This week my antivirus started detecting a newly created DLL in my temporary folder whenever I boot my PC. Full scans and an offline boot-time scan have come back clean, but the file keeps reappearing after each restart. I noticed references to PowerShell, smss.exe, and wininit.exe in system logs, although those are legitimate Windows processes. I may have downloaded some game updates or files recently, but I'm not sure which one caused this. Is there a reliable way to trace the PowerShell command or startup mechanism creating the DLL, or should I assume the system is compromised and reinstall Windows?
2 Answers
Think about what changed shortly before the detections began. Suspicious game cracks, mods, unofficial updates, and downloads that tell you to paste a PowerShell command are common infection routes. After reinstalling, use a separate standard account for daily work and keep an administrator account only for tasks that require elevation. Reinstall software from official sources and scan backed-up files before opening them.
Task Scheduler is one place to check for PowerShell persistence, but it isn’t the only one. Startup folders, registry Run keys, services, WMI event subscriptions, and scheduled tasks can all launch scripts or DLLs. You can also review PowerShell operational logging and process-creation audit events if they were enabled, but a clean-looking log does not prove the machine is safe.
Checking one startup location won’t rule out persistence elsewhere. If you don’t regularly perform incident response or forensic analysis, a full wipe is more dependable than trying to identify every mechanism.