I visited a website that appeared to be a Cloudflare verification page and was instructed to press Win+X, choose a menu option, paste a command, and press Enter. I followed the instructions before realizing the command used PowerShell to download and execute a script from an unfamiliar domain, then pause briefly and exit. Event ID 4104 indicates the script attempted to create and run a randomly named executable. I may have interrupted it, but I'm not sure whether anything completed. Microsoft Defender reports no threats, an offline scan found nothing, and I haven't found suspicious processes, startup entries, or scheduled tasks. I've already changed my passwords. How serious is this, and what should I check or do next?
4 Answers
Treat the machine as potentially compromised even if Defender is clean. An information-stealing malware sample may run briefly, remove itself, or avoid ordinary scans. The safest response is to back up only personal documents and photos after checking them carefully, then perform a full Windows reinstall from trusted installation media. Choose the option that removes applications, settings, and the existing system rather than preserving them. Change important passwords again from a known-clean device and revoke active sessions, especially for email, banking, password managers, and work accounts.
This is a common social-engineering trick: legitimate verification pages do not ask visitors to open a system menu and paste commands into PowerShell. If you need to preserve files, scan them from a separate trusted system and avoid copying executables, scripts, archives, or browser profiles. After reinstalling, update Windows and applications before restoring data, and monitor account and financial activity for a while.
Before reinstalling, disconnect the computer from the network if practical so it cannot communicate with an attacker or continue downloading files. From another clean device, review account activity, sign out all sessions, rotate passwords, and enable multifactor authentication. Pay particular attention to email and financial accounts, since access to email can be used to reset everything else.
The PowerShell logging entry is a serious warning because it confirms that the downloaded script was executed or at least began execution. Check Defender history, PowerShell operational logs, scheduled tasks, services, startup locations, recent downloads, and browser extensions, but a clean result does not prove the system is safe. Those checks are useful for understanding what happened, not as a substitute for rebuilding a machine that ran an unknown executable.
That makes sense. I’m copying only essential personal files and will wipe the system rather than keeping programs or settings.