topic Thank you for contacting in Software Archive


	 

	I did run a scan with few of antivirus/antimalware programs that I use, none found anything except for Roguekiller. Each time I run roguekiller in normal mode, it finds esif_assist_64.exe in C:/Windows/Temp/DPTF/ folder. Folder cannot be deleted.

	DPTF folder along with that file and 2 others was not there after fresh reinstall, but it appeared after windows updates.

		

		Detection in Roguekiller is labeled as Suspicious.Path, and type is Process.

		

		Each time I click on delete it does not get deleted, instead it gets "killed".

		

		File shows up every time I boot computer and shows time of creation time I booted the computer.

		

		Description of the file is: Intel (R) Dynamic Platform and Thermal Framework Utility Application.

		

		File does not show up in the folder when I boot computer in safe mode, and neither does it get detected by roguekiller. It gets detected by it only when I run it in normal mode.

		

		I ran it through virustotal and it came in clean, however I checked the details and it shows all certificates as legit except the first one:

	Intel (R) Software - Certificate Intel external basic issuing CA 3B. It is expired certificate that expired on 7/15/2016.

	 

	Also, it specified it as a Portable execution file.

	

		I have questions:

	1. Is it legit?

	2. Is it possible that file with Intel Dynamic Platform and Thermal Framework was installed along with windows updates? That is only explanation that I have, but I would need a verification that this file is part of normal windows updates. That is when it actually showed up. Could it be malware or something perhaps?

	 

	Thanks.

topic Thank you for contacting in Software Archive

Is Esif_assist_64.exe legit intel file or malware?

Thank you for contacting

Quote:Noga C. (Intel) wrote:

This forum is primarily for