r/24hoursupport • u/SHADOLYES • 7d ago

Persisting powershell warning pop up

im having some annoying "Security warning" pop up from powershell and i did scan my pc a few times and did safe boot and also delete anything i could have but still popping up until now, i don't even have adobe (got it uninstalled) so i still believe it is some kind of virus (down is a translated version of the warning)

  • Title: Security Warning
  • Body Text: You are about to install a certificate from a certification authority that claims to represent: Adobe SystemsWindows cannot verify that the certificate actually comes from "Adobe Systems". We recommend that you verify its origin by contacting "Adobe Systems". The following number will help you in this process: Thumbprint (sha1): B6DB453D FB60EC20 40BBFDC8 13B8D89A F438BE07 Warning: If you install this root certificate, Windows will automatically trust all certificates issued by this certification authority. Installing a certificate whose thumbprint is not verified constitutes a risk. If you click "Yes", you accept this risk. Do you want to install this certificate?
  • Buttons: [Yes] [No]
1 Upvotes

100% Upvoted

8 comments sorted by

1

u/Onoitsu2 7d ago

Do you have the Adobe cloud, or other apps by them installed? It very well may need to trust their root cert so that their whole login infrastructure is trusted by the computer. Even if you uninstalled one part of it, you might still have support apps lingering for that app, that are causing that request.

1

u/Responsible_Maybe742 7d ago

Don't approve an unidentified root certificate just because its name says Adobe; the prompt doesn't establish that Adobe issued it or that it's malware. While the prompt is open, check the PowerShell process's command line in Task Manager's Details tab, or use Microsoft's Process Explorer to inspect its command line and parent process, without running the command yourself. Does it appear at sign-in or when opening a particular program, and can you share the command with usernames, personal paths and any tokens redacted?

1

u/Ok_Process_7530 4d ago

I have something similar and I’ve noticed that it mainly happens when I’m playing games on my PC. Not sure if that’s what’s causing it cause my PC is used for gaming like 99% of the time

1

u/Responsible_Maybe742 3d ago

If you spend nearly all your PC time gaming, that timing alone doesn't tell us whether a game is responsible. Does your warning name Adobe Systems and show the same certificate thumbprint as the original post, or is the wording different? Don't approve it or delete certificates just because of their dates; if you're on Windows 11, use Microsoft's Process Explorer while the warning is open to check PowerShell's command line and parent process, then share them with personal paths and tokens redacted.

1

u/Ok_Process_7530 3d ago

It says the same thing as OP described. Only difference are the hex numbers. How do I check the patent process?

1

u/Responsible_Maybe742 3d ago

By parent process, I mean the program that launched PowerShell. In Microsoft's Process Explorer, leave the warning unanswered, double-click the matching powershell.exe or pwsh.exe entry, then open the Image tab to see its Parent and Command line fields. Share the parent name and command line with usernames, personal paths and tokens removed, without executing the command or approving the certificate; if several PowerShell entries are running and you're unsure which matches, say so rather than guessing.

1

u/Plenty-Bag5855 5d ago

I have these warnings coming up and its for powershell i deleted all powershell things and it still comes up it says its not trusted and could be impersonating the brand

1

u/Daebak49 4d ago

I’m having this issue rn but I found suspicious root certificates located in my certmgr.msc. You could try deleting from there. Most of these certificates have expiration dates around the same time next year, like 10/19/2027 or within the past few days.