I recently noticed Windows PowerShell appearing among my background processes. After that, several command-line windows or processes seem to start slowly; one stays open briefly and claims it is an important Windows component, while the others disappear after a few seconds. I have not knowingly downloaded anything or installed software recently, so I am worried this could be malware. How can I identify what launched PowerShell, determine whether it is legitimate, and remove it if necessary?
3 Answers
Microsoft Sysinternals Autoruns can show programs, scheduled tasks, services, and other items configured to start automatically. Check entries that launch powershell.exe or cmd.exe and investigate the file path and publisher. If the command points to a strange folder in a temporary or user-download location, that is more suspicious than a signed Windows or trusted-software path.
Start by checking Task Manager. Open the Details tab, right-click the PowerShell process, and choose the option to view its command line if available. That can show the script, arguments, or program that started it. You can also inspect Windows Event Viewer under Applications and Services Logs > Microsoft > Windows > PowerShell for more details. Event IDs such as 400, 403, and 600 can be normal PowerShell activity by themselves, so they do not prove the computer is infected.
I found events with IDs 400, 403, and several 600 entries, but I still do not know how to tell whether the process is legitimate.
Run a full scan with Microsoft Defender, and consider using Malwarebytes for a second opinion. The free version is generally enough for an on-demand scan. Do not delete random Windows files just because PowerShell appears; it is a normal Windows component and can be launched by updates, scheduled tasks, drivers, or installed software.
Thanks. I was not sure whether Autoruns or Malwarebytes required payment, so I will use the official versions and scan before changing anything.