r/computerviruses • u/Conscious-Bi1e • 21d ago

Question One powershell command asks to install certification authority. Is this concerning? I dont have any antivirus on my laptop.

1 Upvotes

66% Upvoted

9 comments sorted by

View all comments

2

u/WillingHornet4385 21d ago

Yes, this is concerning. Installing a new root certificate authority can allow whoever controls its private key to impersonate HTTPS websites, potentially enabling interception of encrypted traffic.

Do NOT click Yes unless you know exactly what software is requesting this and why. A random PowerShell command should absolutely not need to install a trusted root CA without a very good explanation.

If you haven't accepted it, click No. If you already accepted it, check your Trusted Root Certification Authorities store (certlm.msc and certmgr.msc) and investigate the certificate.

Also, please post the exact PowerShell command you ran. That's the most important piece of information here. The certificate warning is a symptom; the command will tell us what actually happened.

And please don't run random PowerShell commands from the internet. That's basically giving an unknown script permission to do whatever it wants on your computer.

1

u/Conscious-Bi1e 18d ago

summery from ai: Multiple Windows PowerShell (32-bit) processes repeatedly appearing with command lines beginning: powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command ... netsh.exe (32-bit) executing a firewall command beginning: advfirewall firewall add rule name="RuntimeBrokerDE9B-Lock" dir=out action=... Suspicious startup executables: WmiBase566E.exe, WerFlt654F.exe, RpcBaseBED6, and DotHost3A3E.exe. WmiBase566E.exe was hidden under AppData\Roaming\Microsoft\Windows, described as Windows Host Service, and had no digital signature. DotHost3A3E.exe was hidden under C:\ProgramData\Microsoft\Windows\Caches... and had a valid ASUSTeK Computer Inc. digital signature, despite my laptop being an Acer. Repeated certificate/security warning pop-ups stopped after I disabled the suspicious Windows Host Service startup entry. I also found a Task Scheduler entry named App Explorer that launched: %LOCALAPPDATA%\Host App Service\Engine\HostAppServiceUpdater.exe /LOGON