I'm
    afraid of not allowing it, since nTune is pretty shaky already and has
    been known to swallow up OS installations whole. I also Googled
    nvoclk64.sys and I found hardly anything about it, which is also odd.

    Tony Sperling wrote:
    > There could be a multitude of reasons - a few could be that it is checking
    > what passes through the registers and something it is doing happens to look
    > suspicious, even though it isn't, much of this is simply warnings to alert
    > you - it is ultimately YOU who decide what actions to take. I don't
    > remember. but doesn't Defender have a way for you to sanction actions
    > against an offender? Such that you can accept the program and never be
    > reminded of it again?
    >
    > Other reasons could be that there is a bit of code that keeps rewriting
    > itself, such that it never presents Defender with the same exact digital
    > signature. Further, Defender might look for things in a look-up table and
    > 'hoot' every time it hits on something that it don't know about. And then,
    > some - originally well written programs, are being distributed via sites
    > that have private adds or messages inserted as a compensation for
    > distributing it. Mostly harmless, but these could be a pest too.
    >
    > Better to be warned, than pestered!
    >
    > Tony. . .
    >
    >
    > "jabloomf1230" <> wrote in message
    > news:%23khO$...
    >> I just happened to be deleting my system log files and noticed this
    >> "Warning" entry:
    >>
    >> Windows Defender Real-Time Protection agent has detected spyware or
    >> other potentially unwanted software.
    >>
    >> Scan ID: {32C51653-E534-4CD4-9023-FBA3C53A5D1C}
    >> User: ....\Administrator
    >> Name: Unknown
    >> ID:
    >> Severity ID:
    >> Category ID:
    >> Path Found: driver:NVR0Dev;file:C:\WINDOWS\nvoclk64.sys
    >> Alert Type: Unknown
    >> Detection Type:
    >>
    >> nvoclk64.sys gets installed with the x64 version of the nVidia system
    >> utility nTune. Anybody have any thoughts as to why Windows Defender
    >> thinks this is spyware?

    >
    >
    >
    >
    > ---
    > avast! Antivirus: Inbound message clean.
    > Virus Database (VPS): 0636-3, 09/08/2006
    > Tested on: 9/10/2006 12:10:47 AM
    > avast! - copyright (c) 1988-2006 ALWIL Software.
    > http://www.avast.com
    >
    >
    >
     
    jabloomf1230, Sep 10, 2006
    #3
  4. I don't know, but there seem to be - not just a whole lot of 'Undocumented
    Functions' inside Windows, but several complete 'Undocumented API's', that
    third party producers are experimenting with. I've had no end of trouble
    with several early generations of the nView applet, it's mostly alright now,
    and sometimes I install it, but for years, I didn't. If you think your nTune
    is 'shakey', I recomend not to install it - and for that reason. By the text
    in your log, Defender would seem to be raising the alarm over an 'unknown'
    entity, which is precisely what it would be expected to do, comforting
    then, that not too many others know about it either.

    If you like it, and it does valuable things that you would miss if it wasn't
    there, you have only to make up your mind. If it is premature, mostly
    useless junk - or, alternatively, keeps raising your suspicion, you keep it
    out.

    The job that Defender has taken on is not something trivial, it is still
    Beta Software, but it seems to me it is doing useful work and this event is
    hardly a sign of 'bugs'.

    One good strategy that Charlie taught me, is that you can, and indeed ought
    to have several spyware cleaners running in unison - do that, and your
    chances to catch something multiplies, even though they all have holes in
    their algorithms, but you cannot evaluate the effectiveness on the number of
    instances that is cought, since any of them may be a false alarm, and always
    just a warning. On top of this, there is no such thing as 'Bug Free' code
    anyway, which makes it hard for you to know precisely how to deal with such
    things. Searching Internet then, as you do, to pick up on how others are
    dealing with it, probably is the only obviously 'good' advice. After that,
    the only thing anyone can do is to sit back and wait for disaster.


    Tony. . .


    "jabloomf1230" <> wrote in message
    news:uKy18$...
    > I'm only suspicious about it, since it's a .sys file and it's installed
    > in the folder c:\windows, which is somewhat unusual these days. I'm
    > afraid of not allowing it, since nTune is pretty shaky already and has
    > been known to swallow up OS installations whole. I also Googled
    > nvoclk64.sys and I found hardly anything about it, which is also odd.
    >
    > Tony Sperling wrote:
    > > There could be a multitude of reasons - a few could be that it is

    checking
    > > what passes through the registers and something it is doing happens to

    look
    > > suspicious, even though it isn't, much of this is simply warnings to

    alert
    > > you - it is ultimately YOU who decide what actions to take. I don't
    > > remember. but doesn't Defender have a way for you to sanction actions
    > > against an offender? Such that you can accept the program and never be
    > > reminded of it again?
    > >
    > > Other reasons could be that there is a bit of code that keeps rewriting
    > > itself, such that it never presents Defender with the same exact digital
    > > signature. Further, Defender might look for things in a look-up table

    and
    > > 'hoot' every time it hits on something that it don't know about. And

    then,
    > > some - originally well written programs, are being distributed via sites
    > > that have private adds or messages inserted as a compensation for
    > > distributing it. Mostly harmless, but these could be a pest too.
    > >
    > > Better to be warned, than pestered!
    > >
    > > Tony. . .
    > >
    > >
    > > "jabloomf1230" <> wrote in message
    > > news:%23khO$...
    > >> I just happened to be deleting my system log files and noticed this
    > >> "Warning" entry:
    > >>
    > >> Windows Defender Real-Time Protection agent has detected spyware or
    > >> other potentially unwanted software.
    > >>
    > >> Scan ID: {32C51653-E534-4CD4-9023-FBA3C53A5D1C}
    > >> User: ....\Administrator
    > >> Name: Unknown
    > >> ID:
    > >> Severity ID:
    > >> Category ID:
    > >> Path Found: driver:NVR0Dev;file:C:\WINDOWS\nvoclk64.sys
    > >> Alert Type: Unknown
    > >> Detection Type:
    > >>
    > >> nvoclk64.sys gets installed with the x64 version of the nVidia system
    > >> utility nTune. Anybody have any thoughts as to why Windows Defender
    > >> thinks this is spyware?

    > >
    > >
    > >
    > >
    > > ---
    > > avast! Antivirus: Inbound message clean.
    > > Virus Database (VPS): 0636-3, 09/08/2006
    > > Tested on: 9/10/2006 12:10:47 AM
    > > avast! - copyright (c) 1988-2006 ALWIL Software.
    > > http://www.avast.com
    > >
    > >
    > >
     
    Tony Sperling, Sep 10, 2006
    #4
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Au79
    Replies:
    4
    Views:
    507
    Leythos
    Jan 28, 2007
  2. Steve H.

    Windows Defender whitelisting certain spyware ?

    Steve H., Mar 11, 2007, in forum: Computer Security
    Replies:
    20
    Views:
    1,712
    Moe Trin
    Mar 15, 2007
  3. Texas Smoke

    Windows Defender/ unable to remove unwanted spyware

    Texas Smoke, Jun 30, 2007, in forum: Computer Support
    Replies:
    3
    Views:
    1,970
  4. Guest

    need help deting defender file..

    Guest, Feb 29, 2008, in forum: Computer Support
    Replies:
    4
    Views:
    445
    Ctrl¤/Alt¤/Del
    Mar 1, 2008
  5. dfinc
    Replies:
    0
    Views:
    443
    dfinc
    May 1, 2009
Loading...

Share This Page