Author Topic: Consent.exe: What is this? (Quick Question)  (Read 18199 times)

Offline Misuzu

  • Sr. Member
  • ****
  • Posts: 262
    • Personal Message (Offline)
Consent.exe: What is this? (Quick Question)
« on: June 22, 2010, 11:05:16 AM »
I have a new process I once again don't remember:
consent.exe

I did a up-to-date MBAM quick scan and it found nothing.

I couldn't find it on this website: http://www.what-is-exe.com/

This is just a quick question
Thanks.

EDIT: Okay I clicked on the process and picked "Preform Administrative Task" (Or something similar) and it came up with another "Task Manager List" of Processes and it said it was created on early Junuary 2008 and it was some sort of SYSTEM file, so I'd imagine it's safe.
But can anyone confirm?
EDIT: Okay I researched it and apparently consent.exe has a malware-version of it. Though I don't know what consent.exe really does (Normal version and Malware version). But my cursor did show the "loading" icon for a longer period of time than normal... I don't know, maybe I'm just paranoid.

Okay I found where it is: C:\Windows\System32
I added a picture of it below.

P.S. I only can "Preform Administrative Task" on it in the Task Manager. (After I do "Preform Administrative Task" however, it lets me do other things with it)
« Last Edit: June 22, 2010, 11:20:51 AM by Misuzu »
I Use: Free Avast!   |  MBAM (Both up-to-date)
Computers:
HP Windows 7 64-Bit Laptop (Family Computer: Connected to Internet)  |  DELL Windows 7 64-Bit Laptop (My Computer: Disconnected from Internet)

Offline Asyn

  • avast! Überevangelist
  • Maybe Bot
  • *****
  • Posts: 24924
  • Frohe Ostern
    • >>>  avast! Forum - Deutschsprachiger Bereich  <<<
    • Personal Message (Offline)
Re: Consent.exe: What is this? (Quick Question)
« Reply #1 on: June 22, 2010, 11:54:21 AM »
Check the file at virustotal.com
asyn
XP SP3 - avast! 9.0.2018 - CIS 3.14 [FW/D+] - MBAM 1.75 [On Demand] - Firefox ESR 24.4 [NS/ABP/EHH/BP] - Thunderbird 24.4 [EM/CH]
Deutschsprachiger Bereich -> avast! Wissenswertes (Downloads, Anleitungen und Infos): http://forum.avast.com/index.php?topic=60523.0

Offline Misuzu

  • Sr. Member
  • ****
  • Posts: 262
    • Personal Message (Offline)
I Use: Free Avast!   |  MBAM (Both up-to-date)
Computers:
HP Windows 7 64-Bit Laptop (Family Computer: Connected to Internet)  |  DELL Windows 7 64-Bit Laptop (My Computer: Disconnected from Internet)

Offline Asyn

  • avast! Überevangelist
  • Maybe Bot
  • *****
  • Posts: 24924
  • Frohe Ostern
    • >>>  avast! Forum - Deutschsprachiger Bereich  <<<
    • Personal Message (Offline)
Re: Consent.exe: What is this? (Quick Question)
« Reply #3 on: June 22, 2010, 12:04:37 PM »
1. What does this mean?
2. Anyway, consent.exe is gone now after restarting the computer...

1. Be happy. It seems clean..! ;)
2. Good news for you, I guess..!??
asyn
XP SP3 - avast! 9.0.2018 - CIS 3.14 [FW/D+] - MBAM 1.75 [On Demand] - Firefox ESR 24.4 [NS/ABP/EHH/BP] - Thunderbird 24.4 [EM/CH]
Deutschsprachiger Bereich -> avast! Wissenswertes (Downloads, Anleitungen und Infos): http://forum.avast.com/index.php?topic=60523.0

Offline Pondus

  • avast! Überevangelist
  • Maybe Bot
  • *****
  • Posts: 21702
  • Gender: Male
    • Personal Message (Offline)
Re: Consent.exe: What is this? (Quick Question)
« Reply #4 on: June 22, 2010, 12:05:25 PM »
http://lmgtfy.com/?q=consent.exe


there is also some malware using the name, as seen in the search above....
http://spywarefiles.prevx.com/RRHJID405482/CONSENT.EXE.html


« Last Edit: June 22, 2010, 12:07:53 PM by Pondus »
Chief Wiggum: Uh, no, you got the wrong number. This is 9-1…2.


Offline Misuzu

  • Sr. Member
  • ****
  • Posts: 262
    • Personal Message (Offline)
Re: Consent.exe: What is this? (Quick Question)
« Reply #5 on: June 22, 2010, 12:12:58 PM »
AGAIN

Sorry for being off topic, but Avast! just detected "mbamswissarmy.sys" as a rootkit again.  ::)
This is a FP right? I just chose to "Ignore" it. But I thought I added it to exclusions. (Check my last topic here.)


@Pondus:
Are you saying the consent.exe I have is malware? Or are you just posting information about it?

Thanks for the replies.
« Last Edit: June 22, 2010, 12:14:33 PM by Misuzu »
I Use: Free Avast!   |  MBAM (Both up-to-date)
Computers:
HP Windows 7 64-Bit Laptop (Family Computer: Connected to Internet)  |  DELL Windows 7 64-Bit Laptop (My Computer: Disconnected from Internet)

Offline Asyn

  • avast! Überevangelist
  • Maybe Bot
  • *****
  • Posts: 24924
  • Frohe Ostern
    • >>>  avast! Forum - Deutschsprachiger Bereich  <<<
    • Personal Message (Offline)
Re: Consent.exe: What is this? (Quick Question)
« Reply #6 on: June 22, 2010, 12:15:14 PM »
Sorry for being off topic, but Avast! just detected "mbamswissarmy.sys" as a rootkit again.  ::)
This is a FP right?

Yes, afaik..!
asyn
XP SP3 - avast! 9.0.2018 - CIS 3.14 [FW/D+] - MBAM 1.75 [On Demand] - Firefox ESR 24.4 [NS/ABP/EHH/BP] - Thunderbird 24.4 [EM/CH]
Deutschsprachiger Bereich -> avast! Wissenswertes (Downloads, Anleitungen und Infos): http://forum.avast.com/index.php?topic=60523.0

Offline Pondus

  • avast! Überevangelist
  • Maybe Bot
  • *****
  • Posts: 21702
  • Gender: Male
    • Personal Message (Offline)
Re: Consent.exe: What is this? (Quick Question)
« Reply #7 on: June 22, 2010, 12:16:51 PM »
Quote
Are you saying the consent.exe I have is malware?
you just scanned your version at virustotal, and it came out clean.....

Quote
Or are you just posting information about it?
yes
Chief Wiggum: Uh, no, you got the wrong number. This is 9-1…2.


Offline Pondus

  • avast! Überevangelist
  • Maybe Bot
  • *****
  • Posts: 21702
  • Gender: Male
    • Personal Message (Offline)
Re: Consent.exe: What is this? (Quick Question)
« Reply #8 on: June 22, 2010, 12:20:53 PM »
clicking rescan i get this

VirusTotal - consent.exe - 0/41
http://www.virustotal.com/analisis/a77dd8a8d8a562b54321c60812c7c77387e88cacbfa4e8911f1f7e010410a1be-1277208001

if you scroll down to the end you find this


sigcheck: publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. All rights reserved.
product......: Microsoft_ Windows_ Operating System
description..: Consent UI for administrative applications
original name: consent.exe
internal name: consent
file version.: 6.0.6001.18000 (longhorn_rtm.080118-1840)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned


if it was malware i dont think you will find that there.....
« Last Edit: June 22, 2010, 12:23:18 PM by Pondus »
Chief Wiggum: Uh, no, you got the wrong number. This is 9-1…2.


Offline polonus

  • avast! Überevangelist
  • Maybe Bot
  • *****
  • Posts: 20143
  • Gender: Male
  • malware fighter
    • Personal Message (Offline)
Re: Consent.exe: What is this? (Quick Question)
« Reply #9 on: June 22, 2010, 12:29:40 PM »
Hi Misuzu,

Just consider these info
http://spywarefiles.prevx.com/RRHJID405482/CONSENT.EXE.html
http://www.technologyquestions.com/technology/windows-vista/132192-consent-exe.html
There is a MalWare version of Consent.exe
Right Click ALL of the ones you find and look for
Microsoft details in Properties
Comment found: "ten consent.exe skanowałem też poleconym prevx i jest ok tzn czysto. Wobec tego zezwolic na dostęp do sieci bo zapora co uruchomienie peceta to komunikuje ,że zablokowała dostęp do sieci consent.exe"
translated: "this consent.exe scanned through Prevx and it is ok, that means clean. Therefore allow access to the network because the firewall at the PC to run it communicates that it has blocked access to the network for consent.exe",

polonus

Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Misuzu

  • Sr. Member
  • ****
  • Posts: 262
    • Personal Message (Offline)
Re: Consent.exe: What is this? (Quick Question)
« Reply #10 on: June 22, 2010, 02:59:09 PM »
Okay thanks guys. :)

Hi Misuzu,

Just consider these info
http://spywarefiles.prevx.com/RRHJID405482/CONSENT.EXE.html
http://www.technologyquestions.com/technology/windows-vista/132192-consent-exe.html
There is a MalWare version of Consent.exe
Right Click ALL of the ones you find and look for
Microsoft details in Properties
Comment found: "ten consent.exe skanowałem też poleconym prevx i jest ok tzn czysto. Wobec tego zezwolic na dostęp do sieci bo zapora co uruchomienie peceta to komunikuje ,że zablokowała dostęp do sieci consent.exe"
translated: "this consent.exe scanned through Prevx and it is ok, that means clean. Therefore allow access to the network because the firewall at the PC to run it communicates that it has blocked access to the network for consent.exe",

polonus



Are there several consent.exe on the computer? Or shouldn't there be?
I know I checked the new Windows 7 computer and it had two consent.exe on it, as well as something called consent.mui but that's another story.  :P

If I find more consent.exe, should I scan them with my programs (Avast!/MBAM) or with Virustotal?

However,
From what I can understand (Sorry, my malware knowledge is limited) I have no malware and my consent.exe is totally safe.

Thanks for the help again guys. :)
I Use: Free Avast!   |  MBAM (Both up-to-date)
Computers:
HP Windows 7 64-Bit Laptop (Family Computer: Connected to Internet)  |  DELL Windows 7 64-Bit Laptop (My Computer: Disconnected from Internet)

Offline Asyn

  • avast! Überevangelist
  • Maybe Bot
  • *****
  • Posts: 24924
  • Frohe Ostern
    • >>>  avast! Forum - Deutschsprachiger Bereich  <<<
    • Personal Message (Offline)
Re: Consent.exe: What is this? (Quick Question)
« Reply #11 on: June 23, 2010, 08:34:43 AM »
1. If I find more consent.exe, should I scan them with my programs (Avast!/MBAM) or with Virustotal?
2. From what I can understand (Sorry, my malware knowledge is limited) I have no malware and my consent.exe is totally safe.
3. Thanks for the help again guys. :)

1. If you fear an infection, you can do so...
2. Yes. At least the one you scanned on VT...
3. You're welcome..!
asyn
XP SP3 - avast! 9.0.2018 - CIS 3.14 [FW/D+] - MBAM 1.75 [On Demand] - Firefox ESR 24.4 [NS/ABP/EHH/BP] - Thunderbird 24.4 [EM/CH]
Deutschsprachiger Bereich -> avast! Wissenswertes (Downloads, Anleitungen und Infos): http://forum.avast.com/index.php?topic=60523.0

Offline Misuzu

  • Sr. Member
  • ****
  • Posts: 262
    • Personal Message (Offline)
Re: Consent.exe: What is this? (Quick Question)
« Reply #12 on: June 25, 2010, 04:50:28 AM »
No malware or anything, but I just got the warning about rootkits again and it's the same old file, mbamswissarmy.sys. I added it to the exclusions but I guess I didn't do it right.
Has Avast! not fixed this FP yet?
I Use: Free Avast!   |  MBAM (Both up-to-date)
Computers:
HP Windows 7 64-Bit Laptop (Family Computer: Connected to Internet)  |  DELL Windows 7 64-Bit Laptop (My Computer: Disconnected from Internet)

Offline Gargamel360

  • avast! Evangelist
  • Super Poster
  • ***
  • Posts: 2357
  • Gender: Male
  • Memento Mori
    • Personal Message (Offline)
Re: Consent.exe: What is this? (Quick Question)
« Reply #13 on: June 25, 2010, 04:57:30 AM »
Did you add it to both exclusion lists?

One is in main settings and another in the file system shield expert settings.

edit: nvm, I see you went through that part already
« Last Edit: June 25, 2010, 05:18:40 AM by Gargamel360 »
Signature?  But I gots no pen....

Offline Misuzu

  • Sr. Member
  • ****
  • Posts: 262
    • Personal Message (Offline)
Re: Consent.exe: What is this? (Quick Question)
« Reply #14 on: July 07, 2010, 11:06:37 PM »
Sorry for reviving the thread, but it happened again. :P
I just picked "Do not tell me about this rootkit in the future".

Obviously Avast! hasn't fixed this issue yet?
I Use: Free Avast!   |  MBAM (Both up-to-date)
Computers:
HP Windows 7 64-Bit Laptop (Family Computer: Connected to Internet)  |  DELL Windows 7 64-Bit Laptop (My Computer: Disconnected from Internet)

 

Google Chrome

AVAST recommends using the FREE Google Chrome™ browser.

Download Google Chrome Now