Trojan Vigorf.A in OpenHardwareMonitorLib.sys

Mark James 70

Windows Defender is telling me that a trojan: vigorf.a is in a file; OpenHardwareMonitorLib.sys

I've told it to remove, rebooted several times. It's still there.

Marcus Reid 10 Reputation points

2025-09-05T07:32:50.7766667+00:00

Same. I think it might be part of Intel NUC Software Studio.
Yiming Wang 0 Reputation points

2025-09-05T12:59:39.8033333+00:00

我也怀疑是NUC Softwaree studio是不是出现了问题
James Utz 5 Reputation points

2025-09-05T13:10:43.9366667+00:00

Same, the file keeps coming back after deletion. Using an Intel NUC with this same software loaded.
Oli 10 Reputation points

2025-09-05T18:42:23.9966667+00:00

I had the same problem with OHM. Removing the flagged file via Windows Defender did not help, but after removing the entire OHM folder manually, I did not get any warnings again after a full scan.

I did some research and found out that the problem isn't directly OHM, but the driver WinRing0 it uses.

As far as I understand, it's a driver that allows low-level hardware access which is sometimes abused by malware, and Windows Defender treats that as a risk.

There is also a post on the Microsoft support page that confirms that the driver is classified as a known vulnerabitly and that OHM is one of the impacted applications.

https://support.microsoft.com/en-us/windows/microsoft-defender-antivirus-alert-vulnerabledriver-winnt-winring0-eb057830-d77b-41a2-9a34-015a5d203c42

Another thread related to this: https://learn.microsoft.com/en-us/answers/questions/5545190/threats-detected-trojan-win32-vigorf-a
Mark James 30 Reputation points

2025-09-05T18:55:11.32+00:00

Oli, The system will not allow me to delete the file. (C:\Windows\System32\DriverStore\FileRepository\performancedriverextension.inf_amd64_4307518ac694be75\Service\OpenHardwareMonitorLib.sys) I can run Explorer in Administrative mode and it still says I need SYSTEM privilege to delete it. I can't seem to change the permissions of the file either. Every time Windows Defender "says" it's deleted it, it reappears with a creation date and time of the reboot.

How do I get rid of this file? I tried uninstalling NUC Software suite, but that only appeared to remove the menu entry, not the underlying files.

I'm this close to just wiping out the system and reinstalling Windows. (Backing up my files as I write this) I'd REALLY prefer not to do this as it takes days to get everything back the way I want it.
James Utz 5 Reputation points

2025-09-05T19:08:15.9233333+00:00

So, here's 'the funny part.' I DID completely reinstall Windows 11 from scratch, wiping my disk. Microsoft automatically pushed the NUC Suite on to the PC in a driver update without my intervention - I did not install it manually. Now Microsoft Defender is complaining vigorously. So, Microsoft is technically causing this conflict on NUC PCs right now, even though they did not write the NUC Suite software (but they are actively pushing it).
Mark James 30 Reputation points

2025-09-05T19:21:00.2666667+00:00

Oi-Vay!
GlotonCL 0 Reputation points

2025-09-05T20:47:36.3266667+00:00

Yeah. I had the same problen yesterday (Vigorf.A in OpenHardwareMonitorLib.sys). After delete the file with Windows Defender, I decided format mi PC. Now all seen nice. I need say that I have an AMD system, AMD Ryzen 2700 and RX7800XT, so I think is not an Intel problem.
Rom P 0 Reputation points

2025-09-06T02:52:02.6433333+00:00

running a NUC machine as well and having this issue. Can't delete it manually too.
Paul Maxfield 5 Reputation points

2025-09-07T07:56:37.7066667+00:00
Last Thursday, I encountered the same persistent "Trojan:Win32/Vigorf.A" detection targeting OpenHardwareMonitorLib.sys in Intel NUC Software Studio. After extensive troubleshooting, I can confirm this is a false positive affecting legitimate Intel software. The detection stems from an outdated, vulnerable driver component (WinRing0) that Intel bundles without proper security updates.

Confirming It's a False Positive

Before removal, I verified the legitimacy of the software:

Digital Signature Analysis:

Main executable (NucSoftwareStudioService.exe) shows valid Microsoft signatures

Certificate: "Microsoft Windows Hardware Compatibility Publisher"

Thumbprint: 426510225A68B9260814230B37E289BFE0566F28

The problematic file (OpenHardwareMonitorLib.sys) revealed:

Signed by original developer: Noriyuki MIYAZAKI (******@crystalmark.info)

Certificate expired in 2008 (17+ years old)

This is legitimate, open-source OpenHardwareMonitor library bundled by Intel

Complete Removal Process

Step 1: Stop the Service

# Open Services (services.msc) # Find "Intel(R) NUC Software Studio Service" # Set to "Disabled" and Stop

Step 2: Uninstall the Application

Settings → Apps → Installed apps → Intel NUC Software Studio → Uninstall

Step 3: Remove Driver Package

pnputil /delete-driver performancedriverextension.inf /uninstall /force

Step 4: Clean Registry

# Open Registry Editor (regedit) # Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ # Delete "NucSoftwareStudioService" key

Step 5: Force Delete Remaining Files

# Take ownership takeown /f "C:\Windows\System32\DriverStore\FileRepository\performancedriverextension.inf_amd64_[hash]" /r /d y # Grant permissions icacls "C:\Windows\System32\DriverStore\FileRepository\performancedriverextension.inf_amd64_[hash]" /grant administrators:F /t # Delete folder rmdir /s /q "C:\Windows\System32\DriverStore\FileRepository\performancedriverextension.inf_amd64_[hash]"

Step 6: Prevent Automatic Reinstallation

Disable automatic driver updates in Windows Update settings

Uninstall "Intel Driver & Support Assistant" if present

Use "Show or hide updates" troubleshooter to block Intel NUC driver packages

Verification

After removal:

Windows Defender scans show no threats

No "Trojan:Win32/Vigorf.A" detections

System stability maintained

Hardware monitoring can be replaced with alternatives like HWiNFO64

Industry Context

This false positive is part of a broader issue affecting hardware monitoring applications. Microsoft Defender began flagging WinRing0-based drivers in March 2025 due to CVE-2020-14979, a known vulnerability from 2020. Multiple users reported identical detections starting September 4th, 2025.

Challenge to Intel

Intel must address this security and user experience failure:

Immediate Actions Required:

Update OpenHardwareMonitor components to current, signed versions

Replace vulnerable WinRing0 drivers with secure alternatives

Implement proper code signing for all bundled third-party libraries

Release security updates for existing installations

Long-term Improvements:

Security audit of all bundled open-source components

Automated vulnerability scanning in software releases

Clear communication about false positives to users

Alternative hardware monitoring solutions that don't rely on vulnerable drivers

Intel's current approach is unacceptable for enterprise and consumer users alike. Bundling 17-year-old expired certificates and known vulnerable drivers in 2025 software releases demonstrates poor security practices and inadequate quality assurance.

Users shouldn't need to perform complex manual removal procedures for legitimate software flagged as malware. Intel must take responsibility for shipping secure, properly maintained software components or face continued user migration to alternative hardware monitoring solutions.

The company's apparent discontinuation of NUC Software Studio support while leaving vulnerable installations in the wild further compounds this issue. If Intel cannot maintain these software packages securely, they should provide clear migration paths to supported alternatives rather than abandoning users with false-positive-generating software.

Important Disclaimer

The actions and commands detailed in this article were AI-generated based on a comprehensive chat history that successfully resolved this specific Trojan:Win32/Vigorf.A false positive issue. However, the exact commands, file paths, and folder names may differ slightly from what individual users encounter on their systems.

Before executing any commands:

Verify file paths match your specific system configuration

Ensure you have appropriate administrative privileges

Create a system backup or restore point

Test commands in a safe environment when possible

The hash values in folder names (e.g., performancedriverextension.inf_amd64_[hash]) will be unique to each installation. Use the dir command to identify the correct folder names on your system before proceeding with deletion commands.

While this solution worked for the documented case, system configurations vary. Adapt the commands to match your specific environment and exercise appropriate caution when modifying system files and registry entries. Complete Solution: Resolving Trojan:Win32/Vigorf.A False Positive in Intel NUC Software Studio

Context

I recently encountered the same persistent "Trojan:Win32/Vigorf.A" detection targeting OpenHardwareMonitorLib.sys in Intel NUC Software Studio. After extensive troubleshooting, I can confirm this is a false positive affecting legitimate Intel software. The detection stems from an outdated, vulnerable driver component (WinRing0) that Intel bundles without proper security updates.

Confirming It's a False Positive

Before removal, I verified the legitimacy of the software:

Digital Signature Analysis:

Main executable (NucSoftwareStudioService.exe) shows valid Microsoft signatures

Certificate: "Microsoft Windows Hardware Compatibility Publisher"

Thumbprint: 426510225A68B9260814230B37E289BFE0566F28

The problematic file (OpenHardwareMonitorLib.sys) revealed:

Signed by original developer: Noriyuki MIYAZAKI (******@crystalmark.info)

Certificate expired in 2008 (17+ years old)

This is legitimate open-source OpenHardwareMonitor library bundled by Intel

Complete Removal Process

Step 1: Stop the Service

# Open Services (services.msc) # Find "Intel(R) NUC Software Studio Service" # Set to "Disabled" and Stop

Step 2: Uninstall the Application

Settings → Apps → Installed apps → Intel NUC Software Studio → Uninstall

Step 3: Remove Driver Package

pnputil /delete-driver performancedriverextension.inf /uninstall /force

Step 4: Clean Registry

# Open Registry Editor (regedit) # Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ # Delete "NucSoftwareStudioService" key

Step 5: Force Delete Remaining Files

# Take ownership takeown /f "C:\Windows\System32\DriverStore\FileRepository\performancedriverextension.inf_amd64_[hash]" /r /d y # Grant permissions icacls "C:\Windows\System32\DriverStore\FileRepository\performancedriverextension.inf_amd64_[hash]" /grant administrators:F /t # Delete folder rmdir /s /q "C:\Windows\System32\DriverStore\FileRepository\performancedriverextension.inf_amd64_[hash]"

Step 6: Prevent Automatic Reinstallation

Disable automatic driver updates in Windows Update settings

Uninstall "Intel Driver & Support Assistant" if present

Use "Show or hide updates" troubleshooter to block Intel NUC driver packages

Verification

After removal:

Windows Defender scans show no threats

No "Trojan:Win32/Vigorf.A" detections

System stability maintained

Hardware monitoring can be replaced with alternatives like HWiNFO64

Industry Context

This false positive is part of a broader issue affecting hardware monitoring applications. Microsoft Defender began flagging WinRing0-based drivers in March 2025 due to CVE-2020-14979, a known vulnerability from 2020. Multiple users reported identical detections starting September 4th, 2025.

Challenge to Intel

Intel must address this security and user experience failure:

Immediate Actions Required:

Update OpenHardwareMonitor components to current, signed versions

Replace vulnerable WinRing0 drivers with secure alternatives

Implement proper code signing for all bundled third-party libraries

Release security updates for existing installations

Long-term Improvements:

Security audit of all bundled open-source components

Automated vulnerability scanning in software releases

Clear communication about false positives to users

Alternative hardware monitoring solutions that don't rely on vulnerable drivers

Intel's current approach is unacceptable for enterprise and consumer users alike. Bundling 17-year-old expired certificates and known vulnerable drivers in 2025 software releases demonstrates poor security practices and inadequate quality assurance.

Users shouldn't need to perform complex manual removal procedures for legitimate software flagged as malware. Intel must take responsibility for shipping secure, properly maintained software components or face continued user migration to alternative hardware monitoring solutions.

The company's apparent discontinuation of NUC Software Studio support while leaving vulnerable installations in the wild further compounds this issue. If Intel cannot maintain these software packages securely, they should provide clear migration paths to supported alternatives rather than abandoning users with false-positive-generating software.

Important Disclaimer

The actions and commands detailed in this article were AI-generated based on a comprehensive chat history that successfully resolved this specific Trojan:Win32/Vigorf.A false positive issue. However, the exact commands, file paths, and folder names may differ slightly from what individual users encounter on their systems.

Before executing any commands:

Verify file paths match your specific system configuration

Ensure you have appropriate administrative privileges

Create a system backup or restore point

Test commands in a safe environment when possible

The hash values in folder names (e.g., performancedriverextension.inf_amd64_[hash]) will be unique to each installation. Use the dir command to identify the correct folder names on your system before proceeding with deletion commands.

While this solution worked for the documented case, system configurations vary. Adapt the commands to match your specific environment and exercise appropriate caution when modifying system files and registry entries.
T KM 0 Reputation points

2025-09-14T13:31:05.8866667+00:00

Thank you, thank you people. Same problem, Winring0 driver in OpenHardwareMonitorLib.sys running Windows11 on a NUC. So much time spent, running in safe mode, trying to delete the effected files, running Defender over and over in all modes, all over the net searching, couldn't get rid of it.

Finally ended up here, disabled and then uninstalled the NUC software, all problems solved immediately and so far, permanently.
Emily 0 Reputation points

2025-10-23T20:56:28.5533333+00:00

Hi There, I was able to get through about half of the steps but when I got to step 3 & 4 either I wasnt doing it right or I wasnt able to continue due to not having permission to delete. I am getting this error over and over throughout the day and still cant get rid of it on my work computer.
Marcus Reid 10 Reputation points

2025-11-16T05:27:28.4833333+00:00

This was so incredibly hard to remove that it is almost certainly malware. I had to resort to getting Codex set up on my machine and let it try numerous things before it found a way forward.
Tom Wilson 0 Reputation points

2026-03-10T00:11:57.7966667+00:00

So if this is part of Intel Software Studio, and we need that for things like controlling the lighting on our NUC, does that mean we either have to allow a software vulnerability or deal with the ugly rainbow lighting on the NUC Skull logo and side panel LEDs?

I might have to open the system and unplug all the RGB, if that's the case.

11 answers

Mark James 30 Reputation points

2025-09-11T15:39:02.8033333+00:00

Thank you for the details. The issue came back today. I simply went to services.msc, stopped and disabled the Intel Software Studio service. Then I told Windows defender to remove the file. Rebooted and came back with a clean scan. The OpenHardwareMonitor.sys file did not come back after reboot.

If I see this again, I'll employ your very detailed instructions. Hopefully I won't see this again.
Was this answer helpful?

2 people found this answer helpful.
Joe Gilray 10 Reputation points

2025-09-11T16:57:36.4833333+00:00

Nice! Yes, the secret was to disable the service via services.msc, then it can be deleted. Problem solved, thanks... until the next one!

agama 0 Reputation points

2025-09-18T02:03:51.0433333+00:00

Thanks, this worked for me, I feel very relieved!

I just have a question. Are there implications of leaving the Intel Software Studio Service disabled?

In other words, could something work strangely because of that?

Mark James 30 Reputation points

2025-09-18T10:30:46.86+00:00

I don't know everything about the studio, but from what I saw of it, it just reported on the environment of your computer. CPU Temperature, fan speeds and such.

I'd say this would only be a concern if you're running gaming or other compute intensive programs. The NUCs came with SSDs, and those can degrade under heat.

I'm not really worried about it as I just use mine for browsing and streaming. If you're really concerned, just put your hand on the box from time to time to check if it's running hot.

agama 0 Reputation points

2025-09-20T17:23:31.96+00:00

I see, thanks for the observations.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Mark James 30 Reputation points

2025-09-07T13:03:48.03+00:00

Joe Gilray - Ding-Ding-Ding! We have a solution! I too noticed that the IntelSoftwareStudioService is still running on my system. I also removed OpenHardwareMonitorLib.sys from my virus scanning exclusion and re-ran the quick scan with the result of "No Threats Detected".

My theory of what happened is a little different however. Yes, when I uninstalled the IntelSoftwareStudio, it may well have rebuilt OpenHardwareMonitorLib.sys without Winring0, but that was irrelevant to Defender as it was still dinging it as a threat until the virus definitions were updated today (Mine updated on 9/7 too) This was a problem that Microsoft Defender made.

Now to see if I can cancel my order with Amazon for the new Lenovo mini PC. (Yeah, I was willing to just replace the hardware for my peace of mind)
Was this answer helpful?

2 people found this answer helpful.
Joe Gilray 10 Reputation points

2025-09-11T04:04:09.75+00:00

It's back tonight. Still flagging OpenHardwareMonitorLib.sys, but now for WinRing0_1_2_0... Unfortunately I don't know what is using OpenHardwareMonitorLib or how to delete it
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Gordon Shaw 10 Reputation points

2025-09-07T00:44:08.12+00:00
1. Right-click Command Prompt → Run as administrator.
2. Then enter: pnputil /delete-driver oem27.inf /uninstall /force
3. Restart your computer.
Was this answer helpful?

2 people found this answer helpful.
Mike Gadd 0 Reputation points

2025-09-18T12:43:17.7133333+00:00

Gordons tip works but, when you allow Widows update to be automatic it reloads this Intel update which brings back the problem Intel(R) Corporation - System - 1.0.1695.0, so is it a Microsoft problem or an Intel problem?

Ronald 0 Reputation points

2025-09-19T08:27:25.8666667+00:00

Well I used a similar solution, but for me it was oem18.inf so I guess we should not assume the number 27 or 18. I checked the number by using:
pnputil /enum-drivers > enumdrivers.txt
notepad .\enumdrivers.txt

then I searched for "performancedriverextension.inf" to find the oem number.
I did uninstall Intel NUC Software Studio before, and even before that I disabeld the relating service using 'services.msc' this helped Windows Defender in removing OpenHardwareMonitorLib.sys but I wanted to get rid of it all.

Update:
Oops Windows update installed it back again, it's the updated called:
"Intel Corporation - Extension - 1.0.0.38"

First I paused Windows Update. Then I uninstalled this again using the mentioned procedure (now it was oem1.inf on my system, so lookup the number). Then did the required reboot. After this I used a tool called wushowhide that can be downloaded from Microsoft: http://download.microsoft.com/download/f/2/2/f22d5fdb-59cd-4275-8c95-1be17bf70b21/wushowhide.diagcab

Found that url here: https://learn.microsoft.com/en-us/answers/questions/4076307/where-do-i-find-wushowhide-found-it

Click through and select hide updates and then set this update as hidden:

Then I resumed Windows Update and this update didn't come back up again. I hope this might be useful to others as well.

jason b 0 Reputation points

2025-09-22T03:24:24.86+00:00

Ignoring /force when used with /uninstall to delete driver package.

Driver package uninstalled.

Failed to delete driver package: The specified file is not an installed OEM INF.

C:\Windows\System32>
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Joe Gilray 10 Reputation points

2025-09-07T06:57:56.7633333+00:00

Starting 9/4/2025 I started seeing the same warning related to Winring0 in OpenHardwareMonitorLib.sys. I had seen this in mid March and fixed it by uninstalling HWMonitor. After reading many of the comments here I decided to uninstall Nuc SW Studio, then I removed the defender exclusion I had put on OpenHardwareMonitorLib.sys, rebooted and checked the file... yes it is there and its date is the time of reboot... and NUCSoftwareStudioService is still running... but... now defender isn't flagging it even if I force it to scan that file... strange, I think. I noticed that the defender definitions were updated today, I wonder if they changed to allow this, but I think a more likely explanation is that when you uninstall the NUC SW Studio then reboot, NUCSoftwareStudioService.exe builds a new OpenHardwareMonitorLib.sys without Winring0.
Was this answer helpful?

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
paozi 0 Reputation points

2025-09-05T07:39:57.7533333+00:00

一样，重新安装了win11，仍然提示相关问题。让重新启动。
Was this answer helpful?
James Utz 5 Reputation points

2025-09-05T22:05:31.0166667+00:00

One additional note, my wife has the same kind of computer, also running Windows 11. I checked, and she has this same Microsoft Defender warning. It all started on 9/4.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Trojan Vigorf.A in OpenHardwareMonitorLib.sys

11 answers

Your answer