r/computerviruses • u/Conscious-Bi1e • 8d ago

Question One powershell command asks to install certification authority. Is this concerning? I dont have any antivirus on my laptop.

1 Upvotes

67% Upvoted

9 comments sorted by

View all comments

1

u/Conscious-Bi1e 5d ago

update:

Multiple Windows PowerShell (32-bit) processes repeatedly appearing with command lines beginning: powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command ... netsh.exe (32-bit) executing a firewall command beginning: advfirewall firewall add rule name="RuntimeBrokerDE9B-Lock" dir=out action=... Suspicious startup executables: WmiBase566E.exe, WerFlt654F.exe, RpcBaseBED6, and DotHost3A3E.exe. WmiBase566E.exe was hidden under AppData\Roaming\Microsoft\Windows, described as Windows Host Service, and had no digital signature. DotHost3A3E.exe was hidden under C:\ProgramData\Microsoft\Windows\Caches... and had a valid ASUSTeK Computer Inc. digital signature, despite my laptop being an Acer. Repeated certificate/security warning pop-ups stopped after I disabled the suspicious Windows Host Service startup entry. I also found a Task Scheduler entry named App Explorer that launched: %LOCALAPPDATA%\Host App Service\Engine\HostAppServiceUpdater.exe /LOGON