How can I remove a PowerShell-launched DLL that keeps returning at startup?
Asked by
MellowCedar42
This week, my antivirus started detecting a newly created DLL in my temporary files whenever I boot my PC. Full and boot-time scans report no other infections, but the file keeps coming back. I checked Event Viewer and security logs, but the entries only mention normal Windows processes such as PowerShell, smss.exe, and wininit.exe. Is there a reliable way to trace the PowerShell command, scheduled task, startup item, or other persistence mechanism that is creating the DLL? I may have installed several game updates or indie games recently, but I'm not sure which file could be responsible.
Answers
You can check Task Scheduler for jobs that launch PowerShell, especially ones set to run at logon or startup. Also inspect startup folders, the Run and RunOnce registry keys, services, WMI event subscriptions, and PowerShell operational logs. However, these checks can miss persistence or fail to reveal what happened, so they’re better for finding the source than proving the system is clean.
Reply to this answer
If you believe the machine is compromised, the safest option is to disconnect it from the network, back up only personal documents and other essential files, then wipe the system drive and perform a clean Windows installation. A clean scan does not prove that every persistence mechanism or account stealer is gone. Afterward, change your passwords from a trusted device, revoke existing sessions, and enable MFA wherever possible.
MellowCedar42: My important files are separated across different drives, so I can back up selectively and isolate anything that might be risky. MFA is already enabled on my important accounts, but I’ll still reset passwords and revoke active sessions.
Reply to this answer
Think about what changed shortly before the detections began. Malware is often bundled with unofficial games, mods, cracks, pirated software, or downloads that ask you to paste a command into PowerShell to prove you’re human. Avoid running those commands, remove untrusted installers, and download software only from sources you can verify.
Reply to this answer
A newly generated DLL at every startup suggests something is recreating it rather than the file simply surviving a scan. You could use a trusted offline scanner or bootable rescue environment to investigate, but if the computer has been used for email, banking, or other sensitive accounts, a full reinstall remains the most trustworthy solution.
Reply to this answer
Add your answer
Answers are reviewed before publication.
SilverKite88: Task Scheduler is only one possible persistence method. If you don’t regularly perform malware incident response or forensic analysis, wiping and reinstalling is much more dependable.