Windows 10: Why is powershell trying to access "%system%\CatRoot", and %temp%/

Discus and support Why is powershell trying to access "%system%\CatRoot", and %temp%/ in Windows 10 Software and Apps to solve the problem; Every time I turn my computer on I get a notification that "unauthorized changes blocked", "powershell.exe". I did have a virus a few weeks ago and... Discussion in 'Windows 10 Software and Apps' started by mysticdragz, Aug 7, 2023.

  1. MYSTICDRAGZ
    mysticdragz Win User

    Why is powershell trying to access "%system%\CatRoot", and %temp%/


    Every time I turn my computer on I get a notification that "unauthorized changes blocked", "powershell.exe". I did have a virus a few weeks ago and possibly still have one. I'm also getting a blocked app or "mscorsvw.exe" "%winddir%\assembly\NativeImages_v4.0.30319_64\Temp\4dd4-0". There is also like 10 different versions of the mscorsvw.exe, after Temp\ is another random 4 characters.Edition Windows 10 Pro Version 22H2 Installed on ‎4/‎23/‎2021 OS build 19045.3208 Experience Windows Feature Experience Pack 1000.19041.1000.0 App or process blocked: powershell.exeProtected folder: %system%\CatR

    :)
     
    mysticdragz, Aug 7, 2023
    #1
  2. SKNIGHTMARE
    sknightmare Win User

    Why is powershell trying to access "%system%\CatRoot" "C:\ProgramData"

    it's been weeks since these started to show up in windows controlled folder access, this never happened before in all the time I've had folder acces on
    i've done some search on what the catroot folder it's used for and the only clue here it's that i've been avoidind windows updates using the metered connection setting to prevent from doing things on its own

    2023-04 Cumulative Update for Windows 10 Version 21H2 for x64-based Systems (KB5025221)

    Status: Pending download

    this it's the update that it's showing pending since i left the metered connection check on, i'm not able to download big updates frequenty so its the only clue for whatever its trying to do

    OS build

    Experience

    Windows 10 Pro

    21H2 22/06/2021 19044.2251

    Windows Feature Experience Pack 120.2212.4180.0

    [My last update]

    still this also trying to acces progam data, i don't know why is powershell trying to acces these 2 locations recently

    App or process blocked: powershell_ise.exe

    Protected folder: C:\ProgramData

    Blocked by: Controlled folder access

    should i allow powershell to access?
    is it because updates and will stop showing once i intall pending update?
    should i worry about it?
    *i've already performed a system scan with malwarebytes with no threats detected [haven't on startup]
     
    sknightmare, Aug 7, 2023
    #2
  3. ASYOURWISH
    Asyourwish Win User
    Powershell trying to access "%system%\CatRoot" "C:\ProgramData" when connected to the internet

    Use Resource Monitor to check if any software is accessing your files through Powershell, given the current Azure domain. You should also contact domain management IT to perform the appropriate system checks.

    https://www.thewindowsclub.com/use-resource-monitor-windows-10
     
    Asyourwish, Aug 7, 2023
    #3
  4. I-SHU CHEN
    I-Shu Chen Win User

    Why is powershell trying to access "%system%\CatRoot", and %temp%/

    Is it necessary for Powershell.exe to access CatRoot folder every time the computer starts?

    Hi,

    When I start my computer every time, my Powershell.exe will try to access the folder %system%\CatRoot. Is this necessary? Does anyone know why?
     
    I-Shu Chen, Aug 7, 2023
    #4
Thema:

Why is powershell trying to access "%system%\CatRoot", and %temp%/

Loading...

  1. Why is powershell trying to access "%system%\CatRoot", and %temp%/ - Similar Threads - Why powershell trying

  2. Why does Powershell V1 and not V7 trying to access %system%\CatRoot?

    in Windows 10 Gaming
    Why does Powershell V1 and not V7 trying to access %system%\CatRoot?: Hi, everyone. Defender notificates that Powershell.exe is trying to access %system%\CatRoot. It should be regular BUT the fact that the specific Powershell is NOT the updated pwsh.exe version 7 I've installed recently, but the old and potentially unsafe version 1.It's strange...

  3. Why does Powershell V1 and not V7 trying to access %system%\CatRoot?

    in Windows 10 Software and Apps
    Why does Powershell V1 and not V7 trying to access %system%\CatRoot?: Hi, everyone. Defender notificates that Powershell.exe is trying to access %system%\CatRoot. It should be regular BUT the fact that the specific Powershell is NOT the updated pwsh.exe version 7 I've installed recently, but the old and potentially unsafe version 1.It's strange...

  4. Why is powershell trying to access "%system%\CatRoot", and %temp%/

    in Windows 10 Gaming
    Why is powershell trying to access "%system%\CatRoot", and %temp%/: Every time I turn my computer on I get a notification that "unauthorized changes blocked", "powershell.exe". I did have a virus a few weeks ago and possibly still have one. I'm also getting a blocked app or "mscorsvw.exe"...

  5. Why is powershell trying to access "%system%\CatRoot", and %temp%/

    in AntiVirus, Firewalls and System Security
    Why is powershell trying to access "%system%\CatRoot", and %temp%/: Every time I turn my computer on I get a notification that "unauthorized changes blocked", "powershell.exe". I did have a virus a few weeks ago and possibly still have one. I'm also getting a blocked app or "mscorsvw.exe"...

  6. Powershell trying to access "%system%\CatRoot" "C:\ProgramData" when connected to the internet

    in Windows 10 Gaming
    Powershell trying to access "%system%\CatRoot" "C:\ProgramData" when connected to the internet: I dont know why but i think my relative acessing my computer remotely, he knew my password and I think He is acessing my computer remotely i clean installed windows but whenever I connect my ethernet cable and sign in my Microsoft account powershell is trying to acess catroot...

  7. Powershell trying to access "%system%\CatRoot" "C:\ProgramData" when connected to the internet

    in Windows 10 Software and Apps
    Powershell trying to access "%system%\CatRoot" "C:\ProgramData" when connected to the internet: I dont know why but i think my relative acessing my computer remotely, he knew my password and I think He is acessing my computer remotely i clean installed windows but whenever I connect my ethernet cable and sign in my Microsoft account powershell is trying to acess catroot...

  8. Why is powershell trying to access "%system%\CatRoot" "C:\ProgramData"

    in AntiVirus, Firewalls and System Security
    Why is powershell trying to access "%system%\CatRoot" "C:\ProgramData": it's been weeks since these started to show up in windows controlled folder access, this never happened before in all the time I've had folder acces oni've done some search on what the catroot folder it's used for and the only clue here it's that i've been avoidind windows...

  9. Why is powershell trying to access "%system%\CatRoot" "C:\ProgramData"

    in Windows 10 Gaming
    Why is powershell trying to access "%system%\CatRoot" "C:\ProgramData": it's been weeks since these started to show up in windows controlled folder access, this never happened before in all the time I've had folder acces oni've done some search on what the catroot folder it's used for and the only clue here it's that i've been avoidind windows...

  10. Why is powershell trying to access "%system%\CatRoot" "C:\ProgramData"

    in Windows 10 Software and Apps
    Why is powershell trying to access "%system%\CatRoot" "C:\ProgramData": it's been weeks since these started to show up in windows controlled folder access, this never happened before in all the time I've had folder acces oni've done some search on what the catroot folder it's used for and the only clue here it's that i've been avoidind windows...