About a month ago, I approved the installation of a program I didn't recognize while downloading something. Nothing seemed wrong afterward, but now a blank black or bluish window appears for a couple of seconds roughly every half hour whenever the computer is running. The window identifies itself as C:WindowsSystem32WindowsPowerShellv1.0powershell.exe. Is PowerShell itself harmless, or could an unwanted script or scheduled task be launching in the background? How can I identify what is causing it and determine whether my system is infected?
2 Answers
PowerShell is a legitimate Windows component used to run commands and scripts, so the executable path alone doesn’t prove anything is malicious. However, something is likely launching a PowerShell script in the background. Check Task Scheduler for tasks that run every 30 minutes, and review their actions to see what command or script they start. Microsoft Sysinternals Autoruns is also useful for finding startup entries and scheduled tasks. Pay particular attention to items launching from temporary folders, AppData, or other unusual locations, especially if they have no recognizable publisher.
The visible PowerShell window doesn’t show what the script is doing, so nobody can determine whether it’s benign from the screenshot or file path alone. The exact same window appearing on a regular schedule strongly suggests a scheduled task or another recurring startup mechanism. Inspect the task’s command line and script location, then scan the computer with updated security software before deleting anything. If the task points to an unfamiliar file in a user or temporary folder, treat it as suspicious.
The window is identical each time and disappears after about two seconds, so I’ll look for the recurring trigger and the script it launches.
That makes sense. I’ll check scheduled tasks and Autoruns rather than assuming PowerShell itself is the problem.