Is Esif_assist_64.exe legit intel file or malware?

[weva_v_]

Hello,

I freshly reinstalled windows, installed basic programs from credible sites and installed automatic updates.

I did run a scan with few of antivirus/antimalware programs that I use, none found anything except for Roguekiller. Each time I run roguekiller in normal mode, it finds esif_assist_64.exe in C:/Windows/Temp/DPTF/ folder. Folder cannot be deleted.

DPTF folder along with that file and 2 others was not there after fresh reinstall, but it appeared after windows updates.

Detection in Roguekiller is labeled as Suspicious.Path, and type is Process.

Each time I click on delete it does not get deleted, instead it gets "killed".

File shows up every time I boot computer and shows time of creation time I booted the computer.

Description of the file is: Intel (R) Dynamic Platform and Thermal Framework Utility Application.

File does not show up in the folder when I boot computer in safe mode, and neither does it get detected by roguekiller. It gets detected by it only when I run it in normal mode.

I ran it through virustotal and it came in clean, however I checked the details and it shows all certificates as legit except the first one:

Intel (R) Software - Certificate Intel external basic issuing CA 3B. It is expired certificate that expired on 7/15/2016.

Also, it specified it as a Portable execution file.

I have questions:

1. Is it legit?

2. Is it possible that file with Intel Dynamic Platform and Thermal Framework was installed along with windows updates? That is only explanation that I have, but I would need a verification that this file is part of normal windows updates. That is when it actually showed up. Could it be malware or something perhaps?

Thanks.

[Light_Intel]

Thank you for contacting Intel Support.

The file mentioned esif_assist_64.exe has nothing to do with the Software support by this forum. I am not familiar with it and had to Google myself. You may find a better answer trying a different Intel Support channel: http://www.intel.com/content/www/us/en/support/contact-support.html

Regards,

Noga
Intel Developer Support

[weva_v_]

Noga C. (Intel) wrote:

Thank you for contacting Intel Support.

The file mentioned esif_assist_64.exe has nothing to do with the Software support by this forum. I am not familiar with it and had to Google myself. You may find a better answer trying a different Intel Support channel: http://www.intel.com/content/www/us/en/support/contact-support.html

Regards,

Noga
Intel Developer Support

So, I should not make a new thread in this intel software development forum at all, or am I just in wrong section of the forum?

Where should I ask my question about file please? I checked other support channels you recommended, but these are hardware related. This problem is software related. Could you please redirect me? Thank you :)

Or perhaps there could be someone else who could find out where does this file originated from, and if it indeed belongs to Intel?

[Light_Intel]

This forum is primarily for Intel Software Development Products. esif_assist_64.exe doesn't fall under this category. I am not familiar with it. I Googled it and found different answers, among them Reason Core Security. However, I am unable to answer your question. I think the following Intel site may be more suitable for this question: https://customercare.intel.com/?lang=en-US

Regards,

Noga