Is it normal this behavior of W10Privacy?

[xspeed]

Excuse me, I am not very sure if this happened also when I opened it without "Run as administrator"

 

But as soon as I "Run as administrator" antivirus HIPS:

 

Application;Operation;Target;Action;Rule;Additional information

C:\Windows\System32\consent.exe;Modify startup settings;HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\internat.exe;allowed;Automatic mode;

 

 

Application;Operation;Target;Action;Rule;Additional information

C:\Windows\System32\services.exe;Modify startup settings;HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TrustedInstaller\Start;allowed;Automatic mode;

 

 

Can anyone say please that this is normal?

 

Thank you.

[xspeed]

Can someone tell please if it is a risk considering:

 

https://virustotal.com/en/file/f02239a3637eec4fac4636c7fc045a3cd81a6389cefee06547c0f03e0aec3485/analysis/1478668924/

 

File name: W10Privacy.exe

 

Antiy-AVL               - Trojan/Generic.ASVCS3S.1E5

Bkav                       - W32.HfsAtITPSINF.7D4E

ClamAV                  - Win.Trojan.Philadelphia-1

Invincea                  - trojandropper.autoit.rebhip.a

 

Regards.

[Aura]

Hi xspeed,

Which Antivirus are you using? Are you using COMODO by any chance?

[xspeed]

ESET Nod32 Antivirus.

Thank you.

[Aura]

According to multiple sources, W10Privacy is a legitimate program. Keep in mind that these programs will often messes up with Windows default settings as they try to disable telemetry, data collection, etc. features from the OS itself, so some security products (like ESET) might flag these modifications as unwanted and/or potentially malicious. This is probably why ESET gave you these alerts earlier.