Author Topic: Consent.exe: What is this? (Quick Question)  (Read 25276 times)

0 Members and 2 Guests are viewing this topic.

Offline Misuzu

  • Sr. Member
  • ****
  • Posts: 274
Consent.exe: What is this? (Quick Question)
« on: June 22, 2010, 01:05:16 PM »
I have a new process I once again don't remember:
consent.exe

I did a up-to-date MBAM quick scan and it found nothing.

I couldn't find it on this website: http://www.what-is-exe.com/

This is just a quick question
Thanks.

EDIT: Okay I clicked on the process and picked "Preform Administrative Task" (Or something similar) and it came up with another "Task Manager List" of Processes and it said it was created on early Junuary 2008 and it was some sort of SYSTEM file, so I'd imagine it's safe.
But can anyone confirm?
EDIT: Okay I researched it and apparently consent.exe has a malware-version of it. Though I don't know what consent.exe really does (Normal version and Malware version). But my cursor did show the "loading" icon for a longer period of time than normal... I don't know, maybe I'm just paranoid.

Okay I found where it is: C:\Windows\System32
I added a picture of it below.

P.S. I only can "Preform Administrative Task" on it in the Task Manager. (After I do "Preform Administrative Task" however, it lets me do other things with it)
« Last Edit: June 22, 2010, 01:20:51 PM by Misuzu »
| I Use: Free Avast!   |  Malwarebytes Anti-Malware (Both up-to-date) |
I am not very computer or tech savvy, so please forgive my lack of knowledge at times. I am still learning!

Offline Asyn

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33508
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Consent.exe: What is this? (Quick Question)
« Reply #1 on: June 22, 2010, 01:54:21 PM »
Check the file at virustotal.com
asyn
XP SP3 - Avast 10.4.2227.R4.B1 - CIS 3.14 [FW/D+] - MBAM 1.75 [OD] - Firefox ESR 38.2.1 [NS/ABP/EHH/SVC] - Thunderbird 38.2 [EM]
Deutschsprachiger Bereich -> Avast Wissenswertes (Downloads, Anleitungen und Infos):
https://forum.avast.com/index.php?topic=60523.0

Offline Misuzu

  • Sr. Member
  • ****
  • Posts: 274
| I Use: Free Avast!   |  Malwarebytes Anti-Malware (Both up-to-date) |
I am not very computer or tech savvy, so please forgive my lack of knowledge at times. I am still learning!

Offline Asyn

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33508
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Consent.exe: What is this? (Quick Question)
« Reply #3 on: June 22, 2010, 02:04:37 PM »
1. What does this mean?
2. Anyway, consent.exe is gone now after restarting the computer...

1. Be happy. It seems clean..! ;)
2. Good news for you, I guess..!??
asyn
XP SP3 - Avast 10.4.2227.R4.B1 - CIS 3.14 [FW/D+] - MBAM 1.75 [OD] - Firefox ESR 38.2.1 [NS/ABP/EHH/SVC] - Thunderbird 38.2 [EM]
Deutschsprachiger Bereich -> Avast Wissenswertes (Downloads, Anleitungen und Infos):
https://forum.avast.com/index.php?topic=60523.0

Offline Pondus

  • Avast Überevangelist
  • Maybe Bot
  • *****
  • Posts: 27792
Re: Consent.exe: What is this? (Quick Question)
« Reply #4 on: June 22, 2010, 02:05:25 PM »
http://lmgtfy.com/?q=consent.exe


there is also some malware using the name, as seen in the search above....
http://spywarefiles.prevx.com/RRHJID405482/CONSENT.EXE.html


« Last Edit: June 22, 2010, 02:07:53 PM by Pondus »
Chief Wiggum: Uh, no, you got the wrong number. This is 9-1…2.


Offline Misuzu

  • Sr. Member
  • ****
  • Posts: 274
Re: Consent.exe: What is this? (Quick Question)
« Reply #5 on: June 22, 2010, 02:12:58 PM »
AGAIN

Sorry for being off topic, but Avast! just detected "mbamswissarmy.sys" as a rootkit again.  ::)
This is a FP right? I just chose to "Ignore" it. But I thought I added it to exclusions. (Check my last topic here.)


@Pondus:
Are you saying the consent.exe I have is malware? Or are you just posting information about it?

Thanks for the replies.
« Last Edit: June 22, 2010, 02:14:33 PM by Misuzu »
| I Use: Free Avast!   |  Malwarebytes Anti-Malware (Both up-to-date) |
I am not very computer or tech savvy, so please forgive my lack of knowledge at times. I am still learning!

Offline Asyn

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33508
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Consent.exe: What is this? (Quick Question)
« Reply #6 on: June 22, 2010, 02:15:14 PM »
Sorry for being off topic, but Avast! just detected "mbamswissarmy.sys" as a rootkit again.  ::)
This is a FP right?

Yes, afaik..!
asyn
XP SP3 - Avast 10.4.2227.R4.B1 - CIS 3.14 [FW/D+] - MBAM 1.75 [OD] - Firefox ESR 38.2.1 [NS/ABP/EHH/SVC] - Thunderbird 38.2 [EM]
Deutschsprachiger Bereich -> Avast Wissenswertes (Downloads, Anleitungen und Infos):
https://forum.avast.com/index.php?topic=60523.0

Offline Pondus

  • Avast Überevangelist
  • Maybe Bot
  • *****
  • Posts: 27792
Re: Consent.exe: What is this? (Quick Question)
« Reply #7 on: June 22, 2010, 02:16:51 PM »
Quote
Are you saying the consent.exe I have is malware?
you just scanned your version at virustotal, and it came out clean.....

Quote
Or are you just posting information about it?
yes
Chief Wiggum: Uh, no, you got the wrong number. This is 9-1…2.


Offline Pondus

  • Avast Überevangelist
  • Maybe Bot
  • *****
  • Posts: 27792
Re: Consent.exe: What is this? (Quick Question)
« Reply #8 on: June 22, 2010, 02:20:53 PM »
clicking rescan i get this

VirusTotal - consent.exe - 0/41
http://www.virustotal.com/analisis/a77dd8a8d8a562b54321c60812c7c77387e88cacbfa4e8911f1f7e010410a1be-1277208001

if you scroll down to the end you find this


sigcheck: publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. All rights reserved.
product......: Microsoft_ Windows_ Operating System
description..: Consent UI for administrative applications
original name: consent.exe
internal name: consent
file version.: 6.0.6001.18000 (longhorn_rtm.080118-1840)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned


if it was malware i dont think you will find that there.....
« Last Edit: June 22, 2010, 02:23:18 PM by Pondus »
Chief Wiggum: Uh, no, you got the wrong number. This is 9-1…2.


Online polonus

  • Avast Überevangelist
  • Maybe Bot
  • *****
  • Posts: 24977
  • malware fighter
Re: Consent.exe: What is this? (Quick Question)
« Reply #9 on: June 22, 2010, 02:29:40 PM »
Hi Misuzu,

Just consider these info
http://spywarefiles.prevx.com/RRHJID405482/CONSENT.EXE.html
http://www.technologyquestions.com/technology/windows-vista/132192-consent-exe.html
There is a MalWare version of Consent.exe
Right Click ALL of the ones you find and look for
Microsoft details in Properties
Comment found: "ten consent.exe skanowałem też poleconym prevx i jest ok tzn czysto. Wobec tego zezwolic na dostęp do sieci bo zapora co uruchomienie peceta to komunikuje ,że zablokowała dostęp do sieci consent.exe"
translated: "this consent.exe scanned through Prevx and it is ok, that means clean. Therefore allow access to the network because the firewall at the PC to run it communicates that it has blocked access to the network for consent.exe",

polonus

Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Misuzu

  • Sr. Member
  • ****
  • Posts: 274
Re: Consent.exe: What is this? (Quick Question)
« Reply #10 on: June 22, 2010, 04:59:09 PM »
Okay thanks guys. :)

Hi Misuzu,

Just consider these info
http://spywarefiles.prevx.com/RRHJID405482/CONSENT.EXE.html
http://www.technologyquestions.com/technology/windows-vista/132192-consent-exe.html
There is a MalWare version of Consent.exe
Right Click ALL of the ones you find and look for
Microsoft details in Properties
Comment found: "ten consent.exe skanowałem też poleconym prevx i jest ok tzn czysto. Wobec tego zezwolic na dostęp do sieci bo zapora co uruchomienie peceta to komunikuje ,że zablokowała dostęp do sieci consent.exe"
translated: "this consent.exe scanned through Prevx and it is ok, that means clean. Therefore allow access to the network because the firewall at the PC to run it communicates that it has blocked access to the network for consent.exe",

polonus



Are there several consent.exe on the computer? Or shouldn't there be?
I know I checked the new Windows 7 computer and it had two consent.exe on it, as well as something called consent.mui but that's another story.  :P

If I find more consent.exe, should I scan them with my programs (Avast!/MBAM) or with Virustotal?

However,
From what I can understand (Sorry, my malware knowledge is limited) I have no malware and my consent.exe is totally safe.

Thanks for the help again guys. :)
| I Use: Free Avast!   |  Malwarebytes Anti-Malware (Both up-to-date) |
I am not very computer or tech savvy, so please forgive my lack of knowledge at times. I am still learning!

Offline Asyn

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33508
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Consent.exe: What is this? (Quick Question)
« Reply #11 on: June 23, 2010, 10:34:43 AM »
1. If I find more consent.exe, should I scan them with my programs (Avast!/MBAM) or with Virustotal?
2. From what I can understand (Sorry, my malware knowledge is limited) I have no malware and my consent.exe is totally safe.
3. Thanks for the help again guys. :)

1. If you fear an infection, you can do so...
2. Yes. At least the one you scanned on VT...
3. You're welcome..!
asyn
XP SP3 - Avast 10.4.2227.R4.B1 - CIS 3.14 [FW/D+] - MBAM 1.75 [OD] - Firefox ESR 38.2.1 [NS/ABP/EHH/SVC] - Thunderbird 38.2 [EM]
Deutschsprachiger Bereich -> Avast Wissenswertes (Downloads, Anleitungen und Infos):
https://forum.avast.com/index.php?topic=60523.0

Offline Misuzu

  • Sr. Member
  • ****
  • Posts: 274
Re: Consent.exe: What is this? (Quick Question)
« Reply #12 on: June 25, 2010, 06:50:28 AM »
No malware or anything, but I just got the warning about rootkits again and it's the same old file, mbamswissarmy.sys. I added it to the exclusions but I guess I didn't do it right.
Has Avast! not fixed this FP yet?
| I Use: Free Avast!   |  Malwarebytes Anti-Malware (Both up-to-date) |
I am not very computer or tech savvy, so please forgive my lack of knowledge at times. I am still learning!

Offline Gargamel360

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2351
  • Memento Mori
Re: Consent.exe: What is this? (Quick Question)
« Reply #13 on: June 25, 2010, 06:57:30 AM »
Did you add it to both exclusion lists?

One is in main settings and another in the file system shield expert settings.

edit: nvm, I see you went through that part already
« Last Edit: June 25, 2010, 07:18:40 AM by Gargamel360 »
Signature?  But I gots no pen....

Offline Misuzu

  • Sr. Member
  • ****
  • Posts: 274
Re: Consent.exe: What is this? (Quick Question)
« Reply #14 on: July 08, 2010, 01:06:37 AM »
Sorry for reviving the thread, but it happened again. :P
I just picked "Do not tell me about this rootkit in the future".

Obviously Avast! hasn't fixed this issue yet?
| I Use: Free Avast!   |  Malwarebytes Anti-Malware (Both up-to-date) |
I am not very computer or tech savvy, so please forgive my lack of knowledge at times. I am still learning!