PowerShell has recently started appearing among my background processes even though I have not intentionally downloaded or installed anything. After it launches, several command-line windows or processes briefly appear; one stays open longer and reports that it is an important Windows component. I would like to identify what is starting PowerShell, determine whether the activity is legitimate or malicious, and remove it safely if necessary. I am not very experienced with Windows troubleshooting, so clear step-by-step instructions would be appreciated.
4 Answers
Start with Task Manager. Press Ctrl+Shift+Esc, open the Details tab, right-click the PowerShell process, and choose “Open file location” or “Properties.” You can also enable the Command line column under View > Select columns. That may show the script or program that launched it. Do not assume that the process is malware just because PowerShell appears; Windows and legitimate applications use it too.
Use Microsoft Sysinternals Autoruns to inspect programs and scheduled tasks that launch at startup or during logon. Pay attention to entries that run PowerShell with a script from a strange folder, a temporary directory, or an unfamiliar user profile. You can uncheck a suspicious startup entry after researching it, but create a restore point first and do not disable entries you cannot identify.
Check Event Viewer for more context. Press Win+R, type eventvwr.msc, and press Enter. Look under Applications and Services Logs > Microsoft > Windows > PowerShell > Operational. Event IDs such as 400, 403, and 600 generally describe PowerShell starting, stopping, or loading components. Those numbers alone do not prove that anything is malicious; the command or script being executed matters more.
I found events with 400, 600, and 403. If those are normal startup and shutdown events, how do I find the actual command that ran?
Run a full scan with Windows Security, including the Microsoft Defender Offline scan if you remain concerned. A second-opinion scan from a reputable anti-malware utility can also help. Update the security software first, avoid deleting random system files, and quarantine anything it specifically identifies rather than trying to remove PowerShell itself.
I’m not very familiar with Task Manager. I’ll look for the Details tab and the Command line column first.